You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
122 lines
6.2 KiB
122 lines
6.2 KiB
#!/bin/bash
|
|
|
|
set -eu -o pipefail
|
|
|
|
# NOTE: apt-key is gone as of apt version 2.9.17, and /etc/apt/trusted.gpg.d
|
|
# got deprecated with version 2.9.24. But key files might still be in
|
|
# /etc/apt/trusted.gpg.d, and there's no interface/tooling available to list
|
|
# trusted key. So rely on apt-key only on Debian bookworm.
|
|
|
|
DEBIAN_RELEASE=$(sed -e 's/\([0-9]*\)\..*/\1/' /etc/debian_version)
|
|
|
|
case "${DEBIAN_RELEASE}" in
|
|
12)
|
|
# note: we need to avoid this apt-key warning on stderr:
|
|
# Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)).
|
|
# otherwise the output of this script doesn't match what we expect
|
|
# from within our system-tests
|
|
|
|
# check for expired key within apt's trust store:
|
|
if apt-key list 2>&1 | grep -q 'expired:' ; then
|
|
echo "Error: Found expired keys in apt-key." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# ensure old dsa1024 sipwise apt key isn't present:
|
|
if apt-key list --with-colons 2>/dev/null | grep '^pub' | cut -d':' -f 5 | grep -Eo '.{8}$' | grep -q 'A42C4F2A' ; then
|
|
echo "Error: Found deprecated dsa1024 apt key A42C4F2A" >&2
|
|
exit 1
|
|
fi
|
|
;;
|
|
*)
|
|
# nothing to do with apt-key for trixie and newer
|
|
;;
|
|
esac
|
|
|
|
apt_etc_dir=$(apt-config dump --format '%v%n' Dir::Etc | head -1)
|
|
apt_etc_trusted_parts=$(apt-config dump --format '%v%n' Dir::Etc::trustedparts)
|
|
apt_trusted_dir="/${apt_etc_dir=}"/"${apt_etc_trusted_parts}"
|
|
|
|
# make sure we don't have any unexpected files inside apt_trusted_dir,
|
|
# which defaults to /etc/apt/trusted.gpg.d
|
|
for file in "${apt_trusted_dir}"/* ; do
|
|
test -f "${file}" || continue
|
|
case "$(basename "${file}")" in
|
|
debian-archive-trixie-automatic.asc|debian-archive-trixie-security-automatic.asc|debian-archive-trixie-stable.asc)
|
|
;;
|
|
debian-archive-bookworm-automatic.asc|debian-archive-bookworm-security-automatic.asc|debian-archive-bookworm-stable.asc)
|
|
;;
|
|
debian-archive-bullseye-automatic.asc|debian-archive-bullseye-security-automatic.asc|debian-archive-bullseye-stable.asc)
|
|
;;
|
|
debian-archive-buster-automatic.asc|debian-archive-buster-security-automatic.asc|debian-archive-buster-stable.asc)
|
|
;;
|
|
sipwise-archive-2015.gpg|sipwise-autobuilder-2011.gpg)
|
|
;;
|
|
sipwise-mr10.5.gpg| sipwise-mr11.5.gpg| sipwise_mr12_5.gpg)
|
|
;;
|
|
*)
|
|
echo "Error: Unexpected file '${file}' inside '${apt_trusted_dir}'" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
done
|
|
|
|
# check for expired keys
|
|
tmpdir=$(mktemp -d --tmpdir ngcp-system-tests-gpg-home.XXXXXXXXXX) # avoid touching ~/.gnupg or alike
|
|
chmod 700 "${tmpdir}"
|
|
for file in "${apt_trusted_dir}"/* ; do
|
|
test -f "${file}" || continue
|
|
if gpg --homedir "${tmpdir}" "${file}" 2>/dev/null | grep -q expired ; then
|
|
echo "Error: Expired key present in '${file}':" >&2
|
|
gpg "${tmpdir}""${file}"
|
|
fi
|
|
done
|
|
rm -rf "${tmpdir}"
|
|
|
|
# some files might be missing (this is OK),
|
|
# but the existing ones need to match what we expect
|
|
pushd "${apt_trusted_dir}" >/dev/null
|
|
case "${DEBIAN_RELEASE}" in
|
|
# bookworm
|
|
12)
|
|
echo "c2a9a16fde95e037bafd0fa6b7e31f41b4ff1e85851de5558f19a2a2f0e955e2 debian-archive-bookworm-automatic.asc
