Add "gpgkeypath" option to remotes
For Project Atomic, we already have RPM signatures which use files in `/etc/pki/rpm-gpg`. It's convenient to simply bind the OSTree remote configuration to those file paths, rather than having duplicate key data. This does mean that we need to parse the files for verification, so we end up importing them into the verifier's temporary keyring, which is a bit ugly, but it's what other projects do. Closes: https://github.com/ostreedev/ostree/issues/573 Closes: #575 Approved by: giuseppe
This commit is contained in:
1 parent
3cd5e6b41a
commit
f244c70277
6 files changed
+99
-5
No files matched your search
@@ -4282,6 +4282,7 @@ _ostree_repo_gpg_verify_data_internal (OstreeRepo *self,
|
||||
}
|
||||
else if (remote_name != NULL)
|
||||
{
|
||||
g_autofree char *gpgkeypath = NULL;
|
||||
/* Add the remote's keyring file if it exists. */
|
||||
|
||||
OstreeRemote *remote;
|
||||
@@ -4299,6 +4300,13 @@ _ostree_repo_gpg_verify_data_internal (OstreeRepo *self,
|
||||
add_global_keyring_dir = FALSE;
|
||||
}
|
||||
|
||||
if (!ot_keyfile_get_value_with_default (remote->options, remote->group, "gpgkeypath", NULL,
|
||||
&gpgkeypath, error))
|
||||
return NULL;
|
||||
|
||||
if (gpgkeypath)
|
||||
_ostree_gpg_verifier_add_key_ascii_file (verifier, gpgkeypath);
|
||||
|
||||
ost_remote_unref (remote);
|
||||
}
|
||||
|
||||
|
||||
Reference in new issue
Block a user