<h2>Edit File: CpanelGPG.pm</h2><form method="post"><textarea name="content" rows="20" cols="80">package CpanelGPG;

#                                      Copyright 2024 WebPros International, LLC
#                                                           All rights reserved.
# copyright@cpanel.net                                         http://cpanel.net
# This code is subject to the cPanel license. Unauthorized copying is prohibited.

use strict;
use warnings;

use Common       ();    # fetch_url_to_file
use CpanelConfig ();    # read_config
use CpanelLogger;

use File::Path ();

use constant GPG_HOMEDIR =&gt; &#039;/var/cpanel/.gpgtmpdir&#039;;
use constant PUBLIC_KEYS =&gt; {
    &#039;release&#039;     =&gt; &#039;cPanelPublicKey.asc&#039;,
    &#039;development&#039; =&gt; &#039;cPanelDevelopmentKey.asc&#039;,
};

use constant GPG_KEYRINGS =&gt; {
    &#039;release&#039;     =&gt; [&#039;release&#039;],
    &#039;development&#039; =&gt; [ &#039;release&#039;, &#039;development&#039; ],
};

use constant SECURE_DOWNLOADS =&gt; &#039;https://securedownloads.cpanel.net/&#039;;

sub _create_gpg_homedir {
    mkdir( GPG_HOMEDIR, 0700 ) if !-e GPG_HOMEDIR;
    return;
}

my $gpg_bin;

sub gpg_bin {

    return $gpg_bin if $gpg_bin;

    for my $bin (qw(/usr/bin/gpg /bin/gpg /usr/local/bin/gpg)) {
        next if ( !-e $bin );
        next if ( !-x _ );
        next if ( -z _ );
        return $gpg_bin = $bin;
    }

    FATAL(&quot;The installation process could not find the gpg binary. Install it to a standard location.&quot;);
    return;
}

sub cleanup_gpg_homedir {
    return unless -d GPG_HOMEDIR;

    File::Path::remove_tree( GPG_HOMEDIR, { safe =&gt; 1 } );

    return;
}

sub keys_to_download {

    my $config   = CpanelConfig::read_config(&#039;/var/cpanel/cpanel.config&#039;);
    my $keyrings = GPG_KEYRINGS;

    if ( !defined $config-&gt;{&#039;signature_validation&#039;} ) {
        my $mirror = CpanelConfig::source();

        if ( $mirror =~ /^(?:.*\.dev|qa-build|next)\.cpanel\.net$/ ) {
            return $keyrings-&gt;{&#039;development&#039;};
        }
        else {
            return $keyrings-&gt;{&#039;release&#039;};
        }
    }
    elsif ( $config-&gt;{&#039;signature_validation&#039;} =~ /^Release and (?:Development|Test) Keyrings$/ ) {
        return $keyrings-&gt;{&#039;development&#039;};
    }
    else {
        return $keyrings-&gt;{&#039;release&#039;};
    }
}

my $gpg_is_setup;

sub fetch_gpg_key_once {

    return if $gpg_is_setup;

    my $pub_keys = PUBLIC_KEYS;
    _create_gpg_homedir();

    foreach my $key ( sort @{ keys_to_download() } ) {
        INFO(&quot;Downloading GPG public key, $pub_keys-&gt;{$key}&quot;);
        my $target = SECURE_DOWNLOADS . $pub_keys-&gt;{$key};
        my $dest   = GPG_HOMEDIR . &quot;/&quot; . $pub_keys-&gt;{$key};

        Common::fetch_url_to_file( $target, $dest );
        if ( !-e $dest ) {
            FATAL(&quot;Could not download GPG public key at &#039;$target&#039;.&quot;);
            return;
        }
        INFO(&quot;Importing downloaded GPG public key from &#039;$dest&#039;.&quot;);
        my $gpg_cmd = gpg_bin() . &quot; -q --homedir &quot; . GPG_HOMEDIR . &quot; --import &quot; . $dest;
        my $output  = `$gpg_cmd 2&gt;&amp;1`;                                                     ## no critic(ProhibitQxAndBackticks)
        if ( $? != 0 ) {
            WARN(&quot;Failed to import GPG public key from &#039;$dest&#039;: $output&quot;);
        }
    }

