13aa4b42aSBaptiste Daroussin /*- 29950eceeSBaptiste Daroussin * Copyright (c) 2012-2013 Baptiste Daroussin <bapt@FreeBSD.org> 3f12db248SBryan Drewery * Copyright (c) 2013 Bryan Drewery <bdrewery@FreeBSD.org> 43aa4b42aSBaptiste Daroussin * All rights reserved. 53aa4b42aSBaptiste Daroussin * 63aa4b42aSBaptiste Daroussin * Redistribution and use in source and binary forms, with or without 73aa4b42aSBaptiste Daroussin * modification, are permitted provided that the following conditions 83aa4b42aSBaptiste Daroussin * are met: 93aa4b42aSBaptiste Daroussin * 1. Redistributions of source code must retain the above copyright 103aa4b42aSBaptiste Daroussin * notice, this list of conditions and the following disclaimer. 113aa4b42aSBaptiste Daroussin * 2. Redistributions in binary form must reproduce the above copyright 123aa4b42aSBaptiste Daroussin * notice, this list of conditions and the following disclaimer in the 133aa4b42aSBaptiste Daroussin * documentation and/or other materials provided with the distribution. 143aa4b42aSBaptiste Daroussin * 153aa4b42aSBaptiste Daroussin * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 163aa4b42aSBaptiste Daroussin * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 173aa4b42aSBaptiste Daroussin * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 183aa4b42aSBaptiste Daroussin * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 193aa4b42aSBaptiste Daroussin * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 203aa4b42aSBaptiste Daroussin * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 213aa4b42aSBaptiste Daroussin * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 223aa4b42aSBaptiste Daroussin * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 233aa4b42aSBaptiste Daroussin * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 243aa4b42aSBaptiste Daroussin * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 253aa4b42aSBaptiste Daroussin * SUCH DAMAGE. 263aa4b42aSBaptiste Daroussin */ 273aa4b42aSBaptiste Daroussin 283aa4b42aSBaptiste Daroussin #include <sys/cdefs.h> 293aa4b42aSBaptiste Daroussin __FBSDID("$FreeBSD$"); 303aa4b42aSBaptiste Daroussin 313aa4b42aSBaptiste Daroussin #include <sys/param.h> 32f12db248SBryan Drewery #include <sys/queue.h> 33f12db248SBryan Drewery #include <sys/types.h> 34f12db248SBryan Drewery #include <sys/sbuf.h> 353b05c2a8SBaptiste Daroussin #include <sys/wait.h> 363aa4b42aSBaptiste Daroussin 37f12db248SBryan Drewery #define _WITH_GETLINE 383aa4b42aSBaptiste Daroussin #include <archive.h> 393aa4b42aSBaptiste Daroussin #include <archive_entry.h> 40f12db248SBryan Drewery #include <dirent.h> 413aa4b42aSBaptiste Daroussin #include <err.h> 423aa4b42aSBaptiste Daroussin #include <errno.h> 43b70213b5SBaptiste Daroussin #include <fcntl.h> 443b05c2a8SBaptiste Daroussin #include <fetch.h> 45a6454741SBaptiste Daroussin #include <paths.h> 469950eceeSBaptiste Daroussin #include <stdbool.h> 473aa4b42aSBaptiste Daroussin #include <stdlib.h> 483aa4b42aSBaptiste Daroussin #include <stdio.h> 493aa4b42aSBaptiste Daroussin #include <string.h> 503aa4b42aSBaptiste Daroussin #include <time.h> 513aa4b42aSBaptiste Daroussin #include <unistd.h> 52f12db248SBryan Drewery #include <yaml.h> 53f12db248SBryan Drewery 54f12db248SBryan Drewery #include <openssl/err.h> 55f12db248SBryan Drewery #include <openssl/ssl.h> 563aa4b42aSBaptiste Daroussin 5729aaa961SBaptiste Daroussin #include "dns_utils.h" 589950eceeSBaptiste Daroussin #include "config.h" 593aa4b42aSBaptiste Daroussin 60f12db248SBryan Drewery struct sig_cert { 61516aaf7cSBryan Drewery char *name; 62f12db248SBryan Drewery unsigned char *sig; 63f12db248SBryan Drewery int siglen; 64f12db248SBryan Drewery unsigned char *cert; 65f12db248SBryan Drewery int certlen; 66f12db248SBryan Drewery bool trusted; 67f12db248SBryan Drewery }; 68f12db248SBryan Drewery 69f12db248SBryan Drewery typedef enum { 70f12db248SBryan Drewery HASH_UNKNOWN, 71f12db248SBryan Drewery HASH_SHA256, 72f12db248SBryan Drewery } hash_t; 73f12db248SBryan Drewery 74f12db248SBryan Drewery struct fingerprint { 75f12db248SBryan Drewery hash_t type; 76516aaf7cSBryan Drewery char *name; 77f12db248SBryan Drewery char hash[BUFSIZ]; 78f12db248SBryan Drewery STAILQ_ENTRY(fingerprint) next; 79f12db248SBryan Drewery }; 80f12db248SBryan Drewery 81f12db248SBryan Drewery STAILQ_HEAD(fingerprint_list, fingerprint); 82f12db248SBryan Drewery 833aa4b42aSBaptiste Daroussin static int 843aa4b42aSBaptiste Daroussin extract_pkg_static(int fd, char *p, int sz) 853aa4b42aSBaptiste Daroussin { 863aa4b42aSBaptiste Daroussin struct archive *a; 873aa4b42aSBaptiste Daroussin struct archive_entry *ae; 883aa4b42aSBaptiste Daroussin char *end; 893aa4b42aSBaptiste Daroussin int ret, r; 903aa4b42aSBaptiste Daroussin 91a6454741SBaptiste Daroussin ret = -1; 923aa4b42aSBaptiste Daroussin a = archive_read_new(); 93a6454741SBaptiste Daroussin if (a == NULL) { 94a6454741SBaptiste Daroussin warn("archive_read_new"); 95a6454741SBaptiste Daroussin return (ret); 96a6454741SBaptiste Daroussin } 97ff75c36aSBaptiste Daroussin archive_read_support_filter_all(a); 983aa4b42aSBaptiste Daroussin archive_read_support_format_tar(a); 993aa4b42aSBaptiste Daroussin 100a6454741SBaptiste Daroussin if (lseek(fd, 0, 0) == -1) { 101a6454741SBaptiste Daroussin warn("lseek"); 102a6454741SBaptiste Daroussin goto cleanup; 103a6454741SBaptiste Daroussin } 1043aa4b42aSBaptiste Daroussin 1053aa4b42aSBaptiste Daroussin if (archive_read_open_fd(a, fd, 4096) != ARCHIVE_OK) { 106a6454741SBaptiste Daroussin warnx("archive_read_open_fd: %s", archive_error_string(a)); 1073aa4b42aSBaptiste Daroussin goto cleanup; 1083aa4b42aSBaptiste Daroussin } 1093aa4b42aSBaptiste Daroussin 1103aa4b42aSBaptiste Daroussin ae = NULL; 1113aa4b42aSBaptiste Daroussin while ((r = archive_read_next_header(a, &ae)) == ARCHIVE_OK) { 1123aa4b42aSBaptiste Daroussin end = strrchr(archive_entry_pathname(ae), '/'); 1133aa4b42aSBaptiste Daroussin if (end == NULL) 1143aa4b42aSBaptiste Daroussin continue; 1153aa4b42aSBaptiste Daroussin 1163aa4b42aSBaptiste Daroussin if (strcmp(end, "/pkg-static") == 0) { 1173aa4b42aSBaptiste Daroussin r = archive_read_extract(a, ae, 1183aa4b42aSBaptiste Daroussin ARCHIVE_EXTRACT_OWNER | ARCHIVE_EXTRACT_PERM | 1193aa4b42aSBaptiste Daroussin ARCHIVE_EXTRACT_TIME | ARCHIVE_EXTRACT_ACL | 1203aa4b42aSBaptiste Daroussin ARCHIVE_EXTRACT_FFLAGS | ARCHIVE_EXTRACT_XATTR); 121a6454741SBaptiste Daroussin strlcpy(p, archive_entry_pathname(ae), sz); 1223aa4b42aSBaptiste Daroussin break; 1233aa4b42aSBaptiste Daroussin } 1243aa4b42aSBaptiste Daroussin } 1253aa4b42aSBaptiste Daroussin 126a6454741SBaptiste Daroussin if (r == ARCHIVE_OK) 127a6454741SBaptiste Daroussin ret = 0; 128a6454741SBaptiste Daroussin else 1293aa4b42aSBaptiste Daroussin warnx("fail to extract pkg-static"); 1303aa4b42aSBaptiste Daroussin 1313aa4b42aSBaptiste Daroussin cleanup: 132ff75c36aSBaptiste Daroussin archive_read_free(a); 1333b05c2a8SBaptiste Daroussin return (ret); 1343aa4b42aSBaptiste Daroussin 1353aa4b42aSBaptiste Daroussin } 1363aa4b42aSBaptiste Daroussin 1373aa4b42aSBaptiste Daroussin static int 1385212e8baSBryan Drewery install_pkg_static(const char *path, const char *pkgpath, bool force) 1393aa4b42aSBaptiste Daroussin { 1403aa4b42aSBaptiste Daroussin int pstat; 1413aa4b42aSBaptiste Daroussin pid_t pid; 1423aa4b42aSBaptiste Daroussin 1433aa4b42aSBaptiste Daroussin switch ((pid = fork())) { 1443aa4b42aSBaptiste Daroussin case -1: 1453aa4b42aSBaptiste Daroussin return (-1); 1463aa4b42aSBaptiste Daroussin case 0: 1475212e8baSBryan Drewery if (force) 1485212e8baSBryan Drewery execl(path, "pkg-static", "add", "-f", pkgpath, 1495212e8baSBryan Drewery (char *)NULL); 1505212e8baSBryan Drewery else 1515212e8baSBryan Drewery execl(path, "pkg-static", "add", pkgpath, 1525212e8baSBryan Drewery (char *)NULL); 1533b05c2a8SBaptiste Daroussin _exit(1); 1543aa4b42aSBaptiste Daroussin default: 1553aa4b42aSBaptiste Daroussin break; 1563aa4b42aSBaptiste Daroussin } 1573aa4b42aSBaptiste Daroussin 158a6454741SBaptiste Daroussin while (waitpid(pid, &pstat, 0) == -1) 1593aa4b42aSBaptiste Daroussin if (errno != EINTR) 1603aa4b42aSBaptiste Daroussin return (-1); 1613aa4b42aSBaptiste Daroussin 162a6454741SBaptiste Daroussin if (WEXITSTATUS(pstat)) 1633aa4b42aSBaptiste Daroussin return (WEXITSTATUS(pstat)); 164a6454741SBaptiste Daroussin else if (WIFSIGNALED(pstat)) 165a6454741SBaptiste Daroussin return (128 & (WTERMSIG(pstat))); 166a6454741SBaptiste Daroussin return (pstat); 1673aa4b42aSBaptiste Daroussin } 1683aa4b42aSBaptiste Daroussin 1693aa4b42aSBaptiste Daroussin static int 170f12db248SBryan Drewery fetch_to_fd(const char *url, char *path) 1713aa4b42aSBaptiste Daroussin { 17229aaa961SBaptiste Daroussin struct url *u; 17329aaa961SBaptiste Daroussin struct dns_srvinfo *mirrors, *current; 174a6454741SBaptiste Daroussin struct url_stat st; 175f12db248SBryan Drewery FILE *remote; 176f12db248SBryan Drewery /* To store _https._tcp. + hostname + \0 */ 177f12db248SBryan Drewery int fd; 178f12db248SBryan Drewery int retry, max_retry; 1793aa4b42aSBaptiste Daroussin off_t done, r; 180f12db248SBryan Drewery time_t now, last; 181f12db248SBryan Drewery char buf[10240]; 182f12db248SBryan Drewery char zone[MAXHOSTNAMELEN + 13]; 183f12db248SBryan Drewery static const char *mirror_type = NULL; 1843aa4b42aSBaptiste Daroussin 1853aa4b42aSBaptiste Daroussin done = 0; 186a6454741SBaptiste Daroussin last = 0; 18729aaa961SBaptiste Daroussin max_retry = 3; 18829aaa961SBaptiste Daroussin current = mirrors = NULL; 189f12db248SBryan Drewery remote = NULL; 1903aa4b42aSBaptiste Daroussin 191f12db248SBryan Drewery if (mirror_type == NULL && config_string(MIRROR_TYPE, &mirror_type) 192f12db248SBryan Drewery != 0) { 1939950eceeSBaptiste Daroussin warnx("No MIRROR_TYPE defined"); 1949950eceeSBaptiste Daroussin return (-1); 1959950eceeSBaptiste Daroussin } 19662940ea9SBryan Drewery 197f12db248SBryan Drewery if ((fd = mkstemp(path)) == -1) { 1983aa4b42aSBaptiste Daroussin warn("mkstemp()"); 1993b05c2a8SBaptiste Daroussin return (-1); 2003aa4b42aSBaptiste Daroussin } 2013aa4b42aSBaptiste Daroussin 20229aaa961SBaptiste Daroussin retry = max_retry; 20329aaa961SBaptiste Daroussin 20429aaa961SBaptiste Daroussin u = fetchParseURL(url); 20529aaa961SBaptiste Daroussin while (remote == NULL) { 20629aaa961SBaptiste Daroussin if (retry == max_retry) { 2079950eceeSBaptiste Daroussin if (strcmp(u->scheme, "file") != 0 && 2089950eceeSBaptiste Daroussin strcasecmp(mirror_type, "srv") == 0) { 20929aaa961SBaptiste Daroussin snprintf(zone, sizeof(zone), 21029aaa961SBaptiste Daroussin "_%s._tcp.%s", u->scheme, u->host); 21129aaa961SBaptiste Daroussin mirrors = dns_getsrvinfo(zone); 21229aaa961SBaptiste Daroussin current = mirrors; 21329aaa961SBaptiste Daroussin } 21429aaa961SBaptiste Daroussin } 21529aaa961SBaptiste Daroussin 21635e07a7aSBaptiste Daroussin if (mirrors != NULL) { 21729aaa961SBaptiste Daroussin strlcpy(u->host, current->host, sizeof(u->host)); 21835e07a7aSBaptiste Daroussin u->port = current->port; 21935e07a7aSBaptiste Daroussin } 22029aaa961SBaptiste Daroussin 22129aaa961SBaptiste Daroussin remote = fetchXGet(u, &st, ""); 22229aaa961SBaptiste Daroussin if (remote == NULL) { 22329aaa961SBaptiste Daroussin --retry; 22429aaa961SBaptiste Daroussin if (retry <= 0) 22529aaa961SBaptiste Daroussin goto fetchfail; 22629aaa961SBaptiste Daroussin if (mirrors == NULL) { 2273aa4b42aSBaptiste Daroussin sleep(1); 22829aaa961SBaptiste Daroussin } else { 22929aaa961SBaptiste Daroussin current = current->next; 23029aaa961SBaptiste Daroussin if (current == NULL) 23129aaa961SBaptiste Daroussin current = mirrors; 23229aaa961SBaptiste Daroussin } 23329aaa961SBaptiste Daroussin } 23429aaa961SBaptiste Daroussin } 