pull: Only have API to disable signapi for local pulls

There's a lot of historical baggage associated with GPG verification
and `ostree pull` versus `ostree pull-local`.  In particular nowadays,
if you use a `file://` remote things are transparently optimized
to e.g. use reflinks if available.

So for anyone who doesn't trust the "remote" repository, you should
really go through through the regular
`ostree remote add --sign-verify=X file://`
path for example.

Having a mechanism to say "turn on signapi verification" *without*
providing keys goes back into the "global state" debate I brought
up in https://github.com/ostreedev/ostree/issues/2080

It's just much cleaner architecturally if there is exactly one
path to find keys: from a remote config.

So here in contrast to the GPG code, for `pull-local` we explictily
disable signapi validation, and the `ostree_repo_pull()` API just
surfaces flags to disable it, not enable it.

diff --git a/src/libostree/ostree-repo-pull.c b/src/libostree/ostree-repo-pull.c
index 291f3fe679b905f712c8e82af863b299a8491b8d..7116c3dc4558c59445d6b987d1da76e916b68a5f 100644 (file)
--- a/src/libostree/ostree-repo-pull.c
+++ b/src/libostree/ostree-repo-pull.c
@@ -3277,6 +3277,8 @@ initiate_request (OtPullData                 *pull_data,
  *   * override-remote-name (s): If local, add this remote to refspec
  *   * gpg-verify (b): GPG verify commits
  *   * gpg-verify-summary (b): GPG verify summary
+ *   * disable-sign-verify (b): Disable signapi verification of commits
+ *   * disable-sign-verify-summary (b): Disable signapi verification of the summary
  *   * depth (i): How far in the history to traverse; default is 0, -1 means infinite
  *   * disable-static-deltas (b): Do not use static deltas
  *   * require-static-deltas (b): Require static deltas
@@ -3334,11 +3336,11 @@ ostree_repo_pull_with_options (OstreeRepo             *self,
   g_autoptr(GSource) update_timeout = NULL;
   gboolean opt_gpg_verify_set = FALSE;
   gboolean opt_gpg_verify_summary_set = FALSE;
-  gboolean opt_sign_verify_set = FALSE;
-  gboolean opt_sign_verify_summary_set = FALSE;
   gboolean opt_collection_refs_set = FALSE;
   gboolean opt_n_network_retries_set = FALSE;
   gboolean opt_ref_keyring_map_set = FALSE;
+  gboolean disable_sign_verify = FALSE;
+  gboolean disable_sign_verify_summary = FALSE;
   const char *main_collection_id = NULL;
   const char *url_override = NULL;
   gboolean inherit_transaction = FALSE;
@@ -3370,10 +3372,8 @@ ostree_repo_pull_with_options (OstreeRepo             *self,
         g_variant_lookup (options, "gpg-verify", "b", &pull_data->gpg_verify);
       opt_gpg_verify_summary_set =
         g_variant_lookup (options, "gpg-verify-summary", "b", &pull_data->gpg_verify_summary);
-      opt_sign_verify_set =
-        g_variant_lookup (options, "sign-verify", "b", &pull_data->sign_verify);
-      opt_sign_verify_summary_set =
-        g_variant_lookup (options, "sign-verify-summary", "b", &pull_data->sign_verify_summary);
+      g_variant_lookup (options, "disable-sign-verify", "b", &disable_sign_verify);
+      g_variant_lookup (options, "disable-sign-verify-summary", "b", &disable_sign_verify_summary);
       (void) g_variant_lookup (options, "depth", "i", &pull_data->maxdepth);
       (void) g_variant_lookup (options, "disable-static-deltas", "b", &pull_data->disable_static_deltas);
       (void) g_variant_lookup (options, "require-static-deltas", "b", &pull_data->require_static_deltas);
@@ -3525,8 +3525,7 @@ ostree_repo_pull_with_options (OstreeRepo             *self,
        * pulls by default.
        */
       if ((pull_data->gpg_verify ||
-           pull_data->gpg_verify_summary ||
-           pull_data->sign_verify
+           pull_data->gpg_verify_summary
           ) &&
           pull_data->remote_name == NULL)
         {
@@ -3553,18 +3552,31 @@ ostree_repo_pull_with_options (OstreeRepo             *self,
         if (!ostree_repo_remote_get_gpg_verify_summary (self, pull_data->remote_name,
                                                         &pull_data->gpg_verify_summary, error))
           goto out;
-      /* Fetch verification settings from remote if it wasn't already
-       * explicitly set in the options. */
-      if (!opt_sign_verify_set)
-        if (!ostree_repo_get_remote_boolean_option (self, pull_data->remote_name,
-                                                    "sign-verify", FALSE,
-                                                    &pull_data->sign_verify, error))
-          goto out;
-      if (!opt_sign_verify_summary_set)
-        if (!ostree_repo_get_remote_boolean_option (self, pull_data->remote_name,
-                                                    "sign-verify-summary", FALSE,
-                                                    &pull_data->sign_verify_summary, error))
-          goto out;
+      /* signapi differs from GPG in that it can only be explicitly *disabled*
+       * transiently during pulls, not enabled.
+       */
+      if (disable_sign_verify)
+        {
+          pull_data->sign_verify = FALSE;
+        }
+      else
+        {
+          if (!ostree_repo_get_remote_boolean_option (self, pull_data->remote_name,
+                                                      "sign-verify", FALSE,
+                                                      &pull_data->sign_verify, error))
+            goto out;
+        }
+      if (disable_sign_verify_summary)
+        {
+          pull_data->sign_verify_summary = FALSE;
+        }
+      else
+        {
+          if (!ostree_repo_get_remote_boolean_option (self, pull_data->remote_name,
+                                                      "sign-verify-summary", FALSE,
+                                                      &pull_data->sign_verify_summary, error))
+            goto out;
+        }
 
