Check 3rd-party repo certificate with operations

When running an operation, swupd uses a certificate to validate things
ilke the MoM and the version file. The certificate that needs to be used
for 3rd-party repos is different than the one that has to be used for
upstream.

This commit enables the use of the 3rd-party repo certificate that will
be installed in the repo's directory with all swupd operations, except
when adding the repository, in those cases, since the os-core bundle
hasn't been installed yet, we need to provide the cert path through
other means, like using the -C flag..

Signed-off-by: Castulo Martinez <castulo.martinez@intel.com>

src/3rd_party_add.c

@@ -99,6 +99,7 @@ enum swupd_code third_party_add_main(int argc, char **argv)
 	bool revert = false;
 	int repo_version;
 	int ret;
+	const bool DONT_VERIFY_CERTIFICATE = false;
 
 	if (!parse_options(argc, argv)) {
 		print_help();
@@ -147,7 +148,7 @@ enum swupd_code third_party_add_main(int argc, char **argv)
 	}
 
 	/* set the appropriate content_dir and state_dir for the selected 3rd-party repo */
-	ret_code = third_party_set_repo(globals.state_dir, globals.path_prefix, repo);
+	ret_code = third_party_set_repo(globals.state_dir, globals.path_prefix, repo, DONT_VERIFY_CERTIFICATE);
 	if (ret_code) {
 		revert = true;
 		goto finish;

src/3rd_party_repos.c

@@ -18,6 +18,8 @@
  */
 
 #include "3rd_party_repos.h"
+#include "config.h"
+#include "signature.h"
 #include "swupd.h"
 
 #include <errno.h>
@@ -248,14 +250,30 @@ int third_party_remove_repo_directory(const char *repo_name)
 	return ret;
 }
 
-enum swupd_code third_party_set_repo(const char *state_dir, const char *path_prefix, struct repo *repo)
+enum swupd_code third_party_set_repo(const char *state_dir, const char *path_prefix, struct repo *repo, bool sigcheck)
 {
 	char *repo_state_dir;
 	char *repo_path_prefix;
+	char *repo_cert_path;
 
 	set_content_url(repo->url);
 	set_version_url(repo->url);
 
+	/* set up swupd to use the certificate from the 3rd-party repository */
+	string_or_die(&repo_cert_path, "%s/opt/3rd_party/%s/%s", path_prefix, repo->name, CERT_PATH);
+	set_cert_path(repo_cert_path);
+	/* if --nosigcheck was used, we do not attempt any signature checking */
+	if (sigcheck) {
+		signature_deinit();
+		if (!signature_init(globals.cert_path, NULL)) {
+			signature_deinit();
+			error("Unable to validate the certificate %s\n\n", repo_cert_path);
+			free_string(&repo_cert_path);
+			return SWUPD_SIGNATURE_VERIFICATION_FAILED;
+		}
+	}
+	free_string(&repo_cert_path);
+
 	string_or_die(&repo_path_prefix, "%s/opt/3rd_party/%s", path_prefix, repo->name);
 	set_path_prefix(repo_path_prefix);
 	free_string(&repo_path_prefix);
@@ -298,9 +316,9 @@ static enum swupd_code third_party_find_bundle(const char *bundle, struct list *
 		struct file *file = NULL;
 
 		/* set the appropriate content_dir and state_dir for the selected 3rd-party repo */
-		ret_code = third_party_set_repo(state_dir, path_prefix, repo);
+		ret_code = third_party_set_repo(state_dir, path_prefix, repo, globals.sigcheck);
 		if (ret_code != SWUPD_OK) {
-			return ret_code;
+			goto clean_and_exit;
 		}
 
 		/* get repo's version */
@@ -405,7 +423,7 @@ enum swupd_code third_party_run_operation(struct list *bundles, const char *repo
 		if (selected_repo) {
 
 			/* set the appropriate content_dir and state_dir for the selected 3rd-party repo */
-			ret = third_party_set_repo(state_dir, path_prefix, selected_repo);
+			ret = third_party_set_repo(state_dir, path_prefix, selected_repo, globals.sigcheck);
 			if (ret) {
 				ret_code = ret;
 				goto next;
@@ -468,7 +486,7 @@ enum swupd_code third_party_run_operation_multirepo(const char *repo, run_operat
 		}
 
 		/* set the appropriate variables for the selected 3rd-party repo */
-		ret_code = third_party_set_repo(state_dir, path_prefix, selected_repo);
+		ret_code = third_party_set_repo(state_dir, path_prefix, selected_repo, globals.sigcheck);
 		if (ret_code) {
 			goto clean_and_exit;
 		}
@@ -481,7 +499,7 @@ enum swupd_code third_party_run_operation_multirepo(const char *repo, run_operat
 			selected_repo = iter->data;
 
 			/* set the appropriate variables for the selected 3rd-party repo */
-			ret = third_party_set_repo(state_dir, path_prefix, selected_repo);
+			ret = third_party_set_repo(state_dir, path_prefix, selected_repo, globals.sigcheck);
 			if (ret) {
 				ret_code = ret;
 				goto clean_and_exit;

src/3rd_party_repos.h

@@ -79,10 +79,11 @@ int third_party_remove_repo_directory(const char *repo_name);
  *
  * @param state_dir the original state directory of the system
  * @param path_prefix the original path prefix of the system
+ * @param sigcheck indicates if the repo certificate has to be validate or not
  *
  * @returns a swupd_code
  */
-enum swupd_code third_party_set_repo(const char *state_dir, const char *path_prefix, struct repo *repo);
+enum swupd_code third_party_set_repo(const char *state_dir, const char *path_prefix, struct repo *repo, bool sigcheck);
 
 /**
  * @brief strcmp like function to search for a repo based on its name

src/globals.c

@@ -369,7 +369,7 @@ void set_default_path_prefix()
 	globals.path_prefix = strdup_or_die("/");
 }
 
-static void set_cert_path(char *path)
+void set_cert_path(char *path)
 {
 	if (globals.cert_path) {
 		free_string(&globals.cert_path);

src/globals.h

@@ -84,6 +84,7 @@ void set_default_path_prefix(void);
 void set_content_url(char *url);
 bool set_state_dir(char *path);
 void set_version_url(char *url);
+void set_cert_path(char *path);
 
 #ifdef __cplusplus
 }

test/functional/3rd-party/3rd-party-diagnose-basic.bats

@@ -69,7 +69,7 @@ global_teardown() {
 		 -> Hash mismatch for file: $PATH_PREFIX/opt/3rd_party/test-repo1/usr/lib/os-release
 		Checking for extraneous files
 		 -> File that should be deleted: $PATH_PREFIX/opt/3rd_party/test-repo1/bar/file_2
-		Inspected 17 files
+		Inspected 19 files
 		  2 files were missing
 		  2 files did not match
 		  1 file found which should be deleted
@@ -83,7 +83,7 @@ global_teardown() {
 		Checking for missing files
 		Checking for corrupt files
 		Checking for extraneous files
-		Inspected 13 files
+		Inspected 15 files
 		Diagnose successful
 	EOM
 	)
@@ -102,7 +102,7 @@ global_teardown() {
 		Checking for missing files
 		Checking for corrupt files
 		Checking for extraneous files
-		Inspected 13 files
+		Inspected 15 files
 		Diagnose successful
 	EOM
 	)
@@ -135,7 +135,7 @@ global_teardown() {
 		Checking for corrupt files
 		 -> Hash mismatch for file: $PATH_PREFIX/opt/3rd_party/test-repo1/usr/lib/os-release
 		Checking for extraneous files
-		Inspected 15 files
+		Inspected 17 files
 		  1 file did not match
 		Use "swupd repair" to correct the problems in the system
 		Diagnose successful
@@ -165,7 +165,7 @@ global_teardown() {
 		Checking for extraneous files
 		 -> File that should be deleted: $PATH_PREFIX/opt/3rd_party/test-repo1/bar/file_2
 		Checking for extra files under $PATH_PREFIX/opt/3rd_party/test-repo1/usr
-		Inspected 17 files
+		Inspected 19 files
 		  2 files were missing
 		  2 files did not match
 		  1 file found which should be deleted
@@ -181,7 +181,7 @@ global_teardown() {
 		Checking for extraneous files
 		Checking for extra files under $PATH_PREFIX/opt/3rd_party/test-repo2/usr
 		 -> Extra file: $PATH_PREFIX/opt/3rd_party/test-repo2/usr/untracked_file3
-		Inspected 14 files
+		Inspected 16 files
 		  1 file found which should be deleted
 		Use "swupd repair --picky" to correct the problems in the system
 		Diagnose successful
@@ -213,7 +213,7 @@ global_teardown() {
 		Checking for extra files under $PATH_PREFIX/opt/3rd_party/test-repo1/bat
 		 -> Extra file: $PATH_PREFIX/opt/3rd_party/test-repo1/bat/untracked_file1
 		 -> Extra file: $PATH_PREFIX/opt/3rd_party/test-repo1/bat/
-		Inspected 19 files
+		Inspected 21 files
 		  2 files were missing
 		  2 files did not match
 		  3 files found which should be deleted
@@ -228,7 +228,7 @@ global_teardown() {
 		Checking for corrupt files
 		Checking for extraneous files
 		Checking for extra files under $PATH_PREFIX/opt/3rd_party/test-repo2/bat
-		Inspected 13 files
+		Inspected 15 files
 		Diagnose successful
 	EOM
 	)

