| 1 | From bcbec3930926e4dc4c39625b3b571c516183e0a9 Mon Sep 17 00:00:00 2001
|
| 2 | From: Kaarle Ritvanen <[email protected]>
|
| 3 | Date: Tue, 10 Dec 2024 15:16:18 +0200
|
| 4 | Subject: [PATCH 05/11] lxc-alpine: remove unverified apk.static
|
| 5 |
|
| 6 | to prevent its execution on the next run
|
| 7 |
|
| 8 | Signed-off-by: Kaarle Ritvanen <[email protected]>
|
| 9 | ---
|
| 10 | templates/lxc-alpine.in | 9 ++++++---
|
| 11 | 1 file changed, 6 insertions(+), 3 deletions(-)
|
| 12 |
|
| 13 | diff --git a/templates/lxc-alpine.in b/templates/lxc-alpine.in
|
| 14 | index beadd53..37f6248 100644
|
| 15 | |
| 16 | |
| 17 | @@ -224,11 +224,14 @@ fetch_apk_static() {
|
| 18 |
|
| 19 | local sigprefix=$apk.SIGN.RSA.
|
| 20 | local keyfile=$(ls -1 "$sigprefix"alpine-*.pub 2>/dev/null | head -n 1)
|
| 21 | - openssl dgst -sha1 \
|
| 22 | + if ! openssl dgst -sha1 \
|
| 23 | -verify "$APK_KEYS_DIR/${keyfile#$sigprefix}" \
|
| 24 | -signature "$keyfile" \
|
| 25 | - "$apk" \
|
| 26 | - || die 2 'Signature verification for apk.static failed'
|
| 27 | + "$apk"; then
|
| 28 | +
|
| 29 | + rm -f "$apk"
|
| 30 | + die 2 'Signature verification for apk.static failed'
|
| 31 | + fi
|
| 32 |
|
| 33 | # Note: apk doesn't return 0 for --version
|
| 34 | local out=$("$apk" --version)
|
| 35 | --
|
| 36 | 2.47.1
|
| 37 |
|