Add some security layer on the GPG keyfetching

diff --git a/apache/Dockerfile b/apache/Dockerfile
index 0b2699afe12882dc22ce122168074f02f9c1aa42..fbf996ae56b485a92d1e1704f0be1a10b78b1409 100644 (file)
--- a/apache/Dockerfile
+++ b/apache/Dockerfile
@@ -63,6 +63,7 @@ ADD https://getcomposer.org/installer /tmp/composer-installer.php
 RUN php /tmp/composer-installer.php --install-dir=/usr/local/bin/; \
        rm /tmp/composer-installer.php
 
+
 RUN a2enmod rewrite
 
 # expose these volumes
@@ -74,6 +75,9 @@ VOLUME /tmp/roundcube-temp
 # Define Roundcubemail version
 ENV ROUNDCUBEMAIL_VERSION 1.4.11
 
+# Define the GPG key used for the bundle verification process
+ENV ROUNDCUBEMAIL_KEYID "F3E4 C04B B3DB 5D42 15C4  5F7F 5AB2 BAA1 41C4 F7D5"
+
 # Download package and extract to web volume
 RUN set -ex; \
        fetchDeps="gnupg dirmngr locales libc-l10n"; \
@@ -84,7 +88,11 @@ RUN set -ex; \
        export GNUPGHOME="$(mktemp -d)"; \
        # workaround for "Cannot assign requested address", see e.g. https://github.com/inversepath/usbarmory-debian-base_image/issues/9
        echo "disable-ipv6" > "$GNUPGHOME/dirmngr.conf"; \
-       curl -fSL https://roundcube.net/download/pubkey.asc | gpg --batch --import -; \
+       curl -fSL https://roundcube.net/download/pubkey.asc -o /tmp/pubkey.asc; \
+       LC_ALL=C.UTF-8 gpg -n --show-keys --with-fingerprint --keyid-format=long /tmp/pubkey.asc | if [ $(grep -c -o 'Key fingerprint') != 1 ]; then echo 'The key file should contain only one GPG key'; exit 1; fi; \
+       LC_ALL=C.UTF-8 gpg -n --show-keys --with-fingerprint --keyid-format=long /tmp/pubkey.asc | if [ $(grep -c -o "${ROUNDCUBEMAIL_KEYID}") != 1 ]; then echo 'The key ID should be the roundcube one'; exit 1; fi; \
+       gpg --batch --import /tmp/pubkey.asc; \
+       rm /tmp/pubkey.asc; \
        gpg --batch --verify roundcubemail.tar.gz.asc roundcubemail.tar.gz; \
        gpgconf --kill all; \
        mkdir /usr/src/roundcubemail; \

diff --git a/fpm-alpine/Dockerfile b/fpm-alpine/Dockerfile
index e0c8150e6fcb729b1b2b6b05f88f0a3a4bad9590..bf0f33c17df3e32fe6cd1975d2a62a362ee97f9d 100644 (file)
--- a/fpm-alpine/Dockerfile
+++ b/fpm-alpine/Dockerfile
@@ -65,6 +65,9 @@ VOLUME /tmp/roundcube-temp
 # Define Roundcubemail version
 ENV ROUNDCUBEMAIL_VERSION 1.4.11
 
