Merge lp:~mabac/linaro-image-tools/bug-638384-hwpackforceyes-unneeded into lp:linaro-image-tools/11.11

[Mattias Backman]

Hi,

This branch makes --hwpack-force-yes implied if signatures for hwpacks are passed and verification is ok.

It will only bypass the package signature checking for those hwpacks which have ok signatures passed.

The behaviour for binary-sig is not changed yet.

Thanks,

Mattias

[lp:~mabac/linaro-image-tools/bug-638384-hwpackforceyes-unneeded]

335. By Mattias Backman on 2011-04-29

Use os.path.basename() instead of split().

[Guilherme Salgado (salgado)]

The existing code seems to cause the script to abort when the sha1sum check of any hwpack fails, but after this change I think such a failure wouldn't cause the script to abort. Is this intentional?

[Mattias Backman (mabac)]

On Fri, Apr 29, 2011 at 7:51 PM, Guilherme Salgado
<email address hidden> wrote:
> The existing code seems to cause the script to abort when the sha1sum check of any hwpack fails, but after this change I think such a failure wouldn't cause the script to abort.  Is this intentional?

I think that cmd_runner makes the script abort when the return code of
sha1sums is > 0. So I think that I can remove the check from the call
to gpg also since it aborts anyway. I couldn't decide whether to do
that or leave it in to make it clear that the intention is to abort
when the verification fails. But then I should do something similar
for sha1sums to be consistent, I guess.

[Guilherme Salgado (salgado)]

You're right, Mattias. I'd forgotten about that. I think we should do the same for the gpg check indeed, as that code will never be executed because cmd_runner.run() will raise an exception in wait() when the return code of the subprocess is non-zero, which means the print and sys.exit() calls can never be executed.

review: Approve

[lp:~mabac/linaro-image-tools/bug-638384-hwpackforceyes-unneeded]

336. By Mattias Backman on 2011-05-02

Remove message and exit that can never be reached.

=== modified file 'linaro-media-create'
--- linaro-media-create	2011-04-29 10:53:52 +0000
+++ linaro-media-create	2011-05-02 07:51:29 +0000
@@ -22,6 +22,7 @@
 import os
 import sys
 import tempfile
+import subprocess
 
 from linaro_image_tools import cmd_runner
 
@@ -104,16 +105,17 @@
     ensure_required_commands(args)
 
     sig_file_list = args.hwpacksigs[:]
+    verified_files = []
     if args.binarysig is not None:
         sig_file_list.append(args.binarysig)
     for sig_file in sig_file_list:
         hash_file = sig_file[0:-len('.asc')]
-        if cmd_runner.run(['gpg', '--verify', sig_file]).wait() != 0:
-            print "Could not verify hash file signature %s." % sig_file
-            sys.exit(1)
-        if cmd_runner.run(['sha1sum', '-c', hash_file]).wait() != 0:
-            print "Could not verify hash in file %s." % hash_file
-            sys.exit(1)
+        cmd_runner.run(['gpg', '--verify', sig_file]).wait() != 0:
+        sha1sums_out, _ = cmd_runner.run(['sha1sum', '-c', hash_file],
+                                         stdout=subprocess.PIPE).communicate()
+        verified_files.extend(sha1sums_out.replace(': OK', '').splitlines())
+    for verified_file in verified_files:
+        print 'Hash verification of file %s OK.' % verified_file
 
     media = Media(args.device)
     if media.is_block_device:
@@ -134,7 +136,7 @@
     if lmc_dir == '':
         lmc_dir = None
     install_hwpacks(
-        ROOTFS_DIR, TMP_DIR, lmc_dir, args.hwpack_force_yes, *hwpacks)
+        ROOTFS_DIR, TMP_DIR, lmc_dir, args.hwpack_force_yes, verified_files, *hwpacks)
 
     if args.rootfs == 'btrfs':
         install_packages(ROOTFS_DIR, TMP_DIR, "btrfs-tools")

=== modified file 'linaro_image_tools/media_create/chroot_utils.py'
--- linaro_image_tools/media_create/chroot_utils.py	2011-04-04 21:20:09 +0000
+++ linaro_image_tools/media_create/chroot_utils.py	2011-05-02 07:51:29 +0000
@@ -43,7 +43,7 @@
                   os.path.join(chroot_dir, 'usr', 'bin'))
 
 def install_hwpacks(
-    chroot_dir, tmp_dir, tools_dir, hwpack_force_yes, *hwpack_files):
+    chroot_dir, tmp_dir, tools_dir, hwpack_force_yes, verified_files, *hwpack_files):
     """Install the given hwpacks onto the given chroot."""
     prepare_chroot(chroot_dir, tmp_dir)
 
@@ -58,7 +58,10 @@
     try:
         mount_chroot_proc(chroot_dir)
         for hwpack_file in hwpack_files:
-            install_hwpack(chroot_dir, hwpack_file, hwpack_force_yes)
+            hwpack_verified = False
+            if os.path.basename(hwpack_file) in verified_files:
+                hwpack_verified = True
+            install_hwpack(chroot_dir, hwpack_file, hwpack_force_yes or hwpack_verified)
     finally:
         run_local_atexit_funcs()
 

=== modified file 'linaro_image_tools/media_create/tests/test_media_create.py'
--- linaro_image_tools/media_create/tests/test_media_create.py	2011-04-29 11:03:10 +0000
+++ linaro_image_tools/media_create/tests/test_media_create.py	2011-05-02 07:51:29 +0000
@@ -1392,7 +1392,7 @@
         prefer_dir = preferred_tools_dir()
 
         install_hwpacks(
-            chroot_dir, tmp_dir, prefer_dir, force_yes, 'hwpack1.tgz',
+            chroot_dir, tmp_dir, prefer_dir, force_yes, [], 'hwpack1.tgz',
             'hwpack2.tgz')
         linaro_hwpack_install = find_command(
             'linaro-hwpack-install', prefer_dir=prefer_dir)
@@ -1506,7 +1506,7 @@
         exception_caught = False
         try:
             install_hwpacks(
-                'chroot', '/tmp/dir', preferred_tools_dir(), force_yes,
+                'chroot', '/tmp/dir', preferred_tools_dir(), force_yes, [],
                 'hwp.tgz', 'hwp2.tgz')
         except:
             exception_caught = True