pacman-key: rework importing distro/repo provided keyrings
The current --reload option, apart from being non-clear in its naming, is very limited in that only one keyring can be provided. A distribution may want to provide multiple keyrings for various subsets of its organisation or custom repo providers may also want to provide a keyring. This patch adds a --populate option that reads keyrings from (by default) /usr/share/pacman/keyrings. A keyring is named foo.gpg, with optional foo-revoked file providing a list of revoked key ids. These files are required to be signed (detached) by a key trusted by pacman-key, in practice probably by the key that signed the package providing these files. The --populate flag either updates the pacman keyring using all keyrings in the directory or individual keyrings can be specified. Signed-off-by: Allan McRae <allan@archlinux.org>
This commit is contained in:
Allan McRae
parent
2cfcc874b9
commit
d1240f67ea
3 changed files with 85 additions and 78 deletions
|
|
@ -80,8 +80,12 @@ Options
|
|||
*-r, \--receive* <keyserver> <keyid(s)>::
|
||||
Fetch the specified keyids from the specified key server URL.
|
||||
|
||||
*\--reload*::
|
||||
Reloads the keys from the keyring package.
|
||||
*\--populate* [<keyring(s)>]::
|
||||
Reload the default keys from the (optionally provided) keyrings in
|
||||
+{pkgdatadir}/keyrings+. Each keyring is provided in a file foo.gpg that
|
||||
contains the keys for the foo keyring. Optionally the file foo-revoked
|
||||
contains a list of revoked key IDs for that keyring. These files are
|
||||
required to be signed (detached) by a trusted PGP key.
|
||||
|
||||
*-u, \--updatedb*::
|
||||
Equivalent to \--check-trustdb in GnuPG.
|
||||
|
|
|
|||
|
|
@ -44,6 +44,7 @@ edit = sed \
|
|||
-e 's|@localedir[@]|$(localedir)|g' \
|
||||
-e 's|@sysconfdir[@]|$(sysconfdir)|g' \
|
||||
-e 's|@localstatedir[@]|$(localstatedir)|g' \
|
||||
-e 's|@pkgdatadir[@]|$(pkgdatadir)|g' \
|
||||
-e 's|@prefix[@]|$(prefix)|g' \
|
||||
-e '1s|!/bin/bash|!$(BASH_SHELL)|g' \
|
||||
-e 's|@PACKAGE_VERSION[@]|$(REAL_PACKAGE_VERSION)|g' \
|
||||
|
|
|
|||
|
|
@ -37,8 +37,8 @@ IMPORT_TRUSTDB=0
|
|||
INIT=0
|
||||
LISTKEYS=0
|
||||
LISTSIGS=0
|
||||
POPULATE=0
|
||||
RECEIVE=0
|
||||
RELOAD=0
|
||||
UPDATEDB=0
|
||||
VERIFY=0
|
||||
|
||||
|
|
@ -73,7 +73,8 @@ usage() {
|
|||
echo "$(gettext " --import-trustdb <dir(s)> Imports ownertrust values from trustdb.gpg in dir(s)")"
|
||||
echo "$(gettext " --init Ensure the keyring is properly initialized")"
|
||||
echo "$(gettext " --list-sigs [<keyid(s)>] List keys and their signatures")"
|
||||
echo "$(gettext " --reload Reload the default keys")"
|
||||
printf "$(gettext " --populate [<keyring(s)] Reload the default keys from the (given) keyrings\n\
|
||||
in '%s'")\n" "@pkgdatadir@/keyrings"
|
||||
}
|
||||
|
||||
version() {
|
||||
|
|
@ -139,75 +140,88 @@ check_keyring() {
|
|||
|
||||
verify_keyring_input() {
|
||||
local ret=0;
|
||||
local KEYRING_IMPORT_DIR='@pkgdatadir@/keyrings'
|
||||
|
||||
# Verify signatures of related files, if they exist
|
||||
if [[ -r "${ADDED_KEYS}" ]]; then
|
||||
msg "$(gettext "Verifying official keys file signature...")"
|
||||
if ! "${GPG_PACMAN[@]}" --verify "${ADDED_KEYS}.sig" &>/dev/null; then
|
||||
# Verify signatures of keyring files and association revocation files if they exist
|
||||
msg "$(gettext "Verifying keyring file signatures...")"
