X-Git-Url: https://git.decadent.org.uk/gitweb/?a=blobdiff_plain;f=dak%2Fprocess_unchecked.py;h=aac33d234662ac6831bc89219169740490467d67;hb=bf7e1ddfb0bc42efad1d58b7010298919f65ecca;hp=3b85d6053b298aeacc6f96b3ca0d6c96a362bc5f;hpb=5bc1925a3750cbafc82703c60c5106686c8c7af4;p=dak.git

diff --git a/dak/process_unchecked.py b/dak/process_unchecked.py
index 3b85d605..aac33d23 100755
--- a/dak/process_unchecked.py
+++ b/dak/process_unchecked.py
@@ -987,7 +987,7 @@ def check_timestamps():
                     apt_inst.debExtract(deb_file,tar.callback,"data.tar.gz")
                 except SystemError, e:
                     # If we can't find a data.tar.gz, look for data.tar.bz2 instead.
-                    if not re.match(r"Cannot f[ui]nd chunk data.tar.gz$", str(e)):
+                    if not re.search(r"Cannot f[ui]nd chunk data.tar.gz$", str(e)):
                         raise
                     deb_file.seek(0)
                     apt_inst.debExtract(deb_file,tar.callback,"data.tar.bz2")
@@ -1013,6 +1013,48 @@ def check_timestamps():
             except:
                 reject("%s: deb contents timestamp check failed [%s: %s]" % (filename, sys.exc_type, sys.exc_value))
 
+################################################################################
+
+def check_signed_by_key():
+    """Ensure the .changes is signed by an authorized uploader."""
+
+    # We only check binary-only uploads right now
+    if changes["architecture"].has_key("source"):
+        return
+
+    if not Cnf.Exists("Binary-Upload-Restrictions"):
+        return
+
+    restrictions = Cnf.SubTree("Binary-Upload-Restrictions")
+
+    # If the restrictions only apply to certain components make sure
+    # that the upload is actual targeted there.
+    if restrictions.Exists("Components"):
+        restricted_components = restrictions.SubTree("Components").ValueList()
+        is_restricted = False
+        for file in files:
+            if files[file]["component"] in restricted_components:
+                is_restricted = True
+                break
+        if not is_restricted:
+            return
+
+    # Assuming binary only upload restrictions are in place we then
+    # iterate over suite and architecture checking the key is in the
+    # allowed list.  If no allowed list exists for a given suite or
+    # architecture it's assumed to be open to anyone.
+    for suite in changes["distribution"].keys():
+        if not restrictions.Exists(suite):
+            continue
+        for arch in changes["architecture"].keys():
+            if not restrictions.SubTree(suite).Exists(arch):
+                continue
+            allowed_keys = restrictions.SubTree("%s::%s" % (suite, arch)).ValueList()
+            if changes["fingerprint"] not in allowed_keys:
+                base_filename = os.path.basename(pkg.changes_file)
+                reject("%s: not signed by authorised uploader for %s/%s"
+                       % (base_filename, suite, arch))
+
 ################################################################################
 ################################################################################
 
@@ -1198,9 +1240,20 @@ def queue_embargo (summary):
 ################################################################################
 
 def is_stableupdate ():
-    if changes["distribution"].has_key("proposed-updates"):
-	return 1
-    return 0
+    if not changes["distribution"].has_key("proposed-updates"):
+	return 0
+
+    if not changes["architecture"].has_key("source"):
+        pusuite = daklib.database.get_suite_id("proposed-updates")
+        q = Upload.projectB.query(
+          "SELECT S.source FROM source s JOIN src_associations sa ON (s.id = sa.source) WHERE s.source = '%s' AND s.version = '%s' AND sa.suite = %d" % 
+          (changes["source"], changes["version"], pusuite))
+        ql = q.getresult()
+        if ql:
+            # source is already in proposed-updates
+            return 0
+
+    return 1
 
 def do_stableupdate (summary):
     print "Moving to PROPOSED-UPDATES holding area."
@@ -1309,6 +1362,7 @@ def process_it (changes_file):
                 check_md5sums()
                 check_urgency()
                 check_timestamps()
+                check_signed_by_key()
         Upload.update_subst(reject_message)
         action()
     except SystemExit: