From 56d51fcd6be992c7bbc38431db06817816c1e08e Mon Sep 17 00:00:00 2001
From: Hans-Christoph Steiner <hans@eds.org>
Date: Thu, 3 Nov 2016 10:26:38 +0100
Subject: [PATCH] gpg-sign all valid files in the repo, including source
 tarballs

This makes sure there is a GPG signature on any file that is included in
the repo, including APKs, OBB, source tarballs, media files, OTA update
ZIPs, etc.  Having a GPG signature is more important on non-APK files since
they mostly do not have any signature mechanism of their own.

This also adds basic tests of adding non-APK/OBB files to a repo with
`fdroid update`.

closes #232
---
 examples/config.py                               |   2 +-
 fdroidserver/common.py                           |  11 +++++++++++
 fdroidserver/gpgsign.py                          |  15 +++++++++------
 fdroidserver/update.py                           |   4 +---
 tests/gnupghome/pubring.gpg                      | Bin 0 -> 724 bytes
 tests/gnupghome/random_seed                      | Bin 0 -> 600 bytes
 tests/gnupghome/secring.gpg                      | Bin 0 -> 1388 bytes
 tests/gnupghome/trustdb.gpg                      | Bin 0 -> 1280 bytes
 tests/repo/fake.ota.update_1234.zip              | Bin 0 -> 233 bytes
 .../repo/obb.main.twoversions_1101617_src.tar.gz | Bin 0 -> 150 bytes
 tests/run-tests                                  |  14 +++++++++++++-
 11 files changed, 35 insertions(+), 11 deletions(-)
 create mode 100644 tests/gnupghome/pubring.gpg
 create mode 100644 tests/gnupghome/random_seed
 create mode 100644 tests/gnupghome/secring.gpg
 create mode 100644 tests/gnupghome/trustdb.gpg
 create mode 100644 tests/repo/fake.ota.update_1234.zip
 create mode 100644 tests/repo/obb.main.twoversions_1101617_src.tar.gz

diff --git a/examples/config.py b/examples/config.py
index 63edc718..3b1ab95c 100644
--- a/examples/config.py
+++ b/examples/config.py
@@ -86,7 +86,7 @@ The repository of older versions of applications from the main demo repository.
 # current_version_name_source = 'id'
 
 # Optionally, override home directory for gpg
-# gpghome = /home/fdroid/somewhere/else/.gnupg
+# gpghome = '/home/fdroid/somewhere/else/.gnupg'
 
 # The ID of a GPG key for making detached signatures for apks. Optional.
 # gpgkey = '1DBA2E89'
diff --git a/fdroidserver/common.py b/fdroidserver/common.py
index b653d5a8..08708f31 100644
--- a/fdroidserver/common.py
+++ b/fdroidserver/common.py
@@ -2084,3 +2084,14 @@ def get_per_app_repos():
                 repos.append(d)
         break
     return repos
+
+
+def is_repo_file(filename):
+    '''Whether the file in a repo is a build product to be delivered to users'''
+    return os.path.isfile(filename) \
+        and os.path.basename(filename) not in [
+            'index.jar',
+            'index.xml',
+            'index.html',
+            'categories.txt',
+        ]
diff --git a/fdroidserver/gpgsign.py b/fdroidserver/gpgsign.py
index 41b5a43f..4c9cf6bb 100644
--- a/fdroidserver/gpgsign.py
+++ b/fdroidserver/gpgsign.py
@@ -50,10 +50,13 @@ def main():
             sys.exit(1)
 
