gib/Panama
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

WIP: Paused over-hardening fix wave (boot checkout verification, double-read package manifest)

Browse Source
This commit is contained in:
Gabriel Brown
2026-09-17 11:43:30 -04:00
parent 28e387868f
commit 442eec19fa
15 changed files with 2553 additions and 326 deletions
Download Patch File Download Diff File Expand all files Collapse all files
setup/lib/artifact-provenance
+47 -29
View File
@@ -7,26 +7,36 @@
declare -gA INSTALLER_PROVENANCE=()
_primary_key_fingerprints() (
local home
home="$(mktemp -d)" || exit 1
chmod 700 "$home"
trap 'rm -rf -- "$home"' EXIT
local home="" gpg_output
trap '[[ -z "$home" ]] || rm -rf -- "$home"' EXIT
trap 'exit 130' INT
trap 'exit 143' TERM
GNUPGHOME="$home" gpg --batch --with-colons --import-options show-only --import "$1" 2>/dev/null \
| awk -F: '$1 == "pub" { primary = 1; next } primary && $1 == "fpr" { print $10; primary = 0 }'
home="$(mktemp -u -d -t panama-gpg.XXXXXX)" || exit 1
if ! mkdir -m 700 -- "$home"; then
home=""
exit 1
fi
gpg_output="$(GNUPGHOME="$home" gpg --batch --with-colons \
--import-options show-only --import "$1" 2>/dev/null)" || exit 1
awk -F: '$1 == "pub" { primary = 1; next } primary && $1 == "fpr" { print $10; primary = 0 }' \
<<<"$gpg_output"
)
key_fingerprint_matches() {
local file="$1" expected="$2"
local file="$1" expected="$2" output
local -a primary_fingerprints=()
mapfile -t primary_fingerprints < <(_primary_key_fingerprints "$file")
output="$(_primary_key_fingerprints "$file")" || return 1
[[ -n "$output" ]] || return 1
mapfile -t primary_fingerprints <<<"$output"
[[ ${#primary_fingerprints[@]} -eq 1 && "${primary_fingerprints[0]}" == "$expected" ]]
}
_key_has_one_primary() {
local output
local -a primary_fingerprints=()
mapfile -t primary_fingerprints < <(_primary_key_fingerprints "$1")
output="$(_primary_key_fingerprints "$1")" || return 1
[[ -n "$output" ]] || return 1
mapfile -t primary_fingerprints <<<"$output"
[[ ${#primary_fingerprints[@]} -eq 1 ]]
}
@@ -34,11 +44,15 @@ verify_detached_signature() {
local key="$1" signature="$2" content="$3" home
_key_has_one_primary "$key" || return 1
(
home="$(mktemp -d)" || exit 1
chmod 700 "$home"
trap 'rm -rf -- "$home"' EXIT
home=""
trap '[[ -z "$home" ]] || rm -rf -- "$home"' EXIT
trap 'exit 130' INT
trap 'exit 143' TERM
home="$(mktemp -u -d -t panama-gpg.XXXXXX)" || exit 1
if ! mkdir -m 700 -- "$home"; then
home=""
exit 1
fi
GNUPGHOME="$home" gpg --batch --quiet --import "$key" >/dev/null 2>&1 \
&& GNUPGHOME="$home" gpg --batch --verify "$signature" "$content" >/dev/null 2>&1
)
@@ -60,7 +74,11 @@ download_sha256() {
[[ "$max_bytes" =~ ^[1-9][0-9]*$ ]] || exit 1
[[ -n "$destination" && -d "$directory" ]] || exit 1
umask 077
part="$(mktemp "$directory/.${filename}.part.XXXXXX")" || exit 1
part="$(mktemp -u "$directory/.${filename}.part.XXXXXX")" || exit 1
if ! (set -o noclobber; : >"$part") 2>/dev/null; then
part=""
exit 1
fi
curl --fail --location --connect-timeout 10 --max-time 600 \
--max-filesize "$max_bytes" --output "$part" "$url" \
|| exit 1
@@ -71,25 +89,25 @@ download_sha256() {
)
}
rpm_signature_matches() {
local package="$1" key="$2" expected="$3" home db output status
rpm_signature_matches() (
local package="$1" key="$2" expected="$3" home="" db output
trap '[[ -z "$home" ]] || rm -rf -- "$home"' EXIT
trap 'exit 130' INT
trap 'exit 143' TERM
key_fingerprint_matches "$key" "$expected" || return 1
home="$(mktemp -d)" || return 1
chmod 700 "$home"
key_fingerprint_matches "$key" "$expected" || exit 1
home="$(mktemp -u -d -t panama-rpm-signature.XXXXXX)" || exit 1
if ! mkdir -m 700 -- "$home"; then
home=""
exit 1
fi
db="$home/rpmdb"
mkdir -m 700 "$db" || {
rm -rf -- "$home"
return 1
}
rpmkeys --dbpath "$db" --import "$key" >/dev/null 2>&1 \
&& output="$(rpmkeys --dbpath "$db" --checksig --verbose "$package" 2>&1)"
status=$?
rm -rf -- "$home"
(( status == 0 )) || return 1
mkdir -m 700 "$db" || exit 1
rpmkeys --dbpath "$db" --import "$key" >/dev/null 2>&1 || exit 1
output="$(rpmkeys --dbpath "$db" --checksig --verbose "$package" 2>&1)" \
|| exit 1
grep -Eqi 'OpenPGP.*signature.*: OK' <<<"$output"
}
)
load_installer_provenance() {
local file="$1" line name value required