|
||||
local keyring
|
||||
for keyring in ${KEYRINGIDS[@]}; do
|
||||
if ! "${GPG_PACMAN[@]}" --verify "${KEYRING_IMPORT_DIR}/${keyring}.gpg.sig" &>/dev/null; then
|
||||
error "$(gettext "The signature of file %s is not valid.")" "${ADDED_KEYS}"
|
||||
ret=1
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ -r "${DEPRECATED_KEYS}" ]]; then
|
||||
msg "$(gettext "Verifying deprecated keys file signature...")"
|
||||
if ! "${GPG_PACMAN[@]}" --verify "${DEPRECATED_KEYS}.sig" &>/dev/null; then
|
||||
error "$(gettext "The signature of file %s is not valid.")" "${DEPRECATED_KEYS}"
|
||||
ret=1
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ -r "${REMOVED_KEYS}" ]]; then
|
||||
msg "$(gettext "Verifying deleted keys file signature...")"
|
||||
if ! "${GPG_PACMAN[@]}" --verify "${REMOVED_KEYS}.sig" &>/dev/null; then
|
||||
error "$(gettext "The signature of file %s is not valid.")" "${REMOVED_KEYS}"
|
||||
if [[ -f "${KEYRING_IMPORT_DIR}/${keyring}-revoked" ]]; then
|
||||
if ! "${GPG_PACMAN[@]}" --verify "${KEYRING_IMPORT_DIR}/${keyring}-revoked.sig" &>/dev/null; then
|
||||
error "$(gettext "The signature of file %s is not valid.")" "${KEYRING_IMPORT_DIR}/${keyring}-revoked"
|
||||
ret=1
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
return $ret
|
||||
}
|
||||
|
||||
reload_keyring() {
|
||||
local PACMAN_SHARE_DIR='@prefix@/share/pacman'
|
||||
local GPG_NOKEYRING=(gpg --batch --quiet --ignore-time-conflict --no-options --no-default-keyring --homedir ${PACMAN_KEYRING_DIR})
|
||||
populate_keyring() {
|
||||
local KEYRING_IMPORT_DIR='@pkgdatadir@/keyrings'
|
||||
local GPG_NOKEYRING=(gpg --batch --quiet --ignore-time-conflict --no-options --no-default-keyring --homedir ${PACMAN_KEYRING_DIR} --no-permission-warning)
|
||||
|
||||
local keyring
|
||||
local ret=0
|
||||
if [[ -z ${KEYRINGIDS[@]} ]]; then
|
||||
# get list of all available keyrings
|
||||
shopt -s nullglob
|
||||
KEYRINGIDS=("$KEYRING_IMPORT_DIR"/*.gpg)
|
||||
shopt -u nullglob
|
||||
KEYRINGIDS=("${KEYRINGIDS[@]##*/}")
|
||||
KEYRINGIDS=("${KEYRINGIDS[@]%.gpg}")
|
||||
if [[ -z ${KEYRINGIDS[@]} ]]; then
|
||||
error "$(gettext "No keyring files exist in %s.")" "$KEYRING_IMPORT_DIR"
|
||||
ret=1
|
||||
fi
|
||||
else
|
||||
# verify listed keyrings exist
|
||||
for keyring in ${KEYRINGIDS[@]}; do
|
||||
if [[ ! -f "$KEYRING_IMPORT_DIR/$keyring.gpg" ]]; then
|
||||
error "$(gettext "The keyring file %s does not exist.")" "$KEYRING_IMPORT_DIR/$keyring.gpg"
|
||||
ret=1
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
if (( ret )); then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
verify_keyring_input || exit 1
|
||||
|
||||
# Variable used for iterating on keyrings
|
||||
local key
|
||||
local key_id
|
||||
|
||||
# Keyring with keys to be added to the keyring
|
||||
local ADDED_KEYS="${PACMAN_SHARE_DIR}/addedkeys.gpg"
|
||||
|
||||
# Keyring with keys that were deprecated and will eventually be deleted
|
||||
local DEPRECATED_KEYS="${PACMAN_SHARE_DIR}/deprecatedkeys.gpg"
