diff --git a/src/3rd_party_add.c b/src/3rd_party_add.c index 46a17c6f..81c4de67 100644 --- a/src/3rd_party_add.c +++ b/src/3rd_party_add.c @@ -99,6 +99,7 @@ enum swupd_code third_party_add_main(int argc, char **argv) bool revert = false; int repo_version; int ret; + const bool DONT_VERIFY_CERTIFICATE = false; if (!parse_options(argc, argv)) { print_help(); @@ -147,7 +148,7 @@ enum swupd_code third_party_add_main(int argc, char **argv) } /* set the appropriate content_dir and state_dir for the selected 3rd-party repo */ - ret_code = third_party_set_repo(globals.state_dir, globals.path_prefix, repo); + ret_code = third_party_set_repo(globals.state_dir, globals.path_prefix, repo, DONT_VERIFY_CERTIFICATE); if (ret_code) { revert = true; goto finish; diff --git a/src/3rd_party_repos.c b/src/3rd_party_repos.c index ab88e503..172bbc2b 100644 --- a/src/3rd_party_repos.c +++ b/src/3rd_party_repos.c @@ -18,6 +18,8 @@ */ #include "3rd_party_repos.h" +#include "config.h" +#include "signature.h" #include "swupd.h" #include @@ -248,14 +250,30 @@ int third_party_remove_repo_directory(const char *repo_name) return ret; } -enum swupd_code third_party_set_repo(const char *state_dir, const char *path_prefix, struct repo *repo) +enum swupd_code third_party_set_repo(const char *state_dir, const char *path_prefix, struct repo *repo, bool sigcheck) { char *repo_state_dir; char *repo_path_prefix; + char *repo_cert_path; set_content_url(repo->url); set_version_url(repo->url); + /* set up swupd to use the certificate from the 3rd-party repository */ + string_or_die(&repo_cert_path, "%s/opt/3rd_party/%s/%s", path_prefix, repo->name, CERT_PATH); + set_cert_path(repo_cert_path); + /* if --nosigcheck was used, we do not attempt any signature checking */ + if (sigcheck) { + signature_deinit(); + if (!signature_init(globals.cert_path, NULL)) { + signature_deinit(); + error("Unable to validate the certificate %s\n\n", repo_cert_path); + free_string(&repo_cert_path); + return SWUPD_SIGNATURE_VERIFICATION_FAILED; + } + } + free_string(&repo_cert_path); + string_or_die(&repo_path_prefix, "%s/opt/3rd_party/%s", path_prefix, repo->name); set_path_prefix(repo_path_prefix); free_string(&repo_path_prefix); @@ -298,9 +316,9 @@ static enum swupd_code third_party_find_bundle(const char *bundle, struct list * struct file *file = NULL; /* set the appropriate content_dir and state_dir for the selected 3rd-party repo */ - ret_code = third_party_set_repo(state_dir, path_prefix, repo); + ret_code = third_party_set_repo(state_dir, path_prefix, repo, globals.sigcheck); if (ret_code != SWUPD_OK) { - return ret_code; + goto clean_and_exit; } /* get repo's version */ @@ -405,7 +423,7 @@ enum swupd_code third_party_run_operation(struct list *bundles, const char *repo if (selected_repo) { /* set the appropriate content_dir and state_dir for the selected 3rd-party repo */ - ret = third_party_set_repo(state_dir, path_prefix, selected_repo); + ret = third_party_set_repo(state_dir, path_prefix, selected_repo, globals.sigcheck); if (ret) { ret_code = ret; goto next; @@ -468,7 +486,7 @@ enum swupd_code third_party_run_operation_multirepo(const char *repo, run_operat } /* set the appropriate variables for the selected 3rd-party repo */ - ret_code = third_party_set_repo(state_dir, path_prefix, selected_repo); + ret_code = third_party_set_repo(state_dir, path_prefix, selected_repo, globals.sigcheck); if (ret_code) { goto clean_and_exit; } @@ -481,7 +499,7 @@ enum swupd_code third_party_run_operation_multirepo(const char *repo, run_operat selected_repo = iter->data; /* set the appropriate variables for the selected 3rd-party repo */ - ret = third_party_set_repo(state_dir, path_prefix, selected_repo); + ret = third_party_set_repo(state_dir, path_prefix, selected_repo, globals.sigcheck); if (ret) { ret_code = ret; goto clean_and_exit; diff --git a/src/3rd_party_repos.h b/src/3rd_party_repos.h index a9ffdb29..f60575e0 100644 --- a/src/3rd_party_repos.h +++ b/src/3rd_party_repos.h @@ -79,10 +79,11 @@ int third_party_remove_repo_directory(const char *repo_name); * * @param state_dir the original state directory of the system * @param path_prefix the original path prefix of the system + * @param sigcheck indicates if the repo certificate has to be validate or not * * @returns a swupd_code */ -enum swupd_code third_party_set_repo(const char *state_dir, const char *path_prefix, struct repo *repo); +enum swupd_code third_party_set_repo(const char *state_dir, const char *path_prefix, struct repo *repo, bool sigcheck); /** * @brief strcmp like function to search for a repo based on its name diff --git a/src/globals.c b/src/globals.c index d82793b3..31357a4a 100644 --- a/src/globals.c +++ b/src/globals.c @@ -369,7 +369,7 @@ void set_default_path_prefix() globals.path_prefix = strdup_or_die("/"); } -static void set_cert_path(char *path) +void set_cert_path(char *path) { if (globals.cert_path) { free_string(&globals.cert_path); diff --git a/src/globals.h b/src/globals.h index eef3f639..3f37faf2 100644 --- a/src/globals.h +++ b/src/globals.h @@ -84,6 +84,7 @@ void set_default_path_prefix(void); void set_content_url(char *url); bool set_state_dir(char *path); void set_version_url(char *url); +void set_cert_path(char *path); #ifdef __cplusplus } diff --git a/test/functional/3rd-party/3rd-party-diagnose-basic.bats b/test/functional/3rd-party/3rd-party-diagnose-basic.bats index 0c640cde..fa1b664d 100755 --- a/test/functional/3rd-party/3rd-party-diagnose-basic.bats +++ b/test/functional/3rd-party/3rd-party-diagnose-basic.bats @@ -69,7 +69,7 @@ global_teardown() { -> Hash mismatch for file: $PATH_PREFIX/opt/3rd_party/test-repo1/usr/lib/os-release Checking for extraneous files -> File that should be deleted: $PATH_PREFIX/opt/3rd_party/test-repo1/bar/file_2 - Inspected 17 files + Inspected 19 files 2 files were missing 2 files did not match 1 file found which should be deleted @@ -83,7 +83,7 @@ global_teardown() { Checking for missing files Checking for corrupt files Checking for extraneous files - Inspected 13 files + Inspected 15 files Diagnose successful EOM ) @@ -102,7 +102,7 @@ global_teardown() { Checking for missing files Checking for corrupt files Checking for extraneous files - Inspected 13 files + Inspected 15 files Diagnose successful EOM ) @@ -135,7 +135,7 @@ global_teardown() { Checking for corrupt files -> Hash mismatch for file: $PATH_PREFIX/opt/3rd_party/test-repo1/usr/lib/os-release Checking for extraneous files - Inspected 15 files + Inspected 17 files 1 file did not match Use "swupd repair" to correct the problems in the system Diagnose successful @@ -165,7 +165,7 @@ global_teardown() { Checking for extraneous files -> File that should be deleted: $PATH_PREFIX/opt/3rd_party/test-repo1/bar/file_2 Checking for extra files under $PATH_PREFIX/opt/3rd_party/test-repo1/usr - Inspected 17 files + Inspected 19 files 2 files were missing 2 files did not match 1 file found which should be deleted @@ -181,7 +181,7 @@ global_teardown() { Checking for extraneous files Checking for extra files under $PATH_PREFIX/opt/3rd_party/test-repo2/usr -> Extra file: $PATH_PREFIX/opt/3rd_party/test-repo2/usr/untracked_file3 - Inspected 14 files + Inspected 16 files 1 file found which should be deleted Use "swupd repair --picky" to correct the problems in the system Diagnose successful @@ -213,7 +213,7 @@ global_teardown() { Checking for extra files