diff --git a/ChangeLog.md b/ChangeLog.md --- a/ChangeLog.md +++ b/ChangeLog.md @@ -1,3 +1,8 @@ +## 0.1.1.0 + +* Optional signature verification (--verify) +* Optional download from all-cabal-hashes (--hashes) + ## 0.1.0.4 * Move to ~/.stackage/update [#6](https://github.com/fpco/stackage-update/issues/6) diff --git a/README.md b/README.md --- a/README.md +++ b/README.md @@ -42,6 +42,43 @@ majority of users tend to not modify their remote-repos, so `stackage-update` should work for most people most of the time. +### GPG signature verification + +Since version 0.1.1.0, stackage-update supports verifying the GPG signature. In +order to do so, you pass in the `--verify` argument. You must first set up your +GPG keychain to trust the relevant key, such as with the following commands: + +``` +$ gpg --recv-key --keyserver keyserver.ubuntu.com D6CF60FD +$ gpg --edit D6CF60FD +gpg> trust +Your decision? 3 +gpg> quit +``` + +This is an example session, and not intended to be a guide to good GPG and +cryptography practice. If you would like to verify this signing key properly +via a web of trust, you can contact Michael Snoyman, who is already a signer +for this key. The fingerprint is: + +``` +E595 AD42 14AF A6BB 1552 0B23 E40D 74D6 D6CF 60FD +``` + +Note: the GPG key may be updated in the future following standard key rotation +policies. If you note that the key information listed here is out of date, +please open an issue/send a pull request. + +### Hash downloads + +When run with the `--hashes` command line argument, this tool instead downloads +from the +[all-cabal-hashes](https://github.com/commercialhaskell/all-cabal-hashes) +repository, which contains additional information for verifying the accuracy of +a tarball. While `stackage-update` does nothing with this extra information, +other tools (like [stackage-install](https://github.com/fpco/stackage-install)) +may do so. + ### Why stackage? You may be wondering why this tool is called `stackage-update`, when in fact @@ -54,7 +91,6 @@ ### Future enhancements -* If desired, add support for GPG signature checking when cloning/pulling from the `all-cabal-files` repository. * Detect modified remote-repos and warn the user ### Some notes diff --git a/Stackage/Update.hs b/Stackage/Update.hs --- a/Stackage/Update.hs +++ b/Stackage/Update.hs @@ -2,6 +2,11 @@ ( stackageUpdate , StackageUpdateSettings , defaultStackageUpdateSettings + , setVerify + , setRemote + , setDirectoryName + , allCabalFiles + , allCabalHashes ) where import Control.Exception (IOException, try) @@ -25,13 +30,57 @@ -- -- Since 0.1.0.0 data StackageUpdateSettings = StackageUpdateSettings + { verify :: Bool + , remote :: String + , name :: FilePath + } +-- | Should we verify the signature on the Git tag. +-- +-- Default: False +-- +-- Since 0.1.1.0 +setVerify :: Bool -> StackageUpdateSettings -> StackageUpdateSettings +setVerify x s = s { verify = x } + +-- | Remote repository to use +-- +-- Default: 'allCabalFiles' +-- +-- Since 0.1.1.0 +setRemote :: String -> StackageUpdateSettings -> StackageUpdateSettings +setRemote x s = s { remote = x } + +-- | Local directory name to clone into +-- +-- Default: \"all-cabal-files\" +-- +-- Since 0.1.1.0 +setDirectoryName :: FilePath -> StackageUpdateSettings -> StackageUpdateSettings +setDirectoryName x s = s { name = x } + -- | Default settings for the update process. -- -- Since 0.1.0.0 defaultStackageUpdateSettings :: StackageUpdateSettings defaultStackageUpdateSettings = StackageUpdateSettings + { verify = False + , remote = allCabalFiles + , name = "all-cabal-files" + } +-- | URL for the all-cabal-files repo +-- +-- Since 0.1.1.0 +allCabalFiles :: String +allCabalFiles = "https://github.com/commercialhaskell/all-cabal-files.git" + +-- | URL for the all-cabal-hashes repo +-- +-- Since 0.1.1.0 +allCabalHashes :: String +allCabalHashes = "https://github.com/commercialhaskell/all-cabal-hashes.git" + -- | Since internal representation of Version