Support hash in `gpgkey=` URLs

[DemiMarie]

Currently, DNF does not provide a reliable way to authenticate the contents of remote gpgkey= URLs. DNSSEC doesn’t always work (for instance, if libdnf is behind an HTTP proxy) and introduces substantial extra attack surface.

Fortunately, the fragment part of a URL can contain arbitrary data that is not sent to the server. In this case, libdnf can check a cryptographic hash against the downloaded data. One example would be gpgkey=http://example.com/something.gpg#sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU.

[Conan-Kudo]

Wouldn't it be easier to just add a gpgfingerprint= option so that we can have an array of fingerprints to match the array of gpg key files?

[DemiMarie]

These are not mutually exclusive. The hash has two major advantages:

• It works for all data, not just GPG keys.
• It protects against exploitable vulnerabilities in GPG’s public key parsers, such as a recent buffer overflow.

[DemiMarie]

To elaborate, parsing a general key is significantly more complex than parsing a signature, and is therefore more likely to have exploitable vulnerabilities. I would be fine with a gpgkeyhash= key, though.