isbm / berrymill

Think of it as Kiwi++
MIT License
2 stars 5 forks source link

Check Repo Key for Flat Repositories for valid gpg content #56

Open wintron04 opened 10 months ago

wintron04 commented 10 months ago

in /etc/berrymill/berrymill.conf, if the URL for flat repositories is wrong, berrymill will not detect this.

It will try to download a key and write it. However it will get an error response from the server and write this html response thinking its a key.... Kiwi will then try to use this "fake key" and complain that it is no valid gpg data.

Fix: Check the downloaded key for valid gpg data before proceeding with writing the key https://github.com/isbm/berrymill/blob/main/src/berry_mill/kiwrap.py#L88