int
sign_repo(struct xbps_handle *xhp, const char *repodir,
const char *privkey, const char *signedby)
{
struct stat st;
struct xbps_repo *repo;
xbps_dictionary_t pkgd, meta = NULL;
xbps_data_t data = NULL, rpubkey = NULL;
xbps_object_iterator_t iter = NULL;
xbps_object_t obj;
RSA *rsa = NULL;
unsigned char *sig;
unsigned int siglen;
uint16_t rpubkeysize, pubkeysize;
const char *arch, *pkgver, *rsignedby = NULL;
char *binpkg = NULL, *binpkg_sig = NULL, *buf = NULL, *defprivkey = NULL;
int binpkg_fd, binpkg_sig_fd, rv = 0;
bool flush = false;
if (signedby == NULL) {
fprintf(stderr, "--signedby unset! cannot sign repository\n");
return -1;
}
/*
* Check that repository index exists and not empty, otherwise bail out.
*/
repo = xbps_repo_open(xhp, repodir, true);
if (repo == NULL) {
rv = errno;
fprintf(stderr, "%s: cannot read repository data: %s\n",
_XBPS_RINDEX, strerror(errno));
goto out;
}
if (xbps_dictionary_count(repo->idx) == 0) {
fprintf(stderr, "%s: invalid repository, existing!\n", _XBPS_RINDEX);
rv = EINVAL;
goto out;
}
/*
* If privkey not set, default to ~/.ssh/id_rsa.
*/
if (privkey == NULL)
defprivkey = xbps_xasprintf("%s/.ssh/id_rsa", getenv("HOME"));
else
defprivkey = strdup(privkey);
ERR_load_crypto_strings();
OpenSSL_add_all_algorithms();
OpenSSL_add_all_ciphers();
OpenSSL_add_all_digests();
if ((rsa = load_rsa_privkey(defprivkey)) == NULL) {
fprintf(stderr, "%s: failed to read the RSA privkey\n", _XBPS_RINDEX);
rv = EINVAL;
goto out;
}
/*
* Iterate over the idx dictionary and then sign all binary
* packages in this repository.
*/
iter = xbps_dictionary_iterator(repo->idx);
assert(iter);
while ((obj = xbps_object_iterator_next(iter))) {
pkgd = xbps_dictionary_get_keysym(repo->idx, obj);
xbps_dictionary_get_cstring_nocopy(pkgd, "architecture", &arch);
xbps_dictionary_get_cstring_nocopy(pkgd, "pkgver", &pkgver);
binpkg = xbps_xasprintf("%s/%s.%s.xbps", repodir, pkgver, arch);
binpkg_sig = xbps_xasprintf("%s.sig", binpkg);
/*
* Skip pkg if file signature exists
*/
if ((binpkg_sig_fd = access(binpkg_sig, R_OK)) == 0) {
if (xhp->flags & XBPS_FLAG_VERBOSE)
fprintf(stderr, "skipping %s, file signature found.\n", pkgver);
free(binpkg);
free(binpkg_sig);
close(binpkg_sig_fd);
continue;
}
/*
* Generate pkg file signature.
*/
if ((binpkg_fd = open(binpkg, O_RDONLY)) == -1) {
fprintf(stderr, "cannot read %s: %s\n", binpkg, strerror(errno));
free(binpkg);
free(binpkg_sig);
continue;
}
fstat(binpkg_fd, &st);
buf = malloc(st.st_size);
assert(buf);
if (read(binpkg_fd, buf, st.st_size) != st.st_size) {
fprintf(stderr, "failed to read %s: %s\n", binpkg, strerror(errno));
close(binpkg_fd);
free(buf);
free(binpkg);
free(binpkg_sig);
continue;
}
close(binpkg_fd);
if (!rsa_sign_buf(rsa, buf, st.st_size, &sig, &siglen)) {
fprintf(stderr, "failed to sign %s: %s\n", binpkg, strerror(errno));
free(buf);
free(binpkg);
free(binpkg_sig);
continue;
}
free(buf);
free(binpkg);
/*
* Write pkg file signature.
