coffey-labs/ubuntu2mint
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Improve key fetching and validation in script

Browse Source 
Enhance key fetching logic with additional validation checks.
This commit is contained in:
LINUXexpert.org
2026-01-22 17:03:58 -07:00
committed by GitHub
parent 5d1a7512f2
commit d6550cf325
1 changed files with 29 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ubuntu-to-mint-convert-v3.sh
+25 -11
View File
@@ -301,23 +301,37 @@ mint_repo_key_write_to() {
: :
else else
# 3) Fallback: fetch armored key over HTTPS/HTTP and dearmor # 3) Fallback: fetch armored key over HTTPS/HTTP and dearmor
info "Keyserver blocked; fetching key over HTTPS from Ubuntu keyserver..." info "Keyserver blocked; fetching key over HTTPS from Ubuntu keyserver..."
local armored="$gnupghome/linuxmint-repo.asc" local armored="$gnupghome/linuxmint-repo.asc"
if ! curl -fsSL "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x${keyid}" -o "$armored"; then if ! curl -fsSL "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x${keyid}" -o "$armored"; then
curl -fsSL "http://keyserver.ubuntu.com/pks/lookup?op=get&search=0x${keyid}" -o "$armored" \ curl -fsSL "http://keyserver.ubuntu.com/pks/lookup?op=get&search=0x${keyid}" -o "$armored" \
|| die "Unable to fetch Mint repo key via keyserver or HTTPS fallback." || die "Unable to fetch Mint repo key via keyserver or HTTPS fallback."
fi
# Sanity: ensure it's a PGP public key block
grep -q "BEGIN PGP PUBLIC KEY BLOCK" "$armored" || die "Downloaded key is not a PGP public key block (proxy portal/HTML?)"
# Validate: the expected keyid appears in the key block (pub OR sub)
local found="no"
while IFS= read -r kid; do
if [[ "${kid^^}" == "${keyid^^}" ]]; then
found="yes"
break
fi fi
done < <(gpg --batch --with-colons --show-keys "$armored" | awk -F: '$1=="pub"||$1=="sub"{print $5}')
# Basic safety check: ensure the fetched key contains the expected key id (last 16 hex of fingerprint) [[ "$found" == "yes" ]] || die "Fetched key does not contain expected keyid ${keyid^^}"
local fpr_last16
fpr_last16="$(gpg --batch --with-colons --show-keys "$armored" | awk -F: '$1=="fpr"{print $10}' | tail -n1 | tail -c 17 | tr -d '\n' | tr '[:lower:]' '[:upper:]')"
[[ "$fpr_last16" == "${keyid^^}" ]] || die "Fetched key fingerprint suffix mismatch (expected ${keyid^^}, got ${fpr_last16:-<none>})."
gpg --batch --dearmor -o "$out_keyring" "$armored" # (Optional) extra guard: make sure the UID looks like Linux Mint repo key
chmod 644 "$out_keyring" if ! gpg --batch --with-colons --show-keys "$armored" | awk -F: '$1=="uid"{print $10}' | grep -qi "Linux Mint Repository Signing Key"; then
rm -rf "$gnupghome" warn "Keyid matched but UID did not match expected Mint repo UID; review /tmp key block if concerned."
return 0 fi
gpg --batch --dearmor -o "$out_keyring" "$armored"
chmod 644 "$out_keyring"
rm -rf "$gnupghome"
return 0
fi fi
# If we got here, gpg received the key into temp keyring; export+dearmor # If we got here, gpg received the key into temp keyring; export+dearmor