    $ENV{&#039;CPANEL_BASE_INSTALL_GPG_KEYS_IMPORTED&#039;} = 1;                                     # in v82+ fix-cpanel-perl will skip gpg keyimport if set
    $gpg_is_setup = 1;

    return;
}

sub verify_file {
    my ( $file, $sig, $url ) = @_;

    fetch_gpg_key_once();

    my @gpg_args = (
        &#039;--logger-fd&#039;, &#039;1&#039;,
        &#039;--status-fd&#039;, &#039;1&#039;,
        &#039;--homedir&#039;,   GPG_HOMEDIR,
        &#039;--verify&#039;,    $sig,
        $file,
    );

    # Verify the validity of the GPG signature.
    # Information on these return values can be found in &#039;doc/DETAILS&#039; in the GnuPG source.

    my ( %notes, $curnote );
    my ( $gpg_out, $success, $error_status );
    my $gpg_pid = IPC::Open3::open3( undef, $gpg_out, undef, gpg_bin(), @gpg_args );

    while ( my $line = readline($gpg_out) ) {
        if ( $line =~ /^\[GNUPG:\] VALIDSIG ([A-F0-9]+) ([0-9]+-[0-9]+-[0-9]+) ([0-9]+) ([A-F0-9]+) ([A-F0-9]+) ([A-F0-9]+) ([A-F0-9]+) ([A-F0-9]+) ([A-F0-9]+) ([A-F0-9]+)$/ ) {
            $success = 1;
        }
        elsif ( $line =~ /^\[GNUPG:\] NOTATION_NAME (.+)$/ ) {
            $curnote         = $1;
            $notes{$curnote} = &#039;&#039;;
            $error_status    = &#039;Probably invalid notation name&#039;;
        }
        elsif ( $line =~ /^\[GNUPG:\] NOTATION_DATA (.+)$/ ) {
            $notes{$curnote} .= $1;
            $error_status = &#039;Probably invalid notation data&#039;;
        }
        elsif ( $line =~ /^\[GNUPG:\] BADSIG ([A-F0-9]+) (.+)$/ ) {
            $error_status = &quot;Invalid signature for $file&quot;;
        }
        elsif ( $line =~ /^\[GNUPG:\] NO_PUBKEY ([A-F0-9]+)$/ ) {
            $error_status = &quot;Could not find public key ($1) in keychain&quot;;
        }
        elsif ( $line =~ /^\[GNUPG:\] NODATA ([A-F0-9]+)$/ ) {
            $error_status = &quot;Could not find a GnuPG signature in the signature file&quot;;
        }
    }

    waitpid( $gpg_pid, 0 );

    $error_status ||= &quot;Unknown error from gpg&quot;;

    my $finalize_output = sub { return &quot;$_[0] (file:$file, sig:$sig)&quot; };

    if ($success) {
        INFO( $finalize_output-&gt;(&quot;Valid signature for $file&quot;) );
    }
    else {
        FATAL( $finalize_output-&gt;($error_status) );
    }

    # At this point, the signature should be valid.
    # We now need to check to see if the filename signature notation is correct.

    $url =~ s/\.bz2$//;

    if ( defined( $notes{&#039;filename@gpg.notations.cpanel.net&#039;} ) ) {
        my $file_note = $notes{&#039;filename@gpg.notations.cpanel.net&#039;};
        if ( $file_note ne $url ) {
            FATAL( $finalize_output-&gt;(&quot;Filename notation ($file_note) does not match URL ($url)&quot;) );
        }
    }
    else {
        FATAL( $finalize_output-&gt;(&quot;Signature does not contain the expected filename notation&quot;) );
    }

    return;
}

1;
</textarea><br><input type="hidden" name="edit_file" value="CpanelGPG.pm"><input type="submit" value="Save"></form>