test/functional/3rd-party/3rd-party-repair-basic.bats

@@ -54,7 +54,7 @@ test_setup() {
 		 -> Hash mismatch for file: $PATH_PREFIX/opt/3rd_party/test-repo1/usr/lib/os-release -> fixed
 		Removing extraneous files
 		 -> File that should be deleted: $PATH_PREFIX/opt/3rd_party/test-repo1/bar/file_2 -> deleted
-		Inspected 17 files
+		Inspected 19 files
 		  2 files were missing
 		    2 of 2 missing files were replaced
 		    0 of 2 missing files were not replaced
@@ -75,7 +75,7 @@ test_setup() {
 		Adding any missing files
 		Repairing corrupt files
 		Removing extraneous files
-		Inspected 13 files
+		Inspected 15 files
 		Calling post-update helper scripts
 		Repair successful
 	EOM
@@ -96,7 +96,7 @@ test_setup() {
 		Adding any missing files
 		Repairing corrupt files
 		Removing extraneous files
-		Inspected 13 files
+		Inspected 15 files
 		Calling post-update helper scripts
 		Repair successful
 	EOM
@@ -121,7 +121,7 @@ test_setup() {
 		Repairing corrupt files
 		 -> Hash mismatch for file: $PATH_PREFIX/opt/3rd_party/test-repo1/usr/lib/os-release -> fixed
 		Removing extraneous files
-		Inspected 15 files
+		Inspected 17 files
 		  1 file did not match
 		    1 of 1 files were repaired
 		    0 of 1 files were not repaired
@@ -156,7 +156,7 @@ test_setup() {
 		Removing extraneous files
 		 -> File that should be deleted: $PATH_PREFIX/opt/3rd_party/test-repo1/bar/file_2 -> deleted
 		Removing extra files under $PATH_PREFIX/opt/3rd_party/test-repo1/usr
-		Inspected 17 files
+		Inspected 19 files
 		  2 files were missing
 		    2 of 2 missing files were replaced
 		    0 of 2 missing files were not replaced
@@ -179,7 +179,7 @@ test_setup() {
 		Removing extraneous files
 		Removing extra files under $PATH_PREFIX/opt/3rd_party/test-repo2/usr
 		 -> Extra file: $PATH_PREFIX/opt/3rd_party/test-repo2/usr/untracked_file3 -> deleted
-		Inspected 14 files
+		Inspected 16 files
 		  1 file found which should be deleted
 		    1 of 1 files were deleted
 		    0 of 1 files were not deleted
@@ -216,7 +216,7 @@ test_setup() {
 		Removing extra files under $PATH_PREFIX/opt/3rd_party/test-repo1/bat
 		 -> Extra file: $PATH_PREFIX/opt/3rd_party/test-repo1/bat/untracked_file1 -> deleted
 		 -> Extra file: $PATH_PREFIX/opt/3rd_party/test-repo1/bat/ -> deleted
-		Inspected 19 files
+		Inspected 21 files
 		  2 files were missing
 		    2 of 2 missing files were replaced
 		    0 of 2 missing files were not replaced
@@ -238,7 +238,7 @@ test_setup() {
 		Repairing corrupt files
 		Removing extraneous files
 		Removing extra files under $PATH_PREFIX/opt/3rd_party/test-repo2/bat
-		Inspected 13 files
+		Inspected 15 files
 		Calling post-update helper scripts
 		Repair successful
 	EOM

test/functional/3rd-party/3rd-party-repo-add.bats

@@ -27,9 +27,11 @@ test_setup() {
 		Installing bundle 'os-core' from 3rd-party repository test-repo1...
 		Note that bundles added from a 3rd-party repository are forced to run with the --no-scripts flag for security reasons
 		Loading required manifests...
-		No packs need to be downloaded
+		Downloading packs for:
+		 - os-core
+		Finishing packs extraction...
 		Validate downloaded files
-		Starting download of remaining update content. This may take a while...
+		No extra files need to be downloaded
 		Installing files...
 		Warning: post-update helper scripts skipped due to --no-scripts argument
 		Successfully installed 1 bundle

test/functional/testlib.bash

@@ -1404,6 +1404,8 @@ create_third_party_repo() { #swupd_function
 	local version=$2
 	local format=${3:-staging}
 	local repo_name=${4:-test-repo}
+	local hashed_name
+	local CERT
 