235a6454741SBaptiste Daroussin 2363aa4b42aSBaptiste Daroussin while (done < st.size) { 2373aa4b42aSBaptiste Daroussin if ((r = fread(buf, 1, sizeof(buf), remote)) < 1) 2383aa4b42aSBaptiste Daroussin break; 2393aa4b42aSBaptiste Daroussin 2403aa4b42aSBaptiste Daroussin if (write(fd, buf, r) != r) { 2413aa4b42aSBaptiste Daroussin warn("write()"); 242f12db248SBryan Drewery goto fetchfail; 2433aa4b42aSBaptiste Daroussin } 2443aa4b42aSBaptiste Daroussin 2453aa4b42aSBaptiste Daroussin done += r; 2463aa4b42aSBaptiste Daroussin now = time(NULL); 247a6454741SBaptiste Daroussin if (now > last || done == st.size) 2483aa4b42aSBaptiste Daroussin last = now; 2493aa4b42aSBaptiste Daroussin } 2503aa4b42aSBaptiste Daroussin 251a6454741SBaptiste Daroussin if (ferror(remote)) 252a6454741SBaptiste Daroussin goto fetchfail; 2533aa4b42aSBaptiste Daroussin 254f12db248SBryan Drewery goto cleanup; 255f12db248SBryan Drewery 256f12db248SBryan Drewery fetchfail: 257f12db248SBryan Drewery if (fd != -1) { 258f12db248SBryan Drewery close(fd); 259f12db248SBryan Drewery fd = -1; 260f12db248SBryan Drewery unlink(path); 261f12db248SBryan Drewery } 262f12db248SBryan Drewery 263f12db248SBryan Drewery cleanup: 264f12db248SBryan Drewery if (remote != NULL) 265f12db248SBryan Drewery fclose(remote); 266f12db248SBryan Drewery 267f12db248SBryan Drewery return fd; 268f12db248SBryan Drewery } 269f12db248SBryan Drewery 270f12db248SBryan Drewery static struct fingerprint * 271f12db248SBryan Drewery parse_fingerprint(yaml_document_t *doc, yaml_node_t *node) 272f12db248SBryan Drewery { 273f12db248SBryan Drewery yaml_node_pair_t *pair; 274f12db248SBryan Drewery yaml_char_t *function, *fp; 275f12db248SBryan Drewery struct fingerprint *f; 276f12db248SBryan Drewery hash_t fct = HASH_UNKNOWN; 277f12db248SBryan Drewery 278f12db248SBryan Drewery function = fp = NULL; 279f12db248SBryan Drewery 280f12db248SBryan Drewery pair = node->data.mapping.pairs.start; 281f12db248SBryan Drewery while (pair < node->data.mapping.pairs.top) { 282f12db248SBryan Drewery yaml_node_t *key = yaml_document_get_node(doc, pair->key); 283f12db248SBryan Drewery yaml_node_t *val = yaml_document_get_node(doc, pair->value); 284f12db248SBryan Drewery 285f12db248SBryan Drewery if (key->data.scalar.length <= 0) { 286f12db248SBryan Drewery ++pair; 287f12db248SBryan Drewery continue; 288f12db248SBryan Drewery } 289f12db248SBryan Drewery 290f12db248SBryan Drewery if (val->type != YAML_SCALAR_NODE) { 291f12db248SBryan Drewery ++pair; 292f12db248SBryan Drewery continue; 293f12db248SBryan Drewery } 294f12db248SBryan Drewery 295f12db248SBryan Drewery if (strcasecmp(key->data.scalar.value, "function") == 0) 296f12db248SBryan Drewery function = val->data.scalar.value; 297f12db248SBryan Drewery else if (strcasecmp(key->data.scalar.value, "fingerprint") 298f12db248SBryan Drewery == 0) 299f12db248SBryan Drewery fp = val->data.scalar.value; 300f12db248SBryan Drewery 301f12db248SBryan Drewery ++pair; 302f12db248SBryan Drewery continue; 303f12db248SBryan Drewery } 304f12db248SBryan Drewery 305f12db248SBryan Drewery if (fp == NULL || function == NULL) 306f12db248SBryan Drewery return (NULL); 307f12db248SBryan Drewery 308f12db248SBryan Drewery if (strcasecmp(function, "sha256") == 0) 309f12db248SBryan Drewery fct = HASH_SHA256; 310f12db248SBryan Drewery 311f12db248SBryan Drewery if (fct == HASH_UNKNOWN) { 312f12db248SBryan Drewery fprintf(stderr, "Unsupported hashing function: %s\n", function); 313f12db248SBryan Drewery return (NULL); 314f12db248SBryan Drewery } 315f12db248SBryan Drewery 316f12db248SBryan Drewery f = calloc(1, sizeof(struct fingerprint)); 317f12db248SBryan Drewery f->type = fct; 318f12db248SBryan Drewery strlcpy(f->hash, fp, sizeof(f->hash)); 319f12db248SBryan Drewery 320f12db248SBryan Drewery return (f); 321f12db248SBryan Drewery } 322f12db248SBryan Drewery 323516aaf7cSBryan Drewery static void 324516aaf7cSBryan Drewery free_fingerprint_list(struct fingerprint_list* list) 325516aaf7cSBryan Drewery { 326*d2201d13SGleb Smirnoff struct fingerprint *fingerprint, *tmp; 327516aaf7cSBryan Drewery 328*d2201d13SGleb Smirnoff STAILQ_FOREACH_SAFE(fingerprint, list, next, tmp) { 329516aaf7cSBryan Drewery if (fingerprint->name) 330516aaf7cSBryan Drewery free(fingerprint->name); 331516aaf7cSBryan Drewery free(fingerprint); 332516aaf7cSBryan Drewery } 333516aaf7cSBryan Drewery free(list); 334516aaf7cSBryan Drewery } 335516aaf7cSBryan Drewery 336f12db248SBryan Drewery static struct fingerprint * 337f12db248SBryan Drewery load_fingerprint(const char *dir, const char *filename) 338f12db248SBryan Drewery { 339f12db248SBryan Drewery yaml_parser_t parser; 340f12db248SBryan Drewery yaml_document_t doc; 341f12db248SBryan Drewery yaml_node_t *node; 342f12db248SBryan Drewery FILE *fp; 343f12db248SBryan Drewery struct fingerprint *f; 344f12db248SBryan Drewery char path[MAXPATHLEN]; 345f12db248SBryan Drewery 346f12db248SBryan Drewery f = NULL; 347f12db248SBryan Drewery 348f12db248SBryan Drewery snprintf(path, MAXPATHLEN, "%s/%s", dir, filename); 349f12db248SBryan Drewery 350f12db248SBryan Drewery if ((fp = fopen(path, "r")) == NULL) 351f12db248SBryan Drewery return (NULL); 352f12db248SBryan Drewery 353f12db248SBryan Drewery yaml_parser_initialize(&parser); 354f12db248SBryan Drewery yaml_parser_set_input_file(&parser, fp); 355f12db248SBryan Drewery yaml_parser_load(&parser, &doc); 356f12db248SBryan Drewery 357f12db248SBryan Drewery node = yaml_document_get_root_node(&doc); 358f12db248SBryan Drewery if (node == NULL || node->type != YAML_MAPPING_NODE) 359f12db248SBryan Drewery goto out; 360f12db248SBryan Drewery 361f12db248SBryan Drewery f = parse_fingerprint(&doc, node); 362516aaf7cSBryan Drewery f->name = strdup(filename); 363f12db248SBryan Drewery 364f12db248SBryan Drewery out: 365f12db248SBryan Drewery yaml_document_delete(&doc); 366f12db248SBryan Drewery