From 1e4b155da614dc3c4e55e849bac8eebe545c502d Mon Sep 17 00:00:00 2001
From: jeanluc <lkubb@protonmail.com>
Date: Mon, 12 Dec 2022 02:12:58 +0100
Subject: [PATCH] fix(general): Signature validation

---
 gitea/package/install.sls | 37 ++++++++++++++++++++++++++++++++-----
 1 file changed, 32 insertions(+), 5 deletions(-)

diff --git a/gitea/package/install.sls b/gitea/package/install.sls
index 9f4590f..9274d72 100644
--- a/gitea/package/install.sls
+++ b/gitea/package/install.sls
@@ -48,7 +48,7 @@ Gitea is available:
 
 Gitea GPG key is present (received from keyserver):
   gpg.present:
-    - name: {{ gitea.lookup.gpg.key }}
+    - name: {{ gitea.lookup.gpg.key[:-16] }}
     - keyserver: {{ gitea.lookup.gpg.keyserver }}
 
 Gitea GPG key is present (fallback):
@@ -65,16 +65,43 @@ Gitea GPG key is present (fallback):
     - require:
       - file: /tmp/gitea-key.asc
 
-Gitea is verified:
+{%- if "gpg.verified" not in salt %}
+
+# Ensure the following does not run without the key being present.
+# The official gpg modules are currently big liars and always report
+# `Yup, no worries! Everything is fine.`
+Gitea key is actually present:
   module.run:
-    - gpg.verify:
-      - filename: /tmp/gitea-{{ gitea.version }}
-      - signature: /tmp/gitea-{{ gitea.version }}.asc
+    - gpg.get_key:
+      - fingerprint: {{ gitea.lookup.gpg.key }}
+{%- endif %}
+
+
+{%- if "gpg.verified" not in salt %}
+
+Gitea is verified:
+  test.configurable_test_state:
+    - name: Check if the downloaded binary has been signed by the release key
+    - changes: False
+    - result: >
+        __slot__:salt:gpg.verify(filename=/tmp/gitea-{{ gitea.version }},
+        signature=/tmp/gitea-{{ gitea.version }}.asc).res
+    - require:
+      - Gitea is available
+      - Gitea key is actually present
+{%- else %}
+
+Gitea is verified:
+  gpg.verified:
+    - name: /tmp/gitea-{{ gitea.version }}
+    - signature: /tmp/gitea-{{ gitea.version }}.asc
+    - signed_by_any: {{ gitea.lookup.gpg.key }}
     - require:
       - Gitea is available
     - require_any:
       - Gitea GPG key is present (received from keyserver)
       - Gitea GPG key is present (fallback)
+{%- endif %}
 
 Gitea binary is absent if verification failed:
   file.absent: