diff options
| author | Timo Teras <timo.teras@iki.fi> | 2009-07-22 16:06:34 +0300 |
|---|---|---|
| committer | Timo Teras <timo.teras@iki.fi> | 2009-07-22 16:06:34 +0300 |
| commit | 5375efac1af6488f8af5063fab243fe844334f05 (patch) | |
| tree | 70d3a4c22f45f4960276de6261e967fe8b5d1045 /src/package.c | |
| parent | 23582a0ec5e52489c22c15a1a77f32de514cf5d9 (diff) | |
| download | apk-tools-5375efac1af6488f8af5063fab243fe844334f05.tar.bz2 apk-tools-5375efac1af6488f8af5063fab243fe844334f05.tar.xz | |
apk: allow-untrusted option
to not make hard error of untrusted or missing signatures
Diffstat (limited to 'src/package.c')
| -rw-r--r-- | src/package.c | 25 |
1 files changed, 15 insertions, 10 deletions
diff --git a/src/package.c b/src/package.c index e480c6f..5e4a3d2 100644 --- a/src/package.c +++ b/src/package.c @@ -453,16 +453,20 @@ int apk_sign_ctx_mpart_cb(void *ctx, int part, apk_blob_t data) return 0; /* Verify the signature if we have public key */ - if (sctx->action == APK_SIGN_VERIFY && - sctx->signature.pkey != NULL) { - r = EVP_VerifyFinal(&sctx->mdctx, - (unsigned char *) sctx->signature.data.ptr, - sctx->signature.data.len, - sctx->signature.pkey); - if (r != 1) - return -EKEYREJECTED; + if (sctx->action == APK_SIGN_VERIFY) { + if (sctx->signature.pkey == NULL) { + if (!(apk_flags & APK_ALLOW_UNTRUSTED)) + return -ENOKEY; + } else { + r = EVP_VerifyFinal(&sctx->mdctx, + (unsigned char *) sctx->signature.data.ptr, + sctx->signature.data.len, + sctx->signature.pkey); + if (r != 1) + return -EKEYREJECTED; - sctx->control_verified = 1; + sctx->control_verified = 1; + } EVP_DigestInit_ex(&sctx->mdctx, sctx->md, NULL); return 0; } else if (sctx->action == APK_SIGN_GENERATE) { @@ -492,7 +496,8 @@ int apk_sign_ctx_mpart_cb(void *ctx, int part, apk_blob_t data) EVP_MD_CTX_size(&sctx->mdctx)) != 0) return -EKEYREJECTED; sctx->data_verified = 1; - if (!sctx->control_verified) + if (!(apk_flags & APK_ALLOW_UNTRUSTED) && + !sctx->control_verified) return -ENOKEY; } else if (sctx->action == APK_SIGN_VERIFY) { if (sctx->signature.pkey == NULL) |