Merge lp:~mvo/software-properties/use-apt-auth into lp:software-properties

[Michael Vogt]

Use apt.auth from python-apt that does the same kind of checks
nowdays

[Barry Warsaw (barry)]

Any chance of getting http://apt.alioth.debian.org/python-apt-doc/contents.html updated? It only covers 0.8.0 and doesn't describe apt.auth at all afaict. Or is there a better, more definitive location for the documentation?

[Barry Warsaw (barry)]

Note that the pre-build hook fails when trying to build a source package with this branch. I suspect the test mocks need to be fixed for the new implementation.

Testing ./test_lp.py /home/barry/projects/ubuntu/softprop/build-area/software-properties-0.92.14/tests with python 2
EEEError getting key from keyserver: Only long keyids (v4, 160bit) are supported
...
======================================================================
ERROR: test_add_ppa_signing_key_multiple_fingerprints (__main__.AddPPASigningKeyTestCase)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/mock.py", line 1224, in patched
    return func(*args, **keywargs)
  File "./test_lp.py", line 76, in test_add_ppa_signing_key_multiple_fingerprints
    with patch.object(self.t, "_get_fingerprints") as mock:
  File "/usr/lib/python2.7/dist-packages/mock.py", line 1275, in __enter__
    original, local = self.get_original()
  File "/usr/lib/python2.7/dist-packages/mock.py", line 1263, in get_original
    "%s does not have the attribute %r" % (target, name)
AttributeError: <AddPPASigningKeyThread(Thread-1, initial)> does not have the attribute '_get_fingerprints'

======================================================================
ERROR: test_add_ppa_signing_key_ok (__main__.AddPPASigningKeyTestCase)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/mock.py", line 1224, in patched
    return func(*args, **keywargs)
  File "./test_lp.py", line 89, in test_add_ppa_signing_key_ok
    with patch.object(self.t, "_get_fingerprints") as mock:
  File "/usr/lib/python2.7/dist-packages/mock.py", line 1275, in __enter__
    original, local = self.get_original()
  File "/usr/lib/python2.7/dist-packages/mock.py", line 1263, in get_original
    "%s does not have the attribute %r" % (target, name)
AttributeError: <AddPPASigningKeyThread(Thread-2, initial)> does not have the attribute '_get_fingerprints'

======================================================================
ERROR: test_add_ppa_signing_key_wrong_fingerprint (__main__.AddPPASigningKeyTestCase)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/mock.py", line 1224, in patched
    return func(*args, **keywargs)
  File "./test_lp.py", line 65, in test_add_ppa_signing_key_wrong_fingerprint
    with patch.object(self.t, "_get_fingerprints") as mock:
  File "/usr/lib/python2.7/dist-packages/mock.py", line 1275, in __enter__
    original, local = self.get_original()
  File "/usr/lib/python2.7/dist-packages/mock.py", line 1263, in get_original
    "%s does not have the attribute %r" % (target, name)
AttributeError: <AddPPASigningKeyThread(Thread-3, initial)> does not have the attribute '_get_fingerprints'

----------------------------------------------------------------------
Ran 6 tests in 1.322s

FAILED (errors=3)
make: *** [check] Error 1
bzr: ERROR: The "pre-build" hook failed.

review: Needs Fixing

Unmerged revisions

813. By Michael Vogt on 2012-10-02

use apt.auth.add_key_from_keyserver() and upate debian/control

=== modified file 'debian/changelog'
--- debian/changelog	2012-10-02 18:32:36 +0000
+++ debian/changelog	2012-10-02 18:42:19 +0000
@@ -1,3 +1,9 @@
+software-properties (0.92.10) UNRELEASED; urgency=low
+
+  * use apt.auth.add_key_from_keyserver() and upate debian/control
+
+ -- Michael Vogt <[e-mail]>  Tue, 02 Oct 2012 20:39:23 +0200
+
 software-properties (0.92.9) quantal; urgency=low
 
   * Call GnuPG with an appropriate --homedir argument (LP: #1060335)

=== modified file 'debian/control'
--- debian/control	2012-09-18 13:13:10 +0000
+++ debian/control	2012-10-02 18:42:19 +0000
@@ -19,7 +19,7 @@
 Section: python
 Architecture: all
 Depends: ${python:Depends}, ${misc:Depends}, python, python-apt (>=
- 0.6.20ubuntu16), lsb-release,
+ 0.8.7ubuntu3), lsb-release,
  unattended-upgrades, iso-codes
 Description: manage the repositories that you install software from
  This software provides an abstraction of the used apt repositories.
@@ -30,7 +30,7 @@
 Section: python
 Architecture: all
 Depends: ${python3:Depends}, ${misc:Depends}, python3, python3-apt (>=
- 0.6.20ubuntu16), lsb-release, unattended-upgrades, iso-codes
+ 0.8.7ubuntu3), lsb-release, unattended-upgrades, iso-codes
 Description: manage the repositories that you install software from
  This software provides an abstraction of the used apt repositories.
  It allows you to easily manage your distribution and independent software

