710e83999b
The optimization of only importing keys that were not to be later revoked was a not smart enough. For example, if a key was in both a repos keyring and its revoke list, alternate runs of pacman-key --populate would add then remove the key from the pacman keyring. This problem is made worse when considering the possibility of multiple keyrings being imported. Instead, import all keys followed by the revoking of all keys. This may result in a key being added then revoked, but that is not much of an issue given that is a very fast operation. Signed-off-by: Allan McRae <allan@archlinux.org>
420 lines
14 KiB
Bash
420 lines
14 KiB
Bash
#!/bin/bash -e
|
|
#
|
|
# pacman-key - manages pacman's keyring
|
|
# Based on apt-key, from Debian
|
|
# @configure_input@
|
|
#
|
|
# Copyright (c) 2010-2011 Pacman Development Team <pacman-dev@archlinux.org>
|
|
#
|
|
# This program is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation; either version 2 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
#
|
|
|
|
# gettext initialization
|
|
export TEXTDOMAIN='pacman-scripts'
|
|
export TEXTDOMAINDIR='@localedir@'
|
|
|
|
myver="@PACKAGE_VERSION@"
|
|
|
|
# Options
|
|
ADD=0
|
|
DELETE=0
|
|
EDITKEY=0
|
|
EXPORT=0
|
|
FINGER=0
|
|
IMPORT=0
|
|
IMPORT_TRUSTDB=0
|
|
INIT=0
|
|
LISTKEYS=0
|
|
LISTSIGS=0
|
|
POPULATE=0
|
|
RECEIVE=0
|
|
UPDATEDB=0
|
|
VERIFY=0
|
|
|
|
m4_include(library/output_format.sh)
|
|
|
|
m4_include(library/parse_options.sh)
|
|
|
|
usage() {
|
|
printf "pacman-key (pacman) %s\n" ${myver}
|
|
echo
|
|
printf "$(gettext "Usage: %s [options]")\n" $(basename $0)
|
|
echo
|
|
printf "$(gettext "Manage pacman\'s list of trusted keys")\n"
|
|
echo
|
|
echo "$(gettext "Options:")"
|
|
echo "$(gettext " -a, --add [<file(s)>] Add the specified keys (empty for stdin)")"
|
|
echo "$(gettext " -d, --delete <keyid(s)> Remove the specified keyids")"
|
|
echo "$(gettext " -e, --export [<keyid(s)>] Export the specified or all keyids")"
|
|
echo "$(gettext " -f, --finger [<keyid(s)>] List fingerprint for specified or all keyids")"
|
|
echo "$(gettext " -h, --help Show this help message and exit")"
|
|
echo "$(gettext " -l, --list-keys [<keyid(s)>] List the specified or all keys")"
|
|
echo "$(gettext " -r, --receive <keyserver> <keyid(s)> Fetch the specified keyids")"
|
|
echo "$(gettext " -u, --updatedb Update the trustdb of pacman")"
|
|
echo "$(gettext " -v, --verify <signature> Verify the file specified by the signature")"
|
|
echo "$(gettext " -V, --version Show program version")"
|
|
printf "$(gettext " --config <file> Use an alternate config file (instead of\n\
|
|
'%s')")\n" "@sysconfdir@/pacman.conf"
|
|
echo "$(gettext " --edit-key <keyid(s)> Present a menu for key management task on keyids")"
|
|
printf "$(gettext " --gpgdir <dir> Set an alternate directory for GnuPG (instead\n\
|
|
of '%s')")\n" "@sysconfdir@/pacman.d/gnupg"
|
|
echo "$(gettext " --import <dir(s)> Imports pubring.gpg and trustdb.gpg from dir(s)")"
|
|
echo "$(gettext " --import-trustdb <dir(s)> Imports ownertrust values from trustdb.gpg in dir(s)")"
|
|
echo "$(gettext " --init Ensure the keyring is properly initialized")"
|
|
echo "$(gettext " --list-sigs [<keyid(s)>] List keys and their signatures")"
|
|
printf "$(gettext " --populate [<keyring(s)] Reload the default keys from the (given) keyrings\n\
|
|
in '%s'")\n" "@pkgdatadir@/keyrings"
|
|
}
|
|
|
|
version() {
|
|
printf "pacman-key (pacman) %s\n" "${myver}"
|
|
printf "$(gettext "\
|
|
Copyright (c) 2010-2011 Pacman Development Team <pacman-dev@archlinux.org>.\n\
|
|
This is free software; see the source for copying conditions.\n\
|
|
There is NO WARRANTY, to the extent permitted by law.\n")"
