Check-in [3b8436d84c]
Not logged in
Home Help Timeline Files Branches Tags Forum Tickets Wiki More... Login
Overview
Comment:Make the temporary file cleanup code shared by all the appropriate code paths. Coding style cleanup.
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA1: 3b8436d84c212d9eb62c60255d073c651b8c26b3
User & Date: mistachkin on 2016-08-16 23:42:54
Other Links: manifest | tags
Context
2016-08-16
23:51
Remove unused procedure argument. check-in: 6a93f22dad user: mistachkin tags: trunk
23:42
Make the temporary file cleanup code shared by all the appropriate code paths. Coding style cleanup. check-in: 3b8436d84c user: mistachkin tags: trunk
23:16
Add preliminary support for package scripts that are signed using OpenPGP. check-in: d81d61b270 user: mistachkin tags: trunk
Changes
Hide Diffs Side-by-Side Diffs Ignore Whitespace Patch

Modified client/pkgr.eagle from [9791c3779a] to [8b2eee5e8c].

︙
99
100
101
102
103
104
105
106
107


108
109
110
111
112
113
114

99
100
101
102
103
104
105


106
107
108
109
110
111
112
113
114








-
-
+
+








  proc verifyPgpSignature { fileName } {
    variable pgpCommand

    if {[isEagle]} then {
      set fileName [appendArgs \" $fileName \"]

      return [expr {[catch {
        eval exec -success Success [subst $pgpCommand]}] == 0
      }]
        eval exec -success Success [subst $pgpCommand]
      }] == 0}]
    } else {
      return [expr {[catch {
        eval exec [subst $pgpCommand] 2>@1
      }] == 0}]
    }
  }
︙
363
364
365
366
367
368
369


















370
371
372
373
374
375
376
377
378
379
380

381
382



383
384
385
386
387

388
389
390

391
392
393
394
395
396
397

398
399


400
401
402
403
404
405
406

363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397

398
399
400
401
402
403
404
405
406
407

408
409
410

411
412
413
414
415
416
417
418
419


420
421
422
423
424
425
426
427
428








+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+










-
+


+
+
+




-
+


-
+







+
-
-
+
+








    #
    # NOTE: If the package script certificate is mising, fail.
    #
    if {![info exists metadata(certificate)]} then {
      error "missing script certificate"
    }

    #
    # NOTE: Create common cleanup script block that deletes any temporary
    #       files created for the script verification process.
    #
    set script(cleanup) {
      if {[string length $fileName(2)] > 0 && \
          [file exists $fileName(2)]} then {
        catch {file delete $fileName(2)}
        unset -nocomplain fileName(2)
      }

      if {[string length $fileName(1)] > 0 && \
          [file exists $fileName(1)]} then {
        catch {file delete $fileName(1)}
        unset -nocomplain fileName(1)
      }
    }

    #
    # NOTE: Figure out the "type" of script certificate we are now dealing
    #       with.
    #
    if {[isHarpyCertificate $metadata(certificate)]} then {
      #
      # NOTE: Attempt to create a completely unique array variable name to
      #       hold the package metadata in this scripting language as well
      #       as possibly in the other necessary scripting language(s).
      #
      set newVarName [appendArgs \
      set newVarName(1) [appendArgs \
          [getLookupVarNamePrefix] metadata_ [getLookupVarNameSuffix]]

      set newVarName(2) [appendArgs \
          [getLookupVarNamePrefix] cleanup_ [getLookupVarNameSuffix]]

      set newProcName(1) [appendArgs \
          [getLookupVarNamePrefix] eagleHasSecurity_ [getLookupVarNameSuffix]]

      set newProcName(2) [appendArgs \
          [getLookupVarNamePrefix] tclMustBeReady_ [getLookupVarNameSuffix]]
          [getLookupVarNamePrefix] getFileTempName_ [getLookupVarNameSuffix]]

      set newProcName(3) [appendArgs \
          [getLookupVarNamePrefix] getFileTempName_ [getLookupVarNameSuffix]]
          [getLookupVarNamePrefix] tclMustBeReady_ [getLookupVarNameSuffix]]

      #
      # NOTE: Create the Eagle script block that will be used to securely
      #       evaluate a signed package script.  This must be evaluated in
      #       Eagle because it uses several plugins only available there.
      #
      set script(outer) [string map [list \
          %metadata% $newVarName(1) %cleanup% $newVarName(2) \
          %metadata% $newVarName %eagleHasSecurity% $newProcName(1) \
          %tclMustBeReady% $newProcName(2) %getFileTempName% $newProcName(3)] {
          %eagleHasSecurity% $newProcName(1) %getFileTempName% \
          $newProcName(2) %tclMustBeReady% $newProcName(3)] {
        try {
          #
          # NOTE: If there is no package ifneeded script, there is nothing we
          #       can do here.
          #
          if {[string length ${%metadata%(ifNeeded)}] > 0} then {
            #
︙
472
473
474
475
476
477
478
479

