'--verify-update', shasum support, OpenPGP signatures verification

src/main/main.cpp

@@ -63,6 +63,7 @@
 #include "MainApp.h"
 #include "qt/ipc.h"
 #include "qt/network.h"
+#include "qt/updater.h"
 #include "qt/utils.h"
 #include "qt/TailsOS.h"
 #include "qt/KeysFiles.h"
@@ -221,6 +222,14 @@ int main(int argc, char *argv[])
         QCoreApplication::translate("main", "Log to specified file"),
         QCoreApplication::translate("main", "file"));
 
+    QCommandLineOption verifyUpdateOption("verify-update", "\
+Verify update binary using 'shasum'-compatible (SHA256 algo) output signed by two maintainers.\n\
+* Requires 'hashes.txt' - signed 'shasum' output \
+(i.e. 'gpg -o hashes.txt --clear-sign <shasum_output>') generated by a maintainer.\n\
+* Requires 'hashes.txt.sig' - detached signature of 'hashes.txt' \
+(i.e. 'gpg -b hashes.txt') generated by another maintainer.", "update-binary");
+    parser.addOption(verifyUpdateOption);
+
     QCommandLineOption testQmlOption("test-qml");
     testQmlOption.setFlags(QCommandLineOption::HiddenFromHelp);
     parser.addOption(logPathOption);
@@ -244,6 +253,32 @@ int main(int argc, char *argv[])
     }
     qWarning().noquote() << "app startd" << "(log: " + logPath + ")";
 
+    if (parser.isSet(verifyUpdateOption))
+    {
+        const QString updateBinaryFullPath = parser.value(verifyUpdateOption);
+        const QFileInfo updateBinaryInfo(updateBinaryFullPath);
+        const QString updateBinaryDir = QDir::toNativeSeparators(updateBinaryInfo.absolutePath()) + QDir::separator();
+        const QString hashesTxt = updateBinaryDir + "hashes.txt";
+        const QString hashesTxtSig = hashesTxt + ".sig";
+        try
+        {
+            const QByteArray updateBinaryContents = fileGetContents(updateBinaryFullPath);
+            const QPair<QString, QString> signers = Updater().verifySignaturesAndHashSum(
+                fileGetContents(hashesTxt),
+                fileGetContents(hashesTxtSig),
+                updateBinaryInfo.fileName(),
+                updateBinaryContents.data(),
+                updateBinaryContents.size());
+            qCritical() << "successfully verified, signed by" << signers.first << "and" << signers.second;
+            return 0;
+        }
+        catch (const std::exception &e)
+        {
+            qCritical() << e.what();
+        }
+        return 1;
+    }
+
     // Desktop entry
 #ifdef Q_OS_LINUX
     registerXdgMime(app);