Fix: Enforce effective repository trust preflight
This commit is contained in:
Gabriel Brown
+163
-24
@@ -294,6 +294,36 @@ _ini_section_count() {
|
||||
' "$file"
|
||||
}
|
||||
|
||||
_ini_key_occurrence_count() {
|
||||
local file="$1" wanted_section="$2" wanted_key="$3"
|
||||
awk -v wanted_section="$wanted_section" -v wanted_key="$wanted_key" '
|
||||
function trim(value) {
|
||||
sub(/^[[:space:]]+/, "", value)
|
||||
sub(/[[:space:]]+$/, "", value)
|
||||
return value
|
||||
}
|
||||
{
|
||||
sub(/\r$/, "")
|
||||
line = trim($0)
|
||||
if (line == "" || line ~ /^[#;]/) next
|
||||
if (line ~ /^\[[^]]+\]$/) {
|
||||
section = substr(line, 2, length(line) - 2)
|
||||
next
|
||||
}
|
||||
if (tolower(section) != tolower(wanted_section)) next
|
||||
equals = index(line, "=")
|
||||
if (equals > 0) {
|
||||
key = trim(substr(line, 1, equals - 1))
|
||||
} else {
|
||||
split(line, words, /[[:space:]]+/)
|
||||
key = words[1]
|
||||
}
|
||||
if (tolower(key) == tolower(wanted_key)) count++
|
||||
}
|
||||
END { print count + 0 }
|
||||
' "$file"
|
||||
}
|
||||
|
||||
_restore_repository_file() {
|
||||
local existed="$1" backup="$2" mode="$3" destination="$4"
|
||||
if (( existed )); then
|
||||
@@ -346,29 +376,107 @@ _publish_repository_pair() {
|
||||
return "$status"
|
||||
}
|
||||
|
||||
_terra_repository_is_trusted() {
|
||||
local repo_file baseurl enabled gpgcheck repo_gpgcheck gpgkey local_key
|
||||
repo_file="$PANAMA_SYSTEM_ETC/yum.repos.d/terra.repo"
|
||||
[[ -f "$repo_file" ]] || return 1
|
||||
baseurl="$(_ini_value "$repo_file" terra baseurl)" || return 1
|
||||
enabled="$(_ini_value "$repo_file" terra enabled)" || return 1
|
||||
gpgcheck="$(_ini_value "$repo_file" terra gpgcheck)" || return 1
|
||||
repo_gpgcheck="$(_ini_value "$repo_file" terra repo_gpgcheck)" || return 1
|
||||
gpgkey="$(_ini_value "$repo_file" terra gpgkey)" || return 1
|
||||
[[ "$baseurl" == "${INSTALLER_PROVENANCE[TERRA_BASEURL]}" \
|
||||
&& "$enabled" == 1 && "$gpgcheck" == 1 && "$repo_gpgcheck" == 1 \
|
||||
&& "$gpgkey" == 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama' ]] || return 1
|
||||
_effective_terra_key() {
|
||||
awk -v reviewed_baseurl="${INSTALLER_PROVENANCE[TERRA_BASEURL]}" '
|
||||
function reset_block() {
|
||||
delete values
|
||||
delete seen
|
||||
in_block = 0
|
||||
id = ""
|
||||
}
|
||||
function finish_block( key) {
|
||||
if (!in_block) return
|
||||
if (seen["enabled"] != 1) {
|
||||
bad = 1
|
||||
return
|
||||
}
|
||||
if (values["enabled"] != "1") return
|
||||
enabled_count++
|
||||
if (id != "terra") bad = 1
|
||||
for (key in required) {
|
||||
if (seen[key] != 1) bad = 1
|
||||
}
|
||||
if (values["baseurl"] != reviewed_baseurl || values["metalink"] != "" \
|
||||
|| values["mirrorlist"] != "" || values["gpgcheck"] != "1" \
|
||||
|| values["pkg_gpgcheck"] != "1" || values["repo_gpgcheck"] != "1" \
|
||||
|| values["gpgkey"] != "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama") bad = 1
|
||||
trusted_key = values["gpgkey"]
|
||||
}
|
||||
BEGIN {
|
||||
split("enabled baseurl metalink mirrorlist gpgcheck pkg_gpgcheck repo_gpgcheck gpgkey", fields)
|
||||
for (field_index in fields) required[fields[field_index]] = 1
|
||||
reset_block()
|
||||
}
|
||||
/^======== ".*" repository configuration: ========$/ {
|
||||
finish_block()
|
||||
reset_block()
|
||||
id = $0
|
||||
sub(/^======== "/, "", id)
|
||||
sub(/" repository configuration: ========$/, "", id)
|
||||
if (id == "" || id !~ /^terra/) bad = 1
|
||||
in_block = 1
|
||||
next
|
||||
}
|
||||
{
|
||||
if (!in_block || $0 == "") next
|
||||
separator = index($0, " = ")
|
||||
if (separator > 0) {
|
||||
key = substr($0, 1, separator - 1)
|
||||
if (key in required) {
|
||||
seen[key]++
|
||||
values[key] = substr($0, separator + 3)
|
||||
}
|
||||
} else if ($0 == "mirrorlist") {
|
||||
seen["mirrorlist"]++
|
||||
values["mirrorlist"] = ""
|
||||
}
|
||||
}
|
||||
END {
|
||||
finish_block()
|
||||
if (bad || enabled_count > 1) exit 2
|
||||
if (enabled_count == 0) exit 1
|
||||
print trusted_key
|
||||
}
|
||||
'
