summaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
authorDan McGee <dan@archlinux.org>2011-08-15 08:56:58 -0500
committerDan McGee <dan@archlinux.org>2011-08-15 15:15:11 -0500
commit11f4a7a48ebd52c69345c3baced5b14974931643 (patch)
tree4250d09bf3f4cff6a606009a64238d70e7307e08 /lib
parent855bc16a9eb21348be8b43273668269383aaaf96 (diff)
downloadpacman-11f4a7a48ebd52c69345c3baced5b14974931643.tar.xz
Only check necessary signatures and checksums
The precedence goes as follows: signature > sha256sum > md5sum Add some logic and helper methods to check what we have available when loading a package, and then only check what is necessary to verify the package. This should speed up sync database verifies as we no longer will be doing both a checksum and a signature validation. Signed-off-by: Dan McGee <dan@archlinux.org>
Diffstat (limited to 'lib')
-rw-r--r--lib/libalpm/be_package.c22
-rw-r--r--lib/libalpm/be_sync.c2
-rw-r--r--lib/libalpm/db.c14
-rw-r--r--lib/libalpm/db.h1
-rw-r--r--lib/libalpm/signing.c34
-rw-r--r--lib/libalpm/signing.h1
6 files changed, 46 insertions, 28 deletions
diff --git a/lib/libalpm/be_package.c b/lib/libalpm/be_package.c
index 3b5b0d0c..80287542 100644
--- a/lib/libalpm/be_package.c
+++ b/lib/libalpm/be_package.c
@@ -288,8 +288,7 @@ alpm_pkg_t *_alpm_pkg_load_internal(alpm_handle_t *handle, const char *pkgfile,
int full, const char *md5sum, const char *sha256sum, const char *base64_sig,
alpm_siglevel_t level)
{
- int ret;
- int config = 0;
+ int ret, skip_checksums, config = 0;
struct archive *archive;
struct archive_entry *entry;
alpm_pkg_t *newpkg = NULL;
@@ -314,9 +313,22 @@ alpm_pkg_t *_alpm_pkg_load_internal(alpm_handle_t *handle, const char *pkgfile,
RET_ERR(handle, ALPM_ERR_PKG_OPEN, NULL);
}
- /* first steps- validate the package file */
+ /* can we get away with skipping checksums? */
+ skip_checksums = 0;
+ if(level & ALPM_SIG_PACKAGE) {
+ if(base64_sig) {
+ skip_checksums = 1;
+ } else {
+ char *sigpath = _alpm_sigpath(handle, pkgfile);
+ if(sigpath && !_alpm_access(handle, NULL, sigpath, R_OK)) {
+ skip_checksums = 1;
+ }
+ free(sigpath);
+ }
+ }
+
_alpm_log(handle, ALPM_LOG_DEBUG, "md5sum: %s\n", md5sum);
- if(md5sum) {
+ if(!skip_checksums && md5sum && !sha256sum) {
_alpm_log(handle, ALPM_LOG_DEBUG, "checking md5sum for %s\n", pkgfile);
if(_alpm_test_checksum(pkgfile, md5sum, ALPM_CSUM_MD5) != 0) {
alpm_pkg_free(newpkg);
@@ -325,7 +337,7 @@ alpm_pkg_t *_alpm_pkg_load_internal(alpm_handle_t *handle, const char *pkgfile,
}
_alpm_log(handle, ALPM_LOG_DEBUG, "sha256sum: %s\n", sha256sum);
- if(sha256sum) {
+ if(!skip_checksums && sha256sum) {
_alpm_log(handle, ALPM_LOG_DEBUG, "checking sha256sum for %s\n", pkgfile);
if(_alpm_test_checksum(pkgfile, sha256sum, ALPM_CSUM_SHA256) != 0) {
alpm_pkg_free(newpkg);
diff --git a/lib/libalpm/be_sync.c b/lib/libalpm/be_sync.c
index 66808a7f..7f016749 100644
--- a/lib/libalpm/be_sync.c
+++ b/lib/libalpm/be_sync.c
@@ -192,7 +192,7 @@ int SYMEXPORT alpm_db_update(int force, alpm_db_t *db)
if(ret == 0 && (level & ALPM_SIG_DATABASE)) {
/* an existing sig file is no good at this point */
- char *sigpath = _alpm_db_sig_path(db);
+ char *sigpath = _alpm_sigpath(handle, _alpm_db_path(db));
if(!sigpath) {
ret = -1;
break;