         # Process any apks that are waiting to be signed...
-        for apkfile in sorted(glob.glob(os.path.join(output_dir, '*.apk'))):
-
-            apkfilename = os.path.basename(apkfile)
-            sigfilename = apkfilename + ".asc"
+        for f in sorted(glob.glob(os.path.join(output_dir, '*.*'))):
+            if common.get_file_extension(f) == 'asc':
+                continue
+            if not common.is_repo_file(f):
+                continue
+            filename = os.path.basename(f)
+            sigfilename = filename + ".asc"
             sigpath = os.path.join(output_dir, sigfilename)
 
             if not os.path.exists(sigpath):
@@ -64,13 +67,13 @@ def main():
                     gpgargs.extend(['--homedir', config['gpghome']])
                 if 'gpgkey' in config:
                     gpgargs.extend(['--local-user', config['gpgkey']])
-                gpgargs.append(os.path.join(output_dir, apkfilename))
+                gpgargs.append(os.path.join(output_dir, filename))
                 p = FDroidPopen(gpgargs)
                 if p.returncode != 0:
                     logging.error("Signing failed.")
                     sys.exit(1)
 
-                logging.info('Signed ' + apkfilename)
+                logging.info('Signed ' + filename)
 
 
 if __name__ == "__main__":
diff --git a/fdroidserver/update.py b/fdroidserver/update.py
index cebd5a92..110de3ef 100644
--- a/fdroidserver/update.py
+++ b/fdroidserver/update.py
@@ -517,13 +517,11 @@ def scan_repo_files(apkcache, repodir, knownapks, use_date_from_file=False):
     cachechanged = False
     repo_files = []
     for name in os.listdir(repodir):
-        if name in ['index.jar', 'index.xml', 'index.html', 'categories.txt', ]:
-            continue
         file_extension = common.get_file_extension(name)
         if file_extension == 'apk' or file_extension == 'obb':
             continue
         filename = os.path.join(repodir, name)
-        if not os.path.isfile(filename):
+        if not common.is_repo_file(name):
             continue
         stat = os.stat(filename)
         if stat.st_size == 0:
diff --git a/tests/gnupghome/pubring.gpg b/tests/gnupghome/pubring.gpg
new file mode 100644
index 0000000000000000000000000000000000000000..fc60c42a12c6b85fc4af9da6199c1f4013eef803
GIT binary patch
literal 724
zcmbQy%Mu~=kDrl+VXtfG<-5BsEZ=f!j&#0qN!X^hO2W*irfq9;VV<wcaX){@iGz{<
z;!kS!&+}lmSbAY0)7;07rJkoUe!45O-zxf`;G0zNly&U`)%CnH)*0v}&GoZkK3G$d
z|7p!dd&5l<Pueuz&oy~AEn<^KSHVR26TI6`ZOKb(X5#(OC4JPSUcD%kL6DJwaZ8|E
zVs@&6o32YyerAe7NNRD3LU3k!US?jpf_G}Af<|6yS!$6&X>qDTNk(R|LRx;2LSkMe
zkPTFjR9d1?0@P8gsbG@^G{yl$*mdk+5oTm!P-0~Qd6Y?-nT?y1gPoa)O_YO)lZ%^0
zjER|%Nsf_8yn%s>Q$Xz6k;~@_zyG!lXJME+Rq*YFQ+pD6>ekKcIp!(haYahc_?6ZI
zyX%d8`zMNBTV{U#z5MKJbDnUCxhY*%v2`$Lco^TF@n-T*o+4%mIqv`3529UXsC8{!
zR9<ra$)cy6JJ!}%A59To<?_Edxs$#4S;L&TwOMma_5~>}b-7jBu;Jxefx>c`j(V+*
zHJ2DH<2EocFz<lJ&xs}Z3!aCEPJ18rs=k+%Bl<*rx^HfSq>)g?p*h_1q^9hiqSckE
zTguS>JpMwS{*%C&KP&z%Q)w)n+G+SQ$ofZAnP0KwrgW}g)<aGIKF6B9&Aw&ta%}&U
zbMvROvp;>=?x-o9Df0I0x&51u<h8!-S^USj$Mn-5Bf-vlJY1U|J~$H$j-QVCEE2%L
z<b(w#4|15X|6~52w`OkIo9(XhB~@bFUyaS8V|<kwotFkr?C!n7Y1CHI<$KgHfMM(Q
z6Z@WNy?Ats$JV83@{S)%J15V5=CrNiRmJhylXv?mHmJ`0w8e1Yipz>tvUgmVCh#_9
xZxUw=7vCu(y<hCF{qn21Uw^(+@87H*%f|nJrQuck4TTm>y+^u-&Pam73;=z?Gz0(u

