/usr/lib/python2.7/dist-packages/dput/hooks/gpg.py is in python-dput 1.17.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 | # -*- coding: utf-8 -*-
# vim: tabstop=4 expandtab shiftwidth=4 softtabstop=4
# Copyright (c) 2012 dput authors
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
# 02110-1301, USA.
import os
import subprocess
import dput.changes
from dput.core import logger
from dput.exceptions import (ChangesFileException, HookException)
class GPGCheckerError(HookException):
"""
Subclass of the :class:`dput.exceptions.HookException`.
Thrown if the ``gpg`` checker encounters an issue.
"""
pass
def check_gpg_signature(changes, profile, interface):
"""
The ``gpg`` checker is a stock dput checker that checks packages
intended for upload for a GPG signature.
Profile key: ``gpg``
Example profile::
{
"allowed_keys": [
"8F049AD82C92066C7352D28A7B585B30807C2A87",
"B7982329"
]
}
``allowed_keys`` is an optional entry which contains all the keys that
may upload to this host. This can come in handy if you use more then one
key to upload to more then one host. Use any length of the last N chars
of the fingerprint.
"""
if "allow_unsigned_uploads" in profile:
if profile['allow_unsigned_uploads']:
logger.info("Not checking GPG signature due to "
"allow_unsigned_uploads being set.")
return
gpg = {}
if 'gpg' in profile:
gpg = profile['gpg']
try:
key = changes.validate_signature()
except ChangesFileException as e:
# Sign unsigned files using debsign:
changes_file = changes.get_changes_file()
if subprocess.call(['debsign', changes_file]) == 0:
changes = dput.changes.parse_changes_file(
changes_file,
os.path.dirname(changes_file)
)
try:
key = changes.validate_signature()
except ChangesFileException as e:
if e.gpg_stderr:
print e.gpg_stderr
raise e
if 'allowed_keys' in gpg:
allowed_keys = gpg['allowed_keys']
found = False
for k in allowed_keys:
if k == key[-len(k):]:
logger.info("Key %s is trusted to upload to this host." % (
k
))
found = True
if not found:
raise GPGCheckerError("Key %s is not in %s" % (
key,
allowed_keys
))
|