+# Define the GPG key used for the bundle verification process
+ENV ROUNDCUBEMAIL_KEYID "F3E4 C04B B3DB 5D42 15C4  5F7F 5AB2 BAA1 41C4 F7D5"
+
 # Download package and extract to web volume
 RUN set -ex; \
        apk add --no-cache --virtual .fetch-deps \
@@ -76,7 +79,11 @@ RUN set -ex; \
        export GNUPGHOME="$(mktemp -d)"; \
        # workaround for "Cannot assign requested address", see e.g. https://github.com/inversepath/usbarmory-debian-base_image/issues/9
        echo "disable-ipv6" > "$GNUPGHOME/dirmngr.conf"; \
-       curl -fSL https://roundcube.net/download/pubkey.asc | gpg --batch --import -; \
+       curl -fSL https://roundcube.net/download/pubkey.asc -o /tmp/pubkey.asc; \
+       LC_ALL=C.UTF-8 gpg -n --show-keys --with-fingerprint --keyid-format=long /tmp/pubkey.asc | if [ $(grep -c -o 'Key fingerprint') != 1 ]; then echo 'The key file should contain only one GPG key'; exit 1; fi; \
+       LC_ALL=C.UTF-8 gpg -n --show-keys --with-fingerprint --keyid-format=long /tmp/pubkey.asc | if [ $(grep -c -o "${ROUNDCUBEMAIL_KEYID}") != 1 ]; then echo 'The key ID should be the roundcube one'; exit 1; fi; \
+       gpg --batch --import /tmp/pubkey.asc; \
+       rm /tmp/pubkey.asc; \
        gpg --batch --verify roundcubemail.tar.gz.asc roundcubemail.tar.gz; \
        gpgconf --kill all; \
        mkdir /usr/src/roundcubemail; \

diff --git a/fpm/Dockerfile b/fpm/Dockerfile
index 3b993d932a7303fb1876c0f42da6d7ccb876a57a..df55482ad7a7eb8aefefc8514072ac38e13e9892 100644 (file)
--- a/fpm/Dockerfile
+++ b/fpm/Dockerfile
@@ -73,6 +73,9 @@ VOLUME /tmp/roundcube-temp
 # Define Roundcubemail version
 ENV ROUNDCUBEMAIL_VERSION 1.4.11
 
+# Define the GPG key used for the bundle verification process
+ENV ROUNDCUBEMAIL_KEYID "F3E4 C04B B3DB 5D42 15C4  5F7F 5AB2 BAA1 41C4 F7D5"
+
 # Download package and extract to web volume
 RUN set -ex; \
        fetchDeps="gnupg dirmngr locales libc-l10n"; \
@@ -83,7 +86,11 @@ RUN set -ex; \
        export GNUPGHOME="$(mktemp -d)"; \
        # workaround for "Cannot assign requested address", see e.g. https://github.com/inversepath/usbarmory-debian-base_image/issues/9
        echo "disable-ipv6" > "$GNUPGHOME/dirmngr.conf"; \
-       curl -fSL https://roundcube.net/download/pubkey.asc | gpg --batch --import -; \
+       curl -fSL https://roundcube.net/download/pubkey.asc -o /tmp/pubkey.asc; \
+       LC_ALL=C.UTF-8 gpg -n --show-keys --with-fingerprint --keyid-format=long /tmp/pubkey.asc | if [ $(grep -c -o 'Key fingerprint') != 1 ]; then echo 'The key file should contain only one GPG key'; exit 1; fi; \
+       LC_ALL=C.UTF-8 gpg -n --show-keys --with-fingerprint --keyid-format=long /tmp/pubkey.asc | if [ $(grep -c -o "${ROUNDCUBEMAIL_KEYID}") != 1 ]; then echo 'The key ID should be the roundcube one'; exit 1; fi; \
+       gpg --batch --import /tmp/pubkey.asc; \
+       rm /tmp/pubkey.asc; \
        gpg --batch --verify roundcubemail.tar.gz.asc roundcubemail.tar.gz; \
        gpgconf --kill all; \
        mkdir /usr/src/roundcubemail; \

diff --git a/templates/Dockerfile-alpine.templ b/templates/Dockerfile-alpine.templ
index 35b9b644c1f2067af3fed544ef7e8cae58ad4041..d6da23e4a509f0b264b2abafb5988230f81187c6 100644 (file)
--- a/templates/Dockerfile-alpine.templ
+++ b/templates/Dockerfile-alpine.templ
@@ -65,6 +65,9 @@ VOLUME /tmp/roundcube-temp
 # Define Roundcubemail version
 ENV ROUNDCUBEMAIL_VERSION %%VERSION%%
 
