185 lines
6.6 KiB
Python
185 lines
6.6 KiB
Python
"""
|
|
Copyright 2018 Oliver Smith
|
|
|
|
This file is part of pmbootstrap.
|
|
|
|
pmbootstrap is free software: you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation, either version 3 of the License, or
|
|
(at your option) any later version.
|
|
|
|
pmbootstrap is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with pmbootstrap. If not, see <http://www.gnu.org/licenses/>.
|
|
"""
|
|
import os
|
|
import logging
|
|
import shutil
|
|
import tarfile
|
|
import tempfile
|
|
import stat
|
|
|
|
import pmb.helpers.run
|
|
import pmb.config
|
|
import pmb.config.load
|
|
import pmb.parse.apkindex
|
|
import pmb.helpers.http
|
|
import pmb.parse.version
|
|
|
|
|
|
def read_signature_info(tar):
|
|
"""
|
|
Find various information about the signature, that was used to sign
|
|
/sbin/apk.static inside the archive (not to be confused with the normal apk
|
|
archive signature!)
|
|
|
|
:returns: (sigfilename, sigkey_path)
|
|
"""
|
|
# Get signature filename and key
|
|
prefix = "sbin/apk.static.SIGN.RSA."
|
|
sigfilename = None
|
|
for filename in tar.getnames():
|
|
if filename.startswith(prefix):
|
|
sigfilename = filename
|
|
break
|
|
if not sigfilename:
|
|
raise RuntimeError("Could not find signature filename in apk." +
|
|
" This means, that your apk file is damaged. Delete it" +
|
|
" and try again. If the problem persists, fill out a bug" +
|
|
" report.")
|
|
sigkey = sigfilename[len(prefix):]
|
|
logging.debug("sigfilename: " + sigfilename)
|
|
logging.debug("sigkey: " + sigkey)
|
|
|
|
# Get path to keyfile on disk
|
|
sigkey_path = pmb.config.apk_keys_path + "/" + sigkey
|
|
if "/" in sigkey or not os.path.exists(sigkey_path):
|
|
logging.debug("sigkey_path: " + sigkey_path)
|
|
raise RuntimeError("Invalid signature key: " + sigkey)
|
|
|
|
return (sigfilename, sigkey_path)
|
|
|
|
|
|
def extract_temp(tar, sigfilename):
|
|
"""
|
|
Extract apk.static and signature as temporary files.
|
|
"""
|
|
ret = {
|
|
"apk": {
|
|
"filename": "sbin/apk.static",
|
|
"temp_path": None
|
|
},
|
|
"sig": {
|
|
"filename": sigfilename,
|
|
"temp_path": None
|
|
}
|
|
}
|
|
for ftype in ret.keys():
|
|
member = tar.getmember(ret[ftype]["filename"])
|
|
|
|
handle, path = tempfile.mkstemp(ftype, "pmbootstrap")
|
|
handle = open(handle, "wb")
|
|
ret[ftype]["temp_path"] = path
|
|
shutil.copyfileobj(tar.extractfile(member), handle)
|
|
|
|
logging.debug("extracted: " + path)
|
|
handle.close()
|
|
return ret
|
|
|
|
|
|
def verify_signature(args, files, sigkey_path):
|
|
"""
|
|
Verify the signature with openssl.
|
|
|
|
:param files: return value from extract_temp()
|
|
:raises RuntimeError: when verification failed and removes temp files
|
|
"""
|
|
logging.debug("Verify apk.static signature with " + sigkey_path)
|
|
try:
|
|
pmb.helpers.run.user(args, ["openssl", "dgst", "-sha1", "-verify",
|
|
sigkey_path, "-signature", files[
|
|
"sig"]["temp_path"],
|
|
files["apk"]["temp_path"]])
|
|
except BaseException:
|
|
os.unlink(files["sig"]["temp_path"])
|
|
os.unlink(files["apk"]["temp_path"])
|
|
raise RuntimeError("Failed to validate signature of apk.static."
|
|
" Either openssl is not installed, or the"
|
|
" download failed. Run 'pmbootstrap zap -hc' to"
|
|
" delete the download and try again.")
|
|
|
|
|
|
def extract(args, version, apk_path):
|
|
"""
|
|
Extract everything to temporary locations, verify signatures and reported
|
|
versions. When everything is right, move the extracted apk.static to the
|
|
final location.
|
|
"""
|
|
# Extract to a temporary path
|
|
with tarfile.open(apk_path, "r:gz") as tar:
|
|
sigfilename, sigkey_path = read_signature_info(tar)
|
|
files = extract_temp(tar, sigfilename)
|
|
|
|
# Verify signature
|
|
verify_signature(args, files, sigkey_path)
|
|
os.unlink(files["sig"]["temp_path"])
|
|
temp_path = files["apk"]["temp_path"]
|
|
|
|
# Verify the version, that the extracted binary reports
|
|
logging.debug("Verify the version reported by the apk.static binary" +
|
|
" (must match the package version " + version + ")")
|
|
os.chmod(temp_path, os.stat(temp_path).st_mode | stat.S_IEXEC)
|
|
version_bin = pmb.helpers.run.user(args, [temp_path, "--version"],
|
|
output_return=True)
|
|
version_bin = version_bin.split(" ")[1].split(",")[0]
|
|
if not version.startswith(version_bin + "-r"):
|
|
os.unlink(temp_path)
|
|
raise RuntimeError("Downloaded apk-tools-static-" + version + ".apk,"
|
|
" but the apk binary inside that package reports to be"
|
|
" version: " + version_bin + "! Looks like a downgrade attack"
|
|
" from a malicious server! Switch the server (-m) and try again.")
|
|
|
|
# Move it to the right path
|
|
target_path = args.work + "/apk.static"
|
|
shutil.move(temp_path, target_path)
|
|
|
|
|
|
def download(args, file):
|
|
"""
|
|
Download a single file from an Alpine mirror.
|
|
"""
|
|
base_url = args.mirror_alpine + "edge/main/" + args.arch_native
|
|
return pmb.helpers.http.download(args, base_url + "/" + file, file)
|
|
|
|
|
|
def init(args):
|
|
"""
|
|
Download, verify, extract $WORK/apk.static.
|
|
"""
|
|
# Get and parse the APKINDEX
|
|
apkindex = pmb.helpers.repo.alpine_apkindex_path(args, "main")
|
|
index_data = pmb.parse.apkindex.package(args, "apk-tools-static",
|
|
indexes=[apkindex])
|
|
version = index_data["version"]
|
|
|
|
# Extract and verify the apk-tools-static version
|
|
version_min = pmb.config.apk_tools_static_min_version
|
|
apk_name = "apk-tools-static-" + version + ".apk"
|
|
if pmb.parse.version.compare(version, version_min) == -1:
|
|
raise RuntimeError("Your APKINDEX has an outdated version of"
|
|
" apk-tools-static (your version: " + version +
|
|
", expected at least:" + version_min + "). Please" +
|
|
" run 'pmbootstrap update'.")
|
|
|
|
# Download, extract, verify apk-tools-static
|
|
apk_static = download(args, apk_name)
|
|
extract(args, version, apk_static)
|
|
|
|
|
|
def run(args, parameters):
|
|
pmb.helpers.run.root(args, [args.work + "/apk.static"] + parameters)
|