yaml_parser_delete(&parser); 367f12db248SBryan Drewery fclose(fp); 368f12db248SBryan Drewery 369f12db248SBryan Drewery return (f); 370f12db248SBryan Drewery } 371f12db248SBryan Drewery 372f12db248SBryan Drewery static struct fingerprint_list * 373f12db248SBryan Drewery load_fingerprints(const char *path, int *count) 374f12db248SBryan Drewery { 375f12db248SBryan Drewery DIR *d; 376f12db248SBryan Drewery struct dirent *ent; 377f12db248SBryan Drewery struct fingerprint *finger; 378f12db248SBryan Drewery struct fingerprint_list *fingerprints; 379f12db248SBryan Drewery 380f12db248SBryan Drewery *count = 0; 381f12db248SBryan Drewery 382f12db248SBryan Drewery fingerprints = calloc(1, sizeof(struct fingerprint_list)); 383f12db248SBryan Drewery if (fingerprints == NULL) 384f12db248SBryan Drewery return (NULL); 385f12db248SBryan Drewery STAILQ_INIT(fingerprints); 386f12db248SBryan Drewery 387f12db248SBryan Drewery if ((d = opendir(path)) == NULL) 388f12db248SBryan Drewery return (NULL); 389f12db248SBryan Drewery 390f12db248SBryan Drewery while ((ent = readdir(d))) { 391f12db248SBryan Drewery if (strcmp(ent->d_name, ".") == 0 || 392f12db248SBryan Drewery strcmp(ent->d_name, "..") == 0) 393f12db248SBryan Drewery continue; 394f12db248SBryan Drewery finger = load_fingerprint(path, ent->d_name); 395f12db248SBryan Drewery if (finger != NULL) { 396f12db248SBryan Drewery STAILQ_INSERT_TAIL(fingerprints, finger, next); 397f12db248SBryan Drewery ++(*count); 398f12db248SBryan Drewery } 399f12db248SBryan Drewery } 400f12db248SBryan Drewery 401f12db248SBryan Drewery closedir(d); 402f12db248SBryan Drewery 403f12db248SBryan Drewery return (fingerprints); 404f12db248SBryan Drewery } 405f12db248SBryan Drewery 406f12db248SBryan Drewery static void 407f12db248SBryan Drewery sha256_hash(unsigned char hash[SHA256_DIGEST_LENGTH], 408f12db248SBryan Drewery char out[SHA256_DIGEST_LENGTH * 2 + 1]) 409f12db248SBryan Drewery { 410f12db248SBryan Drewery int i; 411f12db248SBryan Drewery 412f12db248SBryan Drewery for (i = 0; i < SHA256_DIGEST_LENGTH; i++) 413f12db248SBryan Drewery sprintf(out + (i * 2), "%02x", hash[i]); 414f12db248SBryan Drewery 415f12db248SBryan Drewery out[SHA256_DIGEST_LENGTH * 2] = '\0'; 416f12db248SBryan Drewery } 417f12db248SBryan Drewery 418f12db248SBryan Drewery static void 419f12db248SBryan Drewery sha256_buf(char *buf, size_t len, char out[SHA256_DIGEST_LENGTH * 2 + 1]) 420f12db248SBryan Drewery { 421f12db248SBryan Drewery unsigned char hash[SHA256_DIGEST_LENGTH]; 422f12db248SBryan Drewery SHA256_CTX sha256; 423f12db248SBryan Drewery 424f12db248SBryan Drewery out[0] = '\0'; 425f12db248SBryan Drewery 426f12db248SBryan Drewery SHA256_Init(&sha256); 427f12db248SBryan Drewery SHA256_Update(&sha256, buf, len); 428f12db248SBryan Drewery SHA256_Final(hash, &sha256); 429f12db248SBryan Drewery sha256_hash(hash, out); 430f12db248SBryan Drewery } 431f12db248SBryan Drewery 432f12db248SBryan Drewery static int 433f12db248SBryan Drewery sha256_fd(int fd, char out[SHA256_DIGEST_LENGTH * 2 + 1]) 434f12db248SBryan Drewery { 435f12db248SBryan Drewery int my_fd; 436f12db248SBryan Drewery FILE *fp; 437f12db248SBryan Drewery char buffer[BUFSIZ]; 438f12db248SBryan Drewery unsigned char hash[SHA256_DIGEST_LENGTH]; 439f12db248SBryan Drewery size_t r; 440f12db248SBryan Drewery int ret; 441f12db248SBryan Drewery SHA256_CTX sha256; 442f12db248SBryan Drewery 443f12db248SBryan Drewery my_fd = -1; 444f12db248SBryan Drewery fp = NULL; 445f12db248SBryan Drewery r = 0; 446f12db248SBryan Drewery ret = 1; 447f12db248SBryan Drewery 448f12db248SBryan Drewery out[0] = '\0'; 449f12db248SBryan Drewery 450f12db248SBryan Drewery /* Duplicate the fd so that fclose(3) does not close it. */ 451f12db248SBryan Drewery if ((my_fd = dup(fd)) == -1) { 452f12db248SBryan Drewery warnx("dup"); 453f12db248SBryan Drewery goto cleanup; 454f12db248SBryan Drewery } 455f12db248SBryan Drewery 456f12db248SBryan Drewery if ((fp = fdopen(my_fd, "rb")) == NULL) { 457f12db248SBryan Drewery warnx("fdopen"); 458f12db248SBryan Drewery goto cleanup; 459f12db248SBryan Drewery } 460f12db248SBryan Drewery 461f12db248SBryan Drewery SHA256_Init(&sha256); 462f12db248SBryan Drewery 463f12db248SBryan Drewery while ((r = fread(buffer, 1, BUFSIZ, fp)) > 0) 464f12db248SBryan Drewery SHA256_Update(&sha256, buffer, r); 465f12db248SBryan Drewery 466f12db248SBryan Drewery if (ferror(fp) != 0) { 467f12db248SBryan Drewery warnx("fread"); 468f12db248SBryan Drewery goto cleanup; 469f12db248SBryan Drewery } 470f12db248SBryan Drewery 471f12db248SBryan Drewery SHA256_Final(hash, &sha256); 472f12db248SBryan Drewery sha256_hash(hash, out); 473f12db248SBryan Drewery ret = 0; 474f12db248SBryan Drewery 475f12db248SBryan Drewery cleanup: 476f12db248SBryan Drewery if (fp != NULL) 477f12db248SBryan Drewery fclose(fp); 478f12db248SBryan Drewery else if (my_fd != -1) 479f12db248SBryan Drewery close(my_fd); 480f12db248SBryan Drewery (void)lseek(fd, 0, SEEK_SET); 481f12db248SBryan Drewery 482f12db248SBryan Drewery return (ret); 483f12db248SBryan Drewery } 484f12db248SBryan Drewery 485f12db248SBryan Drewery static EVP_PKEY * 486f12db248SBryan Drewery load_public_key_buf(const unsigned char *cert, int certlen) 487f12db248SBryan Drewery { 488f12db248SBryan Drewery EVP_PKEY *pkey; 489f12db248SBryan Drewery BIO *bp; 490f12db248SBryan Drewery char errbuf[1024]; 491f12db248SBryan Drewery 492c2788c07SBryan Drewery bp = BIO_new_mem_buf(__DECONST(void *, cert), certlen); 493f12db248SBryan Drewery 494f12db248SBryan Drewery if ((pkey = PEM_read_bio_PUBKEY(bp, NULL, NULL, NULL)) == NULL) 495f12db248SBryan Drewery warnx("%s", ERR_error_string(ERR_get_error(), errbuf)); 496f12db248SBryan Drewery 497f12db248SBryan Drewery BIO_free(bp); 498f12db248SBryan Drewery 499f12db248SBryan Drewery return (pkey); 500f12db248SBryan Drewery } 501f12db248SBryan Drewery 502f12db248SBryan Drewery static bool 