195 lines
9.7 KiB
Diff
195 lines
9.7 KiB
Diff
From a4f21266a6dab9e77913d56c04aba1e579f0e0c1 Mon Sep 17 00:00:00 2001
|
|
From: Marek Blaha <mblaha@redhat.com>
|
|
Date: Fri, 23 Oct 2020 09:06:35 +0200
|
|
Subject: [PATCH 1/2] [reposync] Reorder options alphabetically
|
|
|
|
---
|
|
doc/reposync.rst | 30 +++++++++++++++---------------
|
|
plugins/reposync.py | 18 +++++++++---------
|
|
2 files changed, 24 insertions(+), 24 deletions(-)
|
|
|
|
diff --git a/doc/reposync.rst b/doc/reposync.rst
|
|
index 71a435dc..3b820f33 100644
|
|
--- a/doc/reposync.rst
|
|
+++ b/doc/reposync.rst
|
|
@@ -39,36 +39,36 @@ Options
|
|
|
|
All general DNF options are accepted. Namely, the ``--repoid`` option can be used to specify the repositories to synchronize. See `Options` in :manpage:`dnf(8)` for details.
|
|
|
|
-``-p <download-path>, --download-path=<download-path>``
|
|
- Root path under which the downloaded repositories are stored, relative to the current working directory. Defaults to the current working directory. Every downloaded repository has a subdirectory named after its ID under this path.
|
|
-
|
|
-``--norepopath``
|
|
- Don't add the reponame to the download path. Can only be used when syncing a single repository (default is to add the reponame).
|
|
-
|
|
-``--download-metadata``
|
|
- Download all repository metadata. Downloaded copy is instantly usable as a repository, no need to run createrepo_c on it.
|
|
-
|
|
``-a <architecture>, --arch=<architecture>``
|
|
Download only packages of given architectures (default is all architectures). Can be used multiple times.
|
|
|
|
-``--source``
|
|
- Operate on source packages.
|
|
+``--delete``
|
|
+ Delete local packages no longer present in repository.
|
|
+
|
|
+``--download-metadata``
|
|
+ Download all repository metadata. Downloaded copy is instantly usable as a repository, no need to run createrepo_c on it.
|
|
|
|
``-m, --downloadcomps``
|
|
Also download and uncompress comps.xml. Consider using ``--download-metadata`` option which will download all available repository metadata.
|
|
|
|
+``--metadata-path``
|
|
+ Root path under which the downloaded metadata are stored. It defaults to ``--download-path`` value if not given.
|
|
+
|
|
``-n, --newest-only``
|
|
Download only newest packages per-repo.
|
|
|
|
-``--delete``
|
|
- Delete local packages no longer present in repository.
|
|
+``--norepopath``
|
|
+ Don't add the reponame to the download path. Can only be used when syncing a single repository (default is to add the reponame).
|
|
|
|
-``--metadata-path``
|
|
- Root path under which the downloaded metadata are stored. It defaults to ``--download-path`` value if not given.
|
|
+``-p <download-path>, --download-path=<download-path>``
|
|
+ Root path under which the downloaded repositories are stored, relative to the current working directory. Defaults to the current working directory. Every downloaded repository has a subdirectory named after its ID under this path.
|
|
|
|
``--remote-time``
|
|
Try to set the timestamps of the downloaded files to those on the remote side.
|
|
|
|
+``--source``
|
|
+ Operate on source packages.
|
|
+
|
|
``-u, --urls``
|
|
Just print urls of what would be downloaded, don't download.
|
|
|
|
diff --git a/plugins/reposync.py b/plugins/reposync.py
|
|
index 7556e7eb..6f572cac 100644
|
|
--- a/plugins/reposync.py
|
|
+++ b/plugins/reposync.py
|
|
@@ -63,24 +63,24 @@ def set_argparser(parser):
|
|
help=_('download only packages for this ARCH'))
|
|
parser.add_argument('--delete', default=False, action='store_true',
|
|
help=_('delete local packages no longer present in repository'))
|
|
- parser.add_argument('-m', '--downloadcomps', default=False, action='store_true',
|
|
- help=_('also download and uncompress comps.xml'))
|
|
parser.add_argument('--download-metadata', default=False, action='store_true',
|
|
help=_('download all the metadata.'))
|
|
+ parser.add_argument('-m', '--downloadcomps', default=False, action='store_true',
|
|
+ help=_('also download and uncompress comps.xml'))
|
|
+ parser.add_argument('--metadata-path',
|
|
+ help=_('where to store downloaded repository metadata. '
|
|
+ 'Defaults to the value of --download-path.'))
|
|
parser.add_argument('-n', '--newest-only', default=False, action='store_true',
|
|
help=_('download only newest packages per-repo'))
|
|
- parser.add_argument('-p', '--download-path', default='./',
|
|
- help=_('where to store downloaded repositories'))
|
|
parser.add_argument('--norepopath', default=False, action='store_true',
|
|
help=_("Don't add the reponame to the download path."))
|
|
- parser.add_argument('--metadata-path',
|
|
- help=_('where to store downloaded repository metadata. '
|
|
- 'Defaults to the value of --download-path.'))
