If a public key is present, disallow old style full payloads.

omaha_response_handler_action.cc

 // Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "update_engine/omaha_response_handler_action.h"
 
 #include <string>
 
 #include <base/logging.h>
 
 #include "update_engine/delta_performer.h"
 #include "update_engine/prefs_interface.h"
 #include "update_engine/utils.h"
 
 using std::string;
 
 namespace chromeos_update_engine {
 
 const char OmahaResponseHandlerAction::kDeadlineFile[] =
     "/tmp/update-check-response-deadline";
 
+OmahaResponseHandlerAction::OmahaResponseHandlerAction(PrefsInterface* prefs)
+    : prefs_(prefs),
+      got_no_update_response_(false),
+      key_path_(DeltaPerformer::kUpdatePayloadPublicKeyPath) {}
+
 void OmahaResponseHandlerAction::PerformAction() {
   CHECK(HasInputObject());
   ScopedActionCompleter completer(processor_, this);
   const OmahaResponse& response = GetInputObject();
   if (!response.update_exists) {
     got_no_update_response_ = true;
     LOG(INFO) << "There are no updates. Aborting.";
     return;
   }
   install_plan_.download_url = response.codebase;
@@ skipping 10 matching lines @@
         << "Unable to save the update check response hash.";
   }
 
   TEST_AND_RETURN(GetInstallDev(
       (!boot_device_.empty() ? boot_device_ : utils::BootDevice()),
       &install_plan_.install_path));
   install_plan_.kernel_install_path =
       utils::BootKernelDevice(install_plan_.install_path);
 
   install_plan_.is_full_update = !response.is_delta;
+  if (!response.is_delta && utils::FileExists(key_path_.c_str())) {
+    // Can't sign old style full payloads but signature is required so bail out.
+    completer.set_code(kActionCodeSignedDeltaPayloadExpectedError);
+    return;
+  }
 
   TEST_AND_RETURN(HasOutputPipe());
   if (HasOutputPipe())
     SetOutputObject(install_plan_);
   LOG(INFO) << "Using this install plan:";
   install_plan_.Dump();
 
   // Send the deadline data (if any) to Chrome through a file. This is a pretty
   // hacky solution but should be OK for now.
   //
@@ skipping 15 matching lines @@
   string ret(boot_dev);
   string::reverse_iterator it = ret.rbegin();  // last character in string
   // Right now, we just switch '3' and '5' partition numbers.
   TEST_AND_RETURN_FALSE((*it == '3') || (*it == '5'));
   *it = (*it == '3') ? '5' : '3';
   *install_dev = ret;
   return true;
 }
 
 }  // namespace chromeos_update_engine