under $PATH_PREFIX/opt/3rd_party/test-repo1/bat -> Extra file: $PATH_PREFIX/opt/3rd_party/test-repo1/bat/untracked_file1 -> Extra file: $PATH_PREFIX/opt/3rd_party/test-repo1/bat/ - Inspected 19 files + Inspected 21 files 2 files were missing 2 files did not match 3 files found which should be deleted @@ -228,7 +228,7 @@ global_teardown() { Checking for corrupt files Checking for extraneous files Checking for extra files under $PATH_PREFIX/opt/3rd_party/test-repo2/bat - Inspected 13 files + Inspected 15 files Diagnose successful EOM ) diff --git a/test/functional/3rd-party/3rd-party-repair-basic.bats b/test/functional/3rd-party/3rd-party-repair-basic.bats index cb894767..2330d310 100755 --- a/test/functional/3rd-party/3rd-party-repair-basic.bats +++ b/test/functional/3rd-party/3rd-party-repair-basic.bats @@ -54,7 +54,7 @@ test_setup() { -> Hash mismatch for file: $PATH_PREFIX/opt/3rd_party/test-repo1/usr/lib/os-release -> fixed Removing extraneous files -> File that should be deleted: $PATH_PREFIX/opt/3rd_party/test-repo1/bar/file_2 -> deleted - Inspected 17 files + Inspected 19 files 2 files were missing 2 of 2 missing files were replaced 0 of 2 missing files were not replaced @@ -75,7 +75,7 @@ test_setup() { Adding any missing files Repairing corrupt files Removing extraneous files - Inspected 13 files + Inspected 15 files Calling post-update helper scripts Repair successful EOM @@ -96,7 +96,7 @@ test_setup() { Adding any missing files Repairing corrupt files Removing extraneous files - Inspected 13 files + Inspected 15 files Calling post-update helper scripts Repair successful EOM @@ -121,7 +121,7 @@ test_setup() { Repairing corrupt files -> Hash mismatch for file: $PATH_PREFIX/opt/3rd_party/test-repo1/usr/lib/os-release -> fixed Removing extraneous files - Inspected 15 files + Inspected 17 files 1 file did not match 1 of 1 files were repaired 0 of 1 files were not repaired @@ -156,7 +156,7 @@ test_setup() { Removing extraneous files -> File that should be deleted: $PATH_PREFIX/opt/3rd_party/test-repo1/bar/file_2 -> deleted Removing extra files under $PATH_PREFIX/opt/3rd_party/test-repo1/usr - Inspected 17 files + Inspected 19 files 2 files were missing 2 of 2 missing files were replaced 0 of 2 missing files were not replaced @@ -179,7 +179,7 @@ test_setup() { Removing extraneous files Removing extra files under $PATH_PREFIX/opt/3rd_party/test-repo2/usr -> Extra file: $PATH_PREFIX/opt/3rd_party/test-repo2/usr/untracked_file3 -> deleted - Inspected 14 files + Inspected 16 files 1 file found which should be deleted 1 of 1 files were deleted 0 of 1 files were not deleted @@ -216,7 +216,7 @@ test_setup() { Removing extra files under $PATH_PREFIX/opt/3rd_party/test-repo1/bat -> Extra file: $PATH_PREFIX/opt/3rd_party/test-repo1/bat/untracked_file1 -> deleted -> Extra file: $PATH_PREFIX/opt/3rd_party/test-repo1/bat/ -> deleted - Inspected 19 files + Inspected 21 files 2 files were missing 2 of 2 missing files were replaced 0 of 2 missing files were not replaced @@ -238,7 +238,7 @@ test_setup() { Repairing corrupt files Removing extraneous files Removing extra files under $PATH_PREFIX/opt/3rd_party/test-repo2/bat - Inspected 13 files + Inspected 15 files Calling post-update helper scripts Repair successful EOM diff --git a/test/functional/3rd-party/3rd-party-repo-add.bats b/test/functional/3rd-party/3rd-party-repo-add.bats index 3403d152..04c99d0b 100755 --- a/test/functional/3rd-party/3rd-party-repo-add.bats +++ b/test/functional/3rd-party/3rd-party-repo-add.bats @@ -27,9 +27,11 @@ test_setup() { Installing bundle 'os-core' from 3rd-party repository test-repo1... Note that bundles added from a 3rd-party repository are forced to run