Harden repo verification and live installer privileges

minitheguitarist · minitheguitarist · commit 202b10b82b28 · 2026-06-15T01:31:35.000+03:00
diff --git a/docs/profesyonel-installer-ana-plani.md b/docs/profesyonel-installer-ana-plani.md
@@ -101,9 +101,10 @@ Hedef:
 
 Plan:
 
-- Repo GPG anahtari uretilecek ve paket imzalama akisi belgelenecek.
-- `.repo` dosyasi `gpgcheck=1` ve `repo_gpgcheck=1` hedefiyle guncellenecek.
-- Live ISO sudo/polkit politikasi `NOPASSWD: ALL` yerine yalniz installer komut seti veya pkexec policy ile sinirlanacak.
+- Ro `.repo` dosyalari `gpgcheck=1`, `repo_gpgcheck=1` ve `RPM-GPG-KEY-ro-asd` ile guncellendi.
+- COPR depolari RPM imzasi (`gpgcheck=1`) ile kaliyor; COPR metadata imzasi yayinlanmadigi icin `repo_gpgcheck=0` istisnasi belgelendi.
+- Live ISO `NOPASSWD: ALL` kullanmiyor; otomatik baslatma installer launcher + liveuser ile sinirli polkit kuralina tasindi.
+- Hala gereken dis is: 2026-06-15 kontrolunde Ro-Repo tarafinda `RPM-GPG-KEY-ro-asd` ve imzali `repodata/repomd.xml.asc` dosyalari 404 donuyor; bunlar yayinlanmali.
 
 ## Storage Plani
 
diff --git a/docs/sonraki-adim-notu.md b/docs/sonraki-adim-notu.md
@@ -1,11 +1,14 @@
 # Sonraki Adim Notu
 
-Git temizligi ve GitHub senkronizasyonu bittikten sonra teknik siralama:
+Git temizligi ve GitHub senkronizasyonu sonrasi teknik siralama:
 
-1. Repo GPG ve live sudo/polkit sertlestirmesi.
-   - `gpgcheck=0` ve `repo_gpgcheck=0` stable blocker olarak kalacak.
-   - Live ISO icindeki `NOPASSWD: ALL` daraltilacak.
-2. LUKS stage uygulamasi.
+1. Tamamlandi: Repo GPG ve live sudo/polkit sertlestirmesi.
+   - Ro GitHub repo dosyalari `gpgcheck=1`, `repo_gpgcheck=1` ve `RPM-GPG-KEY-ro-asd` ile yaziliyor.
+   - COPR depolarinda RPM imzasi (`gpgcheck=1`) zorunlu; COPR metadata imzasi yayinlamadigi icin `repo_gpgcheck=0` pratik istisna olarak kaliyor.
+   - Live ISO icindeki `NOPASSWD: ALL` kaldirildi; otomatik baslatma dar polkit kuralindan `pkexec` launcher'a gidiyor.
+   - Kurulu sistem dogrulamasi, live polkit/sudoers/installer kalintisi sizarsa kurulumu basarisiz sayiyor.
+   - Dis blocker: 2026-06-15 kontrolunde `RPM-GPG-KEY-ro-asd`, `x86_64/repodata/repomd.xml.asc` ve `noarch/repodata/repomd.xml.asc` GitHub Pages uzerinde 404 donuyor. Bu dosyalar Ro-Repo tarafinda yayinlanmadan yeni guvenli repo ayari bilincli olarak build/install akisini durdurur.
+2. Siradaki is: LUKS stage uygulamasi.
    - `InstallProfile` encryption semasi hazir, ama `enabled=true` profiller stage destegi tamamlanana kadar bilincli olarak reddediliyor.
    - Ilk hedef: gelismis kurulumda opsiyonel LUKS2 root.
 3. QEMU stable matrisi.
diff --git a/lib/services/install_stages/chroot_config_stage.dart b/lib/services/install_stages/chroot_config_stage.dart
@@ -24,15 +24,19 @@ cat > /etc/yum.repos.d/ro-repo.repo <<'EOF'
 name=Acik Kaynak Gelistirme Toplulugu Repo
 baseurl=https://project-ro-asd.github.io/Ro-Repo/$basearch/
 enabled=1
-gpgcheck=0
+gpgcheck=1
+gpgkey=https://project-ro-asd.github.io/Ro-Repo/RPM-GPG-KEY-ro-asd
+repo_gpgcheck=1
 EOF
 
