[master 2/2] Actually verify downloaded packages
marmarek
installerbot-noreply at redhat.com
Tue Sep 29 12:37:59 UTC 2015
From: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?=
<marmarek at invisiblethingslab.com>
---
pyanaconda/packaging/dnfpayload.py | 27 +++++++++++++++++++++++++++
1 file changed, 27 insertions(+)
diff --git a/pyanaconda/packaging/dnfpayload.py b/pyanaconda/packaging/dnfpayload.py
index 7d4dffb..292420e 100644
--- a/pyanaconda/packaging/dnfpayload.py
+++ b/pyanaconda/packaging/dnfpayload.py
@@ -675,6 +675,30 @@ def gatherRepoMetadata(self):
self._base.read_comps()
self._refreshEnvironmentAddons()
+ def gpgsigcheck(self, pkgs):
+ """Perform GPG signature verification on the given packages,
+ installing keys if possible.
+
+ :param pkgs: a list of package objects to verify the GPG
+ signatures of
+ :return: None
+ :raises: Will raise :class:`Error` if there's a problem
+ """
+ for po in pkgs:
+ result, errmsg = self._base.sigCheckPkg(po)
+
+ if result == 0:
+ # Verified ok, or verify not req'd
+ continue
+ elif result == 1:
+ # the callback here expects to be able to take options, which
+ # we don't need; it is used for key import confirmation
+ fn = lambda x, y, z: True
+ self._base.getKeyForPackage(po, fn)
+ else:
+ # Fatal error
+ raise dnf.exceptions.Error(errmsg)
+
def install(self):
progress_message(N_('Starting package installation process'))
@@ -703,6 +727,9 @@ def install(self):
if errors.errorHandler.cb(exc) == errors.ERROR_RAISE:
_failure_limbo()
+ # Verify GPG signatures
+ self.gpgsigcheck(pkgs_to_download)
+
log.info('Downloading packages finished.')
pre_msg = (N_("Preparing transaction from installation source"))
--
To view this commit on github, visit https://github.com/rhinstaller/anaconda/commit/d7aa444636bf42f2bfa8a8d70d3ed8abb25c3b3d
More information about the anaconda-patches
mailing list