       /* NOTE: If changing this, see the matching implementation in
        * ostree-sysroot-upgrader.c

diff --git a/src/ostree/ot-builtin-pull-local.c b/src/ostree/ot-builtin-pull-local.c
index 695b09e513a3e92adfc7e43b24b0cb36ce4236f5..c42d38d71a8178f325e76bf2e2a1274f1a37a380 100644 (file)
--- a/src/ostree/ot-builtin-pull-local.c
+++ b/src/ostree/ot-builtin-pull-local.c
@@ -39,8 +39,6 @@ static gboolean opt_bareuseronly_files;
 static gboolean opt_require_static_deltas;
 static gboolean opt_gpg_verify;
 static gboolean opt_gpg_verify_summary;
-static gboolean opt_sign_verify;
-static gboolean opt_sign_verify_summary;
 static int opt_depth = 0;
 
 /* ATTENTION:
@@ -57,8 +55,6 @@ static GOptionEntry options[] = {
   { "require-static-deltas", 0, 0, G_OPTION_ARG_NONE, &opt_require_static_deltas, "Require static deltas", NULL },
   { "gpg-verify", 0, 0, G_OPTION_ARG_NONE, &opt_gpg_verify, "GPG verify commits (must specify --remote)", NULL },
   { "gpg-verify-summary", 0, 0, G_OPTION_ARG_NONE, &opt_gpg_verify_summary, "GPG verify summary (must specify --remote)", NULL },
-  { "sign-verify", 0, 0, G_OPTION_ARG_NONE, &opt_sign_verify, "Verify commits signature (must specify --remote)", NULL },
-  { "sign-verify-summary", 0, 0, G_OPTION_ARG_NONE, &opt_sign_verify, "Verify summary signature (must specify --remote)", NULL },
   { "depth", 0, 0, G_OPTION_ARG_INT, &opt_depth, "Traverse DEPTH parents (-1=infinite) (default: 0)", "DEPTH" },
   { NULL }
 };
@@ -185,13 +181,13 @@ ostree_builtin_pull_local (int argc, char **argv, OstreeCommandInvocation *invoc
                              g_variant_new_variant (g_variant_new_boolean (TRUE)));
     g_variant_builder_add (&builder, "{s@v}", "depth",
                            g_variant_new_variant (g_variant_new_int32 (opt_depth)));
-
-    if (opt_sign_verify)
-      g_variant_builder_add (&builder, "{s@v}", "sign-verify",
-                             g_variant_new_variant (g_variant_new_boolean (TRUE)));
-    if (opt_sign_verify_summary)
-      g_variant_builder_add (&builder, "{s@v}", "sign-verify-summary",
-                             g_variant_new_variant (g_variant_new_boolean (TRUE)));
+    /* local pulls always disable signapi verification.  If you don't want this, use
+     * ostree remote add --sign-verify=<key> file://
+     */
+    g_variant_builder_add (&builder, "{s@v}", "disable-sign-verify",
+                           g_variant_new_variant (g_variant_new_boolean (TRUE)));
+    g_variant_builder_add (&builder, "{s@v}", "disable-sign-verify-summary",
+                           g_variant_new_variant (g_variant_new_boolean (TRUE)));
 
