Merge lp:~xnox/ubuntu-release-upgrader/gnupg2 into lp:ubuntu-release-upgrader

[Dimitri John Ledkov]

apt-secure key fragment compatibility

=== modified file 'DistUpgrade/DistUpgradeAptCdrom.py'
--- DistUpgrade/DistUpgradeAptCdrom.py	2016-03-03 16:56:55 +0000
+++ DistUpgrade/DistUpgradeAptCdrom.py	2016-10-03 09:58:39 +0000
@@ -28,6 +28,7 @@
 import shutil
 import subprocess
 import sys
+import tempfile
 from gettext import gettext as _
 
 
@@ -46,6 +47,7 @@
         self.packages = set()
         self.signatures = set()
         self.i18n = set()
+        apt_pkg.init_config()
 
     def restore_backup(self, backup_ext):
         """ restore the backup copy of the cdroms.list file 
@@ -199,17 +201,16 @@
 
     def _verifyRelease(self, signatures):
         " verify the signatues and hashes "
-        gpgv = apt_pkg.config.find("Dir::Bin::gpg", "/usr/bin/gpgv")
-        keyring = apt_pkg.config.find("Apt::GPGV::TrustedKeyring",
-                                      "/etc/apt/trusted.gpg")
         for sig in signatures:
             basepath = os.path.split(sig)[0]
             # do gpg checking
             releasef = os.path.splitext(sig)[0]
-            cmd = [gpgv, "--keyring", keyring,
-                   "--ignore-time-conflict",
-                   sig, releasef]
-            ret = subprocess.call(cmd)
+            verify_env = os.environ.copy()
+            cmd = ["apt-key", "--quiet", "verify", sig, releasef]
+            with tempfile.NamedTemporaryFile() as fp:
+                fp.write(apt_pkg.config.dump())
+                verify_env["APT_CONFIG"] = fp.name
+                ret = subprocess.call(cmd, env=verify_env)
             if not (ret == 0):
                 return False
             # now do the hash sum checks

=== modified file 'DistUpgrade/DistUpgradeFetcherCore.py'
--- DistUpgrade/DistUpgradeFetcherCore.py	2015-11-02 17:46:28 +0000
+++ DistUpgrade/DistUpgradeFetcherCore.py	2016-10-03 09:58:39 +0000
@@ -78,58 +78,18 @@
         return False
 
     def gpgauthenticate(self, file, signature,
-                        keyring='/etc/apt/trusted.gpg'):
+                        keyring=None):
         """ authenticated a file against a given signature, if no keyring
             is given use the apt default keyring
         """
-        status_pipe = os.pipe()
-        logger_pipe = os.pipe()
-        if sys.version_info >= (3, 4):
-            os.set_inheritable(status_pipe[1], 1)
-            os.set_inheritable(logger_pipe[1], 1)
-        gpg = [
-            "gpg",
-            "--status-fd", "%d" % status_pipe[1],
-            "--logger-fd", "%d" % logger_pipe[1],
-            "--no-options",
-            "--homedir", self.tmpdir,
-            "--no-default-keyring",
-            "--ignore-time-conflict",
-            "--keyring", keyring,
-            "--verify", signature, file,
-        ]
-
-        def gpg_preexec():
-            os.close(status_pipe[0])
-            os.close(logger_pipe[0])
-
-        proc = subprocess.Popen(
-            gpg, stderr=subprocess.PIPE, preexec_fn=gpg_preexec,
-            close_fds=False, universal_newlines=True)
-        os.close(status_pipe[1])
-        os.close(logger_pipe[1])
-        status_handle = os.fdopen(status_pipe[0])
-        logger_handle = os.fdopen(logger_pipe[0])
-        try:
-            gpgres = status_handle.read()
-            ret = proc.wait()
-            if ret != 0:
-                # gnupg returned a problem (non-zero exit)
-                print("gpg exited %d" % ret)
-                print("Debug information: ")
-                print(status_handle.read())
-                print(proc.stderr.read())
-                print(logger_handle.read())
-                return False
-            if "VALIDSIG" in gpgres:
-                return True
-            print("invalid result from gpg:")
-            print(gpgres)
-            return False
-        finally:
-            status_handle.close()
-            proc.stderr.close()
-            logger_handle.close()
+        gpg = ["apt-key"]
+
+        if keyring:
+            gpg += ["--keyring", keyring]
+
+        gpg += ["verify", signature, file]
+        ret = subprocess.call(gpg, stderr=subprocess.PIPE)
+        return ret == 0
 
