# -v Verbose mode
# Typical Debian invokation may look like:
-# ./gpgwrapper -k /usr/share/keyrings/debian-keyring.gpg:/usr/share/keyrings/debian-keyring.pgp \
+# sigcheck -k /usr/share/keyrings/debian-keyring.gpg:/usr/share/keyrings/debian-keyring.pgp \
# -d ou=users,dc=debian,dc=org -l db.debian.org \
# -m debian.org -a admin@db.debian.org \
# -e /etc/userdir-ldap/templtes/error-reply -- test.sh
# Connect to the ldap server
global ErrTyp, ErrMsg;
ErrType = EX_TEMPFAIL;
- ErrMsg = "An error occured while performing the LDAP lookup:";
+ ErrMsg = "An error occurred while performing the LDAP lookup:";
global l;
l = ldap.open(LDAPServer);
l.simple_bind_s("","");
if len(Attrs) != 1:
raise Error, "Oddly your key fingerprint is assigned to more than one account.."
+ gidnumber_found = 0;
+ for key in Attrs[0][1].keys():
+ if (key == "gidNumber"):
+ gidnumber_found = 1
+
+ if (gidnumber_found != 1):
+ raise Error, "No gidnumber in attributes for fingerprint %s" % FingerPrint
+
+ # Look for the group with the gid of the user
+ GAttr = l.search_s(LDAPDn,ldap.SCOPE_ONELEVEL,"(&(objectClass=debianGroup)(gidnumber=%s))" % Attrs[0][1]["gidNumber"][0], ["gid"])
+ if len(GAttr) == 0:
+ raise Error, "Database inconsistency found: main group for account not found in database"
+
# See if the group membership is OK
+ # Only if a group was given on the commandline
if GroupMember != None:
Hit = 0;
- for x in Attrs[0][1].get("supplementarygid",[]):
- if x == GroupMember:
- Hit = 1;
+ # Check primary group first
+ if GAttr[0][1]["gid"][0] == GroupMember:
+ Hit = 1
+ else:
+ # Check supplementary groups
+ for x in Attrs[0][1].get("supplementaryGid",[]):
+ if x == GroupMember:
+ Hit = 1;
if Hit != 1:
raise Error, "You don't have %s group permissions."%(GroupMember);
# Check the signature
ErrMsg = "Unable to check the signature or the signature was invalid:";
Res = GPGCheckSig(Msg[0]);
-
+
if Res[0] != None:
raise Error, Res[0];
if Rply != None:
raise Error, Rply;
RC.Add(Res[1]);
+ RC.close();
# Do LDAP stuff
if LDAPDn != None: