diff options
| author |   Michał Górny <mgorny@gentoo.org> | 2019-07-05 07:09:06 +0200 |
|---|---|---|
| committer | Michał Górny <mgorny@gentoo.org> | 2019-07-05 07:39:20 +0200 |
| commit | b1ab50f40c32959c0341dcdb37e6d4a99a25c712 (patch) | |
| tree | 8bc925e63c9df07b1e97ac1a7b5170ecc5ef7294 | |
| parent | ebuild.sh: suppress export error messages for eix-update (diff) | |
| download | gentoo-portage-b1ab50f40c32959c0341dcdb37e6d4a99a25c712.tar.xz gentoo-portage-b1ab50f40c32959c0341dcdb37e6d4a99a25c712.zip | |
sync: Split key refresh into explicit WKD/keyserver phases
Split key refresh into two parts: first try to refresh the key via WKD,
then via keyservers, rather than using the combined function that is
less explicit. This ensures that users are correctly informed whether
keyservers are actually used, and therefore whether they may be subject
to SKS poisoning attacks. Furthermore, it skips WKD from retry loop.
Reviewed-by: Zac Medico <zmedico@gentoo.org>
Signed-off-by: Michał Górny <mgorny@gentoo.org>
| -rw-r--r-- | lib/portage/sync/syncbase.py | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/lib/portage/sync/syncbase.py b/lib/portage/sync/syncbase.py index d15bb6d14..46644d68e 100644 --- a/lib/portage/sync/syncbase.py +++ b/lib/portage/sync/syncbase.py @@ -252,11 +252,17 @@ class SyncBase(object): @type openpgp_env: gemato.openpgp.OpenPGPEnvironment """ out = portage.output.EOutput(quiet=('--quiet' in self.options['emerge_config'].opts)) + out.ebegin('Refreshing keys via WKD') + if openpgp_env.refresh_keys_wkd(): + out.eend(0) + return + out.eend(1) + out.ebegin('Refreshing keys from keyserver{}'.format( ('' if self.repo.sync_openpgp_keyserver is None else ' ' + self.repo.sync_openpgp_keyserver))) retry_decorator = self._key_refresh_retry_decorator() if retry_decorator is None: - openpgp_env.refresh_keys(keyserver=self.repo.sync_openpgp_keyserver) + openpgp_env.refresh_keys_keyserver(keyserver=self.repo.sync_openpgp_keyserver) else: def noisy_refresh_keys(): """ @@ -264,7 +270,7 @@ class SyncBase(object): errors, display errors as soon as they occur. """ try: - openpgp_env.refresh_keys(keyserver=self.repo.sync_openpgp_keyserver) + openpgp_env.refresh_keys_keyserver(keyserver=self.repo.sync_openpgp_keyserver) except Exception as e: writemsg_level("%s\n" % (e,), level=logging.ERROR, noiselevel=-1) |