lib/repo: Search a list of paths in gpgkeypath for gpg keys

This allows specifying gpgpath as list of
paths that can point to a file or a directory. If a directory path
is given, paths to all regular files in the directory are added
to the remote as gpg ascii keys. If the path is not a directory,
the file is directly added (whether regular file, empty - errors
will be reported later when verifying gpg keys e.g. when pulling).

Adding the gpgkeypath property looks like:

ostree --repo=repo remote add --set=gpgpath="/path/key1.asc,/path/keys.d" R1 https://example.com/some/remote/ostree/repo

Closes #773

Closes: #1773
Approved by: cgwalters

tests/test-remote-gpg-import.sh

@@ -154,6 +154,79 @@ ${OSTREE} prune --refs-only
 ${OSTREE} remote add --set=gpgkeypath=${test_tmpdir}/gpghome/key3.asc R4 $(cat httpd-address)/ostree/gnomerepo
 ${OSTREE} pull R4:main >/dev/null
 
+# Test gpgkeypath success with multiple keys to try
+${OSTREE} remote add --set=gpgkeypath=${test_tmpdir}/gpghome/key1.asc,${test_tmpdir}/gpghome/key2.asc,${test_tmpdir}/gpghome/key3.asc R7 $(cat httpd-address)/ostree/gnomerepo
+${OSTREE} pull R7:main >/dev/null
+
+# Test gpgkeypath failure with multiple keys but none in keyring
+${OSTREE} remote add --set=gpgkeypath=${test_tmpdir}/gpghome/key1.asc,${test_tmpdir}/gpghome/key2.asc R8 $(cat httpd-address)/ostree/gnomerepo
+if ${OSTREE} pull R8:main 2>err.txt; then
+    assert_not_reached "Unexpectedly succeeded at pulling with different key"
+fi
+assert_file_has_content err.txt "GPG signatures found, but none are in trusted keyring"
+
+# Test gpgkeypath success with directory containing a valid key
+${OSTREE} remote add --set=gpgkeypath=${test_tmpdir}/gpghome/ R9 $(cat httpd-address)/ostree/gnomerepo
+${OSTREE} pull R9:main >/dev/null
+
+# Test gpgkeypath failure with nonexistent directory
+${OSTREE} remote add --set=gpgkeypath=${test_tmpdir}/gpghome/INVALIDKEYDIRPATH/ R10 $(cat httpd-address)/ostree/gnomerepo
+if ${OSTREE} pull R10:main 2>err.txt; then
+    assert_not_reached "Unexpectedly succeeded at pulling with nonexistent key directory"
+fi
+assert_file_has_content err.txt "INVALIDKEYDIRPATH.*No such file or directory"
+
+# Test gpgkeypath failure with a directory containing a valid key, and a nonexistent key
+${OSTREE} remote add --set=gpgkeypath=${test_tmpdir}/gpghome/,${test_tmpdir}/gpghome/INVALIDKEYPATH.asc R11 $(cat httpd-address)/ostree/gnomerepo
+if ${OSTREE} pull R11:main 2>err.txt; then
+    assert_not_reached "Unexpectedly succeeded at pulling with nonexistent key"
+fi
+assert_file_has_content err.txt "INVALIDKEYPATH.*No such file or directory"
+
+# Test gpgkeypath success with a directory containing a valid key, and a key not in keyring
+${OSTREE} remote add --set=gpgkeypath=${test_tmpdir}/gpghome/,${test_tmpdir}/gpghome/key1.asc R12 $(cat httpd-address)/ostree/gnomerepo
+${OSTREE} pull R12:main >/dev/null
+
+# Test gpgkeypath failure with a nonexistent directory, and a valid key
+${OSTREE} remote add --set=gpgkeypath=${test_tmpdir}/gpghome/INVALIDKEYDIRPATH/,${test_tmpdir}/gpghome/key3.asc R13 $(cat httpd-address)/ostree/gnomerepo
+if ${OSTREE} pull R13:main 2>err.txt; then
+    assert_not_reached "Unexpectedly succeeded at pulling with nonexistent key directory"
+fi
+assert_file_has_content err.txt "INVALIDKEYDIRPATH.*No such file or directory"
+
+# Test gpgkeypath failure with a nonexistent directory and a nonexistent key
+${OSTREE} remote add --set=gpgkeypath=${test_tmpdir}/gpghome/INVALIDKEYDIRPATH/,${test_tmpdir}/gpghome/INVALIDKEYPATH.asc R14 $(cat httpd-address)/ostree/gnomerepo
+if ${OSTREE} pull R14:main 2>err.txt; then
+    assert_not_reached "Unexpectedly succeeded at pulling with nonexistent key"
+fi
+assert_file_has_content err.txt "INVALIDKEYDIRPATH.*No such file or directory"
+
+# Test gpgkeypath success for no trailing slash in directory path
+${OSTREE} remote add --set=gpgkeypath=${test_tmpdir}/gpghome R15 $(cat httpd-address)/ostree/gnomerepo
+${OSTREE} pull R15:main >/dev/null
+
+# Test gpgkeypath failure with prefixed separator giving an empty path, and a nonexistent key
+${OSTREE} remote add --set=gpgkeypath=,${test_tmpdir}/gpghome/INVALIDKEYPATH.asc R16 $(cat httpd-address)/ostree/gnomerepo
+if ${OSTREE} pull R16:main 2>err.txt; then
+    assert_not_reached "Unexpectedly succeeded at pulling with nonexistent key"
+fi
+assert_file_has_content err.txt "().*No such file or directory"
+
+# Test gpgkeypath success with suffixed separator
+${OSTREE} remote add --set=gpgkeypath=${test_tmpdir}/gpghome/key3.asc, R17 $(cat httpd-address)/ostree/gnomerepo
+${OSTREE} pull R17:main >/dev/null
+
+# Test gpgkeypath success with multiple keys specified, with semicolons
+${OSTREE} remote add --set=gpgkeypath="${test_tmpdir}/gpghome/key1.asc;${test_tmpdir}/gpghome/key2.asc;${test_tmpdir}/gpghome/key3.asc" R18 $(cat httpd-address)/ostree/gnomerepo
+${OSTREE} pull R18:main >/dev/null
+
+# Test gpgkeypath failure multiple keys specified, with mix of commas and semicolons
+${OSTREE} remote add --set=gpgkeypath="${test_tmpdir}/gpghome/key1.asc,${test_tmpdir}/gpghome/key2.asc;${test_tmpdir}/gpghome/key3.asc" R19 $(cat httpd-address)/ostree/gnomerepo
+if ${OSTREE} pull R19:main 2>err.txt; then
+    assert_not_reached "Unexpectedly succeeded at pulling with invalid gpgkeypath value"
+fi
+assert_file_has_content err.txt ".*key value list contains more than one separator"
+
 rm repo/refs/remotes/* -rf
 ${OSTREE} prune --refs-only