480
481
482
483
484
485
486
487

488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504

505
506

507
508
509
510
511
512
513
514
515
516


517
518
519
520
521
522

523
524
525

526
527
528
529
530
531


532
533
534
535
536
537

538
539
540

541
542
543
544
545
546
547

494
495
496
497
498
499
500

501

502






503





504
505
506
507
508
509
510
511
512
513

514
515
516
517
518
519
520
521
522
523
524
525
526
527

528
529
530
531
532
533
534

535
536
537

538
539
540
541
542
543

544
545
546
547
548
549
550

551
552
553

554
555
556
557
558
559
560
561








-
+
-

-
-
-
-
-
-
+
-
-
-
-
-










-

+


+









-
+
+





-
+


-
+





-
+
+





-
+


-
+








                  }
                  default {
                    error "unsupported language"
                  }
                }
              } finally {
                #
                # NOTE: Delete the temporary files that we created for the
                # NOTE: Perform any necessary cleanup steps.
                #       signed script verification.
                #
                if {[string length $fileName(2)] > 0 && \
                    [file exists $fileName(2)]} then {
                  catch {file delete $fileName(2)}
                  unset -nocomplain fileName(2)
                }

                eval ${%cleanup%}
                if {[string length $fileName(1)] > 0 && \
                    [file exists $fileName(1)]} then {
                  catch {file delete $fileName(1)}
                  unset -nocomplain fileName(1)
                }
              }
            } finally {
              #
              # NOTE: Restore the saved security state for the interpreter.
              #
              if {!$savedSecurity} then {source disableSecurity}
              unset -nocomplain savedSecurity
            }
          }
        } finally {
          rename {%getFileTempName%} ""
          rename {%tclMustBeReady%} ""
          rename {%getFileTempName%} ""
          rename {%eagleHasSecurity%} ""

          unset -nocomplain {%cleanup%}
          unset -nocomplain {%metadata%}
        }
      }]

      #
      # NOTE: Copy the package metadata into the fresh array variable,
      #       if necessary, marshalling it from native Tcl to Eagle.
      #
      if {[isEagle]} then {
        array set $newVarName [array get metadata]
        array set $newVarName(1) [array get metadata]
        set $newVarName(2) $script(cleanup)

        proc $newProcName(1) {} [info body [appendArgs \
            [namespace current] ::eagleHasSecurity]]

        proc $newProcName(2) {} [info body [appendArgs \
            [namespace current] ::tclMustBeReady]]
            [namespace current] ::getFileTempName]]

        proc $newProcName(3) {} [info body [appendArgs \
            [namespace current] ::getFileTempName]]
            [namespace current] ::tclMustBeReady]]

        return [eval $script(outer)]
      } else {
        eagleMustBeReady

        eagle [list array set $newVarName [array get metadata]]
        eagle [list array set $newVarName(1) [array get metadata]]
        eagle [list set $newVarName(2) $script(cleanup)]

        eagle [list proc $newProcName(1) {} [info body [appendArgs \
            [namespace current] ::eagleHasSecurity]]]

        eagle [list proc $newProcName(2) {} [info body [appendArgs \
            [namespace current] ::tclMustBeReady]]]
            [namespace current] ::getFileTempName]]]

        eagle [list proc $newProcName(3) {} [info body [appendArgs \
            [namespace current] ::getFileTempName]]]
            [namespace current] ::tclMustBeReady]]]

        return [eagle $script(outer)]
      }
    } elseif {[isPgpSignature $metadata(certificate)]} then {
      #
      # NOTE: If there is no package ifneeded script, there is nothing we
      #       can do here.
︙
564
565
566
567
568
569
570
571
572
573
574
575




576
577
578
579
580
581







582
583

584
585
586
587


588
589
590





591
592
593
594
595
596
597
598
599
600

578
579
580
581
582
583
584

585



586
587
588
589






590
591
592
593
594
595
596


597




598
599



600
601
602
603
604

605
606
607
608
609
610
611
612
613








-

-
-
-
+
+
+
+
-
-
-
-
-
-
+
+
+
+
+
+
+
-
-
+
-
-
-
-
+
+
-
-
-
+
+
+
+
+
-










        #
        if {[string length $metadata(certificate)] > 0} then {
          writeFile $fileName(2) $metadata(certificate)
        }