|
|
}
|
|
|
|
# read the config file "$1" which has key=value pairs, and return the key which
|
|
# matches "$2". the equals sign between pairs may be surrounded by any amount
|
|
# of whitespace.
|
|
get_from() {
|
|
while IFS='=' read -r key value; do
|
|
[[ -z $key || ${key:0:1} = '#' ]] && continue
|
|
|
|
if [[ ${key%% *} = "$2" && -n ${value##* } ]]; then
|
|
echo "${value##* }"
|
|
return 0
|
|
fi
|
|
done < "$1"
|
|
return 1
|
|
}
|
|
|
|
initialize() {
|
|
# Check for simple existence rather than for a directory as someone
|
|
# may want to use a symlink here
|
|
[[ -e ${PACMAN_KEYRING_DIR} ]] || mkdir -p -m 755 "${PACMAN_KEYRING_DIR}"
|
|
|
|
# keyring files
|
|
[[ -f ${PACMAN_KEYRING_DIR}/pubring.gpg ]] || touch ${PACMAN_KEYRING_DIR}/pubring.gpg
|
|
[[ -f ${PACMAN_KEYRING_DIR}/secring.gpg ]] || touch ${PACMAN_KEYRING_DIR}/secring.gpg
|
|
[[ -f ${PACMAN_KEYRING_DIR}/trustdb.gpg ]] || "${GPG_PACMAN[@]}" --update-trustdb
|
|
chmod 644 ${PACMAN_KEYRING_DIR}/{{pub,sec}ring,trustdb}.gpg
|
|
|
|
# gpg.conf
|
|
[[ -f ${PACMAN_KEYRING_DIR}/gpg.conf ]] || touch ${PACMAN_KEYRING_DIR}/gpg.conf
|
|
chmod 644 ${PACMAN_KEYRING_DIR}/gpg.conf
|
|
if ! grep -w -q "lock-never" ${PACMAN_KEYRING_DIR}/gpg.conf &>/dev/null; then
|
|
echo "lock-never" >> ${PACMAN_KEYRING_DIR}/gpg.conf
|
|
fi
|
|
}
|
|
|
|
check_keyring() {
|
|
if [[ ! -r ${PACMAN_KEYRING_DIR}/pubring.gpg || \
|
|
! -r ${PACMAN_KEYRING_DIR}/secring.gpg || \
|
|
! -r ${PACMAN_KEYRING_DIR}/trustdb.gpg ]]; then
|
|
error "$(gettext "You do not have sufficient permissions to read the %s keyring...")" "pacman"
|
|
msg "$(gettext "Use '%s' to correct the keyring permissions.")" "pacman-key --init"
|
|
exit 1
|
|
fi
|
|
|
|
if (( (EXPORT || FINGER || LIST || VERIFY) && EUID != 0 )); then
|
|
if ! grep -w -q "lock-never" ${PACMAN_KEYRING_DIR}/gpg.conf &>/dev/null; then
|
|
error "$(gettext "You do not have sufficient permissions to run this command...")"
|
|
msg "$(gettext "Use '%s' to correct the keyring permissions.")" "pacman-key --init"
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
}
|
|
|
|
verify_keyring_input() {
|
|
local ret=0;
|
|
local KEYRING_IMPORT_DIR='@pkgdatadir@/keyrings'
|
|
|
|
# Verify signatures of keyring files and association revocation files if they exist
|
|
msg "$(gettext "Verifying keyring file signatures...")"
