Merge lp:~pitti/aptdaemon/pkcompat-enhancements into lp:aptdaemon

[Martin Pitt]

Implement the InstallSignature() PackageKit API.

This branch also changes the actual aptdaemon implementation in worker.py to
get along with "apt-key" exiting with code 2 even on success (in a separate
commit). This happens for both my own key (26B47B9F) as well as the glatzor.gpg
test key. I have tried with a few other keys as well. If it exits with
non-zero, it now checks stdout for success/failure.

[Sebastian Heinlein (glatzor)]

See also https://code.launchpad.net/~glatzor/python-apt/auth/+merge/108290

I would like to move the apt-key/gnupg handling to python-apt

=== modified file 'README.PackageKit'
--- README.PackageKit	2012-05-31 13:07:45 +0000
+++ README.PackageKit	2012-05-31 16:44:20 +0000
@@ -52,6 +52,7 @@
  - UpgradeSystem
  - WhatProvides (no builtin handling, only plugins)
  - RepoEnable: (only enabling, not disabling)
+ - InstallSignature
 
 Not yet supported roles:
 
@@ -62,8 +63,6 @@
  - InstallFiles: not implemented in the worker
  - SimulateInstallFiles: not implemented in the worker
        sessioninstaller.
- - InstallSignature: not implemented in the worker. Could be mapped to
-       AddVendorKeyFromFile.
 
 Roles we won't support at all because of missing infrastructure in APT:
 

=== modified file 'aptdaemon/pkcompat.py'
--- aptdaemon/pkcompat.py	2012-05-31 14:53:14 +0000
+++ aptdaemon/pkcompat.py	2012-05-31 16:44:20 +0000
@@ -263,6 +263,7 @@
                        pk_enums.ROLE_SEARCH_FILE,
                        pk_enums.ROLE_WHAT_PROVIDES,
                        pk_enums.ROLE_REPO_ENABLE,
+                       pk_enums.ROLE_INSTALL_SIGNATURE,
                        pk_enums.ROLE_DOWNLOAD_PACKAGES]
     if META_RELEASE_SUPPORT:
         SUPPORTED_ROLES.append(pk_enums.ROLE_GET_DISTRO_UPGRADES)
@@ -1746,9 +1747,9 @@
         self.role = pk_enums.ROLE_INSTALL_FILES
         GObject.idle_add(self._fail_not_implemented)
 
-    @dbus.service.method(PACKAGEKIT_TRANS_DBUS_INTERFACE,
-                         in_signature="sss", out_signature="",
-                         sender_keyword="sender")
+    @dbus_deferred_method(PACKAGEKIT_TRANS_DBUS_INTERFACE,
+                          in_signature="sss", out_signature="",
+                          sender_keyword="sender")
     def InstallSignature(self, sig_type, key_id, package_id, sender):
         """This method allows us to install new security keys.
 
@@ -1756,9 +1757,13 @@
         :param key_id: A key ID, e.g. BB7576AC
         :param package_id:
             A PackageID for the package that the user is trying to install
+            (ignored)
         """
         self.role = pk_enums.ROLE_INSTALL_SIGNATURE
-        GObject.idle_add(self._fail_not_implemented)
+        kwargs = {"sig_type": sig_type,
+                  "key_id": key_id,
+                  "package_id": package_id}
+        return self._run_query(kwargs, sender)
 
     @dbus.service.method(PACKAGEKIT_TRANS_DBUS_INTERFACE,
                          in_signature="sss", out_signature="",
@@ -1987,6 +1992,8 @@
             self.what_provides(trans, **trans.kwargs)
         elif trans.pktrans.role == pk_enums.ROLE_REPO_ENABLE:
             self.repo_enable(trans, **trans.kwargs)
+        elif trans.pktrans.role == pk_enums.ROLE_INSTALL_SIGNATURE:
+            self.install_signature(trans, **trans.kwargs)
         else:
             raise TransactionFailed(aptd_enums.ERROR_UNKNOWN,
                                     "Role %s isn't supported",
@@ -2598,6 +2605,16 @@
         self.add_repository(trans, fields[0], fields[1], fields[2],
                 fields[3:], '', None)
 
+    def install_signature(self, trans, sig_type, key_id, package_id):
+        """Install an archive key."""
+
+        if sig_type != 'gpg':
+            raise TransactionFailed(aptd_enums.ERROR_NOT_SUPPORTED,
+                    "type %s is not supported" % sig_type)
+
+        keyserver = os.environ.get('APTDAEMON_KEYSERVER',
+                'hkp://keyserver.ubuntu.com:80')
+        self.add_vendor_key_from_keyserver(trans, key_id, keyserver)
 
     # Helpers
 

=== modified file 'aptdaemon/worker.py'
--- aptdaemon/worker.py	2012-05-09 00:50:29 +0000
+++ aptdaemon/worker.py	2012-05-31 16:44:20 +0000
@@ -514,10 +514,13 @@
         #FIXME: Use GObject.spawn_async and deferreds in the worker
         #       Alternatively we could use python-pyme directly for a better
         #       error handling. Or the --status-fd of gpg
+        env = os.environ.copy()
+        env['LC_MESSAGES'] = 'C'
         proc = subprocess.Popen(["/usr/bin/apt-key", "adv",
                                  "--keyserver", keyserver,
                                  "--recv", keyid], stderr=subprocess.STDOUT,
-                                 stdout=subprocess.PIPE, close_fds=True)
+                                 stdout=subprocess.PIPE, close_fds=True,
+                                 env=env)
         while proc.poll() is None:
             self._iterate_mainloop()
             time.sleep(0.05)
@@ -525,16 +528,14 @@
                 trans.progress = 101
                 last_pulse = time.time()
         if proc.returncode != 0:
-            stdout = str(proc.stdout.read(), 
-                             # that can return "None", in this case, just
-                             # assume something
-                             sys.stdin.encoding or "UTF-8",
-                             errors="replace")
-            #TRANSLATORS: The first %s is the key id and the second the server
-            raise TransactionFailed(ERROR_KEY_NOT_INSTALLED,
-                                    _("Failed to download and install the key "
-                                      "%s from %s:\n%s"),
-                                    keyid, keyserver, stdout)
+            stdout = proc.stdout.read().decode('UTF-8', errors='replace')
+            # FIXME: apt-key regularly exists with code 2 even on success
+            if 'processed: 0' in stdout:
+                #TRANSLATORS: The first %s is the key id and the second the server
+                raise TransactionFailed(ERROR_KEY_NOT_INSTALLED,
+                                        _("Failed to download and install the key "
+                                          "%s from %s:\n%s"),
+                                        keyid, keyserver, stdout)
 
