gib/Panama
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix: Isolate installer GPG inspection

Browse Source
This commit is contained in:
Gabriel Brown
2026-08-27 06:05:42 -04:00
parent 94a4314730
commit 18ecc2244f
2 changed files with 36 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
setup/lib/artifact-provenance
+18 -10
View File
@@ -6,10 +6,16 @@
declare -gA INSTALLER_PROVENANCE=()
_primary_key_fingerprints() {
gpg --batch --with-colons --import-options show-only --import "$1" 2>/dev/null \
_primary_key_fingerprints() (
local home
home="$(mktemp -d)" || exit 1
chmod 700 "$home"
trap 'rm -rf -- "$home"' EXIT
trap 'exit 130' INT
trap 'exit 143' TERM
GNUPGHOME="$home" gpg --batch --with-colons --import-options show-only --import "$1" 2>/dev/null \
| awk -F: '$1 == "pub" { primary = 1; next } primary && $1 == "fpr" { print $10; primary = 0 }'
}
)
key_fingerprint_matches() {
local file="$1" expected="$2"
@@ -27,13 +33,15 @@ _key_has_one_primary() {
verify_detached_signature() {
local key="$1" signature="$2" content="$3" home
_key_has_one_primary "$key" || return 1
home="$(mktemp -d)" || return 1
chmod 700 "$home"
GNUPGHOME="$home" gpg --batch --quiet --import "$key" >/dev/null 2>&1 \
&& GNUPGHOME="$home" gpg --batch --verify "$signature" "$content" >/dev/null 2>&1
local status=$?
rm -rf -- "$home"
return "$status"
(
home="$(mktemp -d)" || exit 1
chmod 700 "$home"
trap 'rm -rf -- "$home"' EXIT
trap 'exit 130' INT
trap 'exit 143' TERM
GNUPGHOME="$home" gpg --batch --quiet --import "$key" >/dev/null 2>&1 \
&& GNUPGHOME="$home" gpg --batch --verify "$signature" "$content" >/dev/null 2>&1
)
}
download_sha256() {