coffey-labs/ubuntu2mint
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Improve key fetching and validation in script

Browse Source 
Enhance key fetching logic with additional validation checks.
This commit is contained in:
LINUXexpert.org
2026-01-22 17:03:58 -07:00
committed by GitHub
parent 5d1a7512f2
commit d6550cf325
1 changed files with 29 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ubuntu-to-mint-convert-v3.sh
+25 -11
View File
@@ -301,23 +301,37 @@ mint_repo_key_write_to() {
:
else
# 3) Fallback: fetch armored key over HTTPS/HTTP and dearmor
info "Keyserver blocked; fetching key over HTTPS from Ubuntu keyserver..."
local armored="$gnupghome/linuxmint-repo.asc"
info "Keyserver blocked; fetching key over HTTPS from Ubuntu keyserver..."
local armored="$gnupghome/linuxmint-repo.asc"
if ! curl -fsSL "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x${keyid}" -o "$armored"; then
if ! curl -fsSL "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x${keyid}" -o "$armored"; then
curl -fsSL "http://keyserver.ubuntu.com/pks/lookup?op=get&search=0x${keyid}" -o "$armored" \
|| die "Unable to fetch Mint repo key via keyserver or HTTPS fallback."
fi
# Sanity: ensure it's a PGP public key block
grep -q "BEGIN PGP PUBLIC KEY BLOCK" "$armored" || die "Downloaded key is not a PGP public key block (proxy portal/HTML?)"
# Validate: the expected keyid appears in the key block (pub OR sub)
local found="no"
while IFS= read -r kid; do
if [[ "${kid^^}" == "${keyid^^}" ]]; then
found="yes"
break
fi
done < <(gpg --batch --with-colons --show-keys "$armored" | awk -F: '$1=="pub"||$1=="sub"{print $5}')
# Basic safety check: ensure the fetched key contains the expected key id (last 16 hex of fingerprint)
local fpr_last16
fpr_last16="$(gpg --batch --with-colons --show-keys "$armored" | awk -F: '$1=="fpr"{print $10}' | tail -n1 | tail -c 17 | tr -d '\n' | tr '[:lower:]' '[:upper:]')"
[[ "$fpr_last16" == "${keyid^^}" ]] || die "Fetched key fingerprint suffix mismatch (expected ${keyid^^}, got ${fpr_last16:-<none>})."
[[ "$found" == "yes" ]] || die "Fetched key does not contain expected keyid ${keyid^^}"
gpg --batch --dearmor -o "$out_keyring" "$armored"
chmod 644 "$out_keyring"
rm -rf "$gnupghome"
return 0
# (Optional) extra guard: make sure the UID looks like Linux Mint repo key
if ! gpg --batch --with-colons --show-keys "$armored" | awk -F: '$1=="uid"{print $10}' | grep -qi "Linux Mint Repository Signing Key"; then
warn "Keyid matched but UID did not match expected Mint repo UID; review /tmp key block if concerned."
fi
gpg --batch --dearmor -o "$out_keyring" "$armored"
chmod 644 "$out_keyring"
rm -rf "$gnupghome"
return 0
fi
# If we got here, gpg received the key into temp keyring; export+dearmor