1# 2# SPDX-License-Identifier: GPL-2.0-only 3# 4 5"""Helper module for GPG signing""" 6import os 7 8import bb 9import subprocess 10import shlex 11 12class LocalSigner(object): 13 """Class for handling local (on the build host) signing""" 14 def __init__(self, d): 15 self.gpg_bin = d.getVar('GPG_BIN') or \ 16 bb.utils.which(os.getenv('PATH'), 'gpg') 17 self.gpg_cmd = [self.gpg_bin] 18 self.gpg_agent_bin = bb.utils.which(os.getenv('PATH'), "gpg-agent") 19 # Without this we see "Cannot allocate memory" errors when running processes in parallel 20 # It needs to be set for any gpg command since any agent launched can stick around in memory 21 # and this parameter must be set. 22 if self.gpg_agent_bin: 23 self.gpg_cmd += ["--agent-program=%s|--auto-expand-secmem" % (self.gpg_agent_bin)] 24 self.gpg_path = d.getVar('GPG_PATH') 25 self.rpm_bin = bb.utils.which(os.getenv('PATH'), "rpmsign") 26 self.gpg_version = self.get_gpg_version() 27 28 29 def export_pubkey(self, output_file, keyid, armor=True): 30 """Export GPG public key to a file""" 31 cmd = self.gpg_cmd + ["--no-permission-warning", "--batch", "--yes", "--export", "-o", output_file] 32 if self.gpg_path: 33 cmd += ["--homedir", self.gpg_path] 34 if armor: 35 cmd += ["--armor"] 36 cmd += [keyid] 37 subprocess.check_output(cmd, stderr=subprocess.STDOUT) 38 39 def sign_rpms(self, files, keyid, passphrase, digest, sign_chunk, fsk=None, fsk_password=None): 40 """Sign RPM files""" 41 42 cmd = self.rpm_bin + " --addsign --define '_gpg_name %s' " % keyid 43 gpg_args = '--no-permission-warning --batch --passphrase=%s --agent-program=%s|--auto-expand-secmem' % (passphrase, self.gpg_agent_bin) 44 if self.gpg_version > (2,1,): 45 gpg_args += ' --pinentry-mode=loopback' 46 cmd += "--define '_gpg_sign_cmd_extra_args %s' " % gpg_args 47 cmd += "--define '_binary_filedigest_algorithm %s' " % digest 48 if self.gpg_bin: 49 cmd += "--define '__gpg %s' " % self.gpg_bin 50 if self.gpg_path: 51 cmd += "--define '_gpg_path %s' " % self.gpg_path 52 if fsk: 53 cmd += "--signfiles --fskpath %s " % fsk 54 if fsk_password: 55 cmd += "--define '_file_signing_key_password %s' " % fsk_password 56 57 # Sign in chunks 58 for i in range(0, len(files), sign_chunk): 59 subprocess.check_output(shlex.split(cmd + ' '.join(files[i:i+sign_chunk])), stderr=subprocess.STDOUT) 60 61 def detach_sign(self, input_file, keyid, passphrase_file, passphrase=None, armor=True): 62 """Create a detached signature of a file""" 63 64 if passphrase_file and passphrase: 65 raise Exception("You should use either passphrase_file of passphrase, not both") 66 67 cmd = self.gpg_cmd + ['--detach-sign', '--no-permission-warning', '--batch', 68 '--no-tty', '--yes', '--passphrase-fd', '0', '-u', keyid] 69 70 if self.gpg_path: 71 cmd += ['--homedir', self.gpg_path] 72 if armor: 73 cmd += ['--armor'] 74 75 #gpg > 2.1 supports password pipes only through the loopback interface 76 #gpg < 2.1 errors out if given unknown parameters 77 if self.gpg_version > (2,1,): 78 cmd += ['--pinentry-mode', 'loopback'] 79 80 cmd += [input_file] 81 82 try: 83 if passphrase_file: 84 with open(passphrase_file) as fobj: 85 passphrase = fobj.readline(); 86 87 job = subprocess.Popen(cmd, stdin=subprocess.PIPE, stderr=subprocess.PIPE) 88 (_, stderr) = job.communicate(passphrase.encode("utf-8")) 89 90 if job.returncode: 91 bb.fatal("GPG exited with code %d: %s" % (job.returncode, stderr.decode("utf-8"))) 92 93 except IOError as e: 94 bb.error("IO error (%s): %s" % (e.errno, e.strerror)) 95 raise Exception("Failed to sign '%s'" % input_file) 96 97 except OSError as e: 98 bb.error("OS error (%s): %s" % (e.errno, e.strerror)) 99 raise Exception("Failed to sign '%s" % input_file) 100 101 102 def get_gpg_version(self): 103 """Return the gpg version as a tuple of ints""" 104 try: 105 cmd = self.gpg_cmd + ["--version", "--no-permission-warning"] 106 ver_str = subprocess.check_output(cmd).split()[2].decode("utf-8") 107 return tuple([int(i) for i in ver_str.split("-")[0].split('.')]) 108 except subprocess.CalledProcessError as e: 109 bb.fatal("Could not get gpg version: %s" % e) 110 111 112 def verify(self, sig_file): 113 """Verify signature""" 114 cmd = self.gpg_cmd + [" --verify", "--no-permission-warning"] 115 if self.gpg_path: 116 cmd += ["--homedir", self.gpg_path] 117 118 cmd += [sig_file] 119 status = subprocess.call(cmd) 120 ret = False if status else True 121 return ret 122 123 124def get_signer(d, backend): 125 """Get signer object for the specified backend""" 126 # Use local signing by default 127 if backend == 'local': 128 return LocalSigner(d) 129 else: 130 bb.fatal("Unsupported signing backend '%s'" % backend) 131