coffey-labs/ubuntu2mint
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Improve key fetching and validation in script

Browse Source 
Enhance key fetching logic with additional validation checks.
This commit is contained in:
LINUXexpert.org
2026-01-22 17:03:58 -07:00
committed by GitHub
parent 5d1a7512f2
commit d6550cf325
1 changed files with 29 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ubuntu-to-mint-convert-v3.sh
+29 -15
View File
@@ -300,24 +300,38 @@ mint_repo_key_write_to() {
elif gpg --homedir "$gnupghome" --batch --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys "$keyid" >/dev/null 2>&1; then elif gpg --homedir "$gnupghome" --batch --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys "$keyid" >/dev/null 2>&1; then
: :
else else
# 3) Fallback: fetch armored key over HTTPS/HTTP and dearmor # 3) Fallback: fetch armored key over HTTPS/HTTP and dearmor
info "Keyserver blocked; fetching key over HTTPS from Ubuntu keyserver..." info "Keyserver blocked; fetching key over HTTPS from Ubuntu keyserver..."
local armored="$gnupghome/linuxmint-repo.asc" local armored="$gnupghome/linuxmint-repo.asc"
if ! curl -fsSL "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x${keyid}" -o "$armored"; then if ! curl -fsSL "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x${keyid}" -o "$armored"; then
curl -fsSL "http://keyserver.ubuntu.com/pks/lookup?op=get&search=0x${keyid}" -o "$armored" \ curl -fsSL "http://keyserver.ubuntu.com/pks/lookup?op=get&search=0x${keyid}" -o "$armored" \
|| die "Unable to fetch Mint repo key via keyserver or HTTPS fallback." || die "Unable to fetch Mint repo key via keyserver or HTTPS fallback."
fi fi
# Basic safety check: ensure the fetched key contains the expected key id (last 16 hex of fingerprint) # Sanity: ensure it's a PGP public key block
local fpr_last16 grep -q "BEGIN PGP PUBLIC KEY BLOCK" "$armored" || die "Downloaded key is not a PGP public key block (proxy portal/HTML?)"
fpr_last16="$(gpg --batch --with-colons --show-keys "$armored" | awk -F: '$1=="fpr"{print $10}' | tail -n1 | tail -c 17 | tr -d '\n' | tr '[:lower:]' '[:upper:]')"
[[ "$fpr_last16" == "${keyid^^}" ]] || die "Fetched key fingerprint suffix mismatch (expected ${keyid^^}, got ${fpr_last16:-<none>})."
gpg --batch --dearmor -o "$out_keyring" "$armored" # Validate: the expected keyid appears in the key block (pub OR sub)
chmod 644 "$out_keyring" local found="no"
rm -rf "$gnupghome" while IFS= read -r kid; do
return 0 if [[ "${kid^^}" == "${keyid^^}" ]]; then
found="yes"
break
fi
done < <(gpg --batch --with-colons --show-keys "$armored" | awk -F: '$1=="pub"||$1=="sub"{print $5}')
[[ "$found" == "yes" ]] || die "Fetched key does not contain expected keyid ${keyid^^}"
# (Optional) extra guard: make sure the UID looks like Linux Mint repo key
if ! gpg --batch --with-colons --show-keys "$armored" | awk -F: '$1=="uid"{print $10}' | grep -qi "Linux Mint Repository Signing Key"; then
warn "Keyid matched but UID did not match expected Mint repo UID; review /tmp key block if concerned."
fi
gpg --batch --dearmor -o "$out_keyring" "$armored"
chmod 644 "$out_keyring"
rm -rf "$gnupghome"
return 0
fi fi
# If we got here, gpg received the key into temp keyring; export+dearmor # If we got here, gpg received the key into temp keyring; export+dearmor