 cat > /etc/yum.repos.d/ro-repo-noarch.repo <<'EOF'
 [ro-repo-noarch]
 name=Acik Kaynak Gelistirme Toplulugu Repo - Noarch
 baseurl=https://project-ro-asd.github.io/Ro-Repo/noarch/
 enabled=1
-gpgcheck=0
+gpgcheck=1
+gpgkey=https://project-ro-asd.github.io/Ro-Repo/RPM-GPG-KEY-ro-asd
+repo_gpgcheck=1
 EOF
 
 cat > /etc/yum.repos.d/ro-kernel-stable-copr.repo <<'EOF'
@@ -558,6 +562,7 @@ EOF
       rm -rf /usr/lib/ro-installer /usr/lib64/ro-installer 2>/dev/null || true
       rm -f /usr/libexec/ro-installer-launcher.sh 2>/dev/null || true
       rm -f /usr/share/polkit-1/actions/org.roasd.installer.policy 2>/dev/null || true
+      rm -f /etc/polkit-1/rules.d/49-ro-installer-live.rules 2>/dev/null || true
     ''',
       ],
       'Kurulu sistemden eski autostart girdisi temizlenemedi.',
diff --git a/lib/services/install_stages/post_install_validation_stage.dart b/lib/services/install_stages/post_install_validation_stage.dart
@@ -37,8 +37,18 @@ test -f /etc/yum.repos.d/ro-kernel-stable-copr.repo
 test -f /etc/yum.repos.d/ro-kernel-experimental-copr.repo
 grep -q 'https://project-ro-asd.github.io/Ro-Repo/$basearch/' /etc/yum.repos.d/ro-repo.repo
 grep -q 'https://project-ro-asd.github.io/Ro-Repo/noarch/' /etc/yum.repos.d/ro-repo-noarch.repo
+grep -q '^gpgcheck=1$' /etc/yum.repos.d/ro-repo.repo
+grep -q '^repo_gpgcheck=1$' /etc/yum.repos.d/ro-repo.repo
+grep -q '^gpgkey=https://project-ro-asd.github.io/Ro-Repo/RPM-GPG-KEY-ro-asd$' /etc/yum.repos.d/ro-repo.repo
+grep -q '^gpgcheck=1$' /etc/yum.repos.d/ro-repo-noarch.repo
+grep -q '^repo_gpgcheck=1$' /etc/yum.repos.d/ro-repo-noarch.repo
+grep -q '^gpgkey=https://project-ro-asd.github.io/Ro-Repo/RPM-GPG-KEY-ro-asd$' /etc/yum.repos.d/ro-repo-noarch.repo
 grep -q 'hynkzz/ro-kernel-stable' /etc/yum.repos.d/ro-kernel-stable-copr.repo
+grep -q '^gpgcheck=1$' /etc/yum.repos.d/ro-kernel-stable-copr.repo
+grep -q '^gpgkey=https://download.copr.fedorainfracloud.org/results/hynkzz/ro-kernel-stable/pubkey.gpg$' /etc/yum.repos.d/ro-kernel-stable-copr.repo
 grep -q 'hynkzz/ro-Kernel-Experimental' /etc/yum.repos.d/ro-kernel-experimental-copr.repo
+grep -q '^gpgcheck=1$' /etc/yum.repos.d/ro-kernel-experimental-copr.repo
+grep -q '^gpgkey=https://download.copr.fedorainfracloud.org/results/hynkzz/ro-Kernel-Experimental/pubkey.gpg$' /etc/yum.repos.d/ro-kernel-experimental-copr.repo
 ''';
 
 const postInstallRoDesktopAppsValidationScript = r'''
@@ -354,6 +364,34 @@ class PostInstallValidationStage {
     ], 'ro_installer kurulu sistemde kalmış görünüyor.');
     if (failure != null) return failure;
 
