2011-09-30 06:07:55 -04:00
|
|
|
#!/bin/bash
|
2010-09-15 23:40:35 -04:00
|
|
|
#
|
|
|
|
# pacman-key - manages pacman's keyring
|
|
|
|
# Based on apt-key, from Debian
|
|
|
|
# @configure_input@
|
|
|
|
#
|
2016-01-02 22:48:43 -05:00
|
|
|
# Copyright (c) 2010-2016 Pacman Development Team <pacman-dev@archlinux.org>
|
2010-09-15 23:40:35 -04:00
|
|
|
#
|
|
|
|
# This program is free software; you can redistribute it and/or modify
|
|
|
|
# it under the terms of the GNU General Public License as published by
|
|
|
|
# the Free Software Foundation; either version 2 of the License, or
|
|
|
|
# (at your option) any later version.
|
|
|
|
#
|
|
|
|
# This program is distributed in the hope that it will be useful,
|
|
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
# GNU General Public License for more details.
|
|
|
|
#
|
|
|
|
# You should have received a copy of the GNU General Public License
|
|
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
#
|
|
|
|
|
|
|
|
# gettext initialization
|
2011-06-23 22:21:51 -04:00
|
|
|
export TEXTDOMAIN='pacman-scripts'
|
2010-09-15 23:40:35 -04:00
|
|
|
export TEXTDOMAINDIR='@localedir@'
|
|
|
|
|
2011-12-06 16:29:33 -05:00
|
|
|
declare -r myver="@PACKAGE_VERSION@"
|
2010-09-15 23:40:35 -04:00
|
|
|
|
2016-10-10 04:47:38 -04:00
|
|
|
LIBRARY=${LIBRARY:-'@libmakepkgdir@'}
|
|
|
|
|
|
|
|
# Import parseopts.sh
|
|
|
|
source "$LIBRARY"/util/parseopts.sh
|
|
|
|
|
2011-07-05 13:05:08 -04:00
|
|
|
# Options
|
|
|
|
ADD=0
|
|
|
|
DELETE=0
|
2011-07-08 07:14:53 -04:00
|
|
|
EDITKEY=0
|
2011-07-05 13:05:08 -04:00
|
|
|
EXPORT=0
|
|
|
|
FINGER=0
|
2011-07-19 08:52:07 -04:00
|
|
|
IMPORT=0
|
|
|
|
IMPORT_TRUSTDB=0
|
2011-07-09 03:26:17 -04:00
|
|
|
INIT=0
|
2011-09-01 16:20:53 -04:00
|
|
|
KEYSERVER=''
|
2011-07-29 22:24:46 -04:00
|
|
|
LISTKEYS=0
|
|
|
|
LISTSIGS=0
|
2011-08-29 13:52:51 -04:00
|
|
|
LSIGNKEY=0
|
2011-08-15 08:51:58 -04:00
|
|
|
POPULATE=0
|
2011-07-05 13:05:08 -04:00
|
|
|
RECEIVE=0
|
2011-09-01 16:29:25 -04:00
|
|
|
REFRESH=0
|
2011-07-05 13:05:08 -04:00
|
|
|
UPDATEDB=0
|
2013-03-04 03:23:31 -05:00
|
|
|
USE_COLOR='y'
|
2011-07-08 21:41:04 -04:00
|
|
|
VERIFY=0
|
2011-07-05 13:05:08 -04:00
|
|
|
|
2012-03-27 21:55:39 -04:00
|
|
|
DEFAULT_KEYSERVER='hkp://pool.sks-keyservers.net'
|
2011-09-01 16:20:53 -04:00
|
|
|
|
2011-06-09 06:43:25 -04:00
|
|
|
m4_include(library/output_format.sh)
|
2010-09-15 23:40:35 -04:00
|
|
|
|
|
|
|
usage() {
|
|
|
|
printf "pacman-key (pacman) %s\n" ${myver}
|
|
|
|
echo
|
2012-04-08 14:51:28 -04:00
|
|
|
printf -- "$(gettext "Usage: %s [options] operation [targets]")\n" $(basename $0)
|
2010-09-15 23:40:35 -04:00
|
|
|
echo
|
2012-01-23 17:14:25 -05:00
|
|
|
printf -- "$(gettext "Manage pacman's list of trusted keys")\n"
|
2010-09-15 23:40:35 -04:00
|
|
|
echo
|
2012-04-08 14:51:28 -04:00
|
|
|
printf -- "$(gettext "Operations:")\n"
|
|
|
|
printf -- "$(gettext " -a, --add Add the specified keys (empty for stdin)")\n"
|
|
|
|
printf -- "$(gettext " -d, --delete Remove the specified keyids")\n"
|
|
|
|