503f12db248SBryan Drewery rsa_verify_cert(int fd, const unsigned char *key, int keylen, 504f12db248SBryan Drewery unsigned char *sig, int siglen) 505f12db248SBryan Drewery { 506f12db248SBryan Drewery EVP_MD_CTX *mdctx; 507f12db248SBryan Drewery EVP_PKEY *pkey; 508f12db248SBryan Drewery char sha256[(SHA256_DIGEST_LENGTH * 2) + 2]; 509f12db248SBryan Drewery char errbuf[1024]; 510f12db248SBryan Drewery bool ret; 511f12db248SBryan Drewery 512f12db248SBryan Drewery pkey = NULL; 513f12db248SBryan Drewery mdctx = NULL; 514f12db248SBryan Drewery ret = false; 515f12db248SBryan Drewery 516f12db248SBryan Drewery /* Compute SHA256 of the package. */ 517f12db248SBryan Drewery if (lseek(fd, 0, 0) == -1) { 518f12db248SBryan Drewery warn("lseek"); 519f12db248SBryan Drewery goto cleanup; 520f12db248SBryan Drewery } 521f12db248SBryan Drewery if ((sha256_fd(fd, sha256)) == -1) { 522f12db248SBryan Drewery warnx("Error creating SHA256 hash for package"); 523f12db248SBryan Drewery goto cleanup; 524f12db248SBryan Drewery } 525f12db248SBryan Drewery 526f12db248SBryan Drewery if ((pkey = load_public_key_buf(key, keylen)) == NULL) { 527f12db248SBryan Drewery warnx("Error reading public key"); 528f12db248SBryan Drewery goto cleanup; 529f12db248SBryan Drewery } 530f12db248SBryan Drewery 531f12db248SBryan Drewery /* Verify signature of the SHA256(pkg) is valid. */ 532f12db248SBryan Drewery if ((mdctx = EVP_MD_CTX_create()) == NULL) { 533f12db248SBryan Drewery warnx("%s", ERR_error_string(ERR_get_error(), errbuf)); 534f12db248SBryan Drewery goto error; 535f12db248SBryan Drewery } 536f12db248SBryan Drewery 537f12db248SBryan Drewery if (EVP_DigestVerifyInit(mdctx, NULL, EVP_sha256(), NULL, pkey) != 1) { 538f12db248SBryan Drewery warnx("%s", ERR_error_string(ERR_get_error(), errbuf)); 539f12db248SBryan Drewery goto error; 540f12db248SBryan Drewery } 541f12db248SBryan Drewery if (EVP_DigestVerifyUpdate(mdctx, sha256, strlen(sha256)) != 1) { 542f12db248SBryan Drewery warnx("%s", ERR_error_string(ERR_get_error(), errbuf)); 543f12db248SBryan Drewery goto error; 544f12db248SBryan Drewery } 545f12db248SBryan Drewery 546f12db248SBryan Drewery if (EVP_DigestVerifyFinal(mdctx, sig, siglen) != 1) { 547f12db248SBryan Drewery warnx("%s", ERR_error_string(ERR_get_error(), errbuf)); 548f12db248SBryan Drewery goto error; 549f12db248SBryan Drewery } 550f12db248SBryan Drewery 551f12db248SBryan Drewery ret = true; 552f12db248SBryan Drewery printf("done\n"); 553f12db248SBryan Drewery goto cleanup; 554f12db248SBryan Drewery 555f12db248SBryan Drewery error: 556f12db248SBryan Drewery printf("failed\n"); 557f12db248SBryan Drewery 558f12db248SBryan Drewery cleanup: 559f12db248SBryan Drewery if (pkey) 560f12db248SBryan Drewery EVP_PKEY_free(pkey); 561f12db248SBryan Drewery if (mdctx) 562f12db248SBryan Drewery EVP_MD_CTX_destroy(mdctx); 563f12db248SBryan Drewery ERR_free_strings(); 564f12db248SBryan Drewery 565f12db248SBryan Drewery return (ret); 566f12db248SBryan Drewery } 567f12db248SBryan Drewery 568f12db248SBryan Drewery static struct sig_cert * 569f12db248SBryan Drewery parse_cert(int fd) { 570f12db248SBryan Drewery int my_fd; 571f12db248SBryan Drewery struct sig_cert *sc; 572f12db248SBryan Drewery FILE *fp; 573f12db248SBryan Drewery struct sbuf *buf, *sig, *cert; 574f12db248SBryan Drewery char *line; 575f12db248SBryan Drewery size_t linecap; 576f12db248SBryan Drewery ssize_t linelen; 577f12db248SBryan Drewery 578c2788c07SBryan Drewery buf = NULL; 579f12db248SBryan Drewery my_fd = -1; 580f12db248SBryan Drewery sc = NULL; 581f12db248SBryan Drewery line = NULL; 582f12db248SBryan Drewery linecap = 0; 583f12db248SBryan Drewery 584f12db248SBryan Drewery if (lseek(fd, 0, 0) == -1) { 585f12db248SBryan Drewery warn("lseek"); 586f12db248SBryan Drewery return (NULL); 587f12db248SBryan Drewery } 588f12db248SBryan Drewery 589f12db248SBryan Drewery /* Duplicate the fd so that fclose(3) does not close it. */ 590f12db248SBryan Drewery if ((my_fd = dup(fd)) == -1) { 591f12db248SBryan Drewery warnx("dup"); 592f12db248SBryan Drewery return (NULL); 593f12db248SBryan Drewery } 594f12db248SBryan Drewery 595f12db248SBryan Drewery if ((fp = fdopen(my_fd, "rb")) == NULL) { 596f12db248SBryan Drewery warn("fdopen"); 597f12db248SBryan Drewery close(my_fd); 598f12db248SBryan Drewery return (NULL); 599f12db248SBryan Drewery } 600f12db248SBryan Drewery 601f12db248SBryan Drewery sig = sbuf_new_auto(); 602f12db248SBryan Drewery cert = sbuf_new_auto(); 603f12db248SBryan Drewery 604f12db248SBryan Drewery while ((linelen = getline(&line, &linecap, fp)) > 0) { 605f12db248SBryan Drewery if (strcmp(line, "SIGNATURE\n") == 0) { 606f12db248SBryan Drewery buf = sig; 607f12db248SBryan Drewery continue; 608f12db248SBryan Drewery } else if (strcmp(line, "CERT\n") == 0) { 609f12db248SBryan Drewery buf = cert; 610f12db248SBryan Drewery continue; 611f12db248SBryan Drewery } else if (strcmp(line, "END\n") == 0) { 612f12db248SBryan Drewery break; 613f12db248SBryan Drewery } 614f12db248SBryan Drewery if (buf != NULL) 615f12db248SBryan Drewery sbuf_bcat(buf, line, linelen); 616f12db248SBryan Drewery } 617f12db248SBryan Drewery 618f12db248SBryan Drewery fclose(fp); 619f12db248SBryan Drewery 620f12db248SBryan Drewery /* Trim out unrelated trailing newline */ 621f12db248SBryan Drewery sbuf_setpos(sig, sbuf_len(sig) - 1); 622f12db248SBryan Drewery 623f12db248SBryan Drewery sbuf_finish(sig); 624f12db248SBryan Drewery sbuf_finish(cert); 625f12db248SBryan Drewery 626f12db248SBryan Drewery sc = calloc(1, sizeof(struct sig_cert)); 627f12db248SBryan Drewery sc->siglen = sbuf_len(sig); 628f12db248SBryan Drewery sc->sig = calloc(1, sc->siglen); 629f12db248SBryan Drewery memcpy(sc->sig, sbuf_data(sig), sc->siglen); 630f12db248SBryan Drewery 631f12db248SBryan Drewery sc->certlen = sbuf_len(cert); 632f12db248SBryan Drewery sc->cert = strdup(sbuf_data(cert)); 633f12db248SBryan Drewery 634f12db248SBryan Drewery sbuf_delete(sig); 635f12db248SBryan Drewery sbuf_delete(cert); 636f12db248SBryan Drewery 637f12db248SBryan Drewery return (sc); 638f12db248SBryan Drewery } 639f12db248SBryan Drewery 640f12db248SBryan Drewery static bool 641f12db248SBryan Drewery verify_signature(int fd_pkg, int fd_sig) 642f12db248SBryan Drewery { 643f12db248SBryan Drewery struct fingerprint_list *trusted, *revoked; 644f12db248SBryan Drewery struct fingerprint *fingerprint; 645f12db248SBryan Drewery struct sig_cert *sc; 646f12db248SBryan Drewery bool ret; 647f12db248SBryan Drewery int trusted_count, revoked_count; 648f12db248SBryan Drewery const char *fingerprints; 649f12db248SBryan Drewery char path[MAXPATHLEN]; 650f12db248SBryan Drewery char hash[SHA256_DIGEST_LENGTH * 2 + 1]; 651f12db248SBryan Drewery 652516aaf7cSBryan Drewery sc = NULL; 653f12db248SBryan Drewery trusted = revoked = NULL; 654f12db248SBryan Drewery ret = false; 655f12db248SBryan Drewery 656f12db248SBryan Drewery /* Read and parse fingerprints. */ 657f12db248SBryan Drewery if (config_string(FINGERPRINTS, &fingerprints) != 0) { 658f12db248SBryan Drewery warnx("No CONFIG_FINGERPRINTS defined"); 659f12db248SBryan Drewery goto cleanup; 660f12db248SBryan Drewery } 661f12db248SBryan Drewery 662f12db248SBryan Drewery snprintf(path, MAXPATHLEN, "%s/trusted", fingerprints); 663f12db248SBryan Drewery if ((trusted = load_fingerprints(path, &trusted_count)) == NULL) { 664f12db248SBryan Drewery warnx("Error loading trusted certificates"); 665f12db248SBryan Drewery goto cleanup; 666f12db248SBryan Drewery } 667f12db248SBryan Drewery 668f12db248SBryan Drewery if (trusted_count == 0 || trusted == NULL) { 669f12db248SBryan Drewery fprintf(stderr, "No trusted certificates found.\n"); 670f12db248SBryan Drewery goto cleanup; 671f12db248SBryan Drewery } 672f12db248SBryan Drewery 673f12db248SBryan Drewery snprintf(path, MAXPATHLEN, "%s/revoked", fingerprints); 674f12db248SBryan Drewery if ((revoked = load_fingerprints(path, &revoked_count)) == NULL) { 675f12db248SBryan Drewery warnx("Error loading revoked certificates"); 676f12db248SBryan Drewery goto cleanup; 677f12db248SBryan Drewery } 678f12db248SBryan Drewery 679f12db248SBryan Drewery /* Read certificate and signature in. */ 680f12db248SBryan Drewery if ((sc = parse_cert(fd_sig)) == NULL) { 681f12db248SBryan Drewery warnx("Error parsing certificate"); 682f12db248SBryan Drewery goto cleanup; 683f12db248SBryan Drewery } 684f12db248SBryan Drewery /* Explicitly mark as non-trusted until proven otherwise. */ 685f12db248SBryan Drewery sc->trusted = false; 686f12db248SBryan Drewery 687f12db248SBryan Drewery /* Parse signature and pubkey out of the certificate */ 688f12db248SBryan Drewery sha256_buf(sc->cert, sc->certlen, hash); 689f12db248SBryan Drewery 690f12db248SBryan Drewery /* Check if this hash is revoked */ 691f12db248SBryan Drewery if (revoked != NULL) { 692f12db248SBryan Drewery STAILQ_FOREACH(fingerprint, revoked, next) { 693f12db248SBryan Drewery if (strcasecmp(fingerprint->hash, hash) == 0) { 694516aaf7cSBryan Drewery fprintf(stderr, "The package was signed with " 695516aaf7cSBryan Drewery "revoked certificate %s\n", 696516aaf7cSBryan Drewery fingerprint->name); 697f12db248SBryan Drewery goto cleanup; 698f12db248SBryan Drewery } 699f12db248SBryan Drewery } 700f12db248SBryan Drewery } 701f12db248SBryan Drewery 702f12db248SBryan Drewery STAILQ_FOREACH(fingerprint, trusted, next) { 703f12db248SBryan Drewery if (strcasecmp(fingerprint->hash, hash) == 0) { 704f12db248SBryan Drewery sc->trusted = true; 705516aaf7cSBryan Drewery sc->name = strdup(fingerprint->name); 706f12db248SBryan Drewery break; 707f12db248SBryan Drewery } 708f12db248SBryan Drewery } 709f12db248SBryan Drewery 710f12db248SBryan Drewery if (sc->trusted == false) { 711516aaf7cSBryan Drewery fprintf(stderr, "No trusted fingerprint found matching " 712f12db248SBryan Drewery "package's certificate\n"); 713f12db248SBryan Drewery goto cleanup; 714f12db248SBryan Drewery } 715f12db248SBryan Drewery 716f12db248SBryan Drewery /* Verify the signature. */ 717516aaf7cSBryan Drewery printf("Verifying signature with trusted certificate %s... ", sc->name); 718f12db248SBryan Drewery if (rsa_verify_cert(fd_pkg, sc->cert, sc->certlen, sc->sig, 719f12db248SBryan Drewery sc->siglen) == false) { 720f12db248SBryan Drewery fprintf(stderr, "Signature is not valid\n"); 721f12db248SBryan Drewery goto cleanup; 722f12db248SBryan Drewery } 723f12db248SBryan Drewery 724f12db248SBryan Drewery ret = true; 725f12db248SBryan Drewery 726f12db248SBryan Drewery cleanup: 727516aaf7cSBryan Drewery if (trusted) 728516aaf7cSBryan Drewery free_fingerprint_list(trusted); 729516aaf7cSBryan Drewery if (revoked) 730516aaf7cSBryan Drewery free_fingerprint_list(revoked); 731f12db248SBryan Drewery if (sc) { 732f12db248SBryan Drewery if (sc->cert) 733f12db248SBryan Drewery free(sc->cert); 734f12db248SBryan Drewery if (sc->sig) 735f12db248SBryan Drewery free(sc->sig); 736516aaf7cSBryan Drewery if (sc->name) 737516aaf7cSBryan Drewery free(sc->name); 738f12db248SBryan Drewery free(sc); 739f12db248SBryan Drewery } 740f12db248SBryan Drewery 741f12db248SBryan Drewery return (ret); 742f12db248SBryan Drewery } 743f12db248SBryan Drewery 744f12db248SBryan Drewery static int 7455212e8baSBryan Drewery bootstrap_pkg(bool force) 746f12db248SBryan Drewery { 747f12db248SBryan Drewery FILE *config; 748f12db248SBryan Drewery int fd_pkg, fd_sig; 749f12db248SBryan Drewery int ret; 750f12db248SBryan Drewery char *site; 751f12db248SBryan Drewery char url[MAXPATHLEN]; 752f12db248SBryan Drewery char conf[MAXPATHLEN]; 753f12db248SBryan Drewery char tmppkg[MAXPATHLEN]; 754f12db248SBryan Drewery char tmpsig[MAXPATHLEN]; 755f12db248SBryan Drewery const char *packagesite; 756f12db248SBryan Drewery const char *signature_type; 757f12db248SBryan Drewery char pkgstatic[MAXPATHLEN]; 758f12db248SBryan Drewery 759f12db248SBryan Drewery fd_sig = -1; 760f12db248SBryan Drewery ret = -1; 761f12db248SBryan Drewery config = NULL; 762f12db248SBryan Drewery 763f12db248SBryan Drewery if (config_string(PACKAGESITE, &packagesite) != 0) { 764f12db248SBryan Drewery warnx("No PACKAGESITE defined"); 765f12db248SBryan Drewery return (-1); 766f12db248SBryan Drewery } 767f12db248SBryan Drewery 768f12db248SBryan Drewery if (config_string(SIGNATURE_TYPE, &signature_type) != 0) { 769f12db248SBryan Drewery warnx("Error looking up SIGNATURE_TYPE"); 770f12db248SBryan Drewery return (-1); 771f12db248SBryan Drewery } 772f12db248SBryan Drewery 773f12db248SBryan Drewery printf("Bootstrapping pkg from %s, please wait...