AU: Detect and report public key verify failures, but continue updating.

download_action.cc

 // Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "update_engine/download_action.h"
 #include <errno.h>
 #include <algorithm>
 #include <string>
 #include <vector>
 #include <glib.h>
 #include "update_engine/action_pipe.h"
 #include "update_engine/subprocess.h"
 
 using std::min;
 using std::string;
 using std::vector;
 
 namespace chromeos_update_engine {
 
 // Use a buffer to reduce the number of IOPS on SSD devices.
 const size_t kFileWriterBufferSize = 128 * 1024;  // 128 KiB
 
 DownloadAction::DownloadAction(PrefsInterface* prefs,
                                HttpFetcher* http_fetcher)
     : prefs_(prefs),
       writer_(NULL),
       http_fetcher_(http_fetcher),
       code_(kActionCodeSuccess),
       delegate_(NULL),
-      bytes_received_(0) {}
+      bytes_received_(0),
+      skip_reporting_signature_fail_(NULL) {}
 
 DownloadAction::~DownloadAction() {}
 
 void DownloadAction::PerformAction() {
   http_fetcher_->set_delegate(this);
 
   // Get the InstallPlan and read it
   CHECK(HasInputObject());
   install_plan_ = GetInputObject();
   bytes_received_ = 0;
@@ skipping 109 matching lines @@
 }
 
 void DownloadAction::TransferComplete(HttpFetcher *fetcher, bool successful) {
   if (writer_) {
     LOG_IF(WARNING, writer_->Close() != 0) << "Error closing the writer.";
     writer_ = NULL;
   }
   if (delegate_) {
     delegate_->SetDownloadStatus(false);  // Set to inactive.
   }
+  bool signature_verify_failed = false;
   ActionExitCode code =
       successful ? kActionCodeSuccess : kActionCodeDownloadTransferError;
   if (code == kActionCodeSuccess) {
     if (!install_plan_.is_full_update) {
       if (!delta_performer_->VerifyPayload("",
                                            install_plan_.download_hash,
                                            install_plan_.size,
-                                           NULL)) {
+                                           &signature_verify_failed)) {
         LOG(ERROR) << "Download of " << install_plan_.download_url
                    << " failed due to payload verification error.";
         code = kActionCodeDownloadPayloadVerificationError;
       } else if (!delta_performer_->GetNewPartitionInfo(
           &install_plan_.kernel_size,
           &install_plan_.kernel_hash,
           &install_plan_.rootfs_size,
           &install_plan_.rootfs_hash)) {
         LOG(ERROR) << "Unable to get new partition hash info.";
         code = kActionCodeDownloadNewPartitionInfoError;
       }
     } else {
       // Makes sure the hash and size are correct for an old-style full update.
       omaha_hash_calculator_.Finalize();
       if (omaha_hash_calculator_.hash() != install_plan_.download_hash) {
         LOG(ERROR) << "Download of " << install_plan_.download_url
                    << " failed. Expected hash " << install_plan_.download_hash
                    << " but got hash " << omaha_hash_calculator_.hash();
         code = kActionCodeDownloadHashMismatchError;
       } else if (bytes_received_ != install_plan_.size) {
         LOG(ERROR) << "Download of " << install_plan_.download_url
                    << " failed. Expected size " << install_plan_.size
                    << " but got size " << bytes_received_;
         code = kActionCodeDownloadSizeMismatchError;
       }
     }
   }
 
+  if (skip_reporting_signature_fail_.get() &&
+      (code != kActionCodeSuccess || !signature_verify_failed)) {
+    LOG(INFO) << "Suppressing signature pub key verification warning";
+    skip_reporting_signature_fail_->Run();
+  }
+
   FlushLinuxCaches();
 
   // Write the path to the output pipe if we're successful.
   if (code == kActionCodeSuccess && HasOutputPipe())
     SetOutputObject(install_plan_);
   processor_->ActionComplete(this, code);
 }
 
 void DownloadAction::TransferTerminated(HttpFetcher *fetcher) {
   if (code_ != kActionCodeSuccess) {
     processor_->ActionComplete(this, code_);
   }
 }
 
 };  // namespace {}