From 43896ea67d3a206f0be5643d35e2fc90ab8a600b Mon Sep 17 00:00:00 2001
From: brent s <bts@square-r00t.net>
Date: Wed, 18 Dec 2019 09:12:10 -0500
Subject: [PATCH] tighten up some restrictions

---
 schema/lib/types/cksum.xsd | 7 ++++---
 schema/lib/types/gpg.xsd   | 3 ++-
 schema/lib/types/sys.xsd   | 9 +++++++--
 3 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/schema/lib/types/cksum.xsd b/schema/lib/types/cksum.xsd
index 128dd76..59f637f 100644
--- a/schema/lib/types/cksum.xsd
+++ b/schema/lib/types/cksum.xsd
@@ -66,10 +66,11 @@
     </xs:complexType>
 
     <xs:complexType name="t_cksum_verify">
-        <xs:sequence>
-            <xs:element name="checksum" minOccurs="0" maxOccurs="unbounded" type="t_cksum_hash"/>
+        <xs:choice minOccurs="1" maxOccurs="unbounded">
+            <xs:element name="checksum" minOccurs="0" maxOccurs="unbounded" type="t_cksum_hash">
+            </xs:element>
             <xs:element name="checksumFile" minOccurs="0" maxOccurs="unbounded" type="t_cksum_file"/>
-        </xs:sequence>
+        </xs:choice>
     </xs:complexType>
 
 </xs:schema>
diff --git a/schema/lib/types/gpg.xsd b/schema/lib/types/gpg.xsd
index 1c8e2c0..563f6bb 100644
--- a/schema/lib/types/gpg.xsd
+++ b/schema/lib/types/gpg.xsd
@@ -8,7 +8,7 @@
 
     <xs:simpleType name="t_gpg_key_id">
         <xs:restriction base="xs:string">
-            <xs:pattern value="(auto|default)"/><!-- Program should accept any key IDs it finds (INSECURE) -->
+            <xs:pattern value="auto"/><!-- Program should use hardcoded default (POSSIBLY INSECURE) -->
             <xs:pattern value="\s*(0x)?[0-9A-Fa-f]{40}\s*"/><!-- Full key ID -->
             <xs:pattern value="\s*(0x)?[0-9A-Fa-f]{16}\s*"/><!-- Shorthand key ID ("keyid-format long") -->
             <xs:pattern value="\s*(0x)?[0-9A-Fa-f]{8}\s*"/><!-- Legacy shorter shorthand ("keyid-format short") -->
@@ -26,6 +26,7 @@
             <xs:element name="keyID" minOccurs="0" maxOccurs="unbounded" type="t_gpg_key_id"/>
             <xs:element name="keyFile" minOccurs="0" maxOccurs="unbounded" type="t_net_generic_resource"/>
         </xs:choice>
+        <xs:attribute name="detect" use="optional" default="false" type="xs:boolean"/>
     </xs:complexType>
 
     <xs:simpleType name="t_gpg_sig">
diff --git a/schema/lib/types/sys.xsd b/schema/lib/types/sys.xsd
index 092e79b..6e34b2e 100644
--- a/schema/lib/types/sys.xsd
+++ b/schema/lib/types/sys.xsd
@@ -18,9 +18,14 @@
 
     <xs:complexType name="t_sys_verifyfile">
         <xs:choice minOccurs="1" maxOccurs="2">
-            <xs:element name="gpg" minOccurs="0" maxOccurs="1" type="t_gpg_verify">
+            <xs:element name="gpg" minOccurs="0" maxOccurs="1" type="t_gpg_verify"/>
+            <xs:element name="hash" minOccurs="0" maxOccurs="1" type="t_cksum_verify">
+                <xs:unique name="uniq_cksum_value_attr">
+                    <xs:selector xpath="checksum"/>
+                    <xs:field xpath="@hashType"/>
+                    <xs:field xpath="."/>
+                </xs:unique>
             </xs:element>
-            <xs:element name="hash" minOccurs="0" maxOccurs="1" type="t_cksum_verify"/>
         </xs:choice>
     </xs:complexType>