Merge lp:~cjwatson/ubuntu-archive-publishing/sign-parts into lp:ubuntu-archive-publishing

[Colin Watson]

Add a new sign.d run-parts directory.

Forthcoming Launchpad changes will make use of this to sign individual
files. At the moment it duplicates publish-distro.d/10-sign-releases, but
once Launchpad makes use of this we can drop that other script.

The motivation for this is that I want to have InRelease available earlier so that I can inject it into by-hash directories, but that's difficult at the moment because it's all entirely out of Launchpad's hands. This gives us a finer-grained interface to signing files, while still preserving the detailed control over keys and signature mechanisms that we want for the primary archive.

[William Grant (wgrant)]

review: Approve (code)

[lp:~cjwatson/ubuntu-archive-publishing/sign-parts]

100. By Colin Watson on 2018-03-20

Make check for InRelease files more precise.

101. By Colin Watson on 2018-03-20

Fix variable names to match documentation.

102. By Colin Watson on 2018-03-20

Explain oddity in is_inrelease.

=== added directory 'sign.d'
=== added file 'sign.d/10-sign'
--- sign.d/10-sign	1970-01-01 00:00:00 +0000
+++ sign.d/10-sign	2018-03-20 22:39:54 +0000
@@ -0,0 +1,116 @@
+#! /bin/sh
+set -e
+
+# The calling script may set GNUPGHOME to a value set up by Launchpad's
+# script machinery.  In production, we have a dedicated directory set up
+# for this.
+export GNUPGHOME="$ARCHIVEROOT/../gnupg-home"
+
+if ! test -d "$GNUPGHOME"
+then
+	echo "There is no $GNUPGHOME; not signing files."
+	exit 0
+fi
+
+# Return additional GPG options to be used when signing files for a given
+# series.
+gpg_opts () {
+	local series
+	series="${SUITE%%-*}"
+	case $LPCONFIG in
+	    ftpmaster-publish)
+		case "$series:$1" in
+		    # Use single-signature 1024 key SHA1 for old releases
+		    warty:*|hoary:*|breezy:*|dapper:*|edgy:*|feisty:*|gutsy:*|hardy:*|intrepid:*|jaunty:*|karmic:*|lucid:*|maverick:*|natty:*|oneiric:*|precise:*)
+			printf '%s\n' "-u 0x630239CC130E1A7FD81A27B140976EAF437D05B5 --digest-algo SHA1"
+			;;
+		    # Use single-signature 1024 key SHA1 for upgrades from distributions with 1k key only
+		    quantal:*/dist-upgrader*|raring:*/dist-upgrader*|saucy:*/dist-upgrader*|trusty:*/dist-upgrader*)
+			printf '%s\n' "-u 0x630239CC130E1A7FD81A27B140976EAF437D05B5 --digest-algo SHA1"
+			;;
+		    # Use single-signature 4096 key SHA512 for upgrades from distributions with 4k present
+		    utopic:*/dist-upgrader*|vivid:*/dist-upgrader*|wily:*/dist-upgrader*|xenial:*/dist-upgrader*|yakkety:*/dist-upgrader*)
+			printf '%s\n' "-u 0x790BC7277767219C42C86F933B4FE6ACC0B21F32 --digest-algo SHA512"
+			;;
+		    # Use dual-signatures 1024 & 4096 keys SHA512 for the archive, for a transitioning period, to allow e.g. precise .0 to bootstrap any of these
+		    quantal:*|raring:*|saucy:*|trusty:*|utopic:*|vivid:*|wily:*|xenial:*|yakkety:*)
+			printf '%s\n' "-u 0x630239CC130E1A7FD81A27B140976EAF437D05B5 -u 0x790BC7277767219C42C86F933B4FE6ACC0B21F32 --digest-algo SHA512"
+			;;
+		    *)
+		    # Use single-signature 4096 key SHA512 for zesty and up, including dist-upgrade tarballs
+			printf '%s\n' "-u 0x790BC7277767219C42C86F933B4FE6ACC0B21F32 --digest-algo SHA512"
+			;;
+		esac
+		;;
+	    derived-distro-publish)
+		case $DISTRIBUTION in
+		    ubuntu-rtm)
+			printf '%s\n' "-u 5810338B"
+			;;
+		esac
+		;;
+	    dogfood-publish)
+		case $DISTRIBUTION in
+		    ubuntu-rtm)
+			printf '%s\n' "-u 272AD8D5"
+			;;
+		esac
+		;;
+	esac
+}
+
+# True if the given path refers to an InRelease file.
+is_inrelease () {
+	# Launchpad signs files as .new and then moves them into place.
+	local path="${1%.new}"
+	[ "${path%/InRelease}" != "$path" ]
+}
+
+need_inrelease () {
+	local series
+	series="${SUITE%%-*}"
+	case $series in
+	    warty|hoary|breezy|dapper|edgy|feisty|gutsy|hardy|intrepid|jaunty|karmic|lucid|maverick|natty|oneiric|quantal|raring|saucy|utopic)
+		# Skip all suites from before InRelease was implemented in
+		# Ubuntu.
+		return 1
+		;;
+	    precise|trusty)
+		case $SUITE in
+		    precise|trusty)
+			# Skip LTS release pockets for the moment, because
+			# it will cause apt to redownload the world.
+			return 1
+			;;
+		    *)
+			return 0
+			;;
+		esac
+		;;
+	    *)
+		return 0
+		;;
+	esac
+}
+
+case $MODE in
+    detached)
+	opts="$(gpg_opts "$INPUT_PATH")"
+        echo "$(date -R): (re-)signing $INPUT_PATH as $OUTPUT_PATH ($opts)"
+        gpg --yes --detach-sign --armor -o "$OUTPUT_PATH" \
+            --sign --no-permission-warning $opts "$INPUT_PATH"
+	;;
+    clear)
+	if is_inrelease "$OUTPUT_PATH" && ! need_inrelease; then
+	    exit 0
+	fi
+        opts="$(gpg_opts "$INPUT_PATH")"
+        echo "$(date -R): (re-)signing $INPUT_PATH as $OUTPUT_PATH ($opts)"
+        gpg --yes --clearsign --armor -o "$OUTPUT_PATH" \
+            --no-permission-warning $opts "$INPUT_PATH"
+	;;
+    *)
+	echo "unknown MODE: $MODE" >&2
+	exit 1
+	;;
+esac

=== added file 'sign.d/README.txt'
--- sign.d/README.txt	1970-01-01 00:00:00 +0000
+++ sign.d/README.txt	2018-03-20 22:39:54 +0000
@@ -0,0 +1,25 @@
+Put scripts here that should be run to sign files.  They will be executed
+through the run-parts command, in alphabetical order.
+
+The scripts' filenames must consist entirely of ASCII letters (both upper and
+lower case allowed), digits, underscores, and hyphens.  All other files,
+including this text file, are ignored.
+
+Scripts in this directory will be run for each file that is a candidate for
+signing, including Release files.
+
+The following variables will be set for the script:
+
+INPUT_PATH - the path to the cleartext file to be signed
+
+OUTPUT_PATH - the path where the signature should be written
+
+MODE - either "detached" for a detached signature, or "clear" for a
+cleartext signature
+
+DISTRIBUTION - the distribution name
+
+SUITE - the suite name
+
+The script's PATH will be extended with the Launchpad source tree's
+cronscripts/publishing directory.