 	# If no parameters are received show usage
 	if [ $# -eq 0 ]; then
@@ -1418,7 +1420,15 @@ create_third_party_repo() { #swupd_function
 
 	debug_msg "Creating 3rd-party repo $repo_name..."
 	create_version -r "$env_name" "$version" 0 "$format" "$repo_name"
-	create_bundle -n os-core -v "$version" -f /usr/lib/os-release:"$OS_RELEASE",/usr/share/defaults/swupd/format:"$FORMAT" -u "$repo_name" "$env_name"
+
+	# we need to create os-core which should include the os-release and Swupd_Root.pem
+	debug_msg "Creating os-core with Swupd_Root.pem and os-release..."
+	hashed_name=$(sudo "$SWUPD" hashdump --quiet "$TEST_ROOT_DIR"/Swupd_Root.pem)
+	sudo cp -p "$TEST_ROOT_DIR"/Swupd_Root.pem "$env_name"/3rd_party/"$repo_name"/"$version"/files/"$hashed_name"
+	create_tar "$env_name"/3rd_party/"$repo_name"/"$version"/files/"$hashed_name"
+	CERT="$env_name"/3rd_party/"$repo_name"/"$version"/files/"$hashed_name"
+	create_bundle -n os-core -v "$version" -f /usr/lib/os-release:"$OS_RELEASE",/usr/share/clear/update-ca/Swupd_Root.pem:"$CERT",/usr/share/defaults/swupd/format:"$FORMAT" -u "$repo_name" "$env_name"
+
 	TPWEBDIR=$(realpath "$env_name/3rd_party/$repo_name")
 	export TPWEBDIR
 	debug_msg "3rd-party repo content dir: $TPWEBDIR"
@@ -1479,9 +1489,13 @@ add_third_party_repo() { #swupd_function
 	debug_msg "3rd-party repo content dir: $TPWEBDIR"
 
 	# every 3rd-party repo needs to have at least the os-core bundle so this should be
-	# added by default
+	# added by default which should include the os-release and Swupd_Root.pem
 	debug_msg "Adding bundle os-core to the 3rd-party repo"
-	create_bundle -L -n os-core -v "$version" -f /usr/lib/os-release:"$OS_RELEASE",/usr/share/defaults/swupd/format:"$FORMAT" -u "$repo_name" "$env_name"
+	hashed_name=$(sudo "$SWUPD" hashdump --quiet "$TEST_ROOT_DIR"/Swupd_Root.pem)
+	sudo cp -p "$TEST_ROOT_DIR"/Swupd_Root.pem "$env_name"/3rd_party/"$repo_name"/"$version"/files/"$hashed_name"
+	create_tar "$env_name"/3rd_party/"$repo_name"/"$version"/files/"$hashed_name"
+	CERT="$env_name"/3rd_party/"$repo_name"/"$version"/files/"$hashed_name"
+	create_bundle -L -n os-core -v "$version" -f /usr/lib/os-release:"$OS_RELEASE",/usr/share/clear/update-ca/Swupd_Root.pem:"$CERT",/usr/share/defaults/swupd/format:"$FORMAT" -u "$repo_name" "$env_name"
 
 }
 
@@ -2480,7 +2494,7 @@ create_bundle() { # swupd_function
 		# bundle had been locally installed
 		if [ "$local_bundle" = true ]; then
 			sudo mkdir -p "$target_path$(dirname "$val")"
-			sudo cp "$bundle_file" "$target_path$val"
+			sudo cp -p "$bundle_file" "$target_path$val"
 		fi
 	done
 
@@ -2521,7 +2535,7 @@ create_bundle() { # swupd_function
 			sudo mkdir -p "$target_path$(dirname "$val")"
 			# if local_bundle is enabled copy the link to target-dir but also
 			# copy the file it points to
-			sudo cp "$pfile" "$target_path$pfile_path"
+			sudo cp -p "$pfile" "$target_path$pfile_path"
 			sudo ln -rs "$target_path$pfile_path" "$target_path$val"
 		fi
 	done