        #
        # NOTE: Attempt to verify the PGP signature for the package script.
        #       If this fails, raise an error.
        #
        if {![verifyPgpSignature $fileName(2)]} then {
          error [appendArgs \
              "couldn't read file \"" $fileName(1) "\": bad PGP signature"]
        if {[verifyPgpSignature $fileName(2)]} then {
          #
          # NOTE: Delete the temporary files that we created for the PGP
          #       signature verification.
        }

        #
        # NOTE: Delete the temporary files that we created for the PGP
        #       signature verification.
        #
          #
          eval $script(cleanup)
        } else {
          #
          # NOTE: Delete the temporary files that we created for the PGP
          #       signature verification.
          #
        if {[string length $fileName(2)] > 0 && \
            [file exists $fileName(2)]} then {
          eval $script(cleanup)
          catch {file delete $fileName(2)}
          unset -nocomplain fileName(2)
        }


          #
        if {[string length $fileName(1)] > 0 && \
            [file exists $fileName(1)]} then {
          catch {file delete $fileName(1)}
          # NOTE: PGP signature verification failed.  Raise an error and
          #       do not proceed with evaluating the package script.
          #
          error [appendArgs \
              "couldn't read file \"" $fileName(1) "\": bad PGP signature"]
          unset -nocomplain fileName(1)
        }

        #
        # NOTE: The PGP signature was verified; use the downloaded package
        #       script verbatim.
        #
        set script(inner) $metadata(ifNeeded)

        #
︙

Modified client/pkgr.eagle.harpy from [7739519f37] to [161bd759dc].