+    failure = await _requireCommand(ctx, 'test', [
+      '!',
+      '-e',
+      '/mnt/usr/libexec/ro-installer-launcher.sh',
+    ], 'ro-installer launcher kurulu sistemde kalmış görünüyor.');
+    if (failure != null) return failure;
+
+    failure = await _requireCommand(ctx, 'test', [
+      '!',
+      '-e',
+      '/mnt/usr/share/polkit-1/actions/org.roasd.installer.policy',
+    ], 'ro-installer polkit policy kurulu sistemde kalmış görünüyor.');
+    if (failure != null) return failure;
+
+    failure = await _requireCommand(ctx, 'test', [
+      '!',
+      '-e',
+      '/mnt/etc/polkit-1/rules.d/49-ro-installer-live.rules',
+    ], 'Canlı oturum polkit kuralı hedef sisteme sızmış görünüyor.');
+    if (failure != null) return failure;
+
+    failure = await _requireCommand(ctx, 'test', [
+      '!',
+      '-e',
+      '/mnt/etc/sudoers.d/ro-installer-live',
+    ], 'Canlı oturum sudoers kuralı hedef sisteme sızmış görünüyor.');
+    if (failure != null) return failure;
+
     failure = await _requireCommand(ctx, 'chroot', [
       '/mnt',
       'sh',
diff --git a/linux/org.roasd.installer.policy b/linux/org.roasd.installer.policy
@@ -13,7 +13,6 @@
     <message xml:lang="tr">Ro-ASD Yükleyici yönetici izni gerektirmektedir.</message>
     <icon_name>drive-harddisk</icon_name>
     <defaults>
-      <!-- Live ISO ortamında şifresiz yetki yükseltme -->
       <allow_any>auth_admin_keep</allow_any>
       <allow_inactive>auth_admin_keep</allow_inactive>
       <allow_active>auth_admin_keep</allow_active>
diff --git a/linux/ro-installer.desktop b/linux/ro-installer.desktop
@@ -7,9 +7,9 @@ Name[tr]=Ro-ASD Yükleyici
 Comment=Ro-ASD işletim sistemini bilgisayarınıza kurun
 Comment[en]=Install Ro-ASD Operating System to your computer
 Comment[tr]=Ro-ASD işletim sistemini bilgisayarınıza kurun
-# Exec: /usr/bin/ro-installer symlink'i paketleme asamasinda olusturulur.
-# Uygulama root degilse main.dart icinden pkexec ile kendini tekrar baslatir.
-Exec=/usr/bin/ro-installer
+# Launcher paketleme asamasinda /usr/libexec altina kurulur.
+# Uygulama root degilse launcher pkexec ile kendini tekrar baslatir.
+Exec=/usr/libexec/ro-installer-launcher.sh
 Icon=drive-harddisk
 Terminal=false
 Categories=System;
diff --git a/scripts/02-build-iso.sh b/scripts/02-build-iso.sh
@@ -569,15 +569,19 @@ write_ro_repos() {
 name=Acik Kaynak Gelistirme Toplulugu Repo
 baseurl=https://project-ro-asd.github.io/Ro-Repo/$basearch/
 enabled=1
-gpgcheck=0
+gpgcheck=1
+gpgkey=https://project-ro-asd.github.io/Ro-Repo/RPM-GPG-KEY-ro-asd
+repo_gpgcheck=1
 EOF
 