|
|
- parser.add_argument('--source', default=False, action='store_true',
|
|
- help=_('operate on source packages'))
|
|
+ parser.add_argument('-p', '--download-path', default='./',
|
|
+ help=_('where to store downloaded repositories'))
|
|
parser.add_argument('--remote-time', default=False, action='store_true',
|
|
help=_('try to set local timestamps of local files by '
|
|
'the one on the server'))
|
|
+ parser.add_argument('--source', default=False, action='store_true',
|
|
+ help=_('operate on source packages'))
|
|
parser.add_argument('-u', '--urls', default=False, action='store_true',
|
|
help=_("Just list urls of what would be downloaded, "
|
|
"don't download"))
|
|
|
|
From 978b7f2b1c654fed7b1b4cf45cb607143226804c Mon Sep 17 00:00:00 2001
|
|
From: Marek Blaha <mblaha@redhat.com>
|
|
Date: Fri, 23 Oct 2020 09:14:02 +0200
|
|
Subject: [PATCH 2/2] [reposync] Check GPG signatures of downloaded packages
|
|
(RhBug:1856818)
|
|
|
|
YUMv3 reposync used to have --gpgcheck option to remove packages that fail GPG
|
|
signature checking after downloading.
|
|
This patch implements the option for DNF.
|
|
|
|
= changelog =
|
|
msg: Add --gpgcheck option to reposync (RhBug:1856818)
|
|
type: enhancement
|
|
resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1856818
|
|
---
|
|
doc/reposync.rst | 4 ++++
|
|
plugins/reposync.py | 21 +++++++++++++++++++++
|
|
2 files changed, 25 insertions(+)
|
|
|
|
diff --git a/doc/reposync.rst b/doc/reposync.rst
|
|
index 3b820f33..de40957f 100644
|
|
--- a/doc/reposync.rst
|
|
+++ b/doc/reposync.rst
|
|
@@ -48,6 +48,10 @@ All general DNF options are accepted. Namely, the ``--repoid`` option can be use
|
|
``--download-metadata``
|
|
Download all repository metadata. Downloaded copy is instantly usable as a repository, no need to run createrepo_c on it.
|
|
|
|
+``-g, --gpgcheck``
|
|
+ Remove packages that fail GPG signature checking after downloading. Exit code is ``1`` if at least one package was removed.
|
|
+ Note that for repositories with ``gpgcheck=0`` set in their configuration the GPG signature is not checked even with this option used.
|
|
+
|
|
``-m, --downloadcomps``
|
|
Also download and uncompress comps.xml. Consider using ``--download-metadata`` option which will download all available repository metadata.
|
|
|
|
diff --git a/plugins/reposync.py b/plugins/reposync.py
|
|
index 6f572cac..c891bfa2 100644
|
|
--- a/plugins/reposync.py
|
|
+++ b/plugins/reposync.py
|
|
@@ -24,6 +24,7 @@
|
|
import hawkey
|
|
import os
|
|
import shutil
|
|
+import types
|
|
|
|
from dnfpluginscore import _, logger
|
|
from dnf.cli.option_parser import OptionParser
|
|
@@ -65,6 +66,9 @@ def set_argparser(parser):
|
|
help=_('delete local packages no longer present in repository'))
|
|
parser.add_argument('--download-metadata', default=False, action='store_true',
|
|
help=_('download all the metadata.'))
|
|
+ parser.add_argument('-g', '--gpgcheck', default=False, action='store_true',
|
|
+ help=_('Remove packages that fail GPG signature checking '
|
|
+ 'after downloading'))
|
|
parser.add_argument('-m', '--downloadcomps', default=False, action='store_true',
|
|
help=_('also download and uncompress comps.xml'))
|
|
parser.add_argument('--metadata-path',
|
|
@@ -114,6 +118,7 @@ def configure(self):
|
|
|
|
def run(self):
|
|
self.base.conf.keepcache = True
|
|
+ gpgcheck_ok = True
|
|
for repo in self.base.repos.iter_enabled():
|
|
if self.opts.remote_time:
|
|
repo._repo.setPreserveRemoteTime(True)
|
|
@@ -150,8 +155,24 @@ def run(self):
|
|
self.print_urls(pkglist)
|
|
else:
|
|
self.download_packages(pkglist)
|
|
+ if self.opts.gpgcheck:
|
|
+ for pkg in pkglist:
|
|
+ local_path = self.pkg_download_path(pkg)
|
|
+ # base.package_signature_check uses pkg.localPkg() to determine
|
|
+ # the location of the package rpm file on the disk.
|
|
+ # Set it to the correct download path.
|
|
+ pkg.localPkg = types.MethodType(
|
|
+ lambda s, local_path=local_path: local_path, pkg)
|
|
+ result, error = self.base.package_signature_check(pkg)
|
|
+ if result != 0:
|
|
+ logger.warning(_("Removing {}: {}").format(
|
|
+ os.path.basename(local_path), error))
|
|
+ os.unlink(local_path)
|
|
+ gpgcheck_ok = False
|
|
if self.opts.delete:
|
|
self.delete_old_local_packages(repo, pkglist)
|
|
+ if not gpgcheck_ok:
|
|
+ raise dnf.exceptions.Error(_("GPG signature check failed."))
|
|
|
|
def repo_target(self, repo):
|
|
return _pkgdir(self.opts.destdir or self.opts.download_path,
|