From 4ebcf9d422bef11bd5b50f421a4b30ed826d1cbb Mon Sep 17 00:00:00 2001 From: Vladimir Slavik Date: Tue, 15 Sep 2020 09:57:58 +0200 Subject: [PATCH 20001/20006] Import RPM certificates at end of installation This adds code and a new config key for importing RPM certificates, and enables it for all of Fedora. Resolves: rhbz#748320 Resolves: rhbz#1858006 (cherry picked from commit 5145db39e88b08eb23ac1b96c1a14f1eb73b2e86) --- data/anaconda.conf | 4 +++ data/product.d/centos-stream.conf | 2 ++ data/product.d/fedora.conf | 4 +++ pyanaconda/core/configuration/payload.py | 5 +++ pyanaconda/core/regexes.py | 3 ++ pyanaconda/core/util.py | 20 ++++++++++++ pyanaconda/payload/dnf/payload.py | 14 +++++++++ tests/nosetests/pyanaconda_tests/util_test.py | 31 +++++++++++++++++++ 8 files changed, 83 insertions(+) diff --git a/data/anaconda.conf b/data/anaconda.conf index 824f4bb56..ab6c15bb6 100644 --- a/data/anaconda.conf +++ b/data/anaconda.conf @@ -97,6 +97,10 @@ check_supported_locales = False # Enable ssl verification for all HTTP connection verify_ssl = True +# GPG keys to import to RPM database by default. +# Specify paths on the installed system, each on a line. +# Substitutions for $releasever and $basearch happen automatically. +default_rpm_gpg_keys = [Security] # Enable SELinux usage in the installed system. diff --git a/data/product.d/centos-stream.conf b/data/product.d/centos-stream.conf index 723a48403..c8af2d2fe 100644 --- a/data/product.d/centos-stream.conf +++ b/data/product.d/centos-stream.conf @@ -32,3 +32,5 @@ default_help_pages = [Payload] enable_closest_mirror = True default_source = CLOSEST_MIRROR +default_rpm_gpg_keys = + /etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial diff --git a/data/product.d/fedora.conf b/data/product.d/fedora.conf index 0b2eeeeab..31a9245c0 100644 --- a/data/product.d/fedora.conf +++ b/data/product.d/fedora.conf @@ -15,3 +15,7 @@ default_help_pages = fedora_help_placeholder.txt fedora_help_placeholder.xml fedora_help_placeholder.xml + +[Payload] +default_rpm_gpg_keys = + /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch diff --git a/pyanaconda/core/configuration/payload.py b/pyanaconda/core/configuration/payload.py index 5dde92619..4cc2c0244 100644 --- a/pyanaconda/core/configuration/payload.py +++ b/pyanaconda/core/configuration/payload.py @@ -107,3 +107,8 @@ class PayloadSection(Section): this option. """ return self._get_option("verify_ssl", bool) + + @property + def default_rpm_gpg_keys(self): + """List of GPG keys to import into RPM database at end of installation.""" + return self._get_option("default_rpm_gpg_keys", str).split() diff --git a/pyanaconda/core/regexes.py b/pyanaconda/core/regexes.py index ab4cd900b..17d56b752 100644 --- a/pyanaconda/core/regexes.py +++ b/pyanaconda/core/regexes.py @@ -197,3 +197,6 @@ MAC_OCTET = re.compile(r'[a-fA-F0-9][a-fA-F0-9]') # Name of initramfs connection created by NM based on MAC NM_MAC_INITRAMFS_CONNECTION = re.compile(r'^([0-9A-Fa-f]{2}:){5}([0-9A-Fa-f]{2})$') + +# OS version in os-release file +OS_RELEASE_OS_VERSION = re.compile(r"VERSION_ID=[\"']?