Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master sorcery by Ismael Luceno (c3755deb7e0946df85321c2741e8b5fdce9ea719)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Ismael Luceno <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master sorcery by Ismael Luceno (c3755deb7e0946df85321c2741e8b5fdce9ea719)
  • Date: Fri, 8 Feb 2019 23:15:11 +0000

GIT changes to master sorcery by Ismael Luceno <ismael AT sourcemage.org>:

ChangeLog | 8 ++++++
usr/sbin/cast | 4 +--
usr/sbin/sorcery | 4 +--
var/lib/sorcery/modules/libgpg | 32 ++++++------------------
var/lib/sorcery/modules/libunpack | 50
++++++++++----------------------------
5 files changed, 34 insertions(+), 64 deletions(-)

New commits:
commit c3755deb7e0946df85321c2741e8b5fdce9ea719
Author: Pavel Vinogradov <public AT sourcemage.org>
Commit: Ismael Luceno <ismael AT sourcemage.org>

libgpg, libunpack: Use *sum for hashing

[ismael AT sourcemage.org: Streamlined message and removed bashisms]

commit 2e3ef4fa5a779629841bda8969da16a5cec311f0
Author: Ismael Luceno <ismael AT sourcemage.org>
Commit: Ismael Luceno <ismael AT sourcemage.org>

cast: Fix escaping bug introduced by b87e689bc00ea

diff --git a/ChangeLog b/ChangeLog
index bf6b7c8..7f8a68d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2019-02-08 Pavel Vinogradov <public AT sourcemage.org>
+ * sorcery: adjusted to use coreutils in vrf_select_hashes()
+ * libgpg, libunpack: switched to coreutils' *sum for computing
+ hashsums, removed gpg_get_hashes() and unpack_spell_required(),
+ adjusted unpack_gpg(), added new function get_available_hashes(),
+ unpack_hash() now emits a warning if hash algorithm is either
+ md5 or sha1
+
2016-12-17 Jaka Kranjc <lynxlynxlynx AT sourcemage.org>
* libmisc: use mime type detection in show_file
sanitize constructed variable name in debug
diff --git a/usr/sbin/cast b/usr/sbin/cast
index ee715e3..67d02e2 100755
--- a/usr/sbin/cast
+++ b/usr/sbin/cast
@@ -375,7 +375,7 @@ pass_one() {
message "${MESSAGE_COLOR}None of the spells have dependencies" \
"to cast:${DEFAULT_COLOR}"
message "---------------------------"
- message "${PROBLEM_COLOR}$(sort <<< "${parents//[\t ]/
+ message "${PROBLEM_COLOR}$(sort <<< "${parents//[ ]/
}" | column)"
message "${DEFAULT_COLOR}"
exit 1
@@ -418,7 +418,7 @@ pass_two() {

message "${MESSAGE_COLOR}Spells are to be cast:${DEFAULT_COLOR}"
message "---------------------------"
- message "${SPELL_COLOR}$(sort <<< "${SPELLS_TO_CAST//[\t ]/
+ message "${SPELL_COLOR}$(sort <<< "${SPELLS_TO_CAST//[ ]/
}"|column)"
message "${DEFAULT_COLOR}"

diff --git a/usr/sbin/sorcery b/usr/sbin/sorcery
index 03c2fd0..1365a35 100755
--- a/usr/sbin/sorcery
+++ b/usr/sbin/sorcery
@@ -945,7 +945,7 @@ gpg_download_menu() {
vrf_select_hashes() {
local DIALOG_TITLE="Select the source hashes you would like to use"
local DIALOG_HELP="Select the source hashes you would like to consider
valid hashes"
- local DEFAULT_LIST=$(gpg_get_hashes)
+ local DEFAULT_LIST=$(get_available_hashes)
local rc=0
local CHECKS=""
local check=""
@@ -954,7 +954,7 @@ vrf_select_hashes() {
if [ -z "$DEFAULT_LIST" ] ; then
eval $DIALOG '--title "ERROR" \
--msgbox \
- "ERROR: gpg isn't installed or isn't in your PATH. Please
cast gnupg." 20 20' &&
+ "ERROR: No known hashing programs found." 20 20' &&
return 1
else
# move old values (named with GPG) to new ones
diff --git a/var/lib/sorcery/modules/libgpg b/var/lib/sorcery/modules/libgpg
index db20c68..48cb3be 100755
--- a/var/lib/sorcery/modules/libgpg
+++ b/var/lib/sorcery/modules/libgpg
@@ -325,32 +325,16 @@ gpg_user_query() {


