Extend key ID matching to expired keys

gpg accepts signatures with expired keys as long as the signature was made prior to key expiration. But it also changes the status-fd output format that we grep for the expected key ID. Make sure we look for the alternate EXPKEYSIG line in the output in that case to find the key ID.
Add gnupg as a buildreq if we'll need it during build
2026-06-16 02:45:56 +00:00 · 2024-04-12 09:08:10 -07:00 · 2024-04-11 16:10:02 -07:00 · 2024-04-11 12:37:09 -07:00 · 2024-04-11 12:22:59 -07:00 · 2024-04-11 12:22:59 -07:00
2 changed files with 17 additions and 0 deletions
@@ -115,6 +115,8 @@ class Config(object):
        self.old_keyid = None
        self.profile_payload = None
        self.signature = None
+        self.signature_macro = None
+        self.pkey_macro = None
        self.yum_conf = None
        self.failed_pattern_dir = None
        self.alias = None
@@ -159,8 +159,17 @@ class Specfile(object):

        # if package is verified, include the signature in the source tarball
        if self.keyid and self.config.signature:
+            # We'll need gnupg to verify the signature. Need to add it here so it's ready before write_buildreq
+            self.requirements.add_buildreq("gnupg")
+
            count += 1
            self._write_strip(f"Source{count}  : {self.config.signature}")
+            self.config.signature_macro = f"%{{SOURCE{count}}}"
+
+            # Also include the public key in the source tarball.
+            count += 1
+            self._write_strip(f"Source{count}  : {self.keyid}.pkey")
+            self.config.pkey_macro = f"%{{SOURCE{count}}}"

        for source in self.config.extra_sources:
            count += 1
@@ -430,6 +439,12 @@ class Specfile(object):
    def write_prep(self):
        """Write prep section to spec file."""
        self._write_strip("%prep")
+        if self.keyid and self.config.signature:
+            self._write_strip("mkdir .gnupg")
+            self._write_strip("chmod 700 .gnupg")
+            self._write_strip(f"gpg --homedir .gnupg --import {self.config.pkey_macro}")
+            self._write_strip(f"gpg --homedir .gnupg --status-fd 1 --verify {self.config.signature_macro} %{{SOURCE0}} > gpg.status")
+            self._write_strip(f"grep -E '^\\[GNUPG:\\] (GOODSIG|EXPKEYSIG) {self.keyid}' gpg.status")
        self.write_prep_prepend()
        prefix = self.content.prefixes[self.url]
        if self.config.default_pattern == 'R':
Author	SHA1	Message	Date
Brett T. Warden	81e1eebe28	Extend key ID matching to expired keys gpg accepts signatures with expired keys as long as the signature was made prior to key expiration. But it also changes the status-fd output format that we grep for the expected key ID. Make sure we look for the alternate EXPKEYSIG line in the output in that case to find the key ID.	2024-04-12 09:08:10 -07:00
Brett T. Warden	658bd0de10	Add gnupg as a buildreq if we'll need it during build	2024-04-11 16:10:02 -07:00
Brett T. Warden	b628caf931	Add Config fields for pkey and signature macros	2024-04-11 12:37:09 -07:00
Brett T. Warden	8142032e7c	Fix escaping to satisfy flake	2024-04-11 12:22:59 -07:00
Brett T. Warden	5a302d6c91	Check GPG package signatures during build Add gpg commands to the specfile so we verify the package signature during every rpmbuild. Also ensure that the signature key ID matches what we expect.	2024-04-11 12:22:59 -07:00