mirror/lnd
1
0 Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #7758 from guggero/gpg-homedir

Browse Source 
scripts: use gpg --homedir flag to fix new behavior in 2.4
This commit is contained in:
Oliver Gugger authored and GitHub committed 2023-07-11 10:33:57 +02:00
2 parents 287b0ac219 52115ab19b
commit 54acf270a2
2 files changed
+13 -8
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/release-notes/release-notes-0.17.0.md
+5
View File
@@ -168,6 +168,11 @@ unlock or create.
`RPCCRTPATH`](https://github.com/lightningnetwork/lnd/pull/7429) to the `RPCCRTPATH`](https://github.com/lightningnetwork/lnd/pull/7429) to the
`lnd` Docker image main script (`/start-lnd.sh`). `lnd` Docker image main script (`/start-lnd.sh`).
* Fix bug in `scripts/verify-install.sh` that caused the [release binary
signature verification script to not properly import signing
keys](https://github.com/lightningnetwork/lnd/pull/7758) when being run with
new version of `gpg` (which is the case in the latest Docker image).
# Contributors (Alphabetical Order) # Contributors (Alphabetical Order)
* Aljaz Ceru * Aljaz Ceru
scripts/verify-install.sh
+8 -8
View File
@@ -66,8 +66,8 @@ function import_keys() {
USERNAME=$(echo $key | cut -d' ' -f2) USERNAME=$(echo $key | cut -d' ' -f2)
IMPORT_FILE="keys/$USERNAME.asc" IMPORT_FILE="keys/$USERNAME.asc"
KEY_FILE="$DIR/$IMPORT_FILE" KEY_FILE="$DIR/$IMPORT_FILE"
KEYRING_UNTRUSTED="$TEMP_DIR/$USERNAME.pgp-untrusted" KEYRING_UNTRUSTED="$USERNAME.pgp-untrusted"
KEYRING_TRUSTED="$TEMP_DIR/$USERNAME.pgp" KEYRING_TRUSTED="$USERNAME.pgp"
# Because a key file could contain multiple keys, we need to be careful. To # Because a key file could contain multiple keys, we need to be careful. To
# make sure we only import and use the key with the hard coded key ID of # make sure we only import and use the key with the hard coded key ID of
@@ -79,14 +79,14 @@ function import_keys() {
# few lines. # few lines.
echo "" echo ""
echo "Importing key(s) from $KEY_FILE into temporary keyring $KEYRING_UNTRUSTED" echo "Importing key(s) from $KEY_FILE into temporary keyring $KEYRING_UNTRUSTED"
gpg --no-default-keyring --keyring "$KEYRING_UNTRUSTED" \ gpg --homedir "$TEMP_DIR" --no-default-keyring --keyring "$KEYRING_UNTRUSTED" \
--import < "$KEY_FILE" --import < "$KEY_FILE"
echo "" echo ""
echo "Exporting key $KEY_ID from untrusted keyring to trusted keyring $KEYRING_TRUSTED" echo "Exporting key $KEY_ID from untrusted keyring to trusted keyring $KEYRING_TRUSTED"
gpg --no-default-keyring --keyring "$KEYRING_UNTRUSTED" \ gpg --homedir "$TEMP_DIR" --no-default-keyring --keyring "$KEYRING_UNTRUSTED" \
--export "$KEY_ID" | \ --export "$KEY_ID" | \
gpg --no-default-keyring --keyring "$KEYRING_TRUSTED" --import gpg --homedir "$TEMP_DIR" --no-default-keyring --keyring "$KEYRING_TRUSTED" --import
done done
} }
@@ -137,8 +137,8 @@ function verify_signatures() {
USERNAME=${USERNAME##manifest-} USERNAME=${USERNAME##manifest-}
# If the user is known, they should have a key ring file with only their key. # If the user is known, they should have a key ring file with only their key.
KEYRING="$TEMP_DIR/$USERNAME.pgp" KEYRING="$USERNAME.pgp"
if [[ ! -f "$KEYRING" ]]; then if [[ ! -f "$TEMP_DIR/$KEYRING" ]]; then
echo "User $USERNAME does not have a known key, skipping" echo "User $USERNAME does not have a known key, skipping"
continue continue
fi fi
@@ -156,7 +156,7 @@ function verify_signatures() {
fi fi
# Run the actual verification. # Run the actual verification.
gpg --no-default-keyring --keyring "$KEYRING" --status-fd=1 \ gpg --homedir "$TEMP_DIR" --no-default-keyring --keyring "$KEYRING" --status-fd=1 \
--verify "$TEMP_DIR/$signature" "$TEMP_DIR/$MANIFEST" \ --verify "$TEMP_DIR/$signature" "$TEMP_DIR/$MANIFEST" \
> "$STATUS_FILE" 2>&1 || { echo "ERROR: Invalid signature!"; exit 1; } > "$STATUS_FILE" 2>&1 || { echo "ERROR: Invalid signature!"; exit 1; }