will change in the future. version19 :: Version version19 = @@ -41,7 +90,7 @@ -- | Perform an update from the Git repository stackageUpdate :: StackageUpdateSettings -> IO () -stackageUpdate StackageUpdateSettings = do +stackageUpdate set = do mgit <- findExecutable "git" git <- case mgit of @@ -59,7 +108,7 @@ [] -> False [] -> False cloneArgs = - "clone" : "https://github.com/commercialhaskell/all-cabal-files.git" : rest + "clone" : remote set : name set : rest where rest | hasNSB = @@ -73,11 +122,11 @@ sDir <- getAppUserDataDirectory "stackage" let suDir = sDir "update" - acfDir = suDir "all-cabal-files" + acfDir = suDir name set repoExists <- doesDirectoryExist acfDir if repoExists - then runIn suDir acfDir "git" ["fetch"] - else runIn suDir suDir "git" cloneArgs + then runIn suDir acfDir "git" ["fetch", "--tags"] Nothing + else runIn suDir suDir "git" cloneArgs Nothing cabalDir <- getAppUserDataDirectory "cabal" let hackageDir = cabalDir "packages" "hackage.haskell.org" @@ -87,7 +136,14 @@ gzFile = tarFile <.> "gz" _ <- tryIO $ removeFile tarFile - runIn suDir acfDir "git" ["archive", "--format=tar", "-o", tarFile, "origin/hackage"] + when (verify set) $ do + runIn suDir acfDir "git" ["tag", "-v", "current-hackage"] $ Just $ unlines + [ "Signature verification failed. Please ensure you've set up your" + , "GPG keychain to accept the D6CF60FD signing key." + , "For more information, see:" + , "https://github.com/fpco/stackage-update#readme" + ] + runIn suDir acfDir "git" ["archive", "--format=tar", "-o", tarFile, "current-hackage"] Nothing tryIO :: IO a -> IO (Either IOException a) tryIO = try @@ -96,8 +152,9 @@ -> FilePath -- ^ directory -> FilePath -- ^ command -> [String] -- ^ command line arguments + -> Maybe String -- ^ error message -> IO () -runIn suDir dir cmd args = do +runIn suDir dir cmd args errMsg = do createDirectoryIfMissing True dir (Nothing, Nothing, Nothing, ph) <- createProcess (proc cmd args) { cwd = Just dir @@ -112,9 +169,11 @@ , " in " , dir ] - hPutStrLn stderr $ concat - [ "If the problem persists, please delete the following directory " - , "and try again" - ] - hPutStrLn stderr suDir + hPutStrLn stderr $ maybe defErrMsg id errMsg exitWith ec + +defErrMsg :: String +defErrMsg = concat + [ "If the problem persists, please delete the following directory " + , "and try again" + ] diff --git a/app/stackage-update.hs b/app/stackage-update.hs --- a/app/stackage-update.hs +++ b/app/stackage-update.hs @@ -6,10 +6,21 @@ main = do args <- getArgs case args of - ["--help"] -> putStrLn $ "Usage: stackage-update \n" ++ - "Run this command with no arguments to update your package index." + ["--help"] -> putStrLn $ unlines + [ "Usage: stackage-update [--verify] [--hashes]" + , "Run this command with no arguments to update your package index." + , "" + , " --verify : Verify GPG signature on the repo" + , " --hashes : Download from the all-cabal-hashes repo" + ] ["--summary"] -> putStrLn "Update your package index incrementally (requires git)" - [] -> stackageUpdate defaultStackageUpdateSettings - xs -> putStrLn $ "stackage-update: unrecognized argument \'" ++ - (concat $ intersperse " " xs) ++ "\'\nTry \'stackage-update --help\' for more information" + _ -> stackageUpdate $ foldr addArg defaultStackageUpdateSettings args +addArg :: String -> StackageUpdateSettings -> StackageUpdateSettings +addArg "--verify" = setVerify True +addArg "--hashes" = setRemote allCabalHashes . setDirectoryName "all-cabal-hashes" +addArg s = error $ concat + [ "Did not understand argument " + , show s + , ", try 'stackage-update --help' for more information" + ] diff --git a/stackage-update.cabal b/stackage-update.cabal --- a/stackage-update.cabal +++ b/stackage-update.cabal @@ -1,5 +1,5 @@ name: stackage-update -version: 0.1.0.4 +version: 0.1.1.0 synopsis: Update your package index incrementally (requires git) description: Please see for description homepage: https://github.com/fpco/stackage-update