*/
binpkg_sig_fd = creat(binpkg_sig, 0644);
if (binpkg_sig_fd == -1) {
fprintf(stderr, "failed to create %s: %s\n", binpkg_sig, strerror(errno));
free(sig);
free(binpkg_sig);
continue;
}
if (write(binpkg_sig_fd, sig, siglen) != (ssize_t)siglen) {
fprintf(stderr, "failed to write %s: %s\n", binpkg_sig, strerror(errno));
free(sig);
free(binpkg_sig);
close(binpkg_sig_fd);
continue;
}
free(sig);
free(binpkg_sig);
close(binpkg_sig_fd);
printf("signed successfully %s\n", pkgver);
}
xbps_object_iterator_release(iter);
/*
* Check if repository index-meta contains changes compared to its
* current state.
*/
if ((buf = pubkey_from_privkey(rsa)) == NULL) {
rv = EINVAL;
goto out;
}
meta = xbps_dictionary_create();
data = xbps_data_create_data(buf, strlen(buf));
rpubkey = xbps_dictionary_get(repo->idxmeta, "public-key");
if (!xbps_data_equals(rpubkey, data))
flush = true;
free(buf);
pubkeysize = RSA_size(rsa) * 8;
xbps_dictionary_get_uint16(repo->idxmeta, "public-key-size", &rpubkeysize);
if (rpubkeysize != pubkeysize)
flush = true;
xbps_dictionary_get_cstring_nocopy(repo->idxmeta, "signature-by", &rsignedby);
if (rsignedby == NULL || strcmp(rsignedby, signedby))
flush = true;
if (!flush)
goto out;
xbps_dictionary_set(meta, "public-key", data);
xbps_dictionary_set_uint16(meta, "public-key-size", pubkeysize);
xbps_dictionary_set_cstring_nocopy(meta, "signature-by", signedby);
xbps_dictionary_set_cstring_nocopy(meta, "signature-type", "rsa");
xbps_object_release(data);
data = NULL;
if (!repodata_flush(xhp, repodir, repo->idx, meta)) {
fprintf(stderr, "failed to write repodata: %s\n", strerror(errno));
goto out;
}
printf("Signed repository (%u package%s)\n",
xbps_dictionary_count(repo->idx),
xbps_dictionary_count(repo->idx) == 1 ? "" : "s");
out:
if (defprivkey) {
free(defprivkey);
}
if (rsa) {
RSA_free(rsa);
rsa = NULL;
}
if (repo) {
xbps_repo_close(repo);
}
return rv ? -1 : 0;
}
struct xbps_repo *
xbps_repo_open(struct xbps_handle *xhp, const char *url)
{
struct xbps_repo *repo;
const char *arch;
char *repofile;
assert(xhp);
assert(url);
if (xhp->target_arch)
arch = xhp->target_arch;
else
arch = xhp->native_arch;
repo = calloc(1, sizeof(struct xbps_repo));
assert(repo);
repo->fd = -1;
repo->xhp = xhp;
repo->uri = url;
if (xbps_repository_is_remote(url)) {
/* remote repository */
char *rpath;
if ((rpath = xbps_get_remote_repo_string(url)) == NULL) {
free(repo);
return NULL;
}
repofile = xbps_xasprintf("%s/%s/%s-repodata", xhp->metadir, rpath, arch);
free(rpath);
repo->is_remote = true;
} else {
/* local repository */
repofile = xbps_repo_path(xhp, url);
}
/*
* In memory repo sync.
*/
if (xhp->flags & XBPS_FLAG_REPOS_MEMSYNC) {
if (repo_open_remote(repo))
return repo;
goto out;
}
/*
* Open the repository archive.
*/
repo->fd = open(repofile, O_RDONLY|O_CLOEXEC);
if (repo->fd == -1) {
int rv = errno;
xbps_dbg_printf(xhp, "[repo] `%s' open repodata %s\n",
repofile, strerror(rv));
goto out;
}
if (repo_open_local(repo, repofile)) {
free(repofile);
return repo;
}
out:
free(repofile);
xbps_repo_close(repo);
return NULL;
}
int
sign_repo(struct xbps_handle *xhp, const char *repodir,
const char *privkey, const char *signedby)
{
struct xbps_repo *repo = NULL;
xbps_dictionary_t meta = NULL;
xbps_data_t data = NULL, rpubkey = NULL;
RSA *rsa = NULL;
uint16_t rpubkeysize, pubkeysize;
const char *rsignedby = NULL;
char *buf = NULL, *rlockfname = NULL;
int rlockfd = -1, rv = 0;
bool flush_failed = false, flush = false;
if (signedby == NULL) {
fprintf(stderr, "--signedby unset! cannot initialize signed repository\n");
return -1;
}
/*
* Check that repository index exists and not empty, otherwise bail out.