|
|
local keyring
|
|
for keyring in ${KEYRINGIDS[@]}; do
|
|
if ! "${GPG_PACMAN[@]}" --verify "${KEYRING_IMPORT_DIR}/${keyring}.gpg.sig" &>/dev/null; then
|
|
error "$(gettext "The signature of file %s is not valid.")" "${ADDED_KEYS}"
|
|
ret=1
|
|
fi
|
|
|
|
if [[ -f "${KEYRING_IMPORT_DIR}/${keyring}-revoked" ]]; then
|
|
if ! "${GPG_PACMAN[@]}" --verify "${KEYRING_IMPORT_DIR}/${keyring}-revoked.sig" &>/dev/null; then
|
|
error "$(gettext "The signature of file %s is not valid.")" "${KEYRING_IMPORT_DIR}/${keyring}-revoked"
|
|
ret=1
|
|
fi
|
|
fi
|
|
done
|
|
|
|
return $ret
|
|
}
|
|
|
|
populate_keyring() {
|
|
local KEYRING_IMPORT_DIR='@pkgdatadir@/keyrings'
|
|
local GPG_NOKEYRING=(gpg --batch --quiet --ignore-time-conflict --no-options --no-default-keyring --homedir ${PACMAN_KEYRING_DIR} --no-permission-warning)
|
|
|
|
local keyring
|
|
local ret=0
|
|
if [[ -z ${KEYRINGIDS[@]} ]]; then
|
|
# get list of all available keyrings
|
|
shopt -s nullglob
|
|
KEYRINGIDS=("$KEYRING_IMPORT_DIR"/*.gpg)
|
|
shopt -u nullglob
|
|
KEYRINGIDS=("${KEYRINGIDS[@]##*/}")
|
|
KEYRINGIDS=("${KEYRINGIDS[@]%.gpg}")
|
|
if [[ -z ${KEYRINGIDS[@]} ]]; then
|
|
error "$(gettext "No keyring files exist in %s.")" "$KEYRING_IMPORT_DIR"
|
|
ret=1
|
|
fi
|
|
else
|
|
# verify listed keyrings exist
|
|
for keyring in ${KEYRINGIDS[@]}; do
|
|
if [[ ! -f "$KEYRING_IMPORT_DIR/$keyring.gpg" ]]; then
|
|
error "$(gettext "The keyring file %s does not exist.")" "$KEYRING_IMPORT_DIR/$keyring.gpg"
|
|
ret=1
|
|
fi
|
|
done
|
|
fi
|
|
|
|
if (( ret )); then
|
|
exit 1
|
|
fi
|
|
|
|
verify_keyring_input || exit 1
|
|
|
|
# Variable used for iterating on keyrings
|
|
local key
|
|
local key_id
|
|
|
|
# Add keys from requested keyrings
|
|
for keyring in ${KEYRINGIDS[@]}; do
|
|
msg "$(gettext "Appending keys from %s.gpg...")" "$keyring"
|
|
local add_keys="$("${GPG_NOKEYRING[@]}" --keyring "${KEYRING_IMPORT_DIR}/${keyring}.gpg" --with-colons --list-keys | grep ^pub | cut -d: -f5)"
|
|
for key_id in ${add_keys}; do
|
|
"${GPG_NOKEYRING[@]}" --keyring "${KEYRING_IMPORT_DIR}/${keyring}.gpg" --export "${key_id}" | "${GPG_PACMAN[@]}" --import
|
|
done
|
|
done
|
|
|
|
# Read the revoked key IDs to an array. The conversion from whatever is inside the file
|
|
# to key ids is important, because key ids are the only guarantee of identification
|
|
# for the keys.
|
|
local -A removed_ids
|
|
for keyring in ${KEYRINGIDS[@]}; do
|
|
if [[ -f "${KEYRING_IMPORT_DIR}/${keyring}-revoked" ]]; then
|
|
while read key; do
|
|
local key_values name
|
|
# extract key ID (field 5) and the name of owner (field 10)
|
|
key_values="$("${GPG_PACMAN[@]}" --quiet --with-colons --list-key "${key}" 2>/dev/null | grep ^pub | cut -d: -f5,10 --output-delimiter=' ')"
|
|
if [[ -n $key_values ]]; then
|
|
# The first word is the key_id
|
|
key_id="${key_values%% *}"
|
|
# the rest is the name of the owner
|
|
name="${key_values#* }"
|
|
if [[ -n ${key_id} ]]; then
|
|
# Mark this key to be deleted
|
|
removed_ids[$key_id]="$name"
|
|
fi
|
|
fi
|
|
done < "${KEYRING_IMPORT_DIR}/${keyring}-revoked"
|
|
fi
|
|
done
|
|
|
|
# List of keys that must be kept installed, even if in the list of keys to be removed
|
|
local HOLD_KEYS="$(get_from "$CONFIG" "HoldKeys")"
|
|
|
|
# Remove the keys that must be kept from the set of keys that should be removed
|
|
if [[ -n ${HOLD_KEYS} ]]; then
|
|
for key in ${HOLD_KEYS}; do
|
|
key_id="$("${GPG_PACMAN[@]}" --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5)"
|
|
if [[ -n "${removed_ids[$key_id]}" ]]; then
|
|
unset removed_ids[$key_id]
|
|
fi
|
|
done
|
|
fi
|
|
|
|
# Remove the keys not marked to keep
|
|
if (( ${#removed_ids[@]} > 0 )); then
|
|
msg "$(gettext "Removing revoked keys from keyring...")"
|
|
for key_id in "${!removed_ids[@]}"; do
|
|
echo " removing key $key_id - ${removed_ids[$key_id]}"
|
|
"${GPG_PACMAN[@]}" --quiet --batch --yes --delete-key "${key_id}"
|
|
done
|
|
fi
|
|
|
|
# Update trustdb, just to be sure
|
|
msg "$(gettext "Updating trust database...")"
|
|
"${GPG_PACMAN[@]}" --batch --check-trustdb
|
|
}
|
|
|
|
receive_keys() {
|
|
if [[ -z ${KEYIDS[@]} ]]; then
|
|
error "$(gettext "You need to specify the keyserver and at least one key identifier")"
|
|
exit 1
|
|
fi
|
|
"${GPG_PACMAN[@]}" --keyserver "$KEYSERVER" --recv-keys "${KEYIDS[@]}"
|
|
}
|
|
|
|
edit_keys() {
|
|
local errors=0;
|
|
for key in ${KEYIDS[@]}; do
|
|
# Verify if the key exists in pacman's keyring
|
|
if ! "${GPG_PACMAN[@]}" --list-keys "$key" &>/dev/null; then
|
|
error "$(gettext "The key identified by %s does not exist")" "$key"
|
|
errors=1;
|
|
fi
|
|
done
|
|
(( errors )) && exit 1;
|
|
|
|
for key in ${KEYIDS[@]}; do
|
|
"${GPG_PACMAN[@]}" --edit-key "$key"
|
|
done
|
|
}
|
|
|
|
import_trustdb() {
|
|
local importdir
|
|
local trustdb=$(mktemp)
|
|
"${GPG_PACMAN[@]}" --export-ownertrust > ${trustdb}
|
|
|
|
for importdir in "${IMPORT_DIRS[@]}"; do
|
|
if [[ -f "${importdir}/trustdb.gpg" ]]; then
|
|
gpg --homedir "${importdir}" --export-ownertrust >> ${trustdb}
|
|
fi
|
|
done
|
|
|
|
"${GPG_PACMAN[@]}" --import-ownertrust ${trustdb}
|
|
rm -f ${trustdb}
|
|
}
|
|
|
|
import() {
|
|
local importdir
|
|
|
|
# Imports public keys, then import trustdbs
|
|
for importdir in "${IMPORT_DIRS[@]}"; do
|
|
if [[ -f "${importdir}/pubring.gpg" ]]; then
|
|
"${GPG_PACMAN[@]}" --quiet --batch --import "${importdir}/pubring.gpg"
|
|
fi
|
|
done
|
|
|
|
import_trustdb
|
|
}
|
|
|
|
# PROGRAM START
|
|
if ! type gettext &>/dev/null; then
|
|
gettext() {
|
|
echo "$@"
|
|
}
|
|
fi
|
|
|
|
OPT_SHORT="a::d:e:f::hl::r:uv:V"
|
|
OPT_LONG="add::,config:,delete:,edit-key:,export::,finger::,gpgdir:"
|
|
OPT_LONG+=",help,import:,import-trustdb:,init,list-keys::,list-sigs::"
|
|
OPT_LONG+=",populate::,receive:,updatedb,verify:,version"
|
|
if ! OPT_TEMP="$(parse_options $OPT_SHORT $OPT_LONG "$@")"; then
|
|
echo; usage; exit 1 # E_INVALID_OPTION;
|
|
fi
|
|
eval set -- "$OPT_TEMP"
|
|
unset OPT_SHORT OPT_LONG OPT_TEMP
|
|
|
|
if [[ $1 == "--" ]]; then
|
|
usage;
|
|
exit 0;
|
|
fi
|
|
|
|
while true; do
|
|
case "$1" in
|
|
-a|--add) ADD=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYFILES=($1) ;;
|
|
--config) shift; CONFIG=$1 ;;
|
|
-d|--delete) DELETE=1; shift; KEYIDS=($1) ;;
|
|
--edit-key) EDITKEY=1; shift; KEYIDS=($1) ;;
|
|
-e|--export) EXPORT=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
|
|
-f|--finger) FINGER=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
|
|
--gpgdir) shift; PACMAN_KEYRING_DIR=$1 ;;
|
|
--import) IMPORT=1; shift; IMPORT_DIRS=($1) ;;
|
|
--import-trustdb) IMPORT_TRUSTDB=1; shift; IMPORT_DIRS=($1) ;;
|
|
--init) INIT=1 ;;
|