\n", packagesite); 774f12db248SBryan Drewery 775f12db248SBryan Drewery /* Support pkg+http:// for PACKAGESITE which is the new format 776f12db248SBryan Drewery in 1.2 to avoid confusion on why http://pkg.FreeBSD.org has 777f12db248SBryan Drewery no A record. */ 778f12db248SBryan Drewery if (strncmp(URL_SCHEME_PREFIX, packagesite, 779f12db248SBryan Drewery strlen(URL_SCHEME_PREFIX)) == 0) 780f12db248SBryan Drewery packagesite += strlen(URL_SCHEME_PREFIX); 781f12db248SBryan Drewery snprintf(url, MAXPATHLEN, "%s/Latest/pkg.txz", packagesite); 782f12db248SBryan Drewery 783f12db248SBryan Drewery snprintf(tmppkg, MAXPATHLEN, "%s/pkg.txz.XXXXXX", 784f12db248SBryan Drewery getenv("TMPDIR") ? getenv("TMPDIR") : _PATH_TMP); 785f12db248SBryan Drewery 786f12db248SBryan Drewery if ((fd_pkg = fetch_to_fd(url, tmppkg)) == -1) 787f12db248SBryan Drewery goto fetchfail; 788f12db248SBryan Drewery 789f12db248SBryan Drewery if (signature_type != NULL && 790f12db248SBryan Drewery strcasecmp(signature_type, "FINGERPRINTS") == 0) { 791f12db248SBryan Drewery snprintf(tmpsig, MAXPATHLEN, "%s/pkg.txz.sig.XXXXXX", 792f12db248SBryan Drewery getenv("TMPDIR") ? getenv("TMPDIR") : _PATH_TMP); 793f12db248SBryan Drewery snprintf(url, MAXPATHLEN, "%s/Latest/pkg.txz.sig", 794f12db248SBryan Drewery packagesite); 795f12db248SBryan Drewery 796f12db248SBryan Drewery if ((fd_sig = fetch_to_fd(url, tmpsig)) == -1) { 797f12db248SBryan Drewery fprintf(stderr, "Signature for pkg not available.\n"); 798f12db248SBryan Drewery goto fetchfail; 799f12db248SBryan Drewery } 800f12db248SBryan Drewery 801f12db248SBryan Drewery if (verify_signature(fd_pkg, fd_sig) == false) 802f12db248SBryan Drewery goto cleanup; 803f12db248SBryan Drewery } 804f12db248SBryan Drewery 805f12db248SBryan Drewery if ((ret = extract_pkg_static(fd_pkg, pkgstatic, MAXPATHLEN)) == 0) 8065212e8baSBryan Drewery ret = install_pkg_static(pkgstatic, tmppkg, force); 8073aa4b42aSBaptiste Daroussin 8082fe3761eSBaptiste Daroussin snprintf(conf, MAXPATHLEN, "%s/etc/pkg.conf", 8092fe3761eSBaptiste Daroussin getenv("LOCALBASE") ? getenv("LOCALBASE") : _LOCALBASE); 8102fe3761eSBaptiste Daroussin 8112fe3761eSBaptiste Daroussin if (access(conf, R_OK) == -1) { 8122fe3761eSBaptiste Daroussin site = strrchr(url, '/'); 8132fe3761eSBaptiste Daroussin if (site == NULL) 8142fe3761eSBaptiste Daroussin goto cleanup; 8152fe3761eSBaptiste Daroussin site[0] = '\0'; 8162fe3761eSBaptiste Daroussin site = strrchr(url, '/'); 8172fe3761eSBaptiste Daroussin if (site == NULL) 8182fe3761eSBaptiste Daroussin goto cleanup; 8192fe3761eSBaptiste Daroussin site[0] = '\0'; 8202fe3761eSBaptiste Daroussin 8212fe3761eSBaptiste Daroussin config = fopen(conf, "w+"); 8222fe3761eSBaptiste Daroussin if (config == NULL) 8232fe3761eSBaptiste Daroussin goto cleanup; 824514ead92SBaptiste Daroussin fprintf(config, "packagesite: %s\n", url); 8252fe3761eSBaptiste Daroussin fclose(config); 8262fe3761eSBaptiste Daroussin } 8272fe3761eSBaptiste Daroussin 828a6454741SBaptiste Daroussin goto cleanup; 829a6454741SBaptiste Daroussin 830a6454741SBaptiste Daroussin fetchfail: 831a6454741SBaptiste Daroussin warnx("Error fetching %s: %s", url, fetchLastErrString); 8324ff9a7efSBryan Drewery fprintf(stderr, "A pre-built version of pkg could not be found for " 8334ff9a7efSBryan Drewery "your system.\n"); 8344ff9a7efSBryan Drewery fprintf(stderr, "Consider changing PACKAGESITE or installing it from " 8354ff9a7efSBryan Drewery "ports: 'ports-mgmt/pkg'.\n"); 836a6454741SBaptiste Daroussin 8373aa4b42aSBaptiste Daroussin cleanup: 838f12db248SBryan Drewery if (fd_sig != -1) { 839f12db248SBryan Drewery close(fd_sig); 840f12db248SBryan Drewery unlink(tmpsig); 841f12db248SBryan Drewery } 842f12db248SBryan Drewery close(fd_pkg); 8433aa4b42aSBaptiste Daroussin unlink(tmppkg); 8443aa4b42aSBaptiste Daroussin 845a6454741SBaptiste Daroussin return (ret); 8463aa4b42aSBaptiste Daroussin } 8473aa4b42aSBaptiste Daroussin 848e18ad51cSAlexander Kabaev static const char confirmation_message[] = 849e18ad51cSAlexander Kabaev "The package management tool is not yet installed on your system.\n" 850e18ad51cSAlexander Kabaev "Do you want to fetch and install it now? [y/N]: "; 851e18ad51cSAlexander Kabaev 852e18ad51cSAlexander Kabaev static int 853e18ad51cSAlexander Kabaev pkg_query_yes_no(void) 854e18ad51cSAlexander Kabaev { 855e18ad51cSAlexander Kabaev int ret, c; 856e18ad51cSAlexander Kabaev 857e18ad51cSAlexander Kabaev c = getchar(); 858e18ad51cSAlexander Kabaev 859e18ad51cSAlexander Kabaev if (c == 'y' || c == 'Y') 860e18ad51cSAlexander Kabaev ret = 1; 861e18ad51cSAlexander Kabaev else 862e18ad51cSAlexander Kabaev ret = 0; 863e18ad51cSAlexander Kabaev 864e18ad51cSAlexander Kabaev while (c != '\n' && c != EOF) 865e18ad51cSAlexander Kabaev c = getchar(); 866e18ad51cSAlexander Kabaev 867e18ad51cSAlexander Kabaev return (ret); 868e18ad51cSAlexander Kabaev } 869e18ad51cSAlexander Kabaev 87052cb76feSBryan Drewery static int 8715212e8baSBryan Drewery bootstrap_pkg_local(const char *pkgpath, bool force) 87252cb76feSBryan Drewery { 87352cb76feSBryan Drewery char path[MAXPATHLEN]; 87452cb76feSBryan Drewery char