#---------------------------------------------------------------------
-## @param algorithm to use
-## @param file to get hashsum of
-## @stdout output is exactly the same format as md5sum/sha1sum, just with
-## @stdout a different hashsum. "hashsum<space><space>filename". The hashsum
is
-## @stdout printed with all lowercase letters.
-##
-## This assumes that the caller has already verified that gpg is
-## installed and supports the specified hash function.
-##
-#---------------------------------------------------------------------
-gpg_hashsum() {
- local algorithm=$1
- local file=$2
- LC_ALL=C.UTF-8 gpg --print-md "$algorithm" "$file"| tr -d '\n ' |cut -f2
-d:|
- tr 'A-F' 'a-f'|tr -d '\n'
- echo " $file"
-}
-
-#---------------------------------------------------------------------
-## @stdout All the hash algorithms supported by gpg, algorithms printed in
+## @stdout All the hash algorithms available in system, algorithms printed in
## @stdout lower case.
##
-## This assumes the caller has already verified that gpg is installed.
+#$ This assumes coreutils spell is installed.
+##
#---------------------------------------------------------------------
-gpg_get_hashes() {
- LC_ALL=C.UTF-8 gpg --version 2> /dev/null | awk -F: '/^Hash/ { gsub(",","
",$2); print tolower($2); }'
+get_available_hashes() {
+ for hashalg in b2 md5 sha1 sha224 sha256 sha384 sha512; do
+ type "${hashalg}sum" >/dev/null 2>&1 && echo "${hashalg}"
+ done
}

#---------------------------------------------------------------------
@@ -394,7 +378,7 @@ verify_against_manifest() {
fi
local hash r
while read hashsum file; do
- local hash=$(gpg_hashsum $algorithm $file 2>/dev/null|cut -f1 -d' ')
+ local hash=$(${algorithm}sum $file 2>/dev/null|cut -f1 -d' ')
r=$?
if [[ $hash != $hashsum ]] || [[ $r != 0 ]]; then
NOT_OK=( $NOT_OK "$file" )
diff --git a/var/lib/sorcery/modules/libunpack
b/var/lib/sorcery/modules/libunpack
index dc977a8..3842703 100755
--- a/var/lib/sorcery/modules/libunpack
+++ b/var/lib/sorcery/modules/libunpack
@@ -267,29 +267,6 @@ real_guess_compressor() {
real_uncompress() { uncompress_core "$@"; }


-#---------------------------------------------------------------------
-## @param required spell
-##
-## Returns 200 if the user says not to Abort in the face, otherwise
-##
-#---------------------------------------------------------------------
-unpack_spell_required() {
- debug "libgrimoire" "Running unpack_spell_required -- $1"
-
- local x
- if ! spell_ok "$1" && ! smgl_which $2 x &> /dev/null; then
- query "This spell has an option to check its integrity via spell "\
-"${SPELL_COLOR}${1}${DEFAULT_COLOR}${QUERY_COLOR} with the $2 command for
$3, you might consider installing it. "\
-"Abort?" n &&
- return 1 ||
- return 200
- else
- return 0
- fi
-
-}
-
-
#===================== libunpack newworld ============================

#--------------------------------------------------------------------
@@ -389,7 +366,7 @@ unpack_gpg() {

message "${MESSAGE_COLOR}GPG checking source file $1...${DEFAULT_COLOR}"

- unpack_spell_required gnupg gpg || return "$?"
+ type gpg >/dev/null 2>&1 || return

gpg_verify_signature "$( locate_spell_file "$SFNAME" )" \
"$FILENAME" \
@@ -451,19 +428,20 @@ unpack_hash() {
local HASH
if [ "$MD5SUM_DL" != "off" ]; then

- if [[ "$ALGORITHM" == md5 ]] || [[ "$ALGORITHM" == sha1 ]] ; then
- unpack_spell_required coreutils "${ALGORITHM}sum" "$ALGORITHM" ||
- return "$?"
- HASH="$(${ALGORITHM}sum "$FILENAME" | cut -d' ' -f1)"
+ case "$ALGORITHM" in md5|sha1)
+ message "${PROBLEM_COLOR}WARNING:${MESSAGE_COLOR} Algorithm" \
+ "${PROBLEM_COLOR}${ALGORITHM}${MESSAGE_COLOR} is" \
+ "cryptographically weak and may impose\na security threat in" \
+ "the future.\nProceed with caution."
+ ;;
+ esac
+
+ if type "${ALGORITHM}sum" >/dev/null 2>&1;then
+ HASH="$("${ALGORITHM}sum" "$FILENAME" | cut -d' ' -f1)"
else
- unpack_spell_required gnupg gpg "$ALGORITHM" || return "$?"
- if list_find "$(gpg_get_hashes)" $ALGORITHM; then
- HASH="$(gpg_hashsum "${ALGORITHM}" "$FILENAME" | cut -d' ' -f1)"
- else
- message "${PROBLEM_COLOR}Algorithm $ALGORITHM is not"\
- "known!${DEFAULT_COLOR}"
- return 200
- fi
+ message "${PROBLEM_COLOR}Algorithm $ALGORITHM is not" \
+ "known!${DEFAULT_COLOR}"
+ return 200
fi
local rc=$?




  • [SM-Commit] GIT changes to master sorcery by Ismael Luceno (c3755deb7e0946df85321c2741e8b5fdce9ea719), Ismael Luceno, 02/08/2019

Archive powered by MHonArc 2.6.24.

Top of Page