*/
repo = xbps_repo_open(xhp, repodir);
if (repo == NULL) {
rv = errno;
fprintf(stderr, "%s: cannot read repository data: %s\n",
_XBPS_RINDEX, strerror(errno));
goto out;
}
if (xbps_dictionary_count(repo->idx) == 0) {
fprintf(stderr, "%s: invalid repository, existing!\n", _XBPS_RINDEX);
rv = EINVAL;
goto out;
}
rsa = load_rsa_key(privkey);
/*
* Check if repository index-meta contains changes compared to its
* current state.
*/
if ((buf = pubkey_from_privkey(rsa)) == NULL) {
rv = EINVAL;
goto out;
}
meta = xbps_dictionary_create();
data = xbps_data_create_data(buf, strlen(buf));
rpubkey = xbps_dictionary_get(repo->idxmeta, "public-key");
if (!xbps_data_equals(rpubkey, data))
flush = true;
free(buf);
pubkeysize = RSA_size(rsa) * 8;
xbps_dictionary_get_uint16(repo->idxmeta, "public-key-size", &rpubkeysize);
if (rpubkeysize != pubkeysize)
flush = true;
xbps_dictionary_get_cstring_nocopy(repo->idxmeta, "signature-by", &rsignedby);
if (rsignedby == NULL || strcmp(rsignedby, signedby))
flush = true;
if (!flush)
goto out;
xbps_dictionary_set(meta, "public-key", data);
xbps_dictionary_set_uint16(meta, "public-key-size", pubkeysize);
xbps_dictionary_set_cstring_nocopy(meta, "signature-by", signedby);
xbps_dictionary_set_cstring_nocopy(meta, "signature-type", "rsa");
xbps_object_release(data);
data = NULL;
/* lock repository to write repodata file */
if (!xbps_repo_lock(xhp, repodir, &rlockfd, &rlockfname)) {
rv = errno;
fprintf(stderr, "%s: cannot lock repository: %s\n",
_XBPS_RINDEX, strerror(errno));
goto out;
}
flush_failed = repodata_flush(xhp, repodir, repo->idx, meta);
xbps_repo_unlock(rlockfd, rlockfname);
if (!flush_failed) {
fprintf(stderr, "failed to write repodata: %s\n", strerror(errno));
goto out;
}
printf("Initialized signed repository (%u package%s)\n",
xbps_dictionary_count(repo->idx),
xbps_dictionary_count(repo->idx) == 1 ? "" : "s");
out:
if (rsa) {
RSA_free(rsa);
rsa = NULL;
}
if (repo)
xbps_repo_close(repo);
return rv ? -1 : 0;
}
int
index_add(struct xbps_handle *xhp, int args, int argmax, char **argv, bool force)
{
xbps_dictionary_t idx, idxmeta, idxstage, binpkgd, curpkgd;
struct xbps_repo *repo = NULL;
struct stat st;
char *tmprepodir = NULL, *repodir = NULL, *rlockfname = NULL;
int rv = 0, ret = 0, rlockfd = -1;
assert(argv);
/*
* Read the repository data or create index dictionaries otherwise.
*/
if ((tmprepodir = strdup(argv[args])) == NULL)
return ENOMEM;
repodir = dirname(tmprepodir);
if (!xbps_repo_lock(xhp, repodir, &rlockfd, &rlockfname)) {
fprintf(stderr, "xbps-rindex: cannot lock repository "
"%s: %s\n", repodir, strerror(errno));
rv = -1;
goto out;
}
repo = xbps_repo_public_open(xhp, repodir);
if (repo == NULL && errno != ENOENT) {
fprintf(stderr, "xbps-rindex: cannot open/lock repository "
"%s: %s\n", repodir, strerror(errno));
rv = -1;
goto out;
}
if (repo) {
idx = xbps_dictionary_copy_mutable(repo->idx);
idxmeta = xbps_dictionary_copy_mutable(repo->idxmeta);
} else {
idx = xbps_dictionary_create();
idxmeta = NULL;
}
// TODO: load data from stage repository
idxstage = xbps_dictionary_create();
/*
* Process all packages specified in argv.
*/
for (int i = args; i < argmax; i++) {
const char *arch = NULL, *pkg = argv[i];
char *sha256 = NULL, *pkgver = NULL, *pkgname = NULL;
assert(pkg);
/*
* Read metadata props plist dictionary from binary package.