|
-l|--list-keys) LISTKEYS=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
|
|
--list-sigs) LISTSIGS=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
|
|
--populate) POPULATE=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYRINGIDS=($1) ;;
|
|
-r|--receive) RECEIVE=1; shift; TMP=($1); KEYSERVER=${TMP[0]}; KEYIDS=(${TMP[@]:1}); unset TMP;;
|
|
-u|--updatedb) UPDATEDB=1 ;;
|
|
-v|--verify) VERIFY=1; shift; SIGNATURE=$1 ;;
|
|
|
|
-h|--help) usage; exit 0 ;;
|
|
-V|--version) version; exit 0 ;;
|
|
|
|
--) OPT_IND=0; shift; break;;
|
|
*) usage; exit 1 ;;
|
|
esac
|
|
shift
|
|
done
|
|
|
|
|
|
if ! type -p gpg >/dev/null; then
|
|
error "$(gettext "Cannot find the %s binary required for all %s operations.")" "gpg" "pacman-key"
|
|
exit 1
|
|
fi
|
|
|
|
if (( (ADD || DELETE || EDITKEY || IMPORT || IMPORT_TRUSTDB || INIT || POPULATE || RECEIVE || UPDATEDB) && EUID != 0 )); then
|
|
error "$(gettext "%s needs to be run as root for this operation.")" "pacman-key"
|
|
exit 1
|
|
fi
|
|
|
|
CONFIG=${CONFIG:-@sysconfdir@/pacman.conf}
|
|
if [[ ! -r "${CONFIG}" ]]; then
|
|
error "$(gettext "%s configuration file '%s' not found.")" "pacman" "$CONFIG"
|
|
exit 1
|
|
fi
|
|
|
|
# if PACMAN_KEYRING_DIR isn't assigned, try to get it from the config
|
|
# file, falling back on a hard default
|
|
PACMAN_KEYRING_DIR=${PACMAN_KEYRING_DIR:-$(get_from "$CONFIG" "GPGDir" || echo "@sysconfdir@/pacman.d/gnupg")}
|
|
|
|
GPG_PACMAN=(gpg --homedir ${PACMAN_KEYRING_DIR} --no-permission-warning)
|
|
|
|
# check only a single operation has been given
|
|
numopt=$(( ADD + DELETE + EDITKEY + EXPORT + FINGER + IMPORT + IMPORT_TRUSTDB +
|
|
INIT + LISTKEYS + LISTSIGS + POPULATE + RECEIVE + UPDATEDB + VERIFY ))
|
|
|
|
case $numopt in
|
|
0)
|
|
error "$(gettext "no operation specified (use -h for help)")"
|
|
exit 1
|
|
;;
|
|
[!1])
|
|
error "$(gettext "Multiple operations specified")"
|
|
printf "$(gettext "Please run %s with each operation separately\n")" "pacman-key"
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
(( ! INIT )) && check_keyring
|
|
|
|
(( ADD )) && "${GPG_PACMAN[@]}" --quiet --batch --import "${KEYFILES[@]}"
|
|
(( DELETE )) && "${GPG_PACMAN[@]}" --quiet --batch --delete-key --yes "${KEYIDS[@]}"
|
|
(( EDITKEY )) && edit_keys
|
|
(( EXPORT )) && "${GPG_PACMAN[@]}" --armor --export "${KEYIDS[@]}"
|
|
(( FINGER )) && "${GPG_PACMAN[@]}" --batch --fingerprint "${KEYIDS[@]}"
|
|
(( IMPORT )) && import
|
|
(( IMPORT_TRUSTDB)) && import_trustdb
|
|
(( INIT )) && initialize
|
|
(( LISTKEYS )) && "${GPG_PACMAN[@]}" --batch --list-keys "${KEYIDS[@]}"
|
|
(( LISTSIGS )) && "${GPG_PACMAN[@]}" --batch --list-sigs "${KEYIDS[@]}"
|
|
(( POPULATE )) && populate_keyring
|
|
(( RECEIVE )) && receive_keys
|
|
(( UPDATEDB )) && "${GPG_PACMAN[@]}" --batch --check-trustdb
|
|
(( VERIFY )) && "${GPG_PACMAN[@]}" --verify $SIGNATURE
|
|
|
|
# vim: set ts=2 sw=2 noet:
|