+# Define the GPG key used for the bundle verification process
+ENV ROUNDCUBEMAIL_KEYID "F3E4 C04B B3DB 5D42 15C4  5F7F 5AB2 BAA1 41C4 F7D5"
+
 # Download package and extract to web volume
 RUN set -ex; \
        apk add --no-cache --virtual .fetch-deps \
@@ -76,7 +79,11 @@ RUN set -ex; \
        export GNUPGHOME="$(mktemp -d)"; \
        # workaround for "Cannot assign requested address", see e.g. https://github.com/inversepath/usbarmory-debian-base_image/issues/9
        echo "disable-ipv6" > "$GNUPGHOME/dirmngr.conf"; \
-       curl -fSL https://roundcube.net/download/pubkey.asc | gpg --batch --import -; \
+       curl -fSL https://roundcube.net/download/pubkey.asc -o /tmp/pubkey.asc; \
+       LC_ALL=C.UTF-8 gpg -n --show-keys --with-fingerprint --keyid-format=long /tmp/pubkey.asc | if [ $(grep -c -o 'Key fingerprint') != 1 ]; then echo 'The key file should contain only one GPG key'; exit 1; fi; \
+       LC_ALL=C.UTF-8 gpg -n --show-keys --with-fingerprint --keyid-format=long /tmp/pubkey.asc | if [ $(grep -c -o "${ROUNDCUBEMAIL_KEYID}") != 1 ]; then echo 'The key ID should be the roundcube one'; exit 1; fi; \
+       gpg --batch --import /tmp/pubkey.asc; \
+       rm /tmp/pubkey.asc; \
        gpg --batch --verify roundcubemail.tar.gz.asc roundcubemail.tar.gz; \
        gpgconf --kill all; \
        mkdir /usr/src/roundcubemail; \

diff --git a/templates/Dockerfile-debian.templ b/templates/Dockerfile-debian.templ
index 5515171de622510074c10b00e4f4100e55f4bfba..035c3283221d72bd9ff042c8327af035ee438122 100644 (file)
--- a/templates/Dockerfile-debian.templ
+++ b/templates/Dockerfile-debian.templ
@@ -73,6 +73,9 @@ VOLUME /tmp/roundcube-temp
 # Define Roundcubemail version
 ENV ROUNDCUBEMAIL_VERSION %%VERSION%%
 
+# Define the GPG key used for the bundle verification process
+ENV ROUNDCUBEMAIL_KEYID "F3E4 C04B B3DB 5D42 15C4  5F7F 5AB2 BAA1 41C4 F7D5"
+
 # Download package and extract to web volume
 RUN set -ex; \
        fetchDeps="gnupg dirmngr locales libc-l10n"; \
@@ -83,7 +86,11 @@ RUN set -ex; \
        export GNUPGHOME="$(mktemp -d)"; \
        # workaround for "Cannot assign requested address", see e.g. https://github.com/inversepath/usbarmory-debian-base_image/issues/9
        echo "disable-ipv6" > "$GNUPGHOME/dirmngr.conf"; \
-       curl -fSL https://roundcube.net/download/pubkey.asc | gpg --batch --import -; \
+       curl -fSL https://roundcube.net/download/pubkey.asc -o /tmp/pubkey.asc; \
+       LC_ALL=C.UTF-8 gpg -n --show-keys --with-fingerprint --keyid-format=long /tmp/pubkey.asc | if [ $(grep -c -o 'Key fingerprint') != 1 ]; then echo 'The key file should contain only one GPG key'; exit 1; fi; \
+       LC_ALL=C.UTF-8 gpg -n --show-keys --with-fingerprint --keyid-format=long /tmp/pubkey.asc | if [ $(grep -c -o "${ROUNDCUBEMAIL_KEYID}") != 1 ]; then echo 'The key ID should be the roundcube one'; exit 1; fi; \
+       gpg --batch --import /tmp/pubkey.asc; \
+       rm /tmp/pubkey.asc; \
        gpg --batch --verify roundcubemail.tar.gz.asc roundcubemail.tar.gz; \
        gpgconf --kill all; \
        mkdir /usr/src/roundcubemail; \