|
||||
|
||||
# List of keys removed from the keyring. This file is not a keyring, unlike the others.
|
||||
# It is a textual list of values that gpg recogniezes as identifiers for keys.
|
||||
local REMOVED_KEYS="${PACMAN_SHARE_DIR}/removedkeys"
|
||||
|
||||
verify_keyring_input || exit 1
|
||||
|
||||
# Read the key ids to an array. The conversion from whatever is inside the file
|
||||
# to key ids is important, because key ids are the only guarantee of identification
|
||||
# for the keys.
|
||||
local -A removed_ids
|
||||
if [[ -r "${REMOVED_KEYS}" ]]; then
|
||||
for keyring in ${KEYRINGIDS[@]}; do
|
||||
if [[ -f "${KEYRING_IMPORT_DIR}/${keyring}-revoked" ]]; then
|
||||
while read key; do
|
||||
local key_values name
|
||||
key_values="$("${GPG_PACMAN[@]}" --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5,10 --output-delimiter=' ')"
|
||||
# extract key ID (field 5) and the name of owner (field 10)
|
||||
key_values="$("${GPG_PACMAN[@]}" --quiet --with-colons --list-key "${key}" 2>/dev/null | grep ^pub | cut -d: -f5,10 --output-delimiter=' ')"
|
||||
if [[ -n $key_values ]]; then
|
||||
# The first word is the key_id
|
||||
key_id="${key_values%% *}"
|
||||
# the rest if the name of the owner
|
||||
# the rest is the name of the owner
|
||||
name="${key_values#* }"
|
||||
if [[ -n ${key_id} ]]; then
|
||||
# Mark this key to be deleted
|
||||
removed_ids[$key_id]="$name"
|
||||
fi
|
||||
fi
|
||||
done < "${REMOVED_KEYS}"
|
||||
done < "${KEYRING_IMPORT_DIR}/${keyring}-revoked"
|
||||
fi
|
||||
done
|
||||
|
||||
# List of keys that must be kept installed, even if in the list of keys to be removed
|
||||
local HOLD_KEYS="$(get_from "$CONFIG" "HoldKeys")"
|
||||
|
|
@ -222,33 +236,21 @@ reload_keyring() {
|
|||
done
|
||||
fi
|
||||
|
||||
# Add keys from the current set of keys from pacman-keyring package. The web of trust will
|
||||
# be updated automatically.
|
||||
if [[ -r "${ADDED_KEYS}" ]]; then
|
||||
msg "$(gettext "Appending official keys...")"
|
||||
local add_keys="$("${GPG_NOKEYRING[@]}" --keyring "${ADDED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5)"
|
||||
# Add keys from requested keyrings
|
||||
for keyring in ${KEYRINGIDS[@]}; do
|
||||
msg "$(gettext "Appending keys from %s.gpg...")" "$keyring"
|
||||
local add_keys="$("${GPG_NOKEYRING[@]}" --keyring "${KEYRING_IMPORT_DIR}/${keyring}.gpg" --with-colons --list-keys | grep ^pub | cut -d: -f5)"
|
||||
for key_id in ${add_keys}; do
|
||||
# There is no point in adding a key that will be deleted right after
|
||||
if [[ -z "${removed_ids[$key_id]}" ]]; then
|
||||
"${GPG_NOKEYRING[@]}" --keyring "${ADDED_KEYS}" --export "${key_id}" | "${GPG_PACMAN[@]}" --import
|
||||
"${GPG_NOKEYRING[@]}" --keyring "${KEYRING_IMPORT_DIR}/${keyring}.gpg" --export "${key_id}" | "${GPG_PACMAN[@]}" --import
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ -r "${DEPRECATED_KEYS}" ]]; then
|
||||
msg "$(gettext "Appending deprecated keys...")"
|
||||
local add_keys="$("${GPG_NOKEYRING[@]}" --keyring "${DEPRECATED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5)"
|
||||
for key_id in ${add_keys}; do
|
||||
# There is no point in adding a key that will be deleted right after
|
||||
if [[ -z "${removed_ids[$key_id]}" ]]; then
|
||||
"${GPG_NOKEYRING[@]}" --keyring "${DEPRECATED_KEYS}" --export "${key_id}" | "${GPG_PACMAN[@]}" --import
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
# Remove the keys not marked to keep
|
||||
if (( ${#removed_ids[@]} > 0 )); then
|
||||
msg "$(gettext "Removing deleted keys from keyring...")"