|
||||
}
|
||||
|
||||
# Status 0 is one trusted effective Terra identity, 1 is no enabled Terra
|
||||
# identity, and 2 is an unsafe, duplicated, or unreadable effective state.
|
||||
_terra_effective_status() {
|
||||
local dump gpgkey parse_status=0 local_key
|
||||
dump="$(dnf --quiet --no-plugins --dump-repo-config='terra*')" || return 2
|
||||
gpgkey="$(printf '%s\n' "$dump" | _effective_terra_key)" || parse_status=$?
|
||||
(( parse_status == 0 )) || return "$parse_status"
|
||||
[[ "$gpgkey" == 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama' ]] || return 2
|
||||
local_key="$PANAMA_SYSTEM_ETC/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama"
|
||||
[[ -f "$local_key" ]] || return 1
|
||||
[[ -f "$local_key" ]] || return 2
|
||||
key_fingerprint_matches "$PANAMA_PATH/setup/provenance/keys/terra44.asc" \
|
||||
"${INSTALLER_PROVENANCE[TERRA_FINGERPRINT]}" \
|
||||
&& key_fingerprint_matches "$local_key" \
|
||||
"${INSTALLER_PROVENANCE[TERRA_FINGERPRINT]}"
|
||||
"${INSTALLER_PROVENANCE[TERRA_FINGERPRINT]}" \
|
||||
|| return 2
|
||||
}
|
||||
|
||||
TERRA_TRUST_FAILURE_STATUS=78
|
||||
|
||||
preflight_terra_trust() {
|
||||
local status=0
|
||||
_require_policy_value TERRA_BASEURL 'https://repos.fyralabs.com/terra44' \
|
||||
|| return "$TERRA_TRUST_FAILURE_STATUS"
|
||||
_require_policy_value TERRA_FINGERPRINT AE09157A4DE88B497EA1D5D300CDAB43DE226D6F \
|
||||
|| return "$TERRA_TRUST_FAILURE_STATUS"
|
||||
_terra_effective_status || status=$?
|
||||
if (( status == 0 || status == 1 )); then
|
||||
return 0
|
||||
fi
|
||||
log "Effective Terra repository configuration is not trusted; refusing all package work"
|
||||
return "$TERRA_TRUST_FAILURE_STATUS"
|
||||
}
|
||||
|
||||
# Status 0 is trusted, 1 is absent, and 2 is present but untrusted or malformed.
|
||||
_flathub_remote_status() {
|
||||
local config section_count url gpg_verify summary_verify disabled disabled_status
|
||||
local alternate_key_count
|
||||
config="$PANAMA_SYSTEM_FLATPAK_REPO/config"
|
||||
[[ -f "$config" ]] || return 1
|
||||
section_count="$(_ini_section_count "$config" 'remote "flathub"')" || return 2
|
||||
@@ -387,6 +495,11 @@ _flathub_remote_status() {
|
||||
elif (( disabled_status != 1 )); then
|
||||
return 2
|
||||
fi
|
||||
alternate_key_count="$(_ini_key_occurrence_count "$config" 'remote "flathub"' gpgkeypath)" \
|
||||
|| return 2
|
||||
# The reviewed default keyring is the only permitted trust source. Empty,
|
||||
# duplicate, malformed, and nonempty alternate paths all fail closed.
|
||||
(( alternate_key_count == 0 )) || return 2
|
||||
[[ -f "$PANAMA_SYSTEM_FLATPAK_REPO/flathub.trustedkeys.gpg" ]] || return 2
|
||||
key_fingerprint_matches "$PANAMA_SYSTEM_FLATPAK_REPO/flathub.trustedkeys.gpg" \
|
||||
"${INSTALLER_PROVENANCE[FLATHUB_FINGERPRINT]}" || return 2
|
||||
@@ -428,17 +541,21 @@ install_rpmfusion_repositories() {
|
||||
}
|
||||
|
||||
install_terra_repository() {
|
||||
local work staged_key staged_repo status
|
||||
local work staged_key staged_repo status effective_status=0
|
||||
require_reviewed_fedora_release || return 1
|
||||
_require_policy_value TERRA_BASEURL 'https://repos.fyralabs.com/terra44' || return 1
|
||||
_require_policy_value TERRA_FINGERPRINT AE09157A4DE88B497EA1D5D300CDAB43DE226D6F || return 1
|
||||
_terra_effective_status || effective_status=$?
