�
v�{gc @ s� d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z e r� d d l m Z m
Z
m Z m Z m
Z
m Z m Z m Z m Z d d l m Z m Z m Z m Z m Z m Z n d g Z i d# d 6Z d Z e d
� Z e d � Z e d
� Z d e f d � � YZ! d d � Z" d � Z# d d � Z$ d � Z% d � Z& d � Z' d � Z( d � Z) d � Z* e j+ d � � Z, e j+ d � � Z- d � Z. d � Z/ e d � Z0 d d! � Z2 d d" � Z3 d S($ i����N( t Uniont Listt Mappingt Anyt Sequencet Optionalt Tuplet Dictt Iteratori ( t
ReleaseKeyt AnyKeyt RootKeyt anystrt Signaturet RootKeyst rsa4096t typet kindt rolet serialt keyt gpgs /dev/shmt u t Errorc B s e Z RS( ( t __name__t
__module__( ( ( s) /usr/libexec/kcare/python/kcsig_verify.pyR s t latin1c C sk t | � } | t k r | S| t k r5 | j | � S| t k rQ t t | � � St d t | � � � d S( Ns Unsupported pae type ( R t btypet utypet encodet intt to_bytest strt
ValueError( t datat encodingt dtype( ( s) /usr/libexec/kcare/python/kcsig_verify.pyR s
c C sX t | � } | t k r | S| t k r5 | j d � S| t k rN | j d � St � d S( Ns utf-8( R t ntypeR t decodeR R t NotImplementedError( R" R$ ( ( s) /usr/libexec/kcare/python/kcsig_verify.pyt nstr' s
t wc C sC | d } t | | � � } | j | � Wd QXt j | | � d S( Ns .tmp( t opent writet ost rename( t fnamet contentt modet tmp_fnamet f( ( s) /usr/libexec/kcare/python/kcsig_verify.pyt atomic_write2 s
c C s# t | � � } | j � SWd QXd S( N( R* t read( R. R2 ( ( s) /usr/libexec/kcare/python/kcsig_verify.pyt read_file: s c C s t j t | � � S( N( t jsont loadsR5 ( R. ( ( s) /usr/libexec/kcare/python/kcsig_verify.pyt read_json? s c G sK d t | � } x4 | D], } t | � } | d t | � | f 7} q W| S( Ns %ds %d%s( t lenR ( t partst resultt pt bp( ( s) /usr/libexec/kcare/python/kcsig_verify.pyt paeC s
c C s! t g | D] } | | ^ q
� S( N( R> ( R" t fieldsR2 ( ( s) /usr/libexec/kcare/python/kcsig_verify.pyt
pae_fieldsL s c C s t | t | d � S( NR ( R@ t
PAE_FIELDS( R" ( ( s) /usr/libexec/kcare/python/kcsig_verify.pyt pae_typeQ s c C s1 | d t k r- t d t | d � � � n d S( NR s invalid key type: ( RA R! R( ( R ( ( s) /usr/libexec/kcare/python/kcsig_verify.pyt check_keyU s c c sX | r | VnF t j d t d d � �, } | j t | � � | j � | j VWd QXd S( Nt dirt prefixs kcsig-data-( t tempfilet NamedTemporaryFilet TMPDIRR+ R t flusht name( R" t data_is_fileR2 ( ( s) /usr/libexec/kcare/python/kcsig_verify.pyt
temp_datafileZ s
c c s6 t j d | d | � } z | VWd t j | � Xd S( NRE RD ( RF t mkdtempt shutilt rmtree( RE RD t temp_dir( ( s) /usr/libexec/kcare/python/kcsig_verify.pyt temp_directorye s c C s� t d t d d � �� } d d | d | d d | g } t j | d t j d
t j d t j �} | j | � \ } } | j d k r� t d
t | � d t | � � � n Wd QXd S( NRD RE s
kcsig-gpgtmp-R s --homedirs --keyrings --verifyt -t stdint stdoutt stderri s Verify error: s
( RQ RH t
subprocesst Popent PIPEt communicatet
returncodet ExceptionR( ( t keyfilet datafilet sigdatat tmp_dirt cmdR< RT RU ( ( s) /usr/libexec/kcare/python/kcsig_verify.pyt run_gpg_verifyn s *c C s� t | � t j d t d d � �q } | j t j t | d � � � | j � t | | � �/ } t j t | � � } t
| j | | � Wd QXWd QXd S( NRD RE s
kcsig-key-R ( RC RF RG RH R+ t base64t b64decodeR RI RL Ra RJ ( t signatureR R" RK t key_fileR] R^ ( ( s) /usr/libexec/kcare/python/kcsig_verify.pyt
verify_keyx s
c C s� d } i } x� | j � D]s \ } } | | k rA d | | <q n y t | | | | | � Wn# t k
r� } t | � | | <q X| d 7} q W| | f S( Ni s no corresponding root keyi ( t itemsRf R[ R ( t
signaturest keysR" RK t countt errorst keyidt sigt e( ( s) /usr/libexec/kcare/python/kcsig_verify.pyt verify_count� s
c C s | j d d � } | j d d � } i } | p3 t } i } x� | d j � D]� \ } } yr t | � | d | k r� d j | d | � | | <n7 | d | k r� d j | d | � | | <n
| | | <WqM t k
r� }
t |
� | | <qM qM XqM Wi } xf | j � D]X \ } } t | d
| d d t | � �\ } }
| | k rY|
| | <q | | | <q Wd } xo | j � D]a \ } } y% t | d
| | d | d
t
�Wn# t k
r�}
t |
� | | <qzX| d 7} qzW| st d t j
| � � � n d S( Nt thresholdi' t
min_seriali��Ri R s& invalid kind {0}, accepted list is {1}R s" invalid serial {0}, current is {1}Rh R" i RK i s! Error validating file signature: ( t gett AVAILABLE_KINDSRg RC t formatR[ R Ro RB Rf t TrueR R6 t dumps( R^ R] t root_keyst kindsRp Rq Rk t applicable_keysRl R Rn t
verified_keysRj t root_errors( ( s) /usr/libexec/kcare/python/kcsig_verify.pyt _verify� s>
)
%c C s2 t | � } t | � } t | | | d | �d S( NRx ( R8 R| ( t sigfileR] t rootfileRx R^ Rw ( ( s) /usr/libexec/kcare/python/kcsig_verify.pyt verify� s ( s types kindR s serials key(4 R, Rb RF RV R6 RN t
contextlibt Falset typingR R R R R R R R R t typesR R
R R R
R Rs RA RH R R R R% R[ R R R( R3 R5 R8 R> R@ RB RC t contextmanagerRL RQ Ra Rf Ro t NoneR| R ( ( ( s) /usr/libexec/kcare/python/kcsig_verify.pyt <module> s@ @1
+