Karl/BobStore
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

when adding a repo with fingerprint, make sure to store the pubkey

Browse Source 
The logic here is crufty, so I slapped a flag in there to make sure that
the pubkey gets stored when someone configures a repo and includes the
fingerprint.  When the fingerprint is set, it will first download the
index.jar and verify it against that fingerprint.  The logic for storing
the pubkey permanently happens later in the XML parsing, so there needs to
be a flag to signal to store the pubkey in this case.

Before the flow was always index.xml -> get pubkey -> index.jar.  Really,
there should no longer be support for unsigned repos, then all of this
stuff can be dramatically simplified.

fixes #2924 https://dev.guardianproject.info/issues/2924
refs #2960 https://dev.guardianproject.info/issues/2960
This commit is contained in:
Hans-Christoph Steiner 2014-04-25 23:53:56 -04:00
parent 649bfa10b7
commit a0970d0720
2 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/org/fdroid/fdroid/updater/RepoUpdater.java
View File

@ -43,6 +43,7 @@ abstract public class RepoUpdater {
protected final Repo repo;
private List<App> apps = new ArrayList<App>();
private List<Apk> apks = new ArrayList<Apk>();
protected boolean usePubkeyInJar = false;
protected boolean hasChanged = false;
protected ProgressListener progressListener;
@ -230,9 +231,13 @@ abstract public class RepoUpdater {
values.put(RepoProvider.DataColumns.LAST_ETAG, etag);
}
// We read an unsigned index, but that indicates that
// a signed version is now available...
if (handler.getPubKey() != null && repo.pubkey == null) {
/*
* We read an unsigned index that indicates that a signed version
* is available. Or we received a repo config that included the
* fingerprint, so we need to save the pubkey now.
*/
if (handler.getPubKey() != null &&
(repo.pubkey == null || usePubkeyInJar)) {
// TODO: Spend the time *now* going to get the etag of the signed
// repo, so that we can prevent downloading it next time. Otherwise
// next time we update, we have to download the signed index
@ -241,6 +246,7 @@ abstract public class RepoUpdater {
Log.d("FDroid",
"Public key found - switching to signed repo for future updates");
values.put(RepoProvider.DataColumns.PUBLIC_KEY, handler.getPubKey());
usePubkeyInJar = false;
}
if (handler.getVersion() != -1 && handler.getVersion() != repo.version) {

1
src/org/fdroid/fdroid/updater/SignedRepoUpdater.java
View File

@ -31,6 +31,7 @@ public class SignedRepoUpdater extends RepoUpdater {
String certdata = Hasher.hex(cert);
if (repo.pubkey == null && repo.fingerprint.equals(Utils.calcFingerprint(cert))) {
repo.pubkey = certdata;
usePubkeyInJar = true;
}
if (repo.pubkey != null && repo.pubkey.equals(certdata)) {
match = true;