diff --git a/bin/xbps-rindex/repoflush.c b/bin/xbps-rindex/repoflush.c index c617ccb6..82f312b4 100644 --- a/bin/xbps-rindex/repoflush.c +++ b/bin/xbps-rindex/repoflush.c @@ -45,6 +45,7 @@ repodata_flush(struct xbps_handle *xhp, const char *repodir, struct archive *ar; char *repofile, *tname, *buf; unsigned char *sig = NULL; + const char *signature_type = NULL; int rv, repofd = -1; unsigned int siglen, buflen; mode_t mask; @@ -115,7 +116,7 @@ repodata_flush(struct xbps_handle *xhp, const char *repodir, if (rv != 0) return false; - if (meta) + if (xbps_dictionary_get_cstring_nocopy(meta, "signature-type", &signature_type)) { rv = sign_buffer(buf, buflen, privkey, &sig, &siglen); free(buf); diff --git a/lib/plist_fetch.c b/lib/plist_fetch.c index 427fc7bb..6526c3e0 100644 --- a/lib/plist_fetch.c +++ b/lib/plist_fetch.c @@ -181,6 +181,7 @@ xbps_repo_fetch_remote(struct xbps_repo *repo, const char *url) struct archive *a; struct archive_entry *entry; uint8_t i = 0; + const char *signature_type = NULL; assert(url); assert(repo); @@ -214,7 +215,7 @@ xbps_repo_fetch_remote(struct xbps_repo *repo, const char *url) } archive_read_finish(a); - if (xbps_object_type(repo->idxmeta) == XBPS_TYPE_DICTIONARY) + if (xbps_dictionary_get_cstring_nocopy(repo->idxmeta, "signature-type", &signature_type)) repo->is_signed = true; if (xbps_object_type(repo->idx) == XBPS_TYPE_DICTIONARY) diff --git a/lib/repo.c b/lib/repo.c index 4acf95fd..5132bf97 100644 --- a/lib/repo.c +++ b/lib/repo.c @@ -181,6 +181,7 @@ repo_open_local(struct xbps_repo *repo, const char *repofile) struct stat st; int rv = 0; bool verified = false; + const char *signature_type = NULL; if (fstat(repo->fd, &st) == -1) { rv = errno; @@ -214,7 +215,8 @@ repo_open_local(struct xbps_repo *repo, const char *repofile) xbps_dictionary_make_immutable(repo->idx); repo->idxmeta = repo_get_dict(repo, NULL); if (repo->idxmeta != NULL) { - repo->is_signed = true; + if (xbps_dictionary_get_cstring_nocopy(repo->idxmeta, "signature-type", &signature_type)) + repo->is_signed = true; xbps_dictionary_make_immutable(repo->idxmeta); } @@ -635,6 +637,7 @@ xbps_repo_key_import(struct xbps_repo *repo) char *hexfp = NULL; char *p, *dbkeyd, *rkeyfile = NULL; int import, rv = 0; + bool has_signedby, has_pubkey_size, has_pubkey; assert(repo); /* @@ -655,8 +658,18 @@ xbps_repo_key_import(struct xbps_repo *repo) xbps_dictionary_get_uint16(repo->idxmeta, "public-key-size", &pubkey_size); pubkey = xbps_dictionary_get(repo->idxmeta, "public-key"); - if (signedby == NULL || pubkey_size == 0 || - xbps_object_type(pubkey) != XBPS_TYPE_DATA) { + has_signedby = (signedby != NULL); + has_pubkey_size = (pubkey_size > 0); + has_pubkey = (xbps_object_type(pubkey) == XBPS_TYPE_DATA); + + if (!has_signedby && !has_pubkey_size && !has_pubkey) + { + xbps_dbg_printf(repo->xhp, + "[repo] `%s' unsigned repository with meta!\n", repo->uri); + return 0; + } + else if (!has_signedby || !has_pubkey_size || !has_pubkey) + { xbps_dbg_printf(repo->xhp, "[repo] `%s': incomplete signed repository " "(missing objs)\n", repo->uri);