|
|
74f81645b4e3156d1e9a88c8dd9259271b89c7099d64af89a2a6996b592faa1f debian-archive-bookworm-security-automatic.asc
|
|
521e9f6a9f9b92ee8d5ce74345e8cfd04028dae9db6f571259d584b293549824 debian-archive-bookworm-stable.asc
|
|
0b7dc94b880f0b63e2093394b113cafd870badb86e020a35614f49b9d83beb1e debian-archive-bullseye-automatic.asc
|
|
716e79393c724d14ecba8be46e99ecbe1b689f67ceff3cb3cab28f6e69e8b8b8 debian-archive-bullseye-security-automatic.asc
|
|
fb260ce8521a2faa4937d98a29a5347807e10614b97d510fbabe5480c803bda9 debian-archive-bullseye-stable.asc
|
|
9c854992fc6c423efe8622c3c326a66e73268995ecbe8f685129063206a18043 debian-archive-buster-automatic.asc
|
|
4cf886d6df0fc1c185ce9fb085d1cd8d678bc460e6267d80a833d7ea507a0fbd debian-archive-buster-security-automatic.asc
|
|
ca9bd1a0b3743495ae45693c6d4e54abadcffb242d72df15eda5b28e4ff385fa debian-archive-buster-stable.asc
|
|
811f878f5320fc8563a70b166d2c27ec060b4397ca021702f433bc4659336b9b sipwise-archive-2015.gpg
|
|
f00aad42a76ddec341fb2c67b45b41e2d1c19d67bd239196cd52488c4b7da4a0 sipwise-autobuilder-2011.gpg
|
|
06cd0ec90ce6fe35917debde9976e6ccf24350e6db492ab7b1baab450a58b9af sipwise-mr10.5.gpg
|
|
ff8a919dce361dca2a1a67c7d106ed57159ea362394b2c0f5c622a64382103e0 sipwise-mr11.5.gpg
|
|
e58c32479486501226872a1dc27f41083d636ff21876306f9e35a72c7197dd6a sipwise_mr12_5.gpg" | sha256sum -c --quiet --ignore-missing
|
|
;;
|
|
# trixie and newer
|
|
*)
|
|
echo "c2a9a16fde95e037bafd0fa6b7e31f41b4ff1e85851de5558f19a2a2f0e955e2 debian-archive-bookworm-automatic.asc
|
|
74f81645b4e3156d1e9a88c8dd9259271b89c7099d64af89a2a6996b592faa1f debian-archive-bookworm-security-automatic.asc
|
|
521e9f6a9f9b92ee8d5ce74345e8cfd04028dae9db6f571259d584b293549824 debian-archive-bookworm-stable.asc
|
|
0b7dc94b880f0b63e2093394b113cafd870badb86e020a35614f49b9d83beb1e debian-archive-bullseye-automatic.asc
|
|
716e79393c724d14ecba8be46e99ecbe1b689f67ceff3cb3cab28f6e69e8b8b8 debian-archive-bullseye-security-automatic.asc
|
|
fb260ce8521a2faa4937d98a29a5347807e10614b97d510fbabe5480c803bda9 debian-archive-bullseye-stable.asc
|
|
9c854992fc6c423efe8622c3c326a66e73268995ecbe8f685129063206a18043 debian-archive-buster-automatic.asc
|
|
4cf886d6df0fc1c185ce9fb085d1cd8d678bc460e6267d80a833d7ea507a0fbd debian-archive-buster-security-automatic.asc
|
|
ca9bd1a0b3743495ae45693c6d4e54abadcffb242d72df15eda5b28e4ff385fa debian-archive-buster-stable.asc
|
|
4d097bb93f83d731f475c5b92a0c2fcf108cfce1d4932792fca72d00b48d198b debian-archive-trixie-stable.asc
|
|
6f1d277429dd7ffedcc6f8688a7ad9a458859b1139ffa026d1eeaadcbffb0da7 debian-archive-trixie-automatic.asc
|
|
844c07d242db37f283afab9d5531270a0550841e90f9f1a9c3bd599722b808b7 debian-archive-trixie-security-automatic.asc
|
|
88d92e09810a13b5e749839bca89029fbbe73cca261a3a26712a560cc7b50e47 sipwise-archive-2015.gpg
|
|
b64656d5f8fa0a636d46084bda74e16cef502d3d48e8ed101c6386ad8bbcacef sipwise-autobuilder-2011.gpg
|
|
06cd0ec90ce6fe35917debde9976e6ccf24350e6db492ab7b1baab450a58b9af sipwise-mr10.5.gpg
|
|
ff8a919dce361dca2a1a67c7d106ed57159ea362394b2c0f5c622a64382103e0 sipwise-mr11.5.gpg
|
|
e58c32479486501226872a1dc27f41083d636ff21876306f9e35a72c7197dd6a sipwise_mr12_5.gpg" | sha256sum -c --quiet --ignore-missing
|
|
;;
|
|
esac
|
|
popd >/dev/null
|
|
|
|
# this is the expected output of templates/140_apt-keys.yaml
|
|
echo "OK"
|