literal 0
HcmV?d00001

diff --git a/tests/gnupghome/random_seed b/tests/gnupghome/random_seed
new file mode 100644
index 0000000000000000000000000000000000000000..cb41f6e0107d690b8d2aec094ed6e7b10648c86d
GIT binary patch
literal 600
zcmV-e0;m1-T`r;8DQxp34*eCDD#z{;y@dF;VHekN60OR4My2@deo&N*Omm?%0ldsV
z9=*Fg<f>RYYJv49GmT(8c&wU`%`)R)ya9Z@Yaqn<=~6J{b>i7ZFrU*ACe`%I@pX#^
zKbko|9)MpiW$Fjt!EB813PK>ap!JCL3lr@0!4}!4F4JrZyy|0C<OlG|UpJxCJSOAs
zLPv5O0qGmMps)dO*C9LEA5LB1<Exdxld3&X;A^P(XVq0PH0ifF164X*xLwH9RFhTy
zPaw7qzxKYt#XhZV!$d>IGqmCM>qQ_{{aNJr@51lFjRO@}mVhI<hlGg0DT1wibg`P*
zzB2BNJxiP|Ag~D_Ra?(dsu1j0ZrZ$?4{(W1aN<FrH5?<oa$g|35D&Q-cuOIiGeG5>
zcWjC~FO~#W8(tZ3Dk93K&|}2n&4}u!hp+Vxd&-<fle&i0h432re?60<0il^t4U05c
zu!Q<hk+$NSG8y1UK$8_|PfByB=q$rjCwAzIdf)waVDSCkt}6B!=XO)-$wi@h>|r>x
zAA;fag&I>Q*WO@tA8=^xj#7ePTAUPcKe4H)G5<bz6%J~50VtLDQF=^r+vwr`sgM8g
z*XRwfDl^17boK7F68`WL4Pc*ILZjV8a(t!G0CKbO;?-ALAt6H|{Upp}=|d4)d<>nm
z15?r=X7*gm9gmGzDnaEr?mi7{H)CII`y_YZOWxww+Xy*q&_9I;4KOtd6S>maCi8fn
mWPbmrC!LTJ{9oF=FDJ1W(n7{Hbof>h8d3JB+@GwcYCa1GUM(L0