   cat > /etc/yum.repos.d/ro-repo-noarch.repo <<'EOF'
 [ro-repo-noarch]
 name=Acik Kaynak Gelistirme Toplulugu Repo - Noarch
 baseurl=https://project-ro-asd.github.io/Ro-Repo/noarch/
 enabled=1
-gpgcheck=0
+gpgcheck=1
+gpgkey=https://project-ro-asd.github.io/Ro-Repo/RPM-GPG-KEY-ro-asd
+repo_gpgcheck=1
 EOF
 
   cat > /etc/yum.repos.d/ro-kernel-stable-copr.repo <<'EOF'
@@ -1105,6 +1109,16 @@ test -f /etc/yum.repos.d/ro-repo.repo
 test -f /etc/yum.repos.d/ro-repo-noarch.repo
 test -f /etc/yum.repos.d/ro-kernel-stable-copr.repo
 test -f /etc/yum.repos.d/ro-kernel-experimental-copr.repo
+grep -q '^gpgcheck=1$' /etc/yum.repos.d/ro-repo.repo
+grep -q '^repo_gpgcheck=1$' /etc/yum.repos.d/ro-repo.repo
+grep -q '^gpgkey=https://project-ro-asd.github.io/Ro-Repo/RPM-GPG-KEY-ro-asd$' /etc/yum.repos.d/ro-repo.repo
+grep -q '^gpgcheck=1$' /etc/yum.repos.d/ro-repo-noarch.repo
+grep -q '^repo_gpgcheck=1$' /etc/yum.repos.d/ro-repo-noarch.repo
+grep -q '^gpgkey=https://project-ro-asd.github.io/Ro-Repo/RPM-GPG-KEY-ro-asd$' /etc/yum.repos.d/ro-repo-noarch.repo
+grep -q '^gpgcheck=1$' /etc/yum.repos.d/ro-kernel-stable-copr.repo
+grep -q '^gpgkey=https://download.copr.fedorainfracloud.org/results/hynkzz/ro-kernel-stable/pubkey.gpg$' /etc/yum.repos.d/ro-kernel-stable-copr.repo
+grep -q '^gpgcheck=1$' /etc/yum.repos.d/ro-kernel-experimental-copr.repo
+grep -q '^gpgkey=https://download.copr.fedorainfracloud.org/results/hynkzz/ro-Kernel-Experimental/pubkey.gpg$' /etc/yum.repos.d/ro-kernel-experimental-copr.repo
 install_pkgs=(
   "${installer_rpm}"
   gdisk
@@ -1187,29 +1201,42 @@ rm -f \
 
 log "Live ISO boot kernel/initrd replaced with ro-kernel-stable artifacts."
 
-log "Creating live autostart and passwordless sudo policy for installer..."
+log "Creating live autostart and polkit rule for installer..."
 install -d "${TARGET_ROOT_DIR}/etc/xdg/autostart"
 cat > "${TARGET_ROOT_DIR}/etc/xdg/autostart/ro-Installer.desktop" <<'EOF'
 [Desktop Entry]
 Type=Application
 Version=1.0
 Name=Ro-ASD Installer Live AutoStart
 Comment=Starts Ro-ASD installer in the live session
-Exec=/usr/bin/env RO_INSTALLER_LIVE_SESSION=1 RO_INSTALLER_COMMAND_SUDO=1 /usr/bin/ro-installer
-TryExec=/usr/bin/ro-installer
+Exec=/usr/bin/env RO_INSTALLER_LIVE_SESSION=1 /usr/libexec/ro-installer-launcher.sh
+TryExec=/usr/libexec/ro-installer-launcher.sh
 Terminal=false
 NoDisplay=true
 X-GNOME-Autostart-enabled=true
 X-KDE-autostart-after=panel
 EOF
 