=== modified file 'softwareproperties/ppa.py'
--- softwareproperties/ppa.py	2012-10-02 18:32:36 +0000
+++ softwareproperties/ppa.py	2012-10-02 18:42:19 +0000
@@ -21,6 +21,7 @@
 
 from __future__ import print_function
 
+import apt.auth
 import apt_pkg
 import json
 import os
@@ -29,6 +30,12 @@
 import subprocess
 import tempfile
 
+
+from apt.auth import (
+    AptKeyError,
+    add_key_from_keyserver,
+    )
+
 from threading import Thread
 
 try:
@@ -136,73 +143,16 @@
         self.ppa_path = ppa_path
         self.keyserver = (keyserver if keyserver is not None
                           else DEFAULT_KEYSERVER)
-        
+
     def run(self):
         self.add_ppa_signing_key(self.ppa_path)
-        
-    def _recv_key(self, keyring, secret_keyring, signing_key_fingerprint, keyring_dir):
-        # double check that the signing key is a v4 fingerprint (160bit)
-        if not verify_keyid_is_v4(signing_key_fingerprint):
-            print("Error: signing key fingerprint '%s' too short" % 
-                  signing_key_fingerprint)
-            return False
-        # then get it
-        res = subprocess.call(self.GPG_DEFAULT_OPTIONS + [
-            "--homedir", keyring_dir,
-            "--secret-keyring", secret_keyring,
-            "--keyring", keyring,
-            "--keyserver", self.keyserver,
-            "--recv", signing_key_fingerprint,
-            ])
-        return (res == 0)
-
-    def _export_key(self, keyring, export_keyring, signing_key_fingerprint, keyring_dir):
-        res = subprocess.call(self.GPG_DEFAULT_OPTIONS + [
-          "--homedir", keyring_dir,
-          "--keyring", keyring,
-          "--output", export_keyring,
-          "--export", signing_key_fingerprint,
-          ])
-        if res != 0:
-            return False
-        return True
-
-    def _get_fingerprints(self, keyring, keyring_dir):
-        cmd = self.GPG_DEFAULT_OPTIONS + [
-          "--homedir", keyring_dir,
-          "--keyring", keyring,
-          "--fingerprint",
-          "--batch",
-          "--with-colons",
-          ]
-        output = subprocess.check_output(cmd, universal_newlines=True)
-        fingerprints = []
-        for line in output.splitlines():
-            if line.startswith("fpr:"):
-                fingerprints.append(line.split(":")[9])
-        return fingerprints
-
-    def _verify_fingerprint(self, keyring, expected_fingerprint, keyring_dir):
-        got_fingerprints = self._get_fingerprints(keyring, keyring_dir)
-        if len(got_fingerprints) > 1:
-            print("Got '%s' fingerprints, expected only one" % 
-                  len(got_fingerprints))
-            return False
-        got_fingerprint = got_fingerprints[0]
-        if got_fingerprint != expected_fingerprint:
-            print("Fingerprints do not match, not importing: '%s' != '%s'" % (
-                    expected_fingerprint, got_fingerprint))
-            return False
-        return True
 
     def add_ppa_signing_key(self, ppa_path):
         """Query and add the corresponding PPA signing key.
-        
+
         The signing key fingerprint is obtained from the Launchpad PPA page,
         via a secure channel, so it can be trusted.
         """
-        def cleanup(tmpdir):
-            shutil.rmtree(tmp_keyring_dir)
         owner_name, ppa_name, distro = ppa_path[1:].split('/')
         try:
             ppa_info = get_ppa_info_from_lp(owner_name, ppa_name)
@@ -214,32 +164,12 @@
         except IndexError as e:
             print("Error: can't find signing_key_fingerprint at %s" % ppa_path)
             return False
-        # create temp keyrings
-        tmp_keyring_dir = tempfile.mkdtemp()
-        tmp_secret_keyring = os.path.join(tmp_keyring_dir, "secring.gpg")
-        tmp_keyring = os.path.join(tmp_keyring_dir, "pubring.gpg")
-        #  download the key into a temp keyring first
-        if not self._recv_key(
-            tmp_keyring, tmp_secret_keyring, signing_key_fingerprint, tmp_keyring_dir):
-            cleanup(tmp_keyring_dir)
-            return False
-        # now export the key into a temp keyring using the long key id
-        tmp_export_keyring = os.path.join(tmp_keyring_dir, "export-keyring.gpg")
-        if not self._export_key(
-            tmp_keyring, tmp_export_keyring, signing_key_fingerprint, tmp_keyring_dir):
-            cleanup(tmp_keyring_dir)
-            return False
-        # now verify the fingerprint
-        if not self._verify_fingerprint(
-            tmp_export_keyring, signing_key_fingerprint, tmp_keyring_dir):
-            cleanup(tmp_keyring_dir)
-            return False
-        # and add it
-        res = subprocess.call(["apt-key", "add", tmp_keyring])
-        # cleanup
-        cleanup(tmp_keyring_dir)
-        return (res == 0)
-
+        try:
+            add_key_from_keyserver(signing_key_fingerprint, self.keyserver)
+        except AptKeyError as e:
+            print("Error getting key from keyserver: %s" % e)
+            return False
+        return True
 
 if __name__ == "__main__":
     import sys