︙
17
18
19
20
21
22
23
24

25
26
27

28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48


















49
50

17
18
19
20
21
22
23

24
25
26

27
28
29
30


















31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50








-
+


-
+



-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+



    THE ASSOCIATED SOFTWARE MAY NOT WORK PROPERLY IF THIS FILE IS ALTERED.
-->
<Certificate xmlns="https://eagle.to/2011/harpy"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <Protocol>None</Protocol>
  <Vendor>Mistachkin Systems</Vendor>
  <Id>24efe138-647e-406e-a4ff-1d8728db1a30</Id>
  <Id>6b9ca4d2-f735-4a9c-9e98-6eb4e20071e5</Id>
  <HashAlgorithm>SHA512</HashAlgorithm>
  <EntityType>Script</EntityType>
  <TimeStamp>2016-08-16T23:06:52.1540547Z</TimeStamp>
  <TimeStamp>2016-08-16T23:38:50.4841328Z</TimeStamp>
  <Duration>-1.00:00:00</Duration>
  <Key>0x2c322765603b5278</Key>
  <Signature>
    RXTu3ZtnYNyuZx4ljp1N1Xma67EhkVAKOSZSXp4o6TjLPOkxMA+hXRS8fIVl+U6z0Uv9Pa5kLXOa
    CVuv5yJjm+ushIzOqxjEUk1rLrw+TCFQyYYDsCvlNoiqpUDerPnp8JB08tQXnmO+mRKscGOEw9Ju
    18iT0DZ776Vk8NeNK3uFRnBRxks5Oj3Jy/pTqaumXdtxLDheCYa6KQroZvcFVhh88Jr6Vpor9yGR
    bVDQFQg1HL1Tr+wRzOXcvP3dpAxhBiMnbcH4/DwG1AH9mGohSUhgqKWnhSBb8eWqfkC2l2bw1sQb
    0DvPmTNT/EF5OxHEbxfm9YKaKGmM/1fsX5cwFZntq+pKcL0OXFBgB7JnTdnS0WIftYIKC78/Oweg
    vEL0Q05kFq7if2zhOWAq2cF2utJKLR5m1Tx5nl7QM2xv5ufiMzRKN8NW4n5eg4DMvbNsXEHw3OLm
    qpUn4glsBE8PLnRkyDtbDznUBvvaS3RUK5vaaoKuVaOJw9TM3LHoFdk5uLlk6652uBrV0DCMYkkz
    LouMK6HAES4cWxt5KtSWXC3eJOrVGE2guxMGHOCZbKUSlrh9vu0YRMxN2k6lI22UZa4FEwcL+CdU
    6/nDlAIRMjbBPolYD54M7em/m0TDA4Vg5mdQDJV54+WetcG46snFJnZ6NrOCclx9S3gapW+fnxpg
    gGnHP63qyaIZRoER++UJrmTAq0hNj+BVmhpEH04oSpmss8zOd9cM3G7zKFkbjLNfynPc7f+h4ewD
    3HHYzdgPhOJQe5s5zEQt5EdD+yvUeQlr9Vwh+ek/dPAorQrEtFCJpmuZLo+yE4nC4qPGzc7eLntS
    qTMZ/M8YBbExCx5npgCpo3fFkPqoX/tYqDc5jmLz8xJUXuFij3tDXQ2X95KyHcIuKzVVtWzHvXs4
    1z9p7V6iKY61w9aHRFpWHrkghlMYRrK3TkbbI3PArL0LtNFXQ9jJMthrDYxmaLr+PgWvyiGUeYLy
    S+wncYM4dasHAoeUHlC+orI4LOWoBfpvYmo/uUgN+/tOAjMmVPccu0FV19xdXbEpfj6a1ARVTsEO
    EyuKIxG+H8RLyENRUTeV8KDvP9qit+R7Cu58m0xJXOQPsMPtZoTKHPwD0znNFFxTy1m+CrzEENtz
    VmzYiob+7rb7vY6K2ZI3zcHnpA3y+/6mgqdC9rqgy2KBFslynYuxiVkbQeKWuZTHb3gFW0a4hOAT
    5mTY23+5LOOcfugG0qqlL5JM6pVv3+vVm7PXliaECAsdzs7/1Yt4xxbivp+kPiUYFMuJ7Rf+AJag
    FJufzLgah16EX9hWZmT2tTT9f1j9s3W7AJWwejhL6Y3CIWRXZKlkTLx3vo9s5XWph8PAF7B/lw==
    EXlOLQrhSslSjS2f79QWCtvY5eRmAaLsMz0bissOYcPh9ce6sNgVPaWDr/oyUiQ5kwzmOE3ehBfV
    xMkkTDRsjBVt/oslemlHGsidiAtXtIoQB4g/d71Vmaimwz05VynhrO6tG6rwJ8UO1lbxtYrvL1vS
    rdVfkCQ/yHaayHYJKWrHSLshA+BfsibqpABk0Jc3JOJNohICCCM1h2p+cFnqYO4l0yE1oTxeF8Pe
    RdLbPmuTawiysRvXejwxFWKX+nzXwjx+PxKCDupYhzhQHuMJJviXC23Ocrkya6b0PFeUNovpdyE2
    t1KGcz69T3b52BoEq7El5KUO5zhfQE1878i5CGyf27w1JFc7V1Yo/JNFvrzb38vFUDuX0Y5PecIC
    lcCJ+BqHpuK9PrexKFF9wxrXDP7tuigDrHCEqNIQJFBtB/hS8QoQwC+XrHlD37z7pduV/RX8VpzE
    88m7Bn0j4OtyKaZcZgfLbjsZcuMOxM7ATdwSNwrwy0W8bRl0VIdQcIXUZ/QbKtyN1jsym/p06gln
    dz3TA+PSWoZImYddFQQnTK2wBKJIGr1TNjmBkq9Md1x2IXQNu1CkLYfSof50nHWmWKe70kGURCco
    EGLa8segaC97ssJAIakKcdQGMPO39r7U43q0gFjn/YEXdX5J6/Y+8Q+ZlBkQ01ntc0FO7nIDFWh0
    CM0qcTItbYv+6OEG/aj6/W97jzIhFZLB+4mq2UX9J0SYG4QsdBCcm8l2gEf89TG+AiNNNJUifJjV
    SUQK8RsF5awarJmTl3XIw1KYVPEfiD70inTlDqVt7RTYT4sxZN1Tazd/GxSnqYW683KnawKCAU8W
    1F6+fG+wsT2TO7MCoSorQ2tNL5CZU5S1ufwLi2BE9sIBysNYp+Hlpu1xIp5cSC7NKYp6zV/RceMj
    It42WsMhp2xX3FIcyNEJ9YRoiS7ehz1CLidB5sitt3K3wuA4dlSY23l9i+MIhMesqNF8TA+zOqmp
    mOJOb309IVY158/wJCwucW7b79JRYsNHn45HnHusrgfhSWJzCDLkEbnbElDmNlni6DK+hmzhOgyF
    /R9+4ndWHot5A7fRYWix+80Ek3bZ+NoNnuwcfe5QEzROgJ1FydO4fIlC00Nj90OqBXmYRdHdchfk
    M4P/ZR3h5ozbWjQb6UvBQFMiV+B5H8kF6nzuVsY9nd+0k86vX2YsVbAZUm+c+yhfH9kPtQrnIwEl
    ++r+QDA9GRZVIF3yHGsOEH7K8PlwzBkgapsOpUrjA5rXTRem1tliN98FBZpPueMS5CQXJ+598adQ
    4A4g0VjqtHZFJiYRQ24pfw2hWs4Wk7mwQjBirfbyymBToobU4KHf9WaKs6dsEWN0nGmpkp9vHg==
  </Signature>
</Certificate>

This page was generated in about 0.016s by Fossil version 2.20 Tcl version 8.6.12 [658547aa7c] 2022-10-09 01:11:55