1
=== modified file 'charmhelpers/fetch/ubuntu.py'
2
--- charmhelpers/fetch/ubuntu.py	2017-07-20 08:17:20 +0000
3
+++ charmhelpers/fetch/ubuntu.py	2017-08-15 07:09:24 +0000
4
@@ -27,6 +27,7 @@
5
27
from charmhelpers.core.hookenv import (
27
from charmhelpers.core.hookenv import (
6
28
    log,
28
    log,
7
29
    DEBUG,
29
    DEBUG,
8
30
    WARNING,
9
30
)
31
)
10
31
from charmhelpers.fetch import SourceConfigError, GPGKeyError
32
from charmhelpers.fetch import SourceConfigError, GPGKeyError
11
32
33
12
@@ -261,34 +262,47 @@
13
261
    return apt_mark(packages, 'unhold', fatal=fatal)
262
    return apt_mark(packages, 'unhold', fatal=fatal)
14
262
263
15
263
264
23
264
def import_key(keyid):
265
def import_key(key):
24
265
    """Import a key in either ASCII Armor or Radix64 format.
266
    """Import an ASCII Armor key.
25
266
267
26
267
    `keyid` is either the keyid to fetch from a PGP server, or
268
    /!\ A Radix64 format keyid is also supported for backwards
27
268
    the key in ASCII armor foramt.
269
    compatibility, but should never be used; the key retrieval
28
269
270
    mechanism is insecure and subject to man-in-the-middle attacks
29
270
    :param keyid: String of key (or key id).
271
    voiding all signature checks using that key.
30
272
31
273
    :param keyid: The key in ASCII armor format,
32
274
                  including BEGIN and END markers.
33
271
    :raises: GPGKeyError if the key could not be imported
275
    :raises: GPGKeyError if the key could not be imported
34
272
    """
276
    """
38
273
    key = keyid.strip()
277
    key = key.strip()
39
274
    if (key.startswith('-----BEGIN PGP PUBLIC KEY BLOCK-----') and
278
    if '-' in key or '\n' in key:
40
275
            key.endswith('-----END PGP PUBLIC KEY BLOCK-----')):
279
        # Send everything not obviously a keyid to GPG to import, as
41
280
        # we trust its validation better than our own. eg. handling
42
281
        # comments before the key.
43
276
        log("PGP key found (looks like ASCII Armor format)", level=DEBUG)
282
        log("PGP key found (looks like ASCII Armor format)", level=DEBUG)
56
277
        log("Importing ASCII Armor PGP key", level=DEBUG)
283
        if ('-----BEGIN PGP PUBLIC KEY BLOCK-----' in key and
57
278
        with NamedTemporaryFile() as keyfile:
284
                '-----END PGP PUBLIC KEY BLOCK-----' in key):
58
279
            with open(keyfile.name, 'w') as fd:
285
            log("Importing ASCII Armor PGP key", level=DEBUG)
59
280
                fd.write(key)
286
            with NamedTemporaryFile() as keyfile:
60
281
                fd.write("\n")
287
                with open(keyfile.name, 'w') as fd:
61
282
            cmd = ['apt-key', 'add', keyfile.name]
288
                    fd.write(key)
62
283
            try:
289
                    fd.write("\n")
63
284
                subprocess.check_call(cmd)
290
                cmd = ['apt-key', 'add', keyfile.name]
64
285
            except subprocess.CalledProcessError:
291
                try:
65
286
                error = "Error importing PGP key '{}'".format(key)
292
                    subprocess.check_call(cmd)
66
287
                log(error)
293
                except subprocess.CalledProcessError:
67
288
                raise GPGKeyError(error)
294
                    error = "Error importing PGP key '{}'".format(key)
68
295
                    log(error)
69
296
                    raise GPGKeyError(error)
70
297
        else:
71
298
            raise GPGKeyError("ASCII armor markers missing from GPG key")
72
289
    else:
299
    else:
75
290
        log("PGP key found (looks like Radix64 format)", level=DEBUG)
300
        # We should only send things obviously not a keyid offsite
76
291
        log("Importing PGP key from keyserver", level=DEBUG)
301
        # via this unsecured protocol, as it may be a secret or part
77
302
        # of one.
78
303
        log("PGP key found (looks like Radix64 format)", level=WARNING)
79
304
        log("INSECURLY importing PGP key from keyserver; "
80
305
            "full key not provided.", level=WARNING)
81
292
        cmd = ['apt-key', 'adv', '--keyserver',
306
        cmd = ['apt-key', 'adv', '--keyserver',
82
293
               'hkp://keyserver.ubuntu.com:80', '--recv-keys', key]
307
               'hkp://keyserver.ubuntu.com:80', '--recv-keys', key]
83
294
        try:
308
        try:
Reviewer	Review Type	Date Requested	Status
Alex Kavanagh		2017-08-15	Approve on 2017-08-15
Review via email: mp+329024@code.launchpad.net