Commit 89a603a1 authored by Alad Wenter's avatar Alad Wenter
Browse files

build: sign files in $var_tmp

If package builds are skipped (because the names are already in the
local repository, create_package=0), but the signatures are sparse,
running `gpg` in `$var_tmp` ensures that the build user (--user) always
has write access, and that `gpg` does not operate directly on the local
repository. [1]

Furthermore, only write to the result file after the packages were moved
successfully to the local repository (`create_package=1`).

[1] The multiple cases that need to be considered are formulated in the
    small proof below.

%<---------
let $PWD == $var_tmp, $db_root != $var_tmp,
    $p absolute path to package, $p_base = basename $p

assumption: --sign not specified to makepkg (otherwise, $var_tmp already contains a signature)

package existing, signature in local repo
we have:
  ! -f $p_base.sig    => ! -f $p_base.sig   [preserve signature]
    -f $p.sig
  ! -f $p_base
    -f $p

package existing, no signature in local repo
we have:
  ! -f $p_base.sig    =>   -f $p_base.sig   [write new signature]
  ! -f $p.sig
  ! -f $p_base
    -f $p

new package was built, basename identical to entry in local repo (--rebuild)
we have:
  ! -f $p_base.sig    =>   -f $p_base.sig
    -f $p.sig
    -f $p_base
    -f $p

new package was built, basename does not exist in local repo
we have:
  ! -f $p_base.sig    =>   -f $p_base.sig
  ! -f $p.sig
    -f $p_base
  ! -f $p
parent 4e6c74ee
......@@ -443,32 +443,39 @@ while IFS= read -ru "$fd" path; do
run_msg 3 as_user makepkg "${makepkg_common_args[@]}" "${makepkg_args[@]}"
fi
cd_safe "$var_tmp"
pkglist=(!(*.sig)) # discard makepkg --sign from package list (#410)
if [[ -v results_file ]]; then
printf "build:file://${db_path%/*}/%s\n" "${pkglist[@]}" | \
as_user tee -a "$results_file" >/dev/null
fi
# Discard makepkg --sign output from package list (#410)
pkglist=("$var_tmp"/!(*.sig))
fi
# Sign any packages without signatures, even if the packages are existing.
# In the latter case, $pkglist will contain absolute paths.
# This is done in the temporary directory (write access for build user).
cd_safe "$var_tmp"
siglist=()
for p in "${pkglist[@]}"; do
if [[ -f $p.sig ]]; then
printf >&2 '%q\n' "$p.sig"
siglist+=("$p".sig)
p_name=${p##*/} # package basename
# Move any existing signatures from makepkg --sign.
if [[ -f $p_name.sig ]]; then
siglist+=("$p_name".sig)
elif (( sign_pkg )); then
as_user gpg "${gpg_args[@]}" --output "$p".sig "$p"
siglist+=("$p".sig)
# Otherwise, sign the package if there is no signature in the local
# repository, OR the package was built successfully.
elif (( sign_pkg )) && { [[ ! -f $db_root/$p_name.sig ]] || [[ -f $p_name ]]; }; then
as_user gpg "${gpg_args[@]}" --output "$p_name".sig "$p"
siglist+=("$p_name".sig)
fi
done
if (( ${#siglist[@]} )); then
mv -f "${siglist[@]}" "$db_root"
fi
if (( create_package )); then
mv -f "${pkglist[@]}" "${siglist[@]}" "$db_root"
mv -f "${pkglist[@]}" "$db_root"
if [[ -v results_file ]]; then
printf "build:file://$db_root/%s\n" "${pkglist[@]}" | as_user tee -a "$results_file" >/dev/null
fi
fi
# Update database
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment