Bug#745735: apt: Provide meaningful exit codes for gpg failures

--wjBXLuQJB6WaCwUy
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi,

* Micah Anderson [Thu Apr 24, 2014 at 11:50:35AM -0400]:

> It seems like from reading the code that the gpg signature verification p=
rocess doesn't
> provide meaningful exit codes when bad things happen. This results in apt=
-get update
> providing an exit code of zero, even if there was a BADSIG. It would be v=
ery useful
> if we could get an exit code when these bad situations happen:
>
> BADSIG
> NO_PUBKEY
> KEYEXPIRED
> REVKEYSIG
> NODATA

IMO we should clearly exit with non-zero in case of failures in apt
in such situations.

The behavior in apt v3.0.3 is still like this:

| % sudo apt update
| [=E2=80=A6]
| Err:5 https://demo.example.org/custom trixie InRelease
|   The following signatures were invalid: EXPKEYSIG BEFORE1FAILS2342 Autom=
atic Signing Key <[email protected]>
| [=E2=80=A6]
| W: An error occurred during the signature verification. The repository is=
 not updated and the previous index files will be used. GPG error: http://d=
emo.example.org/custom trixie InRelease: The following signatures were inva=
lid: EXPKEYSIG BEFORE1FAILS2342 Automatic Signing Key <[email protected]>
| W: Failed to fetch https://demo.example.org/custom/dists/trixie/InRelease=
  The following signatures were invalid: EXPKEYSIG BEFORE1FAILS2342 Automat=
ic Signing Key <[email protected]>
| W: Some index files failed to download. They have been ignored, or old on=
es used instead.
| % echo $?
| 0
| %

I've seen too many unpatched + hacked systems which ended up as such
due to expired GPG keys in their (usually 3rd party) Debian
repositories. IMO this might even warrant a CVE.

regards
-mika-

--wjBXLuQJB6WaCwUy
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEM8yxNkAa/shDo4djlqh4crfqNzcFAmpjj4gACgkQlqh4crfq
Nzfm5w/+LqD4F5lzWV0xmeVIiGBbwT4finuOHyUFXn/Sc/4JGHuWitOsMoowN4x6
V5Qhx7tmEhWLgkROHErVQ8HtW+7cTXGYLIKLLHjDsThwuvdxom6eIzcht5lveA52
6zDy0CHI3CF1yqstdS1LSRDLSfcJZTEbjWgcxVHisAfG8hXVP6/DvL/dUFNpYHKL
aSyUAnIZxuHnCQWCPmVmDzjtXvuhhY2xtd/N/gpo/dvJHXYP6sDTT05h0O0xaGbi
DldU/ghmSGDFsHUbxP1Sssb8zsRnTx5BHX1BjrLeZILLyDKV40UXxeDp6BAn0Jem
X71zAMuM2B/sxLrPC696YomA/oYQBWL75ZlTdk+9FPRrL/FODcVNkwHO8hxWGHXA
ZVMkgogRVveIsf4+RoFoorGYH4Az2vLxh8a9tcNa2jSN+ucmlrgibZB6r9sMX9Dj
HFnyGWyoEf7+xMR8Hx5IPcFsljJAyyIS/SzTNNbIAabYqycevHahqCWQ1s3T7kZm
4nnsgdgNeG3ZjjKD53RmUGnNe5AwdgLh5c7b80HoUIfmt7j+RSGvjKgiIM53Q4hk
eJJsv5P59SbtynFGtn3rnfVQD4hlPRqaVAOPTY6E1P179R1SdMrmTv9yUQXYTOQj
IAZwrJy5VPMdqn4z3qmCb35uVmI2o/K+21JXVXAliTZ+CFCZrA0=
=JEOD
-----END PGP SIGNATURE-----

--wjBXLuQJB6WaCwUy--