Edit File: kcsig_verify.py
# COPY of scripts/kcsig/kcsig/verify.py from 4fdf3255d5490df60f7dd import os import base64 import tempfile import subprocess import json import shutil import contextlib if False: from typing import Union, List, Mapping, Any, Sequence, Optional, Tuple, Dict, Iterator # noqa: F401 from .types import ReleaseKey, AnyKey, RootKey, anystr, Signature, RootKeys # noqa: F401 AVAILABLE_KINDS = ['rsa4096'] PAE_FIELDS = {'gpg': ('type', 'kind', 'role', 'serial', 'key')} TMPDIR = '/dev/shm' btype = type(b'') utype = type(u'') ntype = type('') class Error(Exception): pass def to_bytes(data, encoding='latin1'): # type: (Union[str, bytes, int], str) -> bytes dtype = type(data) if dtype is btype: return data # type: ignore elif dtype is utype: return data.encode(encoding) # type: ignore elif dtype is int: return to_bytes(str(data)) raise ValueError('Unsupported pae type ' + str(dtype)) def nstr(data): # type: (anystr) -> str dtype = type(data) if dtype is ntype: return data # type: ignore elif dtype is btype: return data.decode('utf-8') # type: ignore elif dtype is utype: # pragma: no cover, used only in py2 return data.encode('utf-8') # type: ignore raise NotImplementedError # pragma: no cover def atomic_write(fname, content, mode='w'): # type: (str, anystr, str) -> None tmp_fname = fname + '.tmp' with open(tmp_fname, mode) as f: f.write(content) os.rename(tmp_fname, fname) def read_file(fname): # type: (str) -> str with open(fname) as f: return f.read() def read_json(fname): # type: (str) -> Any return json.loads(read_file(fname)) def pae(*parts): # type: (Union[str, bytes, int]) -> bytes result = b'%d' % len(parts) for p in parts: bp = to_bytes(p) result += b'%d%s' % (len(bp), bp) return result def pae_fields(data, fields): # type: (Mapping[str, Any], Sequence[str]) -> bytes return pae(*[data[f] for f in fields]) def pae_type(data): # type: (ReleaseKey) -> bytes return pae_fields(data, PAE_FIELDS[data['type']]) def check_key(key): # type: (AnyKey) -> None if key['type'] not in PAE_FIELDS: raise ValueError('invalid key type: ' + nstr(key['type'])) @contextlib.contextmanager def temp_datafile(data, data_is_file): # type: (anystr, bool) -> Iterator[str] if data_is_file: yield data # type: ignore else: with tempfile.NamedTemporaryFile(dir=TMPDIR, prefix='kcsig-data-') as f: f.write(to_bytes(data)) f.flush() yield f.name @contextlib.contextmanager def temp_directory(prefix, dir): # type: (str, str) -> Iterator[str] temp_dir = tempfile.mkdtemp(prefix=prefix, dir=dir) try: yield temp_dir finally: shutil.rmtree(temp_dir) def run_gpg_verify(keyfile, datafile, sigdata): # type: (str, str, bytes) -> None with temp_directory(dir=TMPDIR, prefix='kcsig-gpgtmp-') as tmp_dir: cmd = ['gpg', '--homedir', tmp_dir, '--keyring', keyfile, '--verify', '-', datafile] p = subprocess.Popen(cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE) stdout, stderr = p.communicate(sigdata) if p.returncode != 0: raise Exception('Verify error: ' + nstr(stderr) + '\n' + nstr(stdout)) def verify_key(signature, key, data, data_is_file): # type: (str, AnyKey, anystr, bool) -> None check_key(key) with tempfile.NamedTemporaryFile(dir=TMPDIR, prefix='kcsig-key-') as key_file: key_file.write(base64.b64decode(to_bytes(key['key']))) key_file.flush() with temp_datafile(data, data_is_file) as datafile: sigdata = base64.b64decode(to_bytes(signature)) run_gpg_verify(key_file.name, datafile, sigdata) def verify_count(signatures, keys, data, data_is_file=False): # type: (Mapping[str, str], Mapping[str, RootKey], anystr, bool) -> Tuple[int, Mapping[str, str]] count = 0 errors = {} for keyid, sig in signatures.items(): if keyid not in keys: errors[keyid] = 'no corresponding root key' continue try: verify_key(sig, keys[keyid], data, data_is_file) except Exception as e: errors[keyid] = str(e) else: count += 1 return count, errors def _verify(sigdata, datafile, root_keys, kinds=None): # type: (Signature, str, RootKeys, Optional[List[str]]) -> None threshold = root_keys.get('threshold', 9999) min_serial = root_keys.get('min_serial', 99999999) errors = {} # type: Dict[str, Union[str, Mapping[str, str]]] kinds = kinds or AVAILABLE_KINDS applicable_keys = {} for keyid, key in sigdata['keys'].items(): try: check_key(key) if key['kind'] not in kinds: errors[keyid] = 'invalid kind {0}, accepted list is {1}'.format(key['kind'], kinds) elif key['serial'] < min_serial: errors[keyid] = 'invalid serial {0}, current is {1}'.format(key['serial'], min_serial) else: applicable_keys[keyid] = key except Exception as e: errors[keyid] = str(e) continue verified_keys = {} for keyid, key in applicable_keys.items(): count, root_errors = verify_count(key['signatures'], root_keys['keys'], data=pae_type(key)) if count < threshold: errors[keyid] = root_errors else: verified_keys[keyid] = key count = 0 for keyid, key in verified_keys.items(): try: verify_key(sigdata['signatures'][keyid], key, data=datafile, data_is_file=True) except Exception as e: errors[keyid] = str(e) else: count += 1 if not count: raise Error('Error validating file signature: ' + json.dumps(errors)) def verify(sigfile, datafile, rootfile, kinds=None): # type: (str, str, str, Optional[List[str]]) -> None sigdata = read_json(sigfile) # type: Signature root_keys = read_json(rootfile) # type: RootKeys _verify(sigdata, datafile, root_keys, kinds=kinds)