([0-9a-z._-]+)[\"']?") diff --git a/pyanaconda/core/util.py b/pyanaconda/core/util.py index 6fab33ed5..73c9d5ba3 100644 --- a/pyanaconda/core/util.py +++ b/pyanaconda/core/util.py @@ -47,6 +47,7 @@ from pyanaconda.core.constants import DRACUT_SHUTDOWN_EJECT, TRANSLATIONS_UPDATE IPMI_ABORTED, X_TIMEOUT, TAINT_HARDWARE_UNSUPPORTED, TAINT_SUPPORT_REMOVED, \ WARNING_HARDWARE_UNSUPPORTED, WARNING_SUPPORT_REMOVED from pyanaconda.core.constants import SCREENSHOTS_DIRECTORY, SCREENSHOTS_TARGET_DIRECTORY +from pyanaconda.core.regexes import OS_RELEASE_OS_VERSION from pyanaconda.errors import RemovedModuleError from pyanaconda.anaconda_logging import program_log_lock @@ -1489,3 +1490,22 @@ def is_smt_enabled(): except (IOError, ValueError): log.warning("Failed to detect SMT.") return False + + +def get_os_version(sysroot=""): + """Find version of the OS from the os-release file. + + See os-release(5). + + :param str sysroot: Where to look. + :return str: The version + """ + for filename in ("/etc/os-release", "/usr/lib/os-release"): + try: + with open(sysroot + filename, "r") as f: + data = f.read(4096) # 4 kB should be enough for everyone! + return OS_RELEASE_OS_VERSION.findall(data)[0] + except (FileNotFoundError, IndexError): + pass + + return None diff --git a/pyanaconda/payload/dnf/payload.py b/pyanaconda/payload/dnf/payload.py index 47e00a49b..ac717e793 100644 --- a/pyanaconda/payload/dnf/payload.py +++ b/pyanaconda/payload/dnf/payload.py @@ -2037,6 +2037,17 @@ class DNFPayload(Payload): """Should we write the storage before doing the installation?""" return True + def _import_rpm_keys(self): + """Import GPG keys to RPM database.""" + if conf.payload.default_rpm_gpg_keys: + # TODO: replace the interpolation with DNF once possible + arch = util.execWithCapture("uname", ["-i"]).strip().replace("'", "") + vers = util.get_os_version(conf.target.system_root) + for key in conf.payload.default_rpm_gpg_keys: + interpolated_key = key.replace("$releasever", vers).replace("$basearch", arch) + log.info("Importing GPG key to RPM database: %s", interpolated_key) + util.execInSysroot("rpm", ["--import", interpolated_key]) + def post_setup(self): """Perform post-setup tasks. @@ -2076,6 +2087,9 @@ class DNFPayload(Payload): self._base.close() super().post_install() + # rpm needs importing installed certificates manually, see rhbz#748320 and rhbz#185800 + self._import_rpm_keys() + @property def kernel_version_list(self): # Find all installed rpms that provide 'kernel' diff --git a/tests/nosetests/pyanaconda_tests/util_test.py b/tests/nosetests/pyanaconda_tests/util_test.py index f047a1e66..c2c3c0c0f 100644 --- a/tests/nosetests/pyanaconda_tests/util_test.py +++ b/tests/nosetests/pyanaconda_tests/util_test.py @@ -855,3 +855,34 @@ class MiscTests(unittest.TestCase): ) self.assertEqual(get_anaconda_version_string(), "1.0") self.assertEqual(get_anaconda_version_string(build_time_version=True), "1.0-1") + + def get_os_version_test(self): + """Test get_os_version.""" + with tempfile.TemporaryDirectory() as root: + # prepare paths + util.mkdirChain(root + "/usr/lib") + util.mkdirChain(root + "/etc") + + # backup file only + with open(root + "/usr/lib/os-release", "w") as f: + f.write("# blah\nVERSION_ID=foo256bar \n VERSION_ID = wrong\n\n") + version = util.get_os_version(root) + self.assertEqual(version, "foo256bar") + + # main file and backup too + with open(root + "/etc/os-release", "w") as f: + f.write("# blah\nVERSION_ID=more-important\n") + version = util.get_os_version(root) + self.assertEqual(version, "more-important") + + # both, main file twice + with open(root + "/etc/os-release", "w") as f: + f.write("# blah\nVERSION_ID=more-important\nVERSION_ID=not-reached\n \n") + version = util.get_os_version(root) + self.assertEqual(version, "more-important") + + # no files + os.remove(root + "/usr/lib/os-release") + os.remove(root + "/etc/os-release") + version = util.get_os_version(root) + self.assertEqual(version, None) -- 2.31.1