|
||||
msg "$(gettext "Removing revoked keys from keyring...")"
|
||||
for key_id in "${!removed_ids[@]}"; do
|
||||
echo " removing key $key_id - ${removed_ids[$key_id]}"
|
||||
"${GPG_PACMAN[@]}" --quiet --batch --yes --delete-key "${key_id}"
|
||||
|
|
@ -321,8 +323,8 @@ fi
|
|||
|
||||
OPT_SHORT="a::d:e:f::hl::r:uv:V"
|
||||
OPT_LONG="add::,config:,delete:,edit-key:,export::,finger::,gpgdir:"
|
||||
OPT_LONG+=",help,import:,import-trustdb:,init,list-keys::,list-sigs::,,receive:"
|
||||
OPT_LONG+=",reload,updatedb,verify:,version"
|
||||
OPT_LONG+=",help,import:,import-trustdb:,init,list-keys::,list-sigs::"
|
||||
OPT_LONG+=",populate::,receive:,updatedb,verify:,version"
|
||||
if ! OPT_TEMP="$(parse_options $OPT_SHORT $OPT_LONG "$@")"; then
|
||||
echo; usage; exit 1 # E_INVALID_OPTION;
|
||||
fi
|
||||
|
|
@ -348,8 +350,8 @@ while true; do
|
|||
--init) INIT=1 ;;
|
||||
-l|--list-keys) LISTKEYS=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
|
||||
--list-sigs) LISTSIGS=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
|
||||
--populate) POPULATE=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYRINGIDS=($1) ;;
|
||||
-r|--receive) RECEIVE=1; shift; TMP=($1); KEYSERVER=${TMP[0]}; KEYIDS=(${TMP[@]:1}); unset TMP;;
|
||||
--reload) RELOAD=1 ;;
|
||||
-u|--updatedb) UPDATEDB=1 ;;
|
||||
-v|--verify) VERIFY=1; shift; SIGNATURE=$1 ;;
|
||||
|
||||
|
|
@ -368,7 +370,7 @@ if ! type -p gpg >/dev/null; then
|
|||
exit 1
|
||||
fi
|
||||
|
||||
if (( (ADD || DELETE || EDITKEY || IMPORT || IMPORT_TRUSTDB || INIT || RECEIVE || RELOAD || UPDATEDB) && EUID != 0 )); then
|
||||
if (( (ADD || DELETE || EDITKEY || IMPORT || IMPORT_TRUSTDB || INIT || POPULATE || RECEIVE || UPDATEDB) && EUID != 0 )); then
|
||||
error "$(gettext "%s needs to be run as root for this operation.")" "pacman-key"
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -387,7 +389,7 @@ GPG_PACMAN=(gpg --homedir ${PACMAN_KEYRING_DIR} --no-permission-warning)
|
|||
|
||||
# check only a single operation has been given
|
||||
numopt=$(( ADD + DELETE + EDITKEY + EXPORT + FINGER + IMPORT + IMPORT_TRUSTDB +
|
||||
INIT + LISTKEYS + LISTSIGS + RECEIVE + RELOAD + UPDATEDB + VERIFY ))
|
||||
INIT + LISTKEYS + LISTSIGS + POPULATE + RECEIVE + UPDATEDB + VERIFY ))
|
||||
|
||||
case $numopt in
|
||||
0)
|
||||
|
|
@ -413,8 +415,8 @@ esac
|
|||
(( INIT )) && initialize
|
||||
(( LISTKEYS )) && "${GPG_PACMAN[@]}" --batch --list-keys "${KEYIDS[@]}"
|
||||
(( LISTSIGS )) && "${GPG_PACMAN[@]}" --batch --list-sigs "${KEYIDS[@]}"
|
||||
(( POPULATE )) && populate_keyring
|
||||
(( RECEIVE )) && receive_keys
|
||||
(( RELOAD )) && reload_keyring
|
||||
(( UPDATEDB )) && "${GPG_PACMAN[@]}" --batch --check-trustdb
|
||||
(( VERIFY )) && "${GPG_PACMAN[@]}" --verify $SIGNATURE
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue