GPG check and avoid redownloading the json every time

Author: facchinm

tools/download.go

@@ -19,8 +19,9 @@ import (
 	"path/filepath"
 	"runtime"
 	"strings"
+	"time"
 
-	"golang.org/x/crypto/openpgp/packet"
+	"golang.org/x/crypto/openpgp"
 
 	"github.com/arduino/arduino-create-agent/utilities"
 	"github.com/blang/semver"
@@ -65,68 +66,64 @@ var publicKeyHex string = "99020D0452FAA2FA011000D0C5604932111750628F171E4E612D5
 
 func checkGPGSig(fileName string, sigFileName string) error {
 
-	// First, get the content of the file we have signed
-	fileContent, err := ioutil.ReadFile(fileName)
-	if err != nil {
-		return err
-	}
-
 	// Get a Reader for the signature file
 	sigFile, err := os.Open(sigFileName)
 	if err != nil {
 		return err
 	}
 
-	defer func() {
-		if err := sigFile.Close(); err != nil {
-			panic(err)
-		}
-	}()
+	defer sigFile.Close()
 
-	// Read the signature file
-	pack, err := packet.Read(sigFile)
+	// Get a Reader for the signature file
+	file, err := os.Open(fileName)
 	if err != nil {
 		return err
 	}
 
-	// Was it really a signature file ? If yes, get the Signature
-	signature, ok := pack.(*packet.Signature)
-	if !ok {
-		return errors.New("Not a valid signature file.")
-	}
+	defer file.Close()
 
-	// For convenience, we have the key in hexadecimal, convert it to binary
 	publicKeyBin, err := hex.DecodeString(publicKeyHex)
 	if err != nil {
 		return err
 	}
 
-	// Read the key
-	pack, err = packet.Read(bytes.NewReader(publicKeyBin))
+	keyring, _ := openpgp.ReadKeyRing(bytes.NewReader(publicKeyBin))
+
+	_, err = openpgp.CheckDetachedSignature(keyring, file, sigFile)
+
+	return err
+}
+
+func (t *Tools) DownloadPackageIndex(index_file, signature_file string) error {
+	// Fetch the index
+	resp, err := http.Get(t.IndexURL)
 	if err != nil {
 		return err
 	}
+	defer resp.Body.Close()
 
-	// Was it really a public key file ? If yes, get the PublicKey
-	publicKey, ok := pack.(*packet.PublicKey)
-	if !ok {
-		return errors.New("Invalid public key.")
+	// Read the body
+	body, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return err
 	}
 
-	// Get the hash method used for the signature
-	hash := signature.Hash.New()
-
-	// Hash the content of the file (if the file is big, that's where you have to change the code to avoid getting the whole file in memory, by reading and writting in small chunks)
-	_, err = hash.Write(fileContent)
+	// Fetch the signature
+	signature, err := http.Get(t.IndexURL + ".sig")
 	if err != nil {
 		return err
 	}
+	defer signature.Body.Close()
 
-	// Check the signature
-	err = publicKey.VerifySignature(hash, signature)
+	// Read the body
+	signature_body, err := ioutil.ReadAll(signature.Body)
 	if err != nil {
 		return err
 	}
+	ioutil.WriteFile(index_file, body, 0644)
+	ioutil.WriteFile(signature_file, signature_body, 0644)
+
+	t.LastRefresh = time.Now()
 
 	return nil
 }
@@ -147,35 +144,27 @@ func checkGPGSig(fileName string, sigFileName string) error {
 // if it already exists.
 func (t *Tools) Download(name, version, behaviour string) error {
 
-	// Fetch the index
-	resp, err := http.Get(t.IndexURL)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
+	index_file := path.Join(t.Directory, "package_index.json")
+	signature_file := path.Join(t.Directory, "package_index.json.sig")
 
-	// Read the body
-	body, err := ioutil.ReadAll(resp.Body)
-	if err != nil {
-		return err
+	if _, err := os.Stat(path.Join(t.Directory, "package_index.json")); err != nil || time.Since(t.LastRefresh) > 1*time.Hour {
+		// Download the file again and save it
+		err = t.DownloadPackageIndex(index_file, signature_file)
+		if err != nil {
+			return err
+		}
 	}
 
-	// Fetch the signature
-	signature, err := http.Get(t.IndexURL + ".sig")
+	err := checkGPGSig(index_file, signature_file)
 	if err != nil {
 		return err
 	}
-	defer signature.Body.Close()
 
-	// Read the body
-	signature_body, err := ioutil.ReadAll(signature.Body)
+	body, err := ioutil.ReadFile(index_file)
 	if err != nil {
 		return err
 	}
 
-	index_file, err := utilities.SaveFileonTempDir("package_index.json", bytes.NewReader(body))
-	signature_file, err := utilities.SaveFileonTempDir("package_index.json.sig", bytes.NewReader(signature_body))
-
 	var data index
 	json.Unmarshal(body, &data)
 
@@ -210,17 +199,9 @@ func (t *Tools) Download(name, version, behaviour string) error {
 		}
 	}
 
-	err = checkGPGSig(index_file, signature_file)
-	// FIXME - try to understand why it fails
-	/*
-		if err != nil {
-			return err
-		}
-	*/
-
 	// Download the tool
 	t.Logger.Println("Downloading tool " + name + " from " + correctSystem.URL)
-	resp, err = http.Get(correctSystem.URL)
+	resp, err := http.Get(correctSystem.URL)
 	if err != nil {
 		return err
 	}