Additional way to distinguish no actual key available for signature checking; make sure to not allow signing in such situation. --- builder/sigchecker.ml | 8 ++++++++ builder/sigchecker.mli | 1 + 2 files changed, 9 insertions(+) diff --git a/builder/sigchecker.ml b/builder/sigchecker.ml index 7459e4b..67d1600 100644 --- a/builder/sigchecker.ml +++ b/builder/sigchecker.ml @@ -97,6 +97,7 @@ ZvXkQ3FVJwZoLmHw47vvlVpLD/4gi1SuHWieRvZ+UdDq00E348pm " type gpgkey_type = + | No_Key | Fingerprint of string | KeyFile of string @@ -127,6 +128,11 @@ let rec create ~debug ~gpg ~gpgkey ~check_signature = (* Create a temporary directory for gnupg. *) let tmpdir = Mkdtemp.mkdtemp (Filename.temp_dir_name // "vb.gpghome.XXXXXX") in rmdir_on_exit tmpdir; + (* Make sure we have no check_signature=true with no actual key. *) + let check_signature, gpgkey = + match check_signature, gpgkey with + | true, No_Key -> false, No_Key + | x, y -> x, y in let fingerprint = if check_signature then ( (* Run gpg so it can setup its own home directory, failing if it @@ -141,6 +147,8 @@ let rec create ~debug ~gpg ~gpgkey ~check_signature = exit 1 ); match gpgkey with + | No_Key -> + assert false | KeyFile kf -> let status_file = import_keyfile gpg tmpdir debug kf in let status = read_whole_file status_file in diff --git a/builder/sigchecker.mli b/builder/sigchecker.mli index f4e817e..ab44a5c 100644 --- a/builder/sigchecker.mli +++ b/builder/sigchecker.mli @@ -21,6 +21,7 @@ val default_fingerprint : string type t type gpgkey_type = + | No_Key | Fingerprint of string | KeyFile of string -- 1.8.3.1

Use Sigchecker.gpgkey_type instead of just string as type in the sources list; adapt the listing code (and its expected output) to that. No behaviour change which eases a bit the addition of new sources with other key types. --- builder/builder.ml | 9 ++++++--- builder/list_entries.ml | 22 +++++++++++++++++----- builder/list_entries.mli | 2 +- builder/test-virt-builder-list.sh | 4 ++-- 4 files changed, 26 insertions(+), 11 deletions(-) diff --git a/builder/builder.ml b/builder/builder.ml index 80ccef7..1ddbd0a 100644 --- a/builder/builder.ml +++ b/builder/builder.ml @@ -136,13 +136,16 @@ let main () = (* Download the sources. *) let downloader = Downloader.create ~debug ~curl ~cache in + let sources = List.map ( + fun (source, fingerprint) -> + source, Sigchecker.Fingerprint fingerprint + ) sources in let index : Index_parser.index = List.concat ( List.map ( - fun (source, fingerprint) -> + fun (source, key) -> let sigchecker = - Sigchecker.create ~debug ~gpg ~check_signature - ~gpgkey:(Sigchecker.Fingerprint fingerprint) in + Sigchecker.create ~debug ~gpg ~check_signature ~gpgkey:key in Index_parser.get_index ~prog ~debug ~downloader ~sigchecker source ) sources ) in diff --git a/builder/list_entries.ml b/builder/list_entries.ml index edf7dfb..476bf14 100644 --- a/builder/list_entries.ml +++ b/builder/list_entries.ml @@ -65,9 +65,15 @@ and list_entries_long ~sources index = | Some locale -> split_locale locale in List.iter ( - fun (source, fingerprint) -> + fun (source, key) -> printf (f_"Source URI: %s\n") source; - printf (f_"Fingerprint: %s\n") fingerprint; + (match key with + | Sigchecker.No_Key -> () + | Sigchecker.Fingerprint fp -> + printf (f_"Fingerprint: %s\n") fp; + | Sigchecker.KeyFile kf -> + printf (f_"Key: %s\n") kf; + ); printf "\n" ) sources; @@ -160,10 +166,16 @@ and list_entries_json ~sources index = printf " \"version\": %d,\n" 1; printf " \"sources\": [\n"; iteri ( - fun i (source, fingerprint) -> + fun i (source, key) -> printf " {\n"; - printf " \"uri\": \"%s\",\n" source; - printf " \"fingerprint\": \"%s\"\n" fingerprint; + (match key with + | Sigchecker.No_Key -> () + | Sigchecker.Fingerprint fp -> + printf " \"fingerprint\": \"%s\",\n" fp; + | Sigchecker.KeyFile kf -> + printf " \"key\": \"%s\",\n" kf; + ); + printf " \"uri\": \"%s\"\n" source; printf " }%s\n" (trailing_comma i (List.length sources)) ) sources; printf " ],\n"; diff --git a/builder/list_entries.mli b/builder/list_entries.mli index e7c32f1..b53ccec 100644 --- a/builder/list_entries.mli +++ b/builder/list_entries.mli @@ -16,4 +16,4 @@ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. *) -val list_entries : list_format:([ `Short | `Long | `Json ]) -> sources:(string * string) list -> Index_parser.index -> unit +val list_entries : list_format:([ `Short | `Long | `Json ]) -> sources:(string * Sigchecker.gpgkey_type) list -> Index_parser.index -> unit diff --git a/builder/test-virt-builder-list.sh b/builder/test-virt-builder-list.sh index 7174152..6db9b78 100755 --- a/builder/test-virt-builder-list.sh +++ b/builder/test-virt-builder-list.sh @@ -117,8 +117,8 @@ if [ "$json_list" != "{ \"version\": 1, \"sources\": [ { - \"uri\": \"$VIRT_BUILDER_SOURCE\", - \"fingerprint\": \"F777 4FB1 AD07 4A7E 8C87 67EA 9173 8F73 E1B7 68A0\" + \"fingerprint\": \"F777 4FB1 AD07 4A7E 8C87 67EA 9173 8F73 E1B7 68A0\", + \"uri\": \"$VIRT_BUILDER_SOURCE\" } ], \"templates\": [ -- 1.8.3.1

On Mon, Mar 03, 2014 at 04:31:47PM +0100, Pino Toscano wrote: ACK. I guess we should use $(LN_S) a few other places? $ git grep -- 'ln -s'|wc -l 28 Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones virt-p2v converts physical machines to virtual machines. Boot with a live CD or over the network (PXE) and turn machines into KVM guests. http://libguestfs.org/virt-v2v

Introduce and use simple .conf files to configure the sources of indexes for virt-builder. The location of these files is in XDG_CONFIG_DIRS / XDG_CONFIG_HOME, so it can be easily overridden. There are three .conf(.in) files shipped with this commit: - "test-index.conf.in" (in "test-config"), which points to the "test-index" index (used in tests only); the tests are adapted to point to the hierarchy containing this .conf - "libguestfs.conf.in" (in "test-website"), which points to the local "index.asc" (i.e. the offline copy of the libguestfs.org index); run(.in) will point to the hierarchy providing this .conf - "libguestfs.conf.in" (directly among the other sources), which points to the online "index.asc" and it is installed in sysconfdir, along with the key of this repository The tests are adapted, other than to the different way to pick sources, to the different output of --list, as "test-index" is not signed. --- .gitignore | 3 + builder/Makefile.am | 10 +- builder/builder.ml | 10 ++ builder/libguestfs.conf.in | 3 + builder/sources.ml | 122 +++++++++++++++++++++ builder/sources.mli | 25 +++++ .../virt-builder/repos.d/test-index.conf.in | 2 + builder/test-virt-builder-list.sh | 8 +- builder/test-virt-builder-planner.sh | 2 +- builder/test-virt-builder.sh | 2 +- .../virt-builder/repos.d/libguestfs.conf.in | 3 + configure.ac | 9 ++ po/POTFILES-ml | 1 + run.in | 6 +- 14 files changed, 195 insertions(+), 11 deletions(-) create mode 100644 builder/libguestfs.conf.in create mode 100644 builder/sources.ml create mode 100644 builder/sources.mli create mode 100644 builder/test-config/virt-builder/repos.d/test-index.conf.in create mode 100644 builder/test-website/virt-builder/repos.d/libguestfs.conf.in diff --git a/.gitignore b/.gitignore index 1ee7775..844df3c 100644 --- a/.gitignore +++ b/.gitignore @@ -61,10 +61,13 @@ Makefile.in /builder/index-parse.c /builder/index-parse.h /builder/index-scan.c +/builder/libguestfs.conf /builder/*.qcow2 /builder/stamp-virt-builder.pod /builder/stamp-virt-index-validate.pod +/builder/test-config/virt-builder/repos.d/test-index.conf /builder/test-index +/builder/test-website/virt-builder/repos.d/libguestfs.conf /builder/virt-builder /builder/virt-builder.1 /builder/virt-index-validate diff --git a/builder/Makefile.am b/builder/Makefile.am index a72b7ac..f0cb1dd 100644 --- a/builder/Makefile.am +++ b/builder/Makefile.am @@ -58,7 +58,9 @@ SOURCES = \ setlocale.mli \ setlocale-c.c \ sigchecker.mli \ - sigchecker.ml + sigchecker.ml \ + sources.mli \ + sources.ml man_MANS = noinst_DATA = @@ -103,6 +105,7 @@ OBJECTS = \ sigchecker.cmx \ index_parser.cmx \ list_entries.cmx \ + sources.cmx \ cmdline.cmx \ builder.cmx @@ -221,6 +224,11 @@ DISTCLEANFILES = .depend .PHONY: depend docs +# virt-builder's default repository + +repoconfdir = $(sysconfdir)/xdg/virt-builder/repos.d +repoconf_DATA = libguestfs.conf libguestfs.gpg + # Build a small C index validator program. bin_PROGRAMS = virt-index-validate diff --git a/builder/builder.ml b/builder/builder.ml index 1ddbd0a..1800f2d 100644 --- a/builder/builder.ml +++ b/builder/builder.ml @@ -136,10 +136,20 @@ let main () = (* Download the sources. *) let downloader = Downloader.create ~debug ~curl ~cache in + let repos = Sources.read_sources ~prog ~debug in + let repos = List.map ( + fun { Sources.uri = uri; Sources.gpgkey = gpgkey } -> + let gpgkey = + match gpgkey with + | None -> Sigchecker.No_Key + | Some key -> Sigchecker.KeyFile key in + uri, gpgkey + ) repos in let sources = List.map ( fun (source, fingerprint) -> source, Sigchecker.Fingerprint fingerprint ) sources in + let sources = List.append repos sources in let index : Index_parser.index = List.concat ( List.map ( diff --git a/builder/libguestfs.conf.in b/builder/libguestfs.conf.in new file mode 100644 index 0000000..633a0ab --- /dev/null +++ b/builder/libguestfs.conf.in @@ -0,0 +1,3 @@ +[libguestfs.org] +uri=http://libguestfs.org/download/builder/index.asc +gpgkey=file://@SYSCONFDIR@/xdg/virt-builder/repos.d/libguestfs.gpg diff --git a/builder/sources.ml b/builder/sources.ml new file mode 100644 index 0000000..fd0b236 --- /dev/null +++ b/builder/sources.ml @@ -0,0 +1,122 @@ +(* virt-builder + * Copyright (C) 2014 Red Hat Inc. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along + * with this program; if not, write to the Free Software Foundation, Inc., + * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + *) + +open Common_gettext.Gettext +open Common_utils + +open Printf +open Unix + +type source = { + name : string; + uri : string; + gpgkey : string option; +} + +let parse_conf ~prog ~debug file = + if debug then ( + eprintf (f_"%s: trying to read %s\n") prog file; + ); + let sections = Ini_reader.read_ini file in + + let sources = List.fold_right ( + fun (n, fields) acc -> + let give_source n fields = + let fields = List.map (fun (k, sk, v) -> (k, sk), v) fields in + let uri = + try List.assoc ("uri", None) fields + with Not_found as ex -> + eprintf (f_"%s: no 'uri' entry for '%s' in %s, skipping it\n") prog n file; + raise ex in + let gpgkey = + let k = + try Some (URI.parse_uri (List.assoc ("gpgkey", None) fields)) with + | Not_found -> None + | Invalid_argument "URI.parse_uri" as ex -> + if debug then ( + eprintf (f_"%s: '%s' has invalid gpgkey URI\n") prog n; + ); + raise ex in + match k with + | None -> None + | Some uri -> + (match uri.URI.protocol with + | "file" -> Some uri.URI.path + | _ -> + if debug then ( + eprintf (f_"%s: '%s' has non-local gpgkey URI\n") prog n; + ); + None + ) in + { + name = n; uri = uri; gpgkey = gpgkey; + } + in + try (give_source n fields) :: acc + with Not_found | Invalid_argument _ -> acc + ) sections [] in + + if debug then ( + eprintf (f_"%s: ... read %d sources\n") prog (List.length sources); + ); + + sources + +let merge_sources current_sources new_sources = + List.fold_right ( + fun source acc -> + if List.exists (fun { name = n } -> n = source.name) acc then + acc + else + source :: acc + ) new_sources current_sources + +let filter_filenames filename = + let suffix = ".conf" in + let n = String.length filename in + let ns = String.length suffix in + n >= ns && String.sub filename (n - ns) ns = suffix + +let read_sources ~prog ~debug = + let dirs = Paths.xdg_config_dirs ~prog in + let dirs = + match Paths.xdg_config_home ~prog with + | None -> dirs + | Some dir -> dir :: dirs in + let dirs = List.map (fun x -> x // "repos.d") dirs in + List.fold_right ( + fun dir acc -> + let files = + try List.filter filter_filenames (Array.to_list (Sys.readdir dir)) + with Sys_error _ -> [] in + let files = List.map (fun x -> dir // x) files in + List.fold_left ( + fun acc file -> + try merge_sources acc (parse_conf ~prog ~debug file) with + | Unix_error (code, fname, _) -> + if debug then ( + eprintf (f_"%s: file error: %s: %s\n") prog fname (error_message code) + ); + acc + | Invalid_argument msg -> + if debug then ( + eprintf (f_"%s: internal error: invalid argument: %s\n") prog msg + ); + acc + ) acc files + ) dirs [] diff --git a/builder/sources.mli b/builder/sources.mli new file mode 100644 index 0000000..76feeda --- /dev/null +++ b/builder/sources.mli @@ -0,0 +1,25 @@ +(* virt-builder + * Copyright (C) 2014 Red Hat Inc. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along + * with this program; if not, write to the Free Software Foundation, Inc., + * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + *) + +type source = { + name : string; + uri : string; + gpgkey : string option; +} + +val read_sources : prog:string -> debug:bool -> source list diff --git a/builder/test-config/virt-builder/repos.d/test-index.conf.in b/builder/test-config/virt-builder/repos.d/test-index.conf.in new file mode 100644 index 0000000..3755e75 --- /dev/null +++ b/builder/test-config/virt-builder/repos.d/test-index.conf.in @@ -0,0 +1,2 @@ +[test-index] +uri=file://@abs_top_srcdir@/builder/test-index diff --git a/builder/test-virt-builder-list.sh b/builder/test-virt-builder-list.sh index 6db9b78..2f9b319 100755 --- a/builder/test-virt-builder-list.sh +++ b/builder/test-virt-builder-list.sh @@ -23,7 +23,7 @@ set -e abs_builddir=$(pwd) -export VIRT_BUILDER_SOURCE=file://$abs_builddir/test-index +export XDG_CONFIG_DIRS="$abs_builddir/test-config" short_list=$($VG ./virt-builder --no-check-signature --no-cache --list) @@ -41,8 +41,7 @@ fi long_list=$(./virt-builder --no-check-signature --no-cache --list --long) -if [ "$long_list" != "Source URI: $VIRT_BUILDER_SOURCE -Fingerprint: F777 4FB1 AD07 4A7E 8C87 67EA 9173 8F73 E1B7 68A0 +if [ "$long_list" != "Source URI: file://$abs_builddir/test-index os-version: phony-debian Full name: Phony Debian @@ -117,8 +116,7 @@ if [ "$json_list" != "{ \"version\": 1, \"sources\": [ { - \"fingerprint\": \"F777 4FB1 AD07 4A7E 8C87 67EA 9173 8F73 E1B7 68A0\", - \"uri\": \"$VIRT_BUILDER_SOURCE\" + \"uri\": \"file://$abs_builddir/test-index\" } ], \"templates\": [ diff --git a/builder/test-virt-builder-planner.sh b/builder/test-virt-builder-planner.sh index 738b299..386de5c 100755 --- a/builder/test-virt-builder-planner.sh +++ b/builder/test-virt-builder-planner.sh @@ -21,7 +21,7 @@ set -e abs_builddir=$(pwd) -export VIRT_BUILDER_SOURCE=file://$abs_builddir/test-index +export XDG_CONFIG_DIRS="$abs_builddir/test-config" if [ ! -f fedora.xz -o ! -f fedora.qcow2 -o ! -f fedora.qcow2.xz ]; then echo "$0: test skipped because there is no fedora.xz, fedora.qcow2 or fedora.qcow2.xz in the build directory" diff --git a/builder/test-virt-builder.sh b/builder/test-virt-builder.sh index 3c8eb60..85a7888 100755 --- a/builder/test-virt-builder.sh +++ b/builder/test-virt-builder.sh @@ -21,7 +21,7 @@ set -e abs_builddir=$(pwd) -export VIRT_BUILDER_SOURCE=file://$abs_builddir/test-index +export XDG_CONFIG_DIRS="$abs_builddir/test-config" if [ ! -f fedora.xz ]; then echo "$0: test skipped because there is no fedora.xz in the build directory" diff --git a/builder/test-website/virt-builder/repos.d/libguestfs.conf.in b/builder/test-website/virt-builder/repos.d/libguestfs.conf.in new file mode 100644 index 0000000..7bbc28d --- /dev/null +++ b/builder/test-website/virt-builder/repos.d/libguestfs.conf.in @@ -0,0 +1,3 @@ +[libguestfs.org] +uri=file://@abs_top_srcdir@/builder/website/index.asc +gpgkey=file://@abs_top_srcdir@/builder/libguestfs.gpg diff --git a/configure.ac b/configure.ac index 96ae786..17e5229 100644 --- a/configure.ac +++ b/configure.ac @@ -1587,6 +1587,12 @@ dnl http://lists.fedoraproject.org/pipermail/devel/2010-November/146343.html LIBTOOL='bash $(top_srcdir)/libtool-kill-dependency_libs.sh $(top_builddir)/libtool' AC_SUBST([LIBTOOL]) +dnl Work around autoconf's lack of expanded variables. +eval my_sysconfdir="\"[$]sysconfdir\"" +eval my_sysconfdir="\"$my_sysconfdir\"" +SYSCONFDIR="${my_sysconfdir}" +AC_SUBST(SYSCONFDIR) + dnl Produce output files. AC_CONFIG_HEADERS([config.h]) @@ -1618,7 +1624,10 @@ AC_CONFIG_FILES([Makefile appliance/Makefile bash/Makefile builder/Makefile + builder/libguestfs.conf + builder/test-config/virt-builder/repos.d/test-index.conf builder/test-index + builder/test-website/virt-builder/repos.d/libguestfs.conf builder/website/Makefile cat/Makefile csharp/Makefile diff --git a/po/POTFILES-ml b/po/POTFILES-ml index 2c9f5dc..8725e5e 100644 --- a/po/POTFILES-ml +++ b/po/POTFILES-ml @@ -9,6 +9,7 @@ builder/paths.ml builder/pxzcat.ml builder/setlocale.ml builder/sigchecker.ml +builder/sources.ml mllib/common_gettext.ml mllib/common_utils.ml mllib/common_utils_tests.ml diff --git a/run.in b/run.in index f77db95..c804b84 100755 --- a/run.in +++ b/run.in @@ -87,9 +87,9 @@ export LD_LIBRARY_PATH # Make virt-builder use the local website copy to avoid hitting # the network all the time. -if [ -z "$VIRT_BUILDER_SOURCE" ]; then - VIRT_BUILDER_SOURCE="file://$s/builder/website/index.asc" - export VIRT_BUILDER_SOURCE +if [ -z "$XDG_CONFIG_DIRS" ]; then + XDG_CONFIG_DIRS="$b/builder/test-website" + export XDG_CONFIG_DIRS fi # For Perl. -- 1.8.3.1

On Fri, Feb 28, 2014 at 02:27:56PM +0100, Pino Toscano wrote: ACK. Minor fixes to EXTRA_DIST don't need acking on the list. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Fedora Windows cross-compiler. Compile Windows programs, test, and build Windows installers. Over 100 libraries supported. http://fedoraproject.org/wiki/MinGW