*/
binpkgd = xbps_archive_fetch_plist(pkg, "/props.plist");
if (binpkgd == NULL) {
fprintf(stderr, "index: failed to read %s metadata for "
"`%s', skipping!\n", XBPS_PKGPROPS, pkg);
continue;
}
xbps_dictionary_get_cstring_nocopy(binpkgd, "architecture", &arch);
xbps_dictionary_get_cstring(binpkgd, "pkgver", &pkgver);
if (!xbps_pkg_arch_match(xhp, arch, NULL)) {
fprintf(stderr, "index: ignoring %s, unmatched arch (%s)\n", pkgver, arch);
xbps_object_release(binpkgd);
free(pkgver);
continue;
}
pkgname = xbps_pkg_name(pkgver);
assert(pkgname);
/*
* Check if this package exists already in the index, but first
* checking the version. If current package version is greater
* than current registered package, update the index; otherwise
* pass to the next one.
*/
curpkgd = xbps_dictionary_get(idxstage, pkgname);
if(curpkgd == NULL)
curpkgd = xbps_dictionary_get(idx, pkgname);
if (curpkgd == NULL) {
if (errno && errno != ENOENT) {
rv = errno;
free(pkgver);
free(pkgname);
goto out;
}
} else if (!force) {
char *opkgver = NULL, *oarch = NULL;
/* Only check version if !force */
xbps_dictionary_get_cstring(curpkgd, "pkgver", &opkgver);
xbps_dictionary_get_cstring(curpkgd, "architecture", &oarch);
ret = xbps_cmpver(pkgver, opkgver);
/*
* If the considered package reverts the package in the index,
* consider the current package as the newer one.
*/
if (ret < 0 && xbps_pkg_reverts(binpkgd, opkgver)) {
ret = 1;
/*
* If package in the index reverts considered package, consider the
* package in the index as the newer one.
*/
} else if (ret > 0 && xbps_pkg_reverts(curpkgd, pkgver)) {
ret = -1;
}
if (ret <= 0) {
/* Same version or index version greater */
fprintf(stderr, "index: skipping `%s' (%s), already registered.\n", pkgver, arch);
xbps_object_release(binpkgd);
free(opkgver);
free(oarch);
free(pkgver);
free(pkgname);
continue;
}
/*
* Current package version is greater than
* index version.
*/
printf("index: removed obsolete entry `%s' (%s).\n", opkgver, oarch);
xbps_dictionary_remove(idx, pkgname);
free(opkgver);
free(oarch);
}
/*
* Add additional objects for repository ops:
* - filename-size
* - filename-sha256
*/
if ((sha256 = xbps_file_hash(pkg)) == NULL) {
free(pkgver);
free(pkgname);
rv = EINVAL;
goto out;
}
if (!xbps_dictionary_set_cstring(binpkgd, "filename-sha256", sha256)) {
free(sha256);
free(pkgver);
free(pkgname);
rv = EINVAL;
goto out;
}
free(sha256);
if (stat(pkg, &st) == -1) {
free(pkgver);
free(pkgname);
rv = EINVAL;
goto out;
}
if (!xbps_dictionary_set_uint64(binpkgd, "filename-size", (uint64_t)st.st_size)) {
free(pkgver);
free(pkgname);
rv = EINVAL;
goto out;
}
if (set_build_date(binpkgd, st.st_mtime) < 0) {
free(pkgver);
free(pkgname);
rv = EINVAL;
goto out;
}
/* Remove unneeded objects */
xbps_dictionary_remove(binpkgd, "pkgname");
xbps_dictionary_remove(binpkgd, "version");
xbps_dictionary_remove(binpkgd, "packaged-with");
/*
* Add new pkg dictionary into the index.
*/
if (!xbps_dictionary_set(idxstage, pkgname, binpkgd)) {
free(pkgname);
free(pkgver);
rv = EINVAL;
goto out;
}
printf("index: added `%s' (%s).\n", pkgver, arch);
xbps_object_release(binpkgd);
free(pkgname);
free(pkgver);
}
/*
* Generate repository data files.
*/
if (!repodata_commit(xhp, repodir, idx, idxmeta, idxstage)) {
fprintf(stderr, "%s: failed to write repodata: %s\n",
_XBPS_RINDEX, strerror(errno));
goto out;
}
printf("index: %u packages registered.\n", xbps_dictionary_count(idx));
out:
if (repo)
xbps_repo_close(repo);
xbps_repo_unlock(rlockfd, rlockfname);
if (tmprepodir)
free(tmprepodir);
return rv;
}