|
||||
if (( effective_status == 0 )); then
|
||||
log "Terra repository already configured and verified"
|
||||
return 0
|
||||
elif (( effective_status != 1 )); then
|
||||
log "Effective Terra repository configuration is not trusted"
|
||||
return "$TERRA_TRUST_FAILURE_STATUS"
|
||||
fi
|
||||
if rpm -q terra-release >/dev/null 2>&1; then
|
||||
if _terra_repository_is_trusted; then
|
||||
log "Terra repository already installed and verified"
|
||||
return 0
|
||||
fi
|
||||
log "Installed Terra repository does not match Panama's reviewed trust policy"
|
||||
return 1
|
||||
log "terra-release is installed without one trusted enabled Terra repository"
|
||||
return "$TERRA_TRUST_FAILURE_STATUS"
|
||||
fi
|
||||
work="$(mktemp -d)" || return 1
|
||||
chmod 0700 "$work"
|
||||
@@ -472,8 +589,10 @@ install_terra_repository() {
|
||||
if (( status == 0 )); then
|
||||
sudo install -m 0644 "$staged_repo" /etc/yum.repos.d/terra.repo || status=$?
|
||||
fi
|
||||
if (( status == 0 )) && ! _terra_repository_is_trusted; then
|
||||
status=1
|
||||
if (( status == 0 )); then
|
||||
effective_status=0
|
||||
_terra_effective_status || effective_status=$?
|
||||
(( effective_status == 0 )) || status="$TERRA_TRUST_FAILURE_STATUS"
|
||||
fi
|
||||
rm -rf -- "$work"
|
||||
return "$status"
|
||||
@@ -513,7 +632,7 @@ configure_hyprland_repository() {
|
||||
|
||||
ensure_flathub_remote() {
|
||||
local work descriptor encoded key_file url no_gpg_verify gpg_verify
|
||||
local status remote_status no_gpg_status gpg_status
|
||||
local alternate_key_count status remote_status no_gpg_status gpg_status
|
||||
require_reviewed_fedora_release || return 1
|
||||
_require_policy_value FLATHUB_DESCRIPTOR_URL 'https://flathub.org/repo/flathub.flatpakrepo' || return 1
|
||||
_require_policy_value FLATHUB_DESCRIPTOR_MAX_BYTES 1048576 || return 1
|
||||
@@ -556,6 +675,12 @@ ensure_flathub_remote() {
|
||||
rm -rf -- "$work"
|
||||
return 1
|
||||
fi
|
||||
alternate_key_count="$(_ini_key_occurrence_count "$descriptor" 'Flatpak Repo' GPGKeyPath)" \
|
||||
|| alternate_key_count=1
|
||||
if (( alternate_key_count != 0 )); then
|
||||
rm -rf -- "$work"
|
||||
return 1
|
||||
fi
|
||||
if ! key_fingerprint_matches "$key_file" "${INSTALLER_PROVENANCE[FLATHUB_FINGERPRINT]}"; then
|
||||
rm -rf -- "$work"
|
||||
return 1
|
||||
@@ -648,6 +773,20 @@ install_claude_desktop_if_trusted() {
|
||||
# RPM Fusion, no Terra, no COPR, no multimedia, no flatpaks: those exist for a
|
||||
# desktop, and every one of them is a network dependency and a failure mode a
|
||||
# headless machine has no reason to carry.
|
||||
if [[ "${1:-}" == --trust-preflight ]]; then
|
||||
if preflight_terra_trust; then
|
||||
exit 0
|
||||
else
|
||||
exit $?
|
||||
fi
|
||||
fi
|
||||
|
||||
# Repeat the enclosing installer's early preflight at the package boundary so
|
||||
# a repository change made after startup cannot reach this stage's first DNF.
|
||||
if ! preflight_terra_trust; then
|
||||
exit "$TERRA_TRUST_FAILURE_STATUS"
|
||||
fi
|
||||
|
||||
if [[ "$ROLE" == server ]]; then
|
||||
echo -e "\n--- Installing packages (server) ---"
|
||||
log "Updating all packages. This may take a while"
|
||||
|
||||
Reference in New Issue
Block a user