diff --git a/lib/libalpm/db.c b/lib/libalpm/db.c
index 5765ab2c..ad5f0bc1 100644
--- a/lib/libalpm/db.c
+++ b/lib/libalpm/db.c
@@ -375,20 +375,6 @@ const char *_alpm_db_path(alpm_db_t *db)
return db->_path;
}
-char *_alpm_db_sig_path(alpm_db_t *db)
-{
- char *sigpath;
- size_t len;
- const char *dbfile = _alpm_db_path(db);
- if(!db || !dbfile) {
- return NULL;
- }
- len = strlen(dbfile) + strlen(".sig") + 1;
- CALLOC(sigpath, len, sizeof(char), RET_ERR(db->handle, ALPM_ERR_MEMORY, NULL));
- sprintf(sigpath, "%s.sig", dbfile);
- return sigpath;
-}
-
int _alpm_db_cmp(const void *d1, const void *d2)
{
alpm_db_t *db1 = (alpm_db_t *)d1;
diff --git a/lib/libalpm/db.h b/lib/libalpm/db.h
index a09c7e26..2938b54a 100644
--- a/lib/libalpm/db.h
+++ b/lib/libalpm/db.h
@@ -80,7 +80,6 @@ struct __alpm_db_t {
alpm_db_t *_alpm_db_new(const char *treename, int is_local);
void _alpm_db_free(alpm_db_t *db);
const char *_alpm_db_path(alpm_db_t *db);
-char *_alpm_db_sig_path(alpm_db_t *db);
int _alpm_db_cmp(const void *d1, const void *d2);
alpm_list_t *_alpm_db_search(alpm_db_t *db, const alpm_list_t *needles);
alpm_db_t *_alpm_db_register_local(alpm_handle_t *handle);
diff --git a/lib/libalpm/signing.c b/lib/libalpm/signing.c
index 7521e3ad..cdbdc31a 100644
--- a/lib/libalpm/signing.c
+++ b/lib/libalpm/signing.c
@@ -186,6 +186,28 @@ error:
return 1;
}
+
+/**
+ * Form a signature path given a file path.
+ * Caller must free the result.
+ * @param handle the context handle
+ * @param path the full path to a file
+ * @return the path with '.sig' appended, NULL on errors
+ */
+char *_alpm_sigpath(alpm_handle_t *handle, const char *path)
+{
+ char *sigpath;
+ size_t len;
+
+ if(!path) {
+ return NULL;
+ }
+ len = strlen(path) + 5;
+ CALLOC(sigpath, len, sizeof(char), RET_ERR(handle, ALPM_ERR_MEMORY, NULL));
+ sprintf(sigpath, "%s.sig", path);
+ return sigpath;
+}
+
/**
* Check the PGP signature for the given file path.
* If base64_sig is provided, it will be used as the signature data after
@@ -226,13 +248,9 @@ int _alpm_gpgme_checksig(alpm_handle_t *handle, const char *path,
result->count = 0;
if(!base64_sig) {
- size_t len = strlen(path) + 5;
- CALLOC(sigpath, len, sizeof(char), RET_ERR(handle, ALPM_ERR_MEMORY, -1));
- snprintf(sigpath, len, "%s.sig", path);
-
- if(!_alpm_access(handle, NULL, sigpath, R_OK) == 0) {
- /* sigcount is 0 */
- }
+ sigpath = _alpm_sigpath(handle, path);
+ /* this will just help debugging */
+ _alpm_access(handle, NULL, sigpath, R_OK);
}
if(init_gpgme(handle)) {
@@ -274,6 +292,8 @@ int _alpm_gpgme_checksig(alpm_handle_t *handle, const char *path,
/* file-based, it is on disk */
sigfile = fopen(sigpath, "rb");
if(sigfile == NULL) {
+ _alpm_log(handle, ALPM_LOG_DEBUG, "sig path %s could not be opened\n",
+ sigpath);
handle->pm_errno = ALPM_ERR_SIG_MISSING;
goto error;
}
diff --git a/lib/libalpm/signing.h b/lib/libalpm/signing.h
index 22f6357e..d07057a2 100644
--- a/lib/libalpm/signing.h
+++ b/lib/libalpm/signing.h
@@ -21,6 +21,7 @@
#include "alpm.h"
+char *_alpm_sigpath(alpm_handle_t *handle, const char *path);
int _alpm_gpgme_checksig(alpm_handle_t *handle, const char *path,
const char *base64_sig, alpm_sigresult_t *result);
int _alpm_check_pgp_helper(alpm_handle_t *handle, const char *path,