From 7f6d223078599c3a6a2f26bf89ba8a91afd4cb88 Mon Sep 17 00:00:00 2001

From: Michal Domonkos <mdomonko@redhat.com>

Date: Mon, 17 Dec 2018 14:38:22 +0100

Subject: [PATCH] Add basic integration with %_pkgverify_level

RPM 4.14.2 introduced a new low-level security policy for package

verification configured with the %_pkgverify_level macro:

http://rpm.org/wiki/Releases/4.14.2

In DNF, signature verification is done via RPM but in a separate step

that precedes the transaction itself (BaseCli.gpgsigcheck()).  We can

make use of that to catch signature errors and/or import public keys the

same way as if gpgcheck was enabled from the start.  To that end, this

commit forces the gpgcheck and localpkg_gpgcheck options to True if the

policy would result in signature verification anyway.

Resolves RHEL-8 bug:

https://bugzilla.redhat.com/show_bug.cgi?id=1614351

---

 dnf/cli/cli.py           | 18 ++++++++++++++++++

 dnf/cli/option_parser.py |  2 +-

 doc/command_ref.rst      |  2 +-

 doc/conf_ref.rst         | 12 ++++++++++--

 4 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/dnf/cli/cli.py b/dnf/cli/cli.py

index ea328702f4..522a2ad936 100644

--- a/dnf/cli/cli.py

+++ b/dnf/cli/cli.py

@@ -972,6 +972,24 @@ def configure(self, args, option_parser=None):

         if self.base.conf.color != 'auto':

             self.base.output.term.reinit(color=self.base.conf.color)

+        if rpm.expandMacro('%_pkgverify_level') in ('signature', 'all'):

+            forcing = False

+            for repo in self.base.repos.iter_enabled():

+                if repo.gpgcheck:

+                    continue

+                repo.gpgcheck = True

+                forcing = True

+            if not self.base.conf.localpkg_gpgcheck:

+                self.base.conf.localpkg_gpgcheck = True

+                forcing = True

+            if forcing:

+                logger.warning(

+                    _("Warning: Enforcing GPG signature check globally "

+                      "as per active RPM security policy (see 'gpgcheck' in "

+                      "dnf.conf(5) for how to squelch this message)"

+                      )

+                )

+

     def _read_conf_file(self, releasever=None):

         timer = dnf.logging.Timer('config')

         conf = self.base.conf

diff --git a/dnf/cli/option_parser.py b/dnf/cli/option_parser.py

index e60179cfac..ba5a316c79 100644

--- a/dnf/cli/option_parser.py

+++ b/dnf/cli/option_parser.py

@@ -274,7 +274,7 @@ def _main_parser(self):

                                  help=_("disable removal of dependencies that are no longer used"))

         main_parser.add_argument("--nogpgcheck", action="store_false",

                                  default=None, dest='gpgcheck',

-                                 help=_("disable gpg signature checking"))

+                                 help=_("disable gpg signature checking (if RPM policy allows)"))

         main_parser.add_argument("--color", dest="color", default=None,

                                  help=_("control whether color is used"))

         main_parser.add_argument("--refresh", dest="freshest_metadata",

diff --git a/doc/command_ref.rst b/doc/command_ref.rst

index 6ba31ff9be..70659e6560 100644

--- a/doc/command_ref.rst

+++ b/doc/command_ref.rst

@@ -275,7 +275,7 @@ Options

     do not install documentation by using rpm flag 'RPMTRANS_FLAG_NODOCS'

 ``--nogpgcheck``

-    skip checking GPG signatures on packages

+    skip checking GPG signatures on packages (if RPM policy allows)

 ``--noplugins``

     Disable all plugins.

diff --git a/doc/conf_ref.rst b/doc/conf_ref.rst

index 979e2d18c6..6bbcbda9c0 100644

--- a/doc/conf_ref.rst

+++ b/doc/conf_ref.rst

@@ -452,7 +452,11 @@ configuration.

 ``gpgcheck``

     :ref:`boolean <boolean-label>`

-    Whether to perform GPG signature check on packages found in this repository. The default is False.

+    Whether to perform GPG signature check on packages found in this repository.

+    The default is False.

+    This option can only be used to strengthen the active RPM security policy set with the `%_pkgverify_level` macro (see /usr/lib/rpm/macros for details).

+    That means, if the macro is set to `signature` or `all` and this option is False, it will be overridden to True when DNF runs and a warning will be printed.

+    To squelch the warning, make sure this option is True on every enabled repository and also enable :ref:`localpkg_gpgcheck <localpkg_gpgcheck-label>`.

 .. _include-label:

@@ -470,10 +474,14 @@ configuration.

     Determines how DNF resolves host names. Set this to '4'/'IPv4' or '6'/'IPv6' to resolve to IPv4 or IPv6 addresses only. By default, DNF resolves to either addresses.

+.. _localpkg_gpgcheck-label:

+

 ``localpkg_gpgcheck``

     :ref:`boolean <boolean-label>`

-    Whether to perform a GPG signature check on local packages (packages in a file, not in a repositoy). The default is False.

+    Whether to perform a GPG signature check on local packages (packages in a file, not in a repository).

+    The default is False.

+    This option is subject to the active RPM security policy (see :ref:`gpgcheck <gpgcheck-label>` for more details).

 ``max_parallel_downloads``

     :ref:`integer <integer-label>`