From 906b7b46fb200946954227602a837977568772cc Mon Sep 17 00:00:00 2001 From: espie Date: Thu, 9 Jan 2014 17:51:56 +0000 Subject: [PATCH] if we're re-signing, check old sig first. shouldn't sign stuff we don't trust. --- usr.sbin/pkg_add/OpenBSD/PkgCreate.pm | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/usr.sbin/pkg_add/OpenBSD/PkgCreate.pm b/usr.sbin/pkg_add/OpenBSD/PkgCreate.pm index deac54a896b..21ac2f33c9f 100644 --- a/usr.sbin/pkg_add/OpenBSD/PkgCreate.pm +++ b/usr.sbin/pkg_add/OpenBSD/PkgCreate.pm @@ -1,6 +1,6 @@ #! /usr/bin/perl # ex:ts=8 sw=4: -# $OpenBSD: PkgCreate.pm,v 1.90 2014/01/09 13:30:46 espie Exp $ +# $OpenBSD: PkgCreate.pm,v 1.91 2014/01/09 17:51:56 espie Exp $ # # Copyright (c) 2003-2010 Marc Espie # @@ -1156,6 +1156,15 @@ sub add_signature if ($plist->has('digital-signature') || $plist->has('signer')) { if ($state->defines('resign')) { + if ($state->defines('nosig')) { + $state->errsay("NOT CHECKING DIGITAL SIGNATURE FOR #1", + $plist->pkgname); + } else { + if (!$plist->check_signature($state)) { + $state->fatal("#1 is corrupted", + $plist->pkgname); + } + } $state->errsay("Resigning #1", $plist->pkgname); delete $plist->{'digital-signature'}; delete $plist->{signer}; -- 2.20.1