-install -d "${TARGET_ROOT_DIR}/etc/sudoers.d"
-cat > "${TARGET_ROOT_DIR}/etc/sudoers.d/ro-installer-live" <<'EOF'
-Defaults:liveuser !requiretty
-liveuser ALL=(ALL) NOPASSWD: ALL
-%wheel ALL=(ALL) NOPASSWD: ALL
+install -d "${TARGET_ROOT_DIR}/etc/polkit-1/rules.d"
+cat > "${TARGET_ROOT_DIR}/etc/polkit-1/rules.d/49-ro-installer-live.rules" <<'EOF'
+polkit.addRule(function(action, subject) {
+  if (subject.user != "liveuser" || !subject.active) {
+    return polkit.Result.NOT_HANDLED;
+  }
+
+  if (action.id == "org.roasd.installer.run") {
+    return polkit.Result.YES;
+  }
+
+  if (action.id == "org.freedesktop.policykit.exec" &&
+      action.lookup("program") == "/usr/bin/ro-installer") {
+    return polkit.Result.YES;
+  }
+
+  return polkit.Result.NOT_HANDLED;
+});
 EOF
-chmod 0440 "${TARGET_ROOT_DIR}/etc/sudoers.d/ro-installer-live"
+chmod 0644 "${TARGET_ROOT_DIR}/etc/polkit-1/rules.d/49-ro-installer-live.rules"
 
 rewrite_os_release() {
   local file="$1"
diff --git a/scripts/check-stable.sh b/scripts/check-stable.sh
@@ -86,10 +86,25 @@ forbid_pattern \
   lib scripts
 
 forbid_pattern \
-  "repo GPG kontrolleri kapali degil" \
-  '(^|[[:space:]])(gpgcheck=0|repo_gpgcheck=0)($|[[:space:]])' \
+  "RPM GPG kontrolleri kapali degil" \
+  '(^|[[:space:]])gpgcheck=0($|[[:space:]])' \
   lib scripts ro-installer.spec
 
+require_ro_repo_metadata_gpg() {
+  local file
+  local key_count
+  local metadata_count
+  for file in lib/services/install_stages/chroot_config_stage.dart scripts/02-build-iso.sh; do
+    rg -n 'project-ro-asd.github.io/Ro-Repo' "${file}" >/dev/null
+    metadata_count="$(rg -c '^repo_gpgcheck=1$' "${file}" || true)"
+    key_count="$(rg -c '^gpgkey=https://project-ro-asd.github.io/Ro-Repo/RPM-GPG-KEY-ro-asd$' "${file}" || true)"
+    [[ "${metadata_count}" -ge 2 ]]
+    [[ "${key_count}" -ge 2 ]]
+  done
+}
+
+run_check "Ro repo metadata GPG zorunlu" require_ro_repo_metadata_gpg
+
 forbid_pattern \
   "live sudo politikasi NOPASSWD ALL degil" \
   'NOPASSWD:[[:space:]]*ALL' \
diff --git a/test/services/install_stages/chroot_config_stage_test.dart b/test/services/install_stages/chroot_config_stage_test.dart
@@ -264,12 +264,15 @@ void main() {
             (cmd) =>
                 cmd.command == 'chroot' &&
                 cmd.args.join(' ').contains('/etc/yum.repos.d/ro-repo.repo') &&
-                cmd.args
-                    .join(' ')
-                    .contains('https://project-ro-asd.github.io/Ro-Repo'),
+                cmd.args.join(' ').contains(
+                  'https://project-ro-asd.github.io/Ro-Repo',
+                ) &&
+                cmd.args.join(' ').contains('gpgcheck=1') &&
+                cmd.args.join(' ').contains('repo_gpgcheck=1') &&
+                cmd.args.join(' ').contains('RPM-GPG-KEY-ro-asd'),
           ),
           true,
-          reason: 'Ro GitHub repo dosyasi hedef sisteme yazilmadi',
+          reason: 'Ro GitHub repo dosyasi imza dogrulamayla yazilmadi',
         );
         expect(
           fake.commandLog.any(
@@ -599,6 +602,11 @@ void main() {
           cleanupScripts,
           contains('/var/lib/AccountsService/users/liveuser'),
         );
+        expect(
+          cleanupScripts,
+          contains('/etc/polkit-1/rules.d/49-ro-installer-live.rules'),
+        );
+        expect(cleanupScripts, contains('/etc/sudoers.d/ro-installer-live'));
         expect(cleanupScripts, contains('userdel -r liveuser'));
       },
     );
diff --git a/test/services/install_stages/post_install_validation_stage_test.dart b/test/services/install_stages/post_install_validation_stage_test.dart
@@ -227,6 +227,26 @@ void main() {
     void addInstallerRemovalResponses(FakeCommandRunner fake) {
       fake.addResponse('test', ['!', '-e', '/mnt/usr/bin/ro-installer']);
       fake.addResponse('test', ['!', '-e', '/mnt/usr/bin/ro_installer']);
+      fake.addResponse('test', [
+        '!',
+        '-e',
+        '/mnt/usr/libexec/ro-installer-launcher.sh',
+      ]);
+      fake.addResponse('test', [
+        '!',
+        '-e',
+        '/mnt/usr/share/polkit-1/actions/org.roasd.installer.policy',
+      ]);
+      fake.addResponse('test', [
+        '!',
+        '-e',
+        '/mnt/etc/polkit-1/rules.d/49-ro-installer-live.rules',
+      ]);
+      fake.addResponse('test', [
+        '!',
+        '-e',
+        '/mnt/etc/sudoers.d/ro-installer-live',
+      ]);
     }
 
