You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

130 lines
5.7 KiB

diff -up yum-3.4.3/docs/yum.conf.5.orig yum-3.4.3/docs/yum.conf.5
--- yum-3.4.3/docs/yum.conf.5.orig 2017-03-23 13:48:19.700471026 +0100
+++ yum-3.4.3/docs/yum.conf.5 2017-03-23 13:48:21.455461060 +0100
@@ -105,6 +105,31 @@ signature check on the repodata. When th
default for all repositories. The default is `0'.
.IP
+\fBpayload_gpgcheck\fR
+Either `1' or `0'. This tells yum whether or not it should also perform a GPG
+signature check on the payload (part of a package holding the actual files that
+comprise the package).
+
+By default, yum only performs GPG signature checks on package headers.
+Thus, if the payload data has been tampered with or corrupted, yum will fail in
+the middle of the transaction due to an RPM unpacking error, after some
+unverified scriptlets might have already run, and possibly leave the package in
+question partly installed.
+
+To prevent all of that, you can enable this option to extend the signature
+check to also include the payload, so that yum can avoid running the
+transaction in case of payload corruption.
+This slightly improves security, however at the expense of significantly
+increased transaction time, so you may want to only use this option when
+package corruption is a concern.
+
+For this option to have effect, make sure to also enable gpgcheck (or
+localpkg_gpgcheck for local packages).
+
+When this option is set in the [main] section it sets the default for all
+repositories. The default is `0'.
+
+.IP
\fBskip_broken\fR
Either `1' or `0'. Resolve depsolve problems by removing packages that
are causing problems from the transaction.
diff -up yum-3.4.3/rpmUtils/miscutils.py.orig yum-3.4.3/rpmUtils/miscutils.py
--- yum-3.4.3/rpmUtils/miscutils.py.orig 2011-06-28 22:27:22.000000000 +0200
+++ yum-3.4.3/rpmUtils/miscutils.py 2017-03-23 13:48:21.455461060 +0100
@@ -58,11 +58,16 @@ def compareVerOnly(v1, v2):
"""compare version strings only using rpm vercmp"""
return compareEVR(('', v1, ''), ('', v2, ''))
-def checkSig(ts, package):
- """Takes a transaction set and a package, check it's sigs,
+def checkSig(ts, package, payload=False):
+ """Takes a transaction set and a package, check it's sigs.
+
+ By default, only RPMv4 sigs (header-only) will be verified (faster). By
+ setting payload to True, RPMv3 sigs (header+payload) will also be verified
+ (slower).
+
return 0 if they are all fine
return 1 if the gpg key can't be found
- return 2 if the header is in someway damaged
+ return 2 if the header or payload is in someway damaged
return 3 if the key is not trusted
return 4 if the pkg is not gpg or pgp signed"""
@@ -89,6 +94,24 @@ def checkSig(ts, package):
else:
del hdr
+ # Don't perform the payload check if the header check failed, otherwise we
+ # could mask the reason stored in "value" (we only return one integer from
+ # this function and shouldn't change that).
+ if payload and value == 0:
+ os.lseek(fdno, 0, 0)
+ # We don't want the OK message to pollute the output but we do want the
+ # BAD message (verbose version) in case of a failure, which is only
+ # possible by running _verifySigs() twice (temporary hack until we have
+ # the proper API for payload verification in RPM).
+ rpm.setVerbosity(rpm.RPMLOG_WARNING)
+ valid = ts._verifySigs(fdno, package)
+ if not valid:
+ value = 2
+ os.lseek(fdno, 0, 0)
+ rpm.setVerbosity(rpm.RPMLOG_INFO)
+ ts._verifySigs(fdno, package)
+ rpm.setVerbosity(rpm.RPMLOG_NOTICE)
+
try:
os.close(fdno)
except OSError, e: # if we're not opened, don't scream about it
diff -up yum-3.4.3/rpmUtils/transaction.py.orig yum-3.4.3/rpmUtils/transaction.py
--- yum-3.4.3/rpmUtils/transaction.py.orig 2017-03-23 13:48:19.441472497 +0100
+++ yum-3.4.3/rpmUtils/transaction.py 2017-03-23 13:48:21.455461060 +0100
@@ -35,7 +35,8 @@ class TransactionWrapper:
'setProbFilter',
'hdrFromFdno',
'next',
- 'clean']
+ 'clean',
+ '_verifySigs']
self.tsflags = []
self.open = True
diff -up yum-3.4.3/yum/config.py.orig yum-3.4.3/yum/config.py
--- yum-3.4.3/yum/config.py.orig 2017-03-23 13:48:19.701471020 +0100
+++ yum-3.4.3/yum/config.py 2017-03-23 13:48:21.456461055 +0100
@@ -46,6 +46,7 @@ from misc import get_uuid, read_in_items
# Alter/patch these to change the default checking...
__pkgs_gpgcheck_default__ = False
__repo_gpgcheck_default__ = False
+__payload_gpgcheck_default__ = False
__main_multilib_policy_default__ = 'all'
__main_failovermethod_default__ = 'roundrobin'
__main_installonly_limit_default__ = 0
@@ -786,6 +787,7 @@ class YumConf(StartupConf):
gpgcheck = BoolOption(__pkgs_gpgcheck_default__)
repo_gpgcheck = BoolOption(__repo_gpgcheck_default__)
localpkg_gpgcheck = BoolOption(__pkgs_gpgcheck_default__)
+ payload_gpgcheck = BoolOption(__payload_gpgcheck_default__)
obsoletes = BoolOption(True)
showdupesfromrepos = BoolOption(False)
enabled = BoolOption(True)
diff -up yum-3.4.3/yum/__init__.py.orig yum-3.4.3/yum/__init__.py
--- yum-3.4.3/yum/__init__.py.orig 2017-03-23 13:48:19.731470850 +0100
+++ yum-3.4.3/yum/__init__.py 2017-03-23 13:48:21.456461055 +0100
@@ -2755,7 +2755,9 @@ much more problems).
if check:
ts = self.rpmdb.readOnlyTS()
- sigresult = rpmUtils.miscutils.checkSig(ts, po.localPkg())
+ sigresult = rpmUtils.miscutils.checkSig(
+ ts, po.localPkg(), payload=self.conf.payload_gpgcheck,
+ )
localfn = os.path.basename(po.localPkg())
if sigresult == 0: