security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2024-12-22 10:19:57 +01:00
Code Activity

tools: Make gpg-authcode-sign.sh more robust on network errors.

Browse Source 
* tools/gpg-authcode-sign.sh: Return on HTTP status 500
--

We have seen timestamping failures after signing some file using
GlobalSign certs.
This commit is contained in:
Werner Koch 2024-06-10 11:30:59 +02:00
parent 55559c8b66
commit 640c58135e
No known key found for this signature in database
GPG Key ID: E3FDFF218E45B72B
1 changed files with 18 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
tools/gpg-authcode-sign.sh Normal file → Executable file
View File

@ -10,7 +10,7 @@
# WITHOUT ANY WARRANTY, to the extent permitted by law; without even the # WITHOUT ANY WARRANTY, to the extent permitted by law; without even the
# implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. # implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
VERSION=2024-03-25 VERSION=2024-06-10
PGM=gpg-authcode-sign.sh PGM=gpg-authcode-sign.sh
set -e set -e
@ -199,6 +199,7 @@ if [ "$stamp" = yes ]; then
fi fi
fi fi
waittime=2
if [ -n "$dryrun" ]; then if [ -n "$dryrun" ]; then
echo >&2 "$PGM: would sign: '$inname' to '$outname'" echo >&2 "$PGM: would sign: '$inname' to '$outname'"
@ -221,13 +222,27 @@ elif [ "$AUTHENTICODE_KEY" = card ]; then
echo >&2 "$PGM: Signing using a card: '$inname'" echo >&2 "$PGM: Signing using a card: '$inname'"
"$OSSLSIGNCODE" sign \ while ! "$OSSLSIGNCODE" sign \
-pkcs11engine "$OSSLPKCS11ENGINE" \ -pkcs11engine "$OSSLPKCS11ENGINE" \
-pkcs11module "$SCUTEMODULE" \ -pkcs11module "$SCUTEMODULE" \
-certs "$AUTHENTICODE_CERTS" \ -certs "$AUTHENTICODE_CERTS" \
-h sha256 -n "$desc" -i "$url" \ -h sha256 -n "$desc" -i "$url" \
-ts "$AUTHENTICODE_TSURL" \ -ts "$AUTHENTICODE_TSURL" \
-in "$inname" -out "$outname.tmp" -in "$inname" -out "$outname.tmp" 2> $outname.tmp.log ; do
cat >&2 $outname.tmp.log
if ! grep 'HTTP status 500' $outname.tmp.log >/dev/null ; then
echo >&2 "$PGM: signing failed - see above"
exit 2
fi
if [ $waittime -ge 32 ]; then
echo >&2 "$PGM: signing failed - giving up"
exit 2
fi
echo >&2 "$PGM: signing failed - waiting ${waittime}s before next try"
sleep $waittime
waittime=$(( $waittime * 2 ))
done
rm "$outname.tmp.log"
cp "$outname.tmp" "$outname" cp "$outname.tmp" "$outname"
rm "$outname.tmp" rm "$outname.tmp"