CasperSecurity
o
4��fg) � @ s, d Z ddlmZ ddlZddlZddlZddlZddlZddlZddl Z ddl
Z
ddl
m Z ddl
mZmZmZ G dd� de�ZG dd � d e�ZG d
d � d e�Zd d
� Zdd� Zdd� Zdd� Zdd� Zdd� Zdd� Z dd� Z d d � Z d d � Z e d kr�d!d"� d#d"� e
�!� e � D ]Z"e#e"� q�dS dS )$z4Handle GnuPG keys used to trust signed repositories.� )�print_functionN)�gettext)�List�Optional�Tuplec @ s e Zd ZdS )� AptKeyErrorN)�__name__�
__module__� __qualname__� r r �*/usr/lib/python3/dist-packages/apt/auth.pyr + s r c @ s e Zd ZdZdS )�AptKeyIDTooShortErrorz!Internal class do not rely on it.N)r r r
�__doc__r r r r r
/ s r
c @ s e Zd ZdZdd� Zdd� ZdS )�
TrustedKeyzRepresents a trusted key.c C s || _ t|�| _|| _|| _d S )N)�raw_name�_�name�keyid�date)�selfr r r r r r �__init__7 s
zTrustedKey.__init__c C s d| j | j| jf S )Nz%s
%s %s)r r r )r r r r �__str__? s zTrustedKey.__str__N)r r r
r r r r r r r r 3 s r c O s d}t j�dd�g}|�| � tj�� }d|d< d|d< zet j�d�d kr@tj d
d d �}|�
t j� � � d
�� |�
� |j|d< tj||dtjtjtjd�}|�dd�}|�|�\}}|jrltd|jd�|�||f ��|rttj�
|� |�� W |dur�|�� S S |dur�|�� w w )z0Run the apt-key script with the given arguments.NzDir::Bin::Apt-Keyz/usr/bin/apt-key�C�LANG�1�$APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE�Dir�/zapt-keyz.conf)�prefix�suffixzUTF-8�
APT_CONFIGT)�env�universal_newlines�stdin�stdout�stderrr# zGThe apt-key script failed with return code %s:
%s
stdout: %s
stderr: %s� )�apt_pkg�config� find_file�extend�os�environ�copy�find_dir�tempfile�NamedTemporaryFile�write�dump�encode�flushr �
subprocess�Popen�PIPE�get� communicate�
returncoder �join�sysr% �strip�close) �args�kwargs�conf�cmdr! �procr# �outputr% r r r �_call_apt_key_scriptD sH
�
� ���
�
�rE c C s@ t j�| �s td| ��t �| t j�std| ��td| � dS )z�Import a GnuPG key file to trust repositores signed by it.
Keyword arguments:
filename -- the absolute path to the public GnuPG key file
z An absolute path is required: %sz Key file cannot be accessed: %s�addN)r+ �path�abspathr �access�R_OKrE )�filenamer r r �add_key_from_fileq s
rL c
C s` t �� }z zt| ||� W n ty � w W dd� }tj||d� dS dd� }tj||d� w )z�Import a GnuPG key file to trust repositores signed by it.
Keyword arguments:
keyid -- the long keyid (fingerprint) of the key, e.g.
A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553
keyserver -- the URL or hostname of the key server
c S s$ t |d t�r|d jtjkrd S � )N� )�
isinstance�OSError�errno�ENOENT)�funcrG �exc_infor r r �onerror� s z'add_key_from_keyserver.<locals>.onerror)rT N)r/ �mkdtemp�_add_key_from_keyserver� Exception�shutil�rmtree)r � keyserver�tmp_keyring_dirrT r r r �add_key_from_keyserver s ���r\ c C sJ t | �dd��dd��dk rtd��tj�|d�}tj�|d�}dd d
d |g}t�|d |d
|d|d| g �}|dkrBtd|| f ��tj�|d�}t�|d
|d|d| g �}|dkr_td| ��tj |d
|ddddg tj
dd�� � d }d } |� � D ]}
|
�
d �r�|
�d �d } nqz| �dd��� } | | kr�td|| f ��t|� d S ) Nr& � �0xg D@z,Only fingerprints (v4, 160bit) are supportedz secring.gpgz pubring.gpg�gpgz--no-default-keyringz --no-optionsz --homedirz--secret-keyringz --keyringz --keyserverz--recvr z recv from '%s' failed for '%s'zexport-keyring.gpgz--outputz--exportzexport of '%s' failedz
--fingerprint�--batch�--fixed-list-mode�
--with-colonsT)r$ r" zfpr:�:� )�len�replacer
r+ rG r; r5 �callr r6 r7 r9 �
splitlines�
startswith�split�upperrL ) r rZ r[ �tmp_secret_keyring� tmp_keyring�gpg_default_options�res�tmp_export_keyringrD �got_fingerprint�line�signing_key_fingerprintr r r rV � sn ����
�
�� �
��� rV c C s t ddddd| d� dS )z�Import a GnuPG key to trust repositores signed by it.
Keyword arguments:
content -- the content of the GnuPG public key
�advz--quietr` z--import�-)r# N�rE )�contentr r r �add_key� s
�rx c C s t d| � dS )z�Remove a GnuPG key to no longer trust repositores signed by it.
Keyword arguments:
fingerprint -- the fingerprint identifying the key
�rmNrv �� fingerprintr r r �
remove_key� s r| c C s
t d| �S )zxReturn the GnuPG key in text format.
Keyword arguments:
fingerprint -- the fingerprint identifying the key
�exportrv rz r r r �
export_key� s
r~ c C � t d�S )a Update the local keyring with the archive keyring and remove from
the local keyring the archive keys which are no longer valid. The
archive keyring is shipped in the archive-keyring package of your
distribution, e.g. the debian-archive-keyring package in Debian.
�updaterv r r r r r� s r� c C r )ay Work similar to the update command above, but get the archive
keyring from an URI instead and validate it against a master key.
This requires an installed wget(1) and an APT build configured to
have a server to fetch from and a master keyring to validate. APT
in Debian does not support this command and relies on update
instead, but Ubuntu's APT does.
z
net-updaterv r r r r �
net_update s r� c C sx t ddddd�} g }| �d�D ]*}|�d�}|d d kr |d
}|d d kr9|d }|d
}t|||�}|�|� q|S )zaReturns a list of TrustedKey instances for each key which is
used to trust repositories.
rt rb r` ra z --list-keys�
rc r �pub� �uidrd � )rE rj r �append)rD ro rr �fieldsr r� �
creation_date�keyr r r � list_keys s �
�r� �__main__c C r )Nz;Ubuntu Archive Automatic Signing Key <ftpmaster@ubuntu.com>�r r r r r �<lambda>0 � r� c C r )Nz:Ubuntu CD Image Automatic Signing Key <cdimage@ubuntu.com>r� r r r r r� 1 r� )$r �
__future__r rP r+ �os.pathrX r5 r< r/ r' r r �typingr r r rW r r
�objectr rE rL r\ rV rx r| r~ r� r� r� r �init� trusted_key�printr r r r �<module> sB -H