     void addLiveUserCleanupResponses(
@@ -486,6 +506,50 @@ void main() {
       );
     });
 
+    test('canlı polkit kuralı sızmışsa doğrulama düşer', () async {
+      final fake = FakeCommandRunner(defaultSuccess: false);
+      fake.addResponse('test', ['-f', '/mnt/etc/fstab']);
+      fake.addResponse('test', ['-f', '/mnt/etc/kernel/cmdline']);
+      addLocalizationResponses(fake);
+      addBrandingResponse(fake);
+      fake.addResponse('sh', [
+        '-c',
+        'ls /mnt/boot/loader/entries/*.conf >/dev/null 2>&1',
+      ]);
+      addNoFedoraKernelResponse(fake);
+      addStableKernelResponse(fake);
+      addRoRepoResponses(fake);
+      addRoDesktopAppsResponses(fake);
+      addRoThemeResponses(fake);
+      fake.addResponse('test', ['!', '-e', '/mnt/usr/bin/ro-installer']);
+      fake.addResponse('test', ['!', '-e', '/mnt/usr/bin/ro_installer']);
+      fake.addResponse('test', [
+        '!',
+        '-e',
+        '/mnt/usr/libexec/ro-installer-launcher.sh',
+      ]);
+      fake.addResponse('test', [
+        '!',
+        '-e',
+        '/mnt/usr/share/polkit-1/actions/org.roasd.installer.policy',
+      ]);
+      fake.addResponse('test', [
+        '!',
+        '-e',
+        '/mnt/etc/polkit-1/rules.d/49-ro-installer-live.rules',
+      ], exitCode: 1);
+
+      final ctx = makeContext({
+        'fileSystem': 'ext4',
+        'partitionMethod': 'full',
+      }, fake);
+
+      final result = await const PostInstallValidationStage().execute(ctx);
+
+      expect(result.success, false);
+      expect(result.message, contains('Canlı oturum polkit kuralı'));
+    });
+
     test('Fedora stock kernel kalırsa stage düşer', () async {
       final fake = FakeCommandRunner(defaultSuccess: false);
       fake.addResponse('test', ['-f', '/mnt/etc/fstab']);