Sigchecker can still import keys from the user's keyring, so there is no need to hardcode fingerprint and key of the index hosted on libguestfs.org (which is now pointed to using a .conf file). --- builder/sigchecker.ml | 79 -------------------------------------------------- builder/sigchecker.mli | 2 -- 2 files changed, 81 deletions(-) diff --git a/builder/sigchecker.ml b/builder/sigchecker.ml index 67d1600..ae8e413 100644 --- a/builder/sigchecker.ml +++ b/builder/sigchecker.ml @@ -24,78 +24,6 @@ open Unix let quote = Filename.quote -(* These are the public key and fingerprint belonging to - * Richard W.M. Jones who signs the templates on - * http://libguestfs.org/download/builder. - *) -let default_fingerprint = "F777 4FB1 AD07 4A7E 8C87 67EA 9173 8F73 E1B7 68A0" -let default_pubkey = "\ ------BEGIN PGP PUBLIC KEY BLOCK----- -Version: GnuPG v1.4.14 (GNU/Linux) - -mQINBE6UMMEBEADM811hfTulaF4JpkVpAI10FImyb4ArvOiu8NdcUwTFo+cyWno3 -U85B86H1Bsk/LgLTYtthSrTgsCtdxy+i5OaMjxZDIwKQ2+IYI3FCn9T3Mn28Idyh -kLHzrO9ph0Dv0BNfrlDZhQEC53aAFe/QxN7+A49BNBV7D1VAOOCsHjxMEDzcZkCa -oCrtXw1aNm2vkkj5ukbfukHAyLcQL7kow0qKPSVa1G4lfQP0WiG259Ydy+sUmbVb -TGdb6MEC84PQRDuw6/ZeoV04tn7ZNtQEMOS0uiciHOGfr2hBxQf9VIPNrHg42yaL -dOv51D99GuaxZ9E0HSoH/RwB1oXgd6rFdqVNYaBIQnnkwJANUEeGBArtIOZNCADT -Bt8vkSDm+lLEAFS+V8CACyW/LMIrGCvLdHeqtoAv0GDVyR2GPxldYfdtEmCUMWcb -Jlf71V9iAse2gUdoiHp5FfpGMkA5j7idKuxIws11XxRZJXXbBqiBqmVEAQ/v0m6p -kdo0MYTHydmecLuUK2bAGhpysfX97EfTSrxfrYphYWjTfKRD9GrADeZNfuz1DbKs -7LSqVaQJSjQrfgAwcnZLRaU0V4P5zxiz50gz1Aj3AZRL+Y3meZenzZTXcLFdnusg -wUfhhCuL3tluMtEh6tznumyxb43WO1yLwj6J6LtveiuJN1Z+KSQ6OieZcwARAQAB -tCVSaWNoYXJkIFcuTS4gSm9uZXMgPHJpY2hAYW5uZXhpYS5vcmc+iQI4BBMBAgAi -BQJOlDDBAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRCRc49z4bdooHQY -D/wJLklSZNyXIW+rG5sUbg7j9cTIF5p/lB9kI2yx6KodJp/2knKyvnmzz0gBw/OE -HL4E4UW26oWKo+36I8wkBnuGa6UtANeITcJqFE19VpHEXHsxre64jNQnO8/w748W -1ROW+Ry43xmrlRWKuCm4oPYUzlp0fq9ATAne8eblfG+NOs8DYuA8xZNQzFaI2kDC -QLD4YoXLoNsP27Koga36b0KwxPFD9tyVZiu9XDH/3hMN7Nb15B66PFr+HcMmQ67G -nUIN5ulcIwj38i40cyaTs1VRheOzTHXE/a6Q2AhMKiKqOoEjQ73/mV7cAVoPtM3o -83Q/8aVKBH0bVRwAeV1tju6b14fqKoG0zNBEcXdlSkht6ScxJYIc/LPUxAMDwgSE -OWshjmeRzKXypBbHn/DP8QVyM2gk5wY+mMSH7MpR0p/hgj+rFO8H9L7pC4dCog3E -qzrYhRN+TaP6MPH3WkOwPH4d4IfQRFnHp+VPYPijKEiLrUl/o8k3DyAanAPBpJ/x -na4wXAjlFBctOq6g+SrCUiHpwk7b2YNwGgr5Vl3GmZELzK/G8gg3uJYKQ9Bpv16t -WWOz+IFiOFa0UULeo0QPmFAIMZiDojNsY1SwBKB3ZL1YWZezgMdQAbpze/IXoSt7 -zxWJoKH2jK7q9mvFiaY12l2YnKuCcegWVAViLxRpBnrbz7QmUmljaGFyZCBXLk0u -IEpvbmVzIDxyam9uZXNAcmVkaGF0LmNvbT6JAjgEEwECACIFAk6UOQsCGwMGCwkI -BwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEJFzj3Pht2igIUYQAKomI0edLakahsUQ -MxOZuhBbXJ4/VWF8bXYChDNPKvJp5nB7fBXujJ+39cIUM5fe2ViO6qSDpFC29imx -F5pPbAqspZBPBkLLiZLji8R42hGarntdtTW0UWSBpq+nC5+G1psrnATI3uXGNxKQ -R99c5HoMY7dBC2Y8TCGE64NINZ/XVh472s6IGLPn8MTn26YdRKC9BrVkCFMP2OBr -6D4IprnyTAWAzb68ew20QmyWO+NBi9MplaDNQVl8PIOgfpyWlkgX1z9m67pcSDkw -46hksp0yuOD1VwR4iVZ2/CmIsGRUlx41vWD6BIp9KxKyDIU1CYTRhq72dahHsl/8 -BjCndV5PO0GphqfCzmCv4DXjUwmrMTbH/GFnt5rfwcMcXUgcK0vV9vQ2SOU56Zd1 -fb27ZCFJKZc0Fu8krwFldCp/NYILf6ogUL/C1hfuCGSSuyDVY16Gg3dla1x+6zpF -asnWQlaw8xT5LlMWvTZs5WsoSVHu7dVZWlgxINP++hlZrTz/S8l38yyQ15YFFl3W -9M7dzkegOeDTPfx6B89WgfvfJjA/D0/FYxxWPXEtrn9DlJ4daEJqNsrvfLErz9R8 -4IQmfmhR93j+rdotner+6keC/wVByEfbW1wmXtmFKXQ6srdpj8VKRFrvkyXVgepM -DypLgRH2v7lL2kdWhUu2y4EAgrwzuQINBE6UMMEBEADxQxMgUuDrw5GT4tqARTPI -SSdNcUsRxRhVA8srYOyECliE+B3TwcRDFBs+MyPFJVEuX8fi4eGj/AK5t1GHerfk -orUGlz72q4c7LLhkfZrsuJbk2dgkjvldKJnIazQJa6epGLqdsE5RlmSgwedIbtMd -naGJBQH8aKP/Wi1+wUxsm5N3p7+R2WRx48VfpEhYB+Zf/FkFm1Ycjwh57KQ0+OHw -ykf8VfMisxuH30tDxOCV+VptWKfOF2rDNdaNPWhij2YIjhJXRpkuRR+1PpI4jLaD -JxcVZmG/0zucacupUN2g5OUH59ySU/totD6YMnmp3FONoyF1uIEJo6Vs30npHGkO -XgBo3Pxt7oLJeykLPtdSLgm3cwXIYMWarVsAkKNXitQIVGpVRLeaK373VwmXFqoi -M2SMHeawTUdOORFjpQzkknlJWM1TmUVtHHKt8Pl9+/5+wXKyt2IDdcUkMrB6K5qF -fb7EwVhoI8ehJQK+eeDCjFwCAiwB3iV8JlyW+tEU7JuyXOQlwY1VWm/WqMD8gaRi -rT+RFDFliZ3tQbW2pqUoZBROV5HN4tieDfwxGKCvk6Tsdb30zA9DPQp93+238bYf -312sg9R+CD0AqxoxFG5FJu4HShcPRrPnYtRZqKRe40GDWvBEArXZprwL1qrP+Kl/ -mRrEQpxAGIoFG8HbVvD3EQARAQABiQIfBBgBAgAJBQJOlDDBAhsMAAoJEJFzj3Ph -t2igSLQP/2uIrAY2CDr0kWBJiD3TztiHy8IdxwUpyTBTebwmAbi44/EvtJfIisrG -YjKIEv/w0E61gO7O1JBG4+IG93W+v9fTT/e39JMyxsYqoZZHUhP11Okx5grDS5b0 -O8VXOmXVRMdVNfstRBr10HD9uNDq7ruKD18TxYTwN0GPD4gj1dbHQDR77Tr5cyBs -6Ou5PBOH4r3qcqf/cJUSMeUUu75xLwixux6E7tD2S+t6F07wlWxntUcPtzyAHj20 -J89orUC+dT6r6MypBoI0jdJCp9JPGtR7i+fE5Gm4E5+AUSubLPtZGRY9Um2eMoS2 -DnQpGOKx1VvsixR/Kw44j2tRAvmYMS4iDKcuZU+nZ+xokAgObILj/b9n/Qe2/fXy -CFdcgSvbm+dV1fZxsdMF/P9OU8aqdT9A9Fv5y+cDMEg4DVnhwMJTxGh/TCkw/H+A -frHEtRc98lSQN5odpITNG17mG6JOdHM+wA57qHH0uy4+5RsbyAJahcdBcmObK/RF -i4WZlThpbHftX5O/LH98aYQ2fJayIxv1EAjzOBOQ0MfBHI0KCJR1pysEisX28sJA -Ic73gnJJ3BLZbqfBRgxjNMNroxC+5Tw6uPGFHa3YnuIAxxw0HcDVZ9vnTWBWFPGw -ZvXkQ3FVJwZoLmHw47vvlVpLD/4gi1SuHWieRvZ+UdDq00E348pm -=neBW ------END PGP PUBLIC KEY BLOCK----- -" - type gpgkey_type = | No_Key | Fingerprint of string @@ -162,13 +90,6 @@ let rec create ~debug ~gpg ~gpgkey ~check_signature = | _ -> () ) status; !fingerprint - | Fingerprint fp when equal_fingerprints default_fingerprint fp -> - let filename, chan = Filename.open_temp_file "vbpubkey" ".asc" in - unlink_on_exit filename; - output_string chan default_pubkey; - close_out chan; - ignore (import_keyfile gpg tmpdir debug filename); - fp | Fingerprint fp -> let filename = Filename.temp_file "vbpubkey" ".asc" in unlink_on_exit filename; diff --git a/builder/sigchecker.mli b/builder/sigchecker.mli index ab44a5c..8c6ba7f 100644 --- a/builder/sigchecker.mli +++ b/builder/sigchecker.mli @@ -16,8 +16,6 @@ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. *) -val default_fingerprint : string - type t type gpgkey_type = -- 1.8.3.1