literal 0
HcmV?d00001

diff --git a/tests/gnupghome/secring.gpg b/tests/gnupghome/secring.gpg
new file mode 100644
index 0000000000000000000000000000000000000000..20b160863a87ac3b36fa315feeba66ebdf3b87bc
GIT binary patch
literal 1388
zcmV-y1(W)f0oVjs8vYLf1OUB7Rny(N(5JM@oEvW=bXKzMA`=73mbQjO1D`Dj-*33c
z!CC%a$tjPXNCP;f(4hjI<3V*v%4qpVBL~`Y@E}cMaODN9;3cmOn65A`Vx3Mr1HpWB
zZ}P0sKQXcx<c28koiyf_Sh6UJaFHL#4Y$g)Zf1i54e*K^#Wa5>a#a8k0RRC21OHEu
z9e2JCL6<fsGrvxiV_NLRMO`E7UN)sOV<=x3i$I<?dK?%N@b0lHQqWV_R9@1^M^|NZ
z8w<?3OfCs@=AN8`XVW0fd2QXw^9>`7aO4gGYa!SIf*FcQx={r#_}<49*%~M!lQ}dn
zQh}2u3ALIuoqjepF3Jk2#K~tIlj8ya*!CHsxk%Dq&72mgZ>yrmE-6^$M{FTGx?;9C
zn_w5h7W^bgGHf;JXzy6ElgmbTWZ0&Ytk8zd>PW*;*<oiV0s!Arx)nVV7!+nGor!)C
z(5#wpj$mvUf%uB|)moc_wHoh(EF?<`<#AJ^Iu)})g18iBP5lIUo;M_Il;~8g=pzCD
za#R7ny%Ik*K9riRR2K%fjg?1VKrKhTH~AP`Kop(O)v+Ii5Wg|%(wfaa9iyvzExbdE
z^?^-36bqCkQ1E~BlRC6fMqz7ZAVw`ja&Kv5AXH^@bRbh{XKrb3XCO;uc_1imWp-t9
zAa!$PAarPHb0B7Kav))Dd30!LZf783b#x$fWpi|MDIh#%VQXbTW?^e(K8Uyk69EDM
zA_W3i8vYLg8v_Ol2?z%R0tOWb0tpHW1Qr4V0RkQY0vCV)3JDMv*2L4!argT>R|Ei+
zl@aaG%DiBVey*O3#z`1R)EX``>MEc<*MW||krvjbH_z`Mo7SA<3Km8p(<D7WFo5A-
zhiL4R`3!Oc7#<7%E8ts2m?ny~qIY!9<f7#XxUGCU#bg(%ME`?hi3fA$fSg{fYMeB_
zQX!>8+I@hq>8%iPcN~a+Du}Go06AW;0ssJ=0oVjs8vYLf1OUjSZ=mN_RhI8o>VJ&|
z2wTX1XH9K@88Q-h!ki198kD<~DvD(-bpVIwU(jwZ<WZUVc>bm&fpwLMG3in}_*!;O
za~ZN{3R4Bbg8uVeHtlQLKSajAl+K@*2M6Wphe0VDX%y|v&cCz7ZiVfPqx?gRHS+v2
z5sBUm3bNtg%u@gn0RRC21O7V)31T#TAdG>CH~-^oZX1?<NY!E(6cK}#tY$qDyY4c}
zF~YiLXRHd(dW1I4cO<-^M8x6y4s99RooDZj{tuOHglvERAHs9T&~H&^Mzm78AOz5&
zX?d5G1JQQO^fg3~2N^jfx1FW3JexRCLE_g2HMZ~a$5MYHw^gO}Q`rIl)W^FQU?nGj
zsWdGRH~;Qt*=ANO<Kk=5-k7jI9MRW(m{aTx6*OzFV94_<(zYX09iCw?z!^Ezn;E|<
zN|RqJ0s!%4jhjnZ@fK=o5>CPsGW$7F44FJL9FdtLp>gFHp%J=4H$*pMqOW{vwjliA
zjS}^Qo9y=6n1#z<Bb);%^LYXN8Gov$(Qf=kvnUn60EF;JnDs?2d%_ff!N>$XgleIy
z0yjqosAcoG$$@oS%sE;$i<m*w3vtrenMRC}20sk*n%Ib+1Q-DV00{*GSQ`Eh0vikf
z3JDMv*2L4!argTN{saGRtes};w?!XxdKL@yGd5dXO(KCqrBjiMjnoM;hIEQe#W7F-
zwYSK=<|^po+6+BJf|I!TrHPZB=0di3>UhVSle<nKfF+sov@xNm(;+$?+(ZJ94S{R2
u7Xeonxf~n67X3e`)ou0p?kA74CtU^)-~@o`hu9#5DK6qI!ps@40ssJ6r)1aw

literal 0
HcmV?d00001

diff --git a/tests/gnupghome/trustdb.gpg b/tests/gnupghome/trustdb.gpg
new file mode 100644
index 0000000000000000000000000000000000000000..7a1fe0f579754979c7c5e966bf5df0d4077ecd54
GIT binary patch
literal 1280
zcmZQfFGy!*W@Ke#Vql1n`sc}j9WZiX7sn7CRfiEIV1dza84VXu2#lr!q;w#MU=tfI
zJPbdV?YLi>_Gh)Y)oN3*Yez1hEByYO4PuZy!aQDv`lSi^MqPL27u~zJYf7%Os7v&M
KRH!<HG6n#&+8a3l

