mirrors/fdroidserver
1
0
Fork 0
mirror of https://github.com/f-droid/fdroidserver.git synced 2025-11-05 06:50:29 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

verify_deprecated_jar_signature(): use temp dir instead of $PWD/.java.security

Browse source
This commit is contained in:
FC Stegerman 2022-11-10 19:16:02 +01:00
parent 88995f71d3
commit e58637374c
No known key found for this signature in database
GPG key ID: B218FF2C27FC6CC6
1 changed files with 18 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

15
fdroidserver/common.py
View file

@ -3445,17 +3445,16 @@ def verify_deprecated_jar_signature(jar):
""" """
error = _('JAR signature failed to verify: {path}').format(path=jar) error = _('JAR signature failed to verify: {path}').format(path=jar)
_java_security = os.path.join(os.getcwd(), '.java.security') with tempfile.TemporaryDirectory() as tmpdir:
if os.path.exists(_java_security): java_security = os.path.join(tmpdir, 'java.security')
os.remove(_java_security) with open(java_security, 'w') as fp:
with open(_java_security, 'w') as fp:
fp.write('jdk.jar.disabledAlgorithms=MD2, RSA keySize < 1024') fp.write('jdk.jar.disabledAlgorithms=MD2, RSA keySize < 1024')
os.chmod(_java_security, 0o400) os.chmod(java_security, 0o400)
try: try:
cmd = [ cmd = [
config['jarsigner'], config['jarsigner'],
'-J-Djava.security.properties=' + _java_security, '-J-Djava.security.properties=' + java_security,
'-strict', '-verify', jar '-strict', '-verify', jar
] ]
output = subprocess.check_output(cmd, stderr=subprocess.STDOUT) output = subprocess.check_output(cmd, stderr=subprocess.STDOUT)
@ -3465,10 +3464,6 @@ def verify_deprecated_jar_signature(jar):
logging.debug(_('JAR signature verified: {path}').format(path=jar)) logging.debug(_('JAR signature verified: {path}').format(path=jar))
else: else:
raise VerificationException(error + '\n' + e.output.decode('utf-8')) from e raise VerificationException(error + '\n' + e.output.decode('utf-8')) from e
finally:
if os.path.exists(_java_security):
os.chmod(_java_security, 0o600)
os.remove(_java_security)
def verify_apk_signature(apk, min_sdk_version=None): def verify_apk_signature(apk, min_sdk_version=None):