| Server IP : 209.38.156.173 / Your IP : 216.73.216.122 [ Web Server : Apache/2.4.52 (Ubuntu) System : Linux lakekumayuhotel 5.15.0-136-generic #147-Ubuntu SMP Sat Mar 15 15:53:30 UTC 2025 x86_64 User : root ( 0) PHP Version : 8.1.2-1ubuntu2.22 Disable Function : NONE Domains : 2 Domains MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : ON Directory : /snap/core20/2599/usr/lib/python3/dist-packages/cloudinit/__pycache__/ |
Upload File : |
U
Ӈg� � @ st d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z m
Z
ddl m Z e�
e�ZdZG dd� d�ZdS ) z0gpg.py - Collection of gpg key related functions� N)�TemporaryDirectory)�Dict�Optional)�subpZ GNUPGHOMEc @ s� e Zd Zdd� Zdd� Zeeeef d�dd��Zdd � Z d
d�d d �Z
ee e d
�dd�Z eed
�dd�Z
d"eed�dd�Zd#eed
d�dd�Zed
d
�dd�Zd$eee e d �d d �Zd
d�d d!�Zd
S )%�GPGc C s d| _ i | _t� | _d S )NF)� gpg_started�_envr �temp_dir��self� r �//usr/lib/python3/dist-packages/cloudinit/gpg.py�__init__ s z GPG.__init__c C s | S �Nr r
r r r
� __enter__ s z
GPG.__enter__)�returnc C s& | j r | j S d| _t| jji| _ | j S )a when this env property gets invoked, set up our temporary
directory, and also set gpg_started to tell the cleanup()
method whether or not
why put this here and not in __init__? pytest seems unhappy
and it's not obvious how to work around it
T)r r �HOMEr �namer
r r r
�env" s
zGPG.envc C s | � � d S r )�cleanup)r Zexc_typ� exc_value� tracebackr r r
�__exit__1 s z GPG.__exit__Nc C s, | � � | jr(tj�| jj�r(| j�� dS )z0cleanup the gpg temporary directory and kill gpgN)�kill_gpgr �os�path�isdirr r r
r r r
r 4 s z GPG.cleanup)�keyr c
C sV z t j ddd|gd| jd�jW S t jk
rP } zt�d||� W 5 d}~X Y nX dS )z*Export gpg key, armoured key gets returned�gpgz--exportz--armourT��capture�
update_env�&Failed to export armoured key "%s": %sN)r r �stdout�ProcessExecutionError�LOG�debug�r r �errorr r r
�
export_armour: s
�
zGPG.export_armourc C s t j ddg|d| jd�jS )z�Dearmor gpg key, dearmored key gets returned
note: man gpg(1) makes no mention of an --armour spelling, only --armor
r z --dearmorF)�data�decoder! )r r r# )r r r r r
�dearmorG s �z GPG.dearmorF)�key_filer c C sT ddddddg}|s |� d� |� |� tj|| jdd �\}}|rPt�d
||� |S ) z�List keys from a keyring with fingerprints. Default to a
stable machine parseable format.
@param key_file: a string containing a filepath to a key
@param human_output: return output intended for human parsing
r z --no-optionsz--with-fingerprintz--no-default-keyringz --list-keysz --keyringz
--with-colonsT)r! r r" )�appendr r r% �warning)r r- Z human_output�cmdr# �stderrr r r
� list_keysP s$ �
�z
GPG.list_keys�� r4 )r � keyserverr c
C s� t �d||� d}d}t|p g �}|d7 }z6tjddd| d|gd | jd
� t �d |||� W dS tjk
r� } z|}W 5 d}~X Y nX z&t|�}t �d |j|� t� |� W q" t
k
r� } zt d
||||f �|�W 5 d}~X Y q"X q"dS )a� Receive gpg key from the specified keyserver.
Retries are done by default because keyservers can be unreliable.
Additionally, there is no way to determine the difference between
a non-existent key and a failure. In both cases gpg (at least 2.2.4)
exits with status 2 and stderr: "keyserver receive failed: No data"
It is assumed that a key provided to cloud-init exists on the keyserver
so re-trying makes better sense than failing.
@param key: a string key fingerprint (as passed to gpg --recv-keys).
@param keyserver: the keyserver to request keys from.
@param retries: an iterable of sleep lengths for retries.
Use None to indicate no retries.z&Importing key '%s' from keyserver '%s'r Nr4 r z--no-ttyz--keyserver=%sz --recv-keysTr z/Imported key '%s' from keyserver '%s' on try %dz6Import failed with exit code %d, will try again in %ssz@Failed to import key '%s' from keyserver '%s' after %d tries: %s) r% r& �iterr r r$ �nextZ exit_code�time�sleep�
StopIteration�
ValueError) r r r5 ZretriesZtrynumr( Zsleeps�eZnaplenr r r
�recv_keyj sR �� ��
���z GPG.recv_keyc
C sX z t j dddd|gd| jd� W n2 t jk
rR } zt�d||� W 5 d}~X Y nX dS ) z0Delete the specified key from the local gpg ringr z--batchz--yesz
--delete-keysTr zFailed delete key "%s": %sN)r r r$ r% r/ r' r r r
�
delete_key� s �
zGPG.delete_key�keyserver.ubuntu.com)�keyidr5 r c C sd | � |�}|s`zDz | j||d� | � |�}W n" tk
rN t�d|� � Y nX W 5 | �|� X |S )z get gpg keyid from keyserver)r5 zFailed to obtain gpg key %s)r) r> r= r; r% Z exception)r r@ r5 Zarmourr r r
�
getkeybyid� s
zGPG.getkeybyidc
C s� z�| j sW dS t�d�r4tjdddgd| jd�j}njtjddd d
d d
d d
d
g dddgd�j}t�d|�}dd� |D �}|r�t�d|� |D ]}t �
|t j � q�W n0 tj
k
r� } zt�d|� W 5 d}~X Y nX dS )a killing with gpgconf is best practice, but when it isn't available
failover is possible
GH: 4344 - stop gpg-agent/dirmgr daemons spawned by gpg
key imports. Daemons spawned by cloud-config.service on systemd
v253 report (running)
NZgpgconfz--kill�allTr Zpsz-ozppid,pidz-CZkeyboxdZdirmngrz gpg-agentr r4 )r Zrcsz (?P<ppid>\d+)\s+(?P<pid>\d+)c S s$ g | ] }|d dkrt |d ��qS )r �1r4 )�int)�.0�pidr r r
�
<listcomp>� s z GPG.kill_gpg.<locals>.<listcomp>z&Killing gpg-agent and dirmngr pids: %sz"Failed to clean up gpg process: %s)r r Zwhichr r# �re�findallr% r& r �kill�signal�SIGKILLr$ r/ )r Zgpg_process_outZgpg_pidsZ
root_gpg_pidsZgpg_pidr< r r r
r � sN
�
� � �� �z GPG.kill_gpg)F)r3 )r? )�__name__�
__module__� __qualname__r r �propertyr �strr r r r r) r, r2 r= r> rA r r r r r
r s$
7 � � r )�__doc__Zloggingr rH rK r8 Ztempfiler �typingr r Z cloudinitr Z getLoggerrM r% r r r r r r
�<module> s