literal 0
HcmV?d00001

diff --git a/tests/repo/fake.ota.update_1234.zip b/tests/repo/fake.ota.update_1234.zip
new file mode 100644
index 0000000000000000000000000000000000000000..7443d70db572f474b00ae74047c4e46639064c90
GIT binary patch
literal 233
zcmWIWW@h1HU}9ikSm>MVsV*{UyDX3m!qN;f3~7nkse1V(iF&04DTyVidIdR&$*CFn
zIVq_{p&^_M%zQtkB0#vbf}4Sn<pnbX1DJ5h&r|TrFH=x3Rxq%%GBLF>Fj8=K4N)*M
yFf`)|@MdI^W5#8t1kh#%21X#>(g<SVbpb2H1!%Shc(byBv@!x=B9JZuaTow*9x^xp

literal 0
HcmV?d00001

diff --git a/tests/repo/obb.main.twoversions_1101617_src.tar.gz b/tests/repo/obb.main.twoversions_1101617_src.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..3e086c60370aa434b2a85f85ccbc141d187a64c8
GIT binary patch
literal 150
zcmb2|=3qGfQ!0Xi`RzGFE+#{P)`wT-CHW~#_BA?~d-d8W?j->(iQ+MLKT8W9aa$`U
z_-}nB&*!e~`pfVBi8%IX+2W~@dzPQ~jQ^~t^4$6D5*gi@!SU<gxTxRxQX;GOROb=j
yQfa%d`~LpFvg&=x<$fi{l8eXg9CMrYdacQ;+;6W78IVE4_B<mgnHvlm3=9C&CPV-L

literal 0
HcmV?d00001

diff --git a/tests/run-tests b/tests/run-tests
index c681a2ba..a4474daa 100755
--- a/tests/run-tests
+++ b/tests/run-tests
@@ -139,21 +139,33 @@ $fdroid update
 
 
 #------------------------------------------------------------------------------#
-echo_header "copy tests/repo, generate a keystore, and update"
+echo_header "copy tests/repo, generate java/gpg keys, update, and gpgsign"
 
 REPOROOT=`create_test_dir`
+GNUPGHOME=$REPOROOT/gnupghome
 cd $REPOROOT
 $fdroid init
 cp -a $WORKSPACE/tests/metadata $WORKSPACE/tests/repo $REPOROOT/
+cp -a $WORKSPACE/tests/gnupghome $GNUPGHOME
+chmod 0700 $GNUPGHOME
 echo "accepted_formats = ['json', 'txt', 'xml', 'yml']" >> config.py
 echo "install_list = 'org.adaway'" >> config.py
 echo "uninstall_list = {'com.android.vending', 'com.facebook.orca',}" >> config.py
+echo "gpghome = '$GNUPGHOME'" >> config.py
+echo "gpgkey = 'CE71F7FB'" >> config.py
 $fdroid update --verbose
 test -e repo/index.xml
 test -e repo/index.jar
 grep -F '<application id=' repo/index.xml > /dev/null
 grep -F '<install packageName=' repo/index.xml > /dev/null
 grep -F '<uninstall packageName=' repo/index.xml > /dev/null
+$fdroid gpgsign --verbose
+$fdroid gpgsign --verbose
+test -e repo/obb.mainpatch.current_1619.apk.asc
+test -e repo/obb.main.twoversions_1101617_src.tar.gz.asc
+! test -e repo/obb.mainpatch.current_1619.apk.asc.asc
+! test -e repo/obb.main.twoversions_1101617_src.tar.gz.asc.asc
+! test -e repo/index.xml.asc
 
 
 #------------------------------------------------------------------------------#