     if (console.is_tty)
       progress = ostree_async_progress_new_and_connect (ostree_repo_pull_default_console_progress_changed, &console);

diff --git a/tests/test-local-pull.sh b/tests/test-local-pull.sh
index d443421ad237005647517296d65881f1342584af..555e9b260936551a88ac695919fdb3042c0fe4f0 100755 (executable)
--- a/tests/test-local-pull.sh
+++ b/tests/test-local-pull.sh
@@ -28,7 +28,7 @@ unset OSTREE_GPG_HOME
 
 skip_without_user_xattrs
 
-echo "1..11"
+echo "1..8"
 
 setup_test_repository "archive"
 echo "ok setup"
@@ -115,39 +115,3 @@ for src_object in `find repo/objects -name '*.filez'`; do
     assert_files_hardlinked "$src_object" "$dst_object"
 done
 echo "ok pull-local z2 to z2 default hardlink"
-
-if has_sign_ed25519; then
-    gen_ed25519_keys
-
-    mkdir repo8
-    ostree_repo_init repo8 --mode="archive"
-    ${CMD_PREFIX} ostree --repo=repo8 remote add --set=verification-ed25519-key="${ED25519PUBLIC}" origin repo
-    cat repo8/config
-
-    if ${CMD_PREFIX} ostree --repo=repo8 pull-local --remote=origin --sign-verify repo test2 2>err.txt; then
-        assert_not_reached "Ed25519 signature verification unexpectedly succeeded"
-    fi
-    assert_file_has_content err.txt 'ed25519: commit have no signatures of my type'
-    echo "ok --sign-verify with no signature"
-
-    ${OSTREE} sign test2 ${ED25519SECRET}
-
-    mkdir repo9
-    ostree_repo_init repo9 --mode="archive"
-    ${CMD_PREFIX} ostree --repo=repo9 remote add --set=verification-ed25519-key="$(gen_ed25519_random_public)" origin repo
-    if ${CMD_PREFIX} ostree --repo=repo9 pull-local --remote=origin --sign-verify repo test2 2>err.txt; then
-        assert_not_reached "Ed25519 signature verification unexpectedly succeeded"
-    fi
-    assert_file_has_content err.txt 'no valid ed25519 signatures found'
-    echo "ok --sign-verify with wrong signature"
-
-    mkdir repo10
-    ostree_repo_init repo10 --mode="archive"
-    ${CMD_PREFIX} ostree --repo=repo10 remote add --set=verification-ed25519-key="${ED25519PUBLIC}" origin repo
-    ${CMD_PREFIX} ostree --repo=repo10 pull-local --remote=origin --sign-verify repo test2
-    echo "ok --sign-verify"
-else
-    echo "ok --sign-verify with no signature | # SKIP due libsodium unavailability"
-    echo "ok --sign-verify with wrong signature | # SKIP due libsodium unavailability"
-    echo "ok --sign-verify | # SKIP libsodium unavailability"
-fi