提交 29f3be3f 编写于 作者: K Kees Cook

debianqueued: Do not output signature validity

Default GPG signature verification output has a trailing validity
identifier ("[ultimate]", "[unknown]", etc) now, so the gpg signature
checking regex was no longer matching. This resulted in surprising log
lines like:

Feb 29 04:59:31 processing /kees-1582951501.dak-commands
Feb 29 04:59:31 (PGP/GnuPG signature by unknown signator)

Existing regex is:
  $output =~ /^(gpg: )?good signature from (user )?"(.*)"\.?$/im;

Current gpg sees:

$ gpg --verify --no-default-keyring --keyring /srv/keyring.debian.org/keyrings/debian-keyring.gpg kees-1582951501.dak-commands
gpg: Signature made Sat 29 Feb 2020 04:45:01 AM UTC
gpg:                using RSA key A5C3F68F229DD60F723E6E138972F4DFDC6DC026
gpg: Good signature from "Kees Cook <kees@outflux.net>" [unknown]
gpg:                 aka "Kees Cook <kees@debian.org>" [unknown]
...

Instead, launch gpg with --verify-options no-show-uid-validity to avoid
breaking the regex.

While here, I made the more robust by adding "?:" prefixes to the unused
regex match groups so the assignment on the next line can always use $1:

  ( $signator = $1 ) ||= "unknown signator";
上级 33f01239
......@@ -1672,6 +1672,7 @@ sub pgp_check($) {
my @command = ("$conf::gpg", "--no-options", "--batch", "--no-tty",
"--trust-model", "always", "--no-default-keyring",
(map +("--keyring" => $_), @conf::keyrings),
"--verify-options", "no-show-uid-validity",
"--verify", "-");
debug( "executing " . join(" ", @command) );
......@@ -1706,8 +1707,8 @@ sub pgp_check($) {
return "";
} ## end if ($stat)
$output =~ /^(gpg: )?good signature from (user )?"(.*)"\.?$/im;
( $signator = $3 ) ||= "unknown signator";
$output =~ /^(?:gpg: )?good signature from (?:user )?"(.*)"\.?$/im;
( $signator = $1 ) ||= "unknown signator";
if ($conf::debug) {
debug("GnuPG signature ok (by $signator)");
}
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册