     def extractDistUpgrader(self):
         # extract the tarball

=== modified file 'debian/changelog'
--- debian/changelog	2016-09-27 22:17:44 +0000
+++ debian/changelog	2016-10-03 09:58:39 +0000
@@ -1,10 +1,16 @@
 ubuntu-release-upgrader (1:16.10.4) UNRELEASED; urgency=medium
 
+  [ Brian Murray ]
   * DistUpgradeController.py: fix UnboundLocalError - thanks to Launchpad user
     MissionSix for the patch.  (LP: #1611470)
   * po/POTFILES.in: use check_new_release_gtk.py to allow for fuzzy
     translations.
 
+  [ Dimitri John Ledkov ]
+  * Mirgrate to using apt-key, instead of gpg/gpgv directly to gain
+    support for apt-secure trustedparts (key fragments in
+    /etc/apt/trusted.gpg.d).
+
  -- Brian Murray <[e-mail]>  Mon, 15 Aug 2016 14:10:55 -0700
 
 ubuntu-release-upgrader (1:16.10.3) yakkety; urgency=medium

=== modified file 'debian/control'
--- debian/control	2016-02-23 17:08:53 +0000
+++ debian/control	2016-10-03 09:58:39 +0000
@@ -40,6 +40,7 @@
          ${misc:Depends},
          python3-update-manager (>= 1:0.196.2~),
          python3-apt (>= 0.8.5~),
+         gpgv,
          lsb-release
 Replaces: python3-update-manager (<< 1:0.165)
 Breaks: python3-update-manager (<< 1:0.165)

=== added file 'tests/test-data/mvo.gpg'
Binary files tests/test-data/mvo.gpg	1970-01-01 00:00:00 +0000 and tests/test-data/mvo.gpg	2016-10-03 09:58:39 +0000 differ
=== modified file 'tests/test_cdrom.py'
--- tests/test_cdrom.py	2015-01-20 22:30:06 +0000
+++ tests/test_cdrom.py	2016-10-03 09:58:39 +0000
@@ -26,9 +26,9 @@
 
     def testWriteDatabase(self):
         expect = \
-            "CD::0380987599d9f666b749fbfe29d5b440-2 " \
+            "CD::47dd35831a1e27f9a0ca8c8c50014981-2 " \
             "\"Ubuntu 8.10 _Intrepid Ibex_ - Beta amd64 (20080930.4)\";\n" \
-            "CD::0380987599d9f666b749fbfe29d5b440-2::Label " \
+            "CD::47dd35831a1e27f9a0ca8c8c50014981-2::Label " \
             "\"Ubuntu 8.10 _Intrepid Ibex_ - Beta amd64 (20080930.4)\";\n"
         p = CURDIR + "/test-data-cdrom/"
         database = CURDIR + "/test-data-cdrom/cdrom.list"
@@ -106,6 +106,7 @@
 
     def testVerifyRelease(self):
         cdrom = AptCdrom(None, CURDIR + "/test-data-cdrom")
+        apt_pkg.config.set("Dir::Etc::trusted", CURDIR + "/test-data/mvo.gpg")
         (p, s, i18n) = cdrom._scanCD()
         res = cdrom._verifyRelease(s)
         self.assertTrue(res)
@@ -135,6 +136,7 @@
     def test_comment_out(self):
         tmpdir = tempfile.mkdtemp()
         sourceslist = os.path.join(tmpdir, "sources.list")
+        open(sourceslist, 'w').close()
         apt_pkg.config.set("dir::etc::sourcelist", sourceslist)
         apt_pkg.config.set("dir::state::lists", tmpdir)
         view = Mock()

=== modified file 'tests/test_end_of_life.py'
--- tests/test_end_of_life.py	2013-09-17 21:33:23 +0000
+++ tests/test_end_of_life.py	2016-10-03 09:58:39 +0000
@@ -1,5 +1,7 @@
 #!/usr/bin/python
 
+import gi
+gi.require_version('Gtk', '3.0')
 from gi.repository import Gtk, GLib
 from mock import patch
 

=== modified file 'tests/test_pep8.py'
--- tests/test_pep8.py	2014-06-26 06:43:50 +0000
+++ tests/test_pep8.py	2016-10-03 09:58:39 +0000
@@ -6,7 +6,7 @@
 import unittest
 
 # pep8 is overdoing it a bit IMO
-IGNORE_PEP8 = "W,E125,E126,E265"
+IGNORE_PEP8 = "W,E125,E126,E265,E402"
 # FIXME: this list should be empty
 IGNORE_FILES = (
     "DistUpgradeViewKDE.py",

=== modified file 'tests/test_prerequists.py'
--- tests/test_prerequists.py	2016-04-06 17:20:53 +0000
+++ tests/test_prerequists.py	2016-10-03 09:58:39 +0000
@@ -35,7 +35,7 @@
         self.orig_sourceparts = apt_pkg.config.get("Dir::Etc::sourceparts")
         self.orig_state = apt_pkg.config.get("Dir::State")
         self.orig_status = apt_pkg.config.get("Dir::State::status")
-        self.orig_trusted = apt_pkg.config.get("APT::GPGV::TrustedKeyring")
+        self.orig_trusted = apt_pkg.config.get("Dir::Etc::trusted")
 
         apt_pkg.config.set("Dir::Etc", self.testdir)
         apt_pkg.config.set("Dir::Etc::sourceparts",
@@ -48,7 +48,7 @@
         apt_pkg.config.set("Dir::Etc::sourceparts", self.orig_sourceparts)
         apt_pkg.config.set("Dir::State", self.orig_state)
         apt_pkg.config.set("Dir::State::status", self.orig_status)
-        apt_pkg.config.set("APT::GPGV::TrustedKeyring", self.orig_trusted)
+        apt_pkg.config.set("Dir::Etc::trusted", self.orig_trusted)
 
     def testPreReqSourcesListAddingSimple(self):
         " test adding the prerequists when a mirror is known "
@@ -112,7 +112,7 @@
         tmpdir = tempfile.mkdtemp()
         #apt_pkg.config.set("Debug::pkgAcquire::Auth","true")
         #apt_pkg.config.set("Debug::Acquire::gpgv","true")
-        apt_pkg.config.set("APT::GPGV::TrustedKeyring",
+        apt_pkg.config.set("Dir::Etc::trusted",
                            self.testdir + "/trusted.gpg")
         # set sourceparts
         apt_pkg.config.set("Dir::Etc::sourceparts", tmpdir)
@@ -137,7 +137,7 @@
         tmpdir = tempfile.mkdtemp()
         #apt_pkg.config.set("Debug::pkgAcquire::Auth","true")
         #apt_pkg.config.set("Debug::Acquire::gpgv","true")
-        apt_pkg.config.set("APT::GPGV::TrustedKeyring",
+        apt_pkg.config.set("Dir::Etc::trusted",
                            self.testdir + "/trusted.gpg")
         # set sourceparts
         apt_pkg.config.set("Dir::Etc::sourceparts", tmpdir)
@@ -164,7 +164,7 @@
         tmpdir = tempfile.mkdtemp()
         #apt_pkg.config.set("Debug::pkgAcquire::Auth","true")
         #apt_pkg.config.set("Debug::Acquire::gpgv","true")
-        apt_pkg.config.set("APT::GPGV::TrustedKeyring",
+        apt_pkg.config.set("Dir::Etc::trusted",
                            self.testdir + "/trusted.gpg")
         # set sourceparts
         apt_pkg.config.set("Dir::Etc::sourceparts", tmpdir)