     def add_vendor_key_from_file(self, trans, path):
         """Add the signing key from the given file to the trusted vendors.

=== modified file 'tests/test_pk.py'
--- tests/test_pk.py	2012-05-31 14:53:14 +0000
+++ tests/test_pk.py	2012-05-31 16:44:20 +0000
@@ -27,6 +27,13 @@
 
 PY3K = sys.version_info.major > 2
 
+if PY3K:
+    from http.server import HTTPServer
+    from http.server import SimpleHTTPRequestHandler as HTTPRequestHandler
+else:
+    from SimpleHTTPServer import BaseHTTPServer as HTTPServer
+    from SimpleHTTPServer import SimpleHTTPRequestHandler as HTTPRequestHandler
+
 
 class PackageKitTest(aptdaemon.test.AptDaemonTestCase):
 
@@ -45,6 +52,15 @@
         self.orig_pythonpath = os.environ.get("PYTHONPATH")
         os.environ["PYTHONPATH"] = "%s:%s" % (self.workdir,
                                               os.environ.get("PYTHONPATH", ""))
+        # write apt config for calling apt-key
+        apt_conf = os.path.join(self.chroot.path, 'aptconfig')
+        with open(apt_conf, 'w') as f:
+            f.write('Dir "%s";\n' % self.chroot.path)
+        os.environ['APT_CONFIG'] = apt_conf
+
+        # if tests install keys, have aptd query a local fake server
+        os.environ['APTDAEMON_KEYSERVER'] = 'hkp://localhost:19191'
+
         self.start_session_aptd(self.chroot.path)
         # Start the fake PolikcyKit daemon
         self.start_fake_polkitd()
@@ -388,6 +404,45 @@
             self.assertTrue('format' in str(e), e)
             self.assertTrue('http://example.com' in str(e), e)
 
+    def test_install_signature(self):
+        """Test installing a new GPG key"""
+
+        def apt_key_list():
+            proc = subprocess.Popen(["apt-key", "list"],
+                    stdout=subprocess.PIPE, universal_newlines=True)
+            out = proc.communicate()[0]
+            self.assertEqual(proc.returncode, 0)
+            return out
+
+        # we do not have any key initially
+        self.assertEqual(apt_key_list().strip(), '')
+
+        # launch our keyserver
+        self._start_keyserver()
+        self.addCleanup(self._stop_keyserver)
+
+        # now add one
+        client = pk.Client()
+        res = client.install_signature(pk.SigTypeEnum.GPG, 'CF982D18', '', None,
+                lambda p, t, d: True, None)
+        self.assertEqual(res.get_exit_code(), pk.ExitEnum.SUCCESS)
+
+        # key was imported
+        out = apt_key_list()
+        self.assertTrue('CF982D18' in out, out)
+
+    def test_install_signature_error(self):
+        """Test installing a new GPG key with failing server"""
+
+        # do not start keyserver, so http://localhost.. will not exist
+        client = pk.Client()
+        try:
+            client.install_signature(pk.SigTypeEnum.GPG, '11111111', '', None,
+                    lambda p, t, d: True, None)
+        except GLib.GError as e:
+            self.assertTrue('Failed to download' in str(e), e)
+            self.assertTrue('11111111' in str(e), e)
+
     def test_unimplemented(self):
         """Test proper error message on unimplemented method."""
         client = pk.Client()
@@ -396,6 +451,35 @@
         except GLib.GError as e:
             self.assertTrue('implemented' in str(e))
 
+    def _start_keyserver(self):
+        '''Start a fake keyserver on http://localhost:19191'''
+
+        dir = os.path.join(self.chroot.path, 'pks')
+        os.mkdir(dir, 0o700)
+        os.symlink(os.path.join(REPO_PATH, 'glatzor.gpg'), 
+                os.path.join(dir, 'lookup'))
+
+        self.keyserver_pid = os.fork()
+        if self.keyserver_pid == 0:
+            # quiesce server log
+            os.dup2(os.open('/dev/null', os.O_WRONLY), sys.stderr.fileno())
+            os.chdir(self.chroot.path)
+            httpd = HTTPServer.HTTPServer(('localhost', 19191), HTTPRequestHandler)
+            httpd.serve_forever()
+            os._exit(0)
+
+        # wait a bit until server is ready
+        time.sleep(0.5)
+
+    def _stop_keyserver(self):
+        '''Stop fake keyserver'''
+
+        assert self.keyserver_pid
+
+        os.kill(self.keyserver_pid, 15)
+        os.wait()
+        shutil.rmtree(os.path.join(self.chroot.path, 'pks'))
+
 
 @unittest.skipIf(sys.version_info.major < 3, "Python3 only")
 def setUp():