[master 2/2] Actually verify downloaded packages

marmarek installerbot-noreply at redhat.com
Tue Sep 29 12:37:59 UTC 2015


From: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?=
 <marmarek at invisiblethingslab.com>

---
 pyanaconda/packaging/dnfpayload.py | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/pyanaconda/packaging/dnfpayload.py b/pyanaconda/packaging/dnfpayload.py
index 7d4dffb..292420e 100644
--- a/pyanaconda/packaging/dnfpayload.py
+++ b/pyanaconda/packaging/dnfpayload.py
@@ -675,6 +675,30 @@ def gatherRepoMetadata(self):
         self._base.read_comps()
         self._refreshEnvironmentAddons()
 
+    def gpgsigcheck(self, pkgs):
+        """Perform GPG signature verification on the given packages,
+        installing keys if possible.
+
+        :param pkgs: a list of package objects to verify the GPG
+           signatures of
+        :return: None
+        :raises: Will raise :class:`Error` if there's a problem
+        """
+        for po in pkgs:
+            result, errmsg = self._base.sigCheckPkg(po)
+
+            if result == 0:
+                # Verified ok, or verify not req'd
+                continue
+            elif result == 1:
+                # the callback here expects to be able to take options, which
+                # we don't need; it is used for key import confirmation
+                fn = lambda x, y, z: True
+                self._base.getKeyForPackage(po, fn)
+            else:
+                # Fatal error
+                raise dnf.exceptions.Error(errmsg)
+
     def install(self):
         progress_message(N_('Starting package installation process'))
 
@@ -703,6 +727,9 @@ def install(self):
             if errors.errorHandler.cb(exc) == errors.ERROR_RAISE:
                 _failure_limbo()
 
+        # Verify GPG signatures
+        self.gpgsigcheck(pkgs_to_download)
+
         log.info('Downloading packages finished.')
 
         pre_msg = (N_("Preparing transaction from installation source"))


-- 
To view this commit on github, visit https://github.com/rhinstaller/anaconda/commit/d7aa444636bf42f2bfa8a8d70d3ed8abb25c3b3d


More information about the anaconda-patches mailing list