pkgstatic[MAXPATHLEN]; 87552cb76feSBryan Drewery const char *signature_type; 87652cb76feSBryan Drewery int fd_pkg, fd_sig, ret; 87752cb76feSBryan Drewery 87852cb76feSBryan Drewery fd_sig = -1; 87952cb76feSBryan Drewery ret = -1; 88052cb76feSBryan Drewery 88152cb76feSBryan Drewery fd_pkg = open(pkgpath, O_RDONLY); 88252cb76feSBryan Drewery if (fd_pkg == -1) 88352cb76feSBryan Drewery err(EXIT_FAILURE, "Unable to open %s", pkgpath); 88452cb76feSBryan Drewery 88552cb76feSBryan Drewery if (config_string(SIGNATURE_TYPE, &signature_type) != 0) { 88652cb76feSBryan Drewery warnx("Error looking up SIGNATURE_TYPE"); 88752cb76feSBryan Drewery return (-1); 88852cb76feSBryan Drewery } 88952cb76feSBryan Drewery if (signature_type != NULL && 89052cb76feSBryan Drewery strcasecmp(signature_type, "FINGERPRINTS") == 0) { 89152cb76feSBryan Drewery snprintf(path, sizeof(path), "%s.sig", pkgpath); 89252cb76feSBryan Drewery 89352cb76feSBryan Drewery if ((fd_sig = open(path, O_RDONLY)) == -1) { 89452cb76feSBryan Drewery fprintf(stderr, "Signature for pkg not available.\n"); 89552cb76feSBryan Drewery goto cleanup; 89652cb76feSBryan Drewery } 89752cb76feSBryan Drewery 89852cb76feSBryan Drewery if (verify_signature(fd_pkg, fd_sig) == false) 89952cb76feSBryan Drewery goto cleanup; 90052cb76feSBryan Drewery } 90152cb76feSBryan Drewery 90252cb76feSBryan Drewery if ((ret = extract_pkg_static(fd_pkg, pkgstatic, MAXPATHLEN)) == 0) 9035212e8baSBryan Drewery ret = install_pkg_static(pkgstatic, pkgpath, force); 90452cb76feSBryan Drewery 90552cb76feSBryan Drewery cleanup: 90652cb76feSBryan Drewery close(fd_pkg); 90752cb76feSBryan Drewery if (fd_sig != -1) 90852cb76feSBryan Drewery close(fd_sig); 90952cb76feSBryan Drewery 91052cb76feSBryan Drewery return (ret); 91152cb76feSBryan Drewery } 91252cb76feSBryan Drewery 9133aa4b42aSBaptiste Daroussin int 9143aa4b42aSBaptiste Daroussin main(__unused int argc, char *argv[]) 9153aa4b42aSBaptiste Daroussin { 9163aa4b42aSBaptiste Daroussin char pkgpath[MAXPATHLEN]; 9175212e8baSBryan Drewery const char *pkgarg; 9185212e8baSBryan Drewery bool bootstrap_only, force, yes; 9195212e8baSBryan Drewery 9205212e8baSBryan Drewery bootstrap_only = false; 9215212e8baSBryan Drewery force = false; 9225212e8baSBryan Drewery pkgarg = NULL; 9235212e8baSBryan Drewery yes = false; 9243aa4b42aSBaptiste Daroussin 9253aa4b42aSBaptiste Daroussin snprintf(pkgpath, MAXPATHLEN, "%s/sbin/pkg", 9263aa4b42aSBaptiste Daroussin getenv("LOCALBASE") ? getenv("LOCALBASE") : _LOCALBASE); 9273aa4b42aSBaptiste Daroussin 9285212e8baSBryan Drewery if (argc > 1 && strcmp(argv[1], "bootstrap") == 0) { 9295212e8baSBryan Drewery bootstrap_only = true; 9305212e8baSBryan Drewery if (argc == 3 && strcmp(argv[2], "-f") == 0) 9315212e8baSBryan Drewery force = true; 9325212e8baSBryan Drewery } 9335212e8baSBryan Drewery 9345212e8baSBryan Drewery if ((bootstrap_only && force) || access(pkgpath, X_OK) == -1) { 935e18ad51cSAlexander Kabaev /* 936d482e1f4SMatthew Seaman * To allow 'pkg -N' to be used as a reliable test for whether 937ecfed9f2SMatthew Seaman * a system is configured to use pkg, don't bootstrap pkg 938ecfed9f2SMatthew Seaman * when that argument is given as argv[1]. 939ecfed9f2SMatthew Seaman */ 940d8f9490cSMatthew Seaman if (argv[1] != NULL && strcmp(argv[1], "-N") == 0) 941e41b8acbSMatthew Seaman errx(EXIT_FAILURE, "pkg is not installed"); 942ecfed9f2SMatthew Seaman 94352cb76feSBryan Drewery config_init(); 94452cb76feSBryan Drewery 9455212e8baSBryan Drewery if (argc > 1 && strcmp(argv[1], "add") == 0) { 9465212e8baSBryan Drewery if (argc > 2 && strcmp(argv[2], "-f") == 0) { 9475212e8baSBryan Drewery force = true; 9485212e8baSBryan Drewery pkgarg = argv[3]; 9495212e8baSBryan Drewery } else 9505212e8baSBryan Drewery pkgarg = argv[2]; 9515212e8baSBryan Drewery if (pkgarg == NULL) { 9525212e8baSBryan Drewery fprintf(stderr, "Path to pkg.txz required\n"); 9535212e8baSBryan Drewery exit(EXIT_FAILURE); 9545212e8baSBryan Drewery } 9555212e8baSBryan Drewery if (access(pkgarg, R_OK) == -1) { 9565212e8baSBryan Drewery fprintf(stderr, "No such file: %s\n", pkgarg); 9575212e8baSBryan Drewery exit(EXIT_FAILURE); 9585212e8baSBryan Drewery } 9595212e8baSBryan Drewery if (bootstrap_pkg_local(pkgarg, force) != 0) 960b70213b5SBaptiste Daroussin exit(EXIT_FAILURE); 961b70213b5SBaptiste Daroussin exit(EXIT_SUCCESS); 962b70213b5SBaptiste Daroussin } 963ecfed9f2SMatthew Seaman /* 964e18ad51cSAlexander Kabaev * Do not ask for confirmation if either of stdin or stdout is 965e18ad51cSAlexander Kabaev * not tty. Check the environment to see if user has answer 966e18ad51cSAlexander Kabaev * tucked in there already. 967e18ad51cSAlexander Kabaev */ 9689950eceeSBaptiste Daroussin config_bool(ASSUME_ALWAYS_YES, &yes); 9699950eceeSBaptiste Daroussin if (!yes) { 970e18ad51cSAlexander Kabaev printf("%s", confirmation_message); 971204ea792SBaptiste Daroussin if (!isatty(fileno(stdin))) 9723a480126SBaptiste Daroussin exit(EXIT_FAILURE); 973204ea792SBaptiste Daroussin 974204ea792SBaptiste Daroussin if (pkg_query_yes_no() == 0) 975e18ad51cSAlexander Kabaev exit(EXIT_FAILURE); 976e18ad51cSAlexander Kabaev } 9775212e8baSBryan Drewery if (bootstrap_pkg(force) != 0) 978a6454741SBaptiste Daroussin exit(EXIT_FAILURE); 9799950eceeSBaptiste Daroussin config_finish(); 980c3e8a27aSBryan Drewery 9815212e8baSBryan Drewery if (bootstrap_only) 982c3e8a27aSBryan Drewery exit(EXIT_SUCCESS); 9835212e8baSBryan Drewery } else if (bootstrap_only) { 9845212e8baSBryan Drewery printf("pkg already bootstrapped at %s\n", pkgpath); 985c3e8a27aSBryan Drewery exit(EXIT_SUCCESS); 986c3e8a27aSBryan Drewery } 9873aa4b42aSBaptiste Daroussin 9883aa4b42aSBaptiste Daroussin execv(pkgpath, argv); 9893aa4b42aSBaptiste Daroussin 990a6454741SBaptiste Daroussin /* NOT REACHED */ 9913b05c2a8SBaptiste Daroussin return (EXIT_FAILURE); 9923aa4b42aSBaptiste Daroussin } 993