Correct signature validation in python-debian (and misc other bugs)

Mon Aug 5 14:43:52 UTC 2013

Dear python-debian maintainers,

I've been scratching a few itches in python-debian just recently and my "quick 
look" turned into a much longer one. The attached patch series (alternatively 
available in git [1]) covers a bit of ground. I realised that this patch set 
was already too big and that discussing it before looking further at python-
debian's bts pages was a good idea.

Comments and discussion welcome

regards
Stuart

#695932 -- deb822 can be fooled into accepting unsigned data:

Given that gpgv doesn't provide a way of retrieving the data that has actually 
been signed in a clearsigned message, there are two choices: (a) detach the 
signature from the original using NIH code and then use gpgv to verify the 
detached signature, or (b) use gpg --decrypt to get original back. The latter 
seems to me to be the better option and is implemented here.

0001-Add-double-signature-test-to-expose-695932.patch
0002-Add-test-for-handling-dash-escaped-clearsign-data.patch
0003-Switch-to-using-gpg-for-extracting-signed-data.patch
0005-Add-dependency-on-gnupg.patch
0007-Make-gpg-use-a-temporary-directory-for-gpghome.patch
0008-Set-encoding-to-be-used-by-gpg.patch
0011-Add-keyring-packages-to-suggests.patch

(patches 0007 and 0008 were needed to cope with some odd bugs picked up by 
the test suite in less well controlled environments)

I started looking at deb822 because I wanted a nice pythonic way of testing 
signatures on Release/Release.gpg and InRelease. That's actually pretty easy 
to add to the previous patch set.

0004-Allow-InRelease-files-to-be-signature-checked.patch
0006-Add-method-to-GpgInfo-to-test-detached-signature.patch

#715558 -- make iter_paragraphs less strict in requiring empty lines between 
paragraphs

0009-Allow-whitespace-only-lines-to-separate-paragraphs.patch

#710923 -- allow GpgInfo to sensibly represent multiple signatures on a file

0010-Handle-multiple-gpg-signatures-gracefully.patch

Running the tests with different locales from d/rules is much easier with a 
tool like nosetests so I've suggested making that change. DEP-8 tests are nice 
too...

0012-Use-nosetests-to-run-the-test-suite.patch
0013-Add-DEP8-autopkgtest-test-suite.patch

And finally a draft of a changelog entry for the work so far.

0014-Add-changelog-for-work-on-this-branch.patch

[1] git clone http://git.nanonanonano.net/projects/python-debian.git -b usegpg

(depending on feedback and how strong the desire for a clean history is, I may 
well rebase that repo)

-- 
Stuart Prescott    http://www.nanonanonano.net/   stuart at nanonanonano.net
Debian Developer   http://www.debian.org/         stuart at debian.org
GPG fingerprint    BE65 FD1E F4EA 08F3 23D4 3C6D 9FE8 B8CD 71C5 D1A8
GPG fingerprint    90E2 D2C1 AD14 6A1B 7EBB 891D BBC1 7EBB 1396 F2F7
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Add-double-signature-test-to-expose-695932.patch
Type: text/x-patch
Size: 4977 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-python-debian-maint/attachments/20130806/bd342c45/attachment-0014.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0005-Add-dependency-on-gnupg.patch
Type: text/x-patch
Size: 1294 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-python-debian-maint/attachments/20130806/bd342c45/attachment-0015.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0008-Set-encoding-to-be-used-by-gpg.patch
Type: text/x-patch
Size: 986 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-python-debian-maint/attachments/20130806/bd342c45/attachment-0016.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Add-test-for-handling-dash-escaped-clearsign-data.patch
Type: text/x-patch
Size: 3568 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-python-debian-maint/attachments/20130806/bd342c45/attachment-0017.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0010-Handle-multiple-gpg-signatures-gracefully.patch
Type: text/x-patch
Size: 17521 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-python-debian-maint/attachments/20130806/bd342c45/attachment-0018.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-Switch-to-using-gpg-for-extracting-signed-data.patch
Type: text/x-patch
Size: 27927 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-python-debian-maint/attachments/20130806/bd342c45/attachment-0019.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0011-Add-keyring-packages-to-suggests.patch
Type: text/x-patch
Size: 1856 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-python-debian-maint/attachments/20130806/bd342c45/attachment-0020.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0004-Allow-InRelease-files-to-be-signature-checked.patch
Type: text/x-patch
Size: 722 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-python-debian-maint/attachments/20130806/bd342c45/attachment-0021.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0006-Add-method-to-GpgInfo-to-test-detached-signature.patch
Type: text/x-patch
Size: 5206 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-python-debian-maint/attachments/20130806/bd342c45/attachment-0022.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0007-Make-gpg-use-a-temporary-directory-for-gpghome.patch
Type: text/x-patch
Size: 3829 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-python-debian-maint/attachments/20130806/bd342c45/attachment-0023.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0009-Allow-whitespace-only-lines-to-separate-paragraphs.patch
Type: text/x-patch
Size: 2461 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-python-debian-maint/attachments/20130806/bd342c45/attachment-0024.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0012-Use-nosetests-to-run-the-test-suite.patch
Type: text/x-patch
Size: 2203 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-python-debian-maint/attachments/20130806/bd342c45/attachment-0025.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0013-Add-DEP8-autopkgtest-test-suite.patch
Type: text/x-patch
Size: 2455 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-python-debian-maint/attachments/20130806/bd342c45/attachment-0026.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0014-Add-changelog-for-work-on-this-branch.patch
Type: text/x-patch
Size: 1955 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-python-debian-maint/attachments/20130806/bd342c45/attachment-0027.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part.
URL: <http://lists.alioth.debian.org/pipermail/pkg-python-debian-maint/attachments/20130806/bd342c45/attachment-0001.sig>