with the --no-scripts flag for security reasons Loading required manifests... - No packs need to be downloaded + Downloading packs for: + - os-core + Finishing packs extraction... Validate downloaded files - Starting download of remaining update content. This may take a while... + No extra files need to be downloaded Installing files... Warning: post-update helper scripts skipped due to --no-scripts argument Successfully installed 1 bundle diff --git a/test/functional/testlib.bash b/test/functional/testlib.bash index f43e2b32..5a51620e 100644 --- a/test/functional/testlib.bash +++ b/test/functional/testlib.bash @@ -1404,6 +1404,8 @@ create_third_party_repo() { #swupd_function local version=$2 local format=${3:-staging} local repo_name=${4:-test-repo} + local hashed_name + local CERT # If no parameters are received show usage if [ $# -eq 0 ]; then @@ -1418,7 +1420,15 @@ create_third_party_repo() { #swupd_function debug_msg "Creating 3rd-party repo $repo_name..." create_version -r "$env_name" "$version" 0 "$format" "$repo_name" - create_bundle -n os-core -v "$version" -f /usr/lib/os-release:"$OS_RELEASE",/usr/share/defaults/swupd/format:"$FORMAT" -u "$repo_name" "$env_name" + + # we need to create os-core which should include the os-release and Swupd_Root.pem + debug_msg "Creating os-core with Swupd_Root.pem and os-release..." + hashed_name=$(sudo "$SWUPD" hashdump --quiet "$TEST_ROOT_DIR"/Swupd_Root.pem) + sudo cp -p "$TEST_ROOT_DIR"/Swupd_Root.pem "$env_name"/3rd_party/"$repo_name"/"$version"/files/"$hashed_name" + create_tar "$env_name"/3rd_party/"$repo_name"/"$version"/files/"$hashed_name" + CERT="$env_name"/3rd_party/"$repo_name"/"$version"/files/"$hashed_name" + create_bundle -n os-core -v "$version" -f /usr/lib/os-release:"$OS_RELEASE",/usr/share/clear/update-ca/Swupd_Root.pem:"$CERT",/usr/share/defaults/swupd/format:"$FORMAT" -u "$repo_name" "$env_name" + TPWEBDIR=$(realpath "$env_name/3rd_party/$repo_name") export TPWEBDIR debug_msg "3rd-party repo content dir: $TPWEBDIR" @@ -1479,9 +1489,13 @@ add_third_party_repo() { #swupd_function debug_msg "3rd-party repo content dir: $TPWEBDIR" # every 3rd-party repo needs to have at least the os-core bundle so this should be - # added by default + # added by default which should include the os-release and Swupd_Root.pem debug_msg "Adding bundle os-core to the 3rd-party repo" - create_bundle -L -n os-core -v "$version" -f /usr/lib/os-release:"$OS_RELEASE",/usr/share/defaults/swupd/format:"$FORMAT" -u "$repo_name" "$env_name" + hashed_name=$(sudo "$SWUPD" hashdump --quiet "$TEST_ROOT_DIR"/Swupd_Root.pem) + sudo cp -p "$TEST_ROOT_DIR"/Swupd_Root.pem "$env_name"/3rd_party/"$repo_name"/"$version"/files/"$hashed_name" + create_tar "$env_name"/3rd_party/"$repo_name"/"$version"/files/"$hashed_name" + CERT="$env_name"/3rd_party/"$repo_name"/"$version"/files/"$hashed_name" + create_bundle -L -n os-core -v "$version" -f /usr/lib/os-release:"$OS_RELEASE",/usr/share/clear/update-ca/Swupd_Root.pem:"$CERT",/usr/share/defaults/swupd/format:"$FORMAT" -u "$repo_name" "$env_name" } @@ -2480,7 +2494,7 @@ create_bundle() { # swupd_function # bundle had been locally installed if [ "$local_bundle" = true ]; then sudo mkdir -p "$target_path$(dirname "$val")" - sudo cp "$bundle_file" "$target_path$val" + sudo cp -p "$bundle_file" "$target_path$val" fi done @@ -2521,7 +2535,7 @@ create_bundle() { # swupd_function sudo mkdir -p "$target_path$(dirname "$val")" # if local_bundle is enabled copy the link to target-dir but also # copy the file it points to - sudo cp "$pfile" "$target_path$pfile_path" + sudo cp -p "$pfile" "$target_path$pfile_path" sudo ln -rs "$target_path$pfile_path" "$target_path$val" fi done