printf -- "$(gettext " -e, --export Export the specified or all keyids")\n"
|
|
|
|
printf -- "$(gettext " -f, --finger List fingerprint for specified or all keyids")\n"
|
|
|
|
printf -- "$(gettext " -l, --list-keys List the specified or all keys")\n"
|
|
|
|
printf -- "$(gettext " -r, --recv-keys Fetch the specified keyids")\n"
|
2012-01-23 17:14:25 -05:00
|
|
|
printf -- "$(gettext " -u, --updatedb Update the trustdb of pacman")\n"
|
2012-04-08 15:40:18 -04:00
|
|
|
printf -- "$(gettext " -v, --verify Verify the file(s) specified by the signature(s)")\n"
|
2012-04-08 14:51:28 -04:00
|
|
|
printf -- "$(gettext " --edit-key Present a menu for key management task on keyids")\n"
|
|
|
|
printf -- "$(gettext " --import Imports pubring.gpg from dir(s)")\n"
|
|
|
|
printf -- "$(gettext " --import-trustdb Imports ownertrust values from trustdb.gpg in dir(s)")\n"
|
|
|
|
printf -- "$(gettext " --init Ensure the keyring is properly initialized")\n"
|
|
|
|
printf -- "$(gettext " --list-sigs List keys and their signatures")\n"
|
|
|
|
printf -- "$(gettext " --lsign-key Locally sign the specified keyid")\n"
|
|
|
|
printf -- "$(gettext " --populate Reload the default keys from the (given) keyrings\n\
|
|
|
|
in '%s'")\n" "@pkgdatadir@/keyrings"
|
|
|
|
printf -- "$(gettext " --refresh-keys Update specified or all keys from a keyserver")\n"
|
|
|
|
echo
|
|
|
|
printf -- "$(gettext "Options:")\n"
|
2012-01-23 17:14:25 -05:00
|
|
|
printf -- "$(gettext " --config <file> Use an alternate config file (instead of\n\
|
2011-08-08 20:01:26 -04:00
|
|
|
'%s')")\n" "@sysconfdir@/pacman.conf"
|
2012-01-23 17:14:25 -05:00
|
|
|
printf -- "$(gettext " --gpgdir <dir> Set an alternate directory for GnuPG (instead\n\
|
2011-08-08 20:01:26 -04:00
|
|
|
of '%s')")\n" "@sysconfdir@/pacman.d/gnupg"
|
2012-04-08 14:51:28 -04:00
|
|
|
printf -- "$(gettext " --keyserver <server-url> Specify a keyserver to use if necessary")\n"
|
|
|
|
echo
|
|
|
|
printf -- "$(gettext " -h, --help Show this help message and exit")\n"
|
|
|
|
printf -- "$(gettext " -V, --version Show program version")\n"
|
2010-09-15 23:40:35 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
version() {
|
|
|
|
printf "pacman-key (pacman) %s\n" "${myver}"
|
2012-01-23 17:14:25 -05:00
|
|
|
printf -- "$(gettext "\
|
2016-01-02 22:48:43 -05:00
|
|
|
Copyright (c) 2010-2016 Pacman Development Team <pacman-dev@archlinux.org>.\n\
|
2010-09-15 23:40:35 -04:00
|
|
|
This is free software; see the source for copying conditions.\n\
|
|
|
|
There is NO WARRANTY, to the extent permitted by law.\n")"
|
|
|
|
}
|
|
|
|
|
2011-07-08 22:40:25 -04:00
|
|
|
# read the config file "$1" which has key=value pairs, and return the key which
|
|
|
|
# matches "$2". the equals sign between pairs may be surrounded by any amount
|
2011-09-25 15:24:53 -04:00
|
|
|
# of whitespace. Optionally, "$3" can be specified which is the default value
|
|
|
|
# when no key is found.
|
2011-04-21 09:59:07 -04:00
|
|
|
get_from() {
|
2011-07-08 22:40:25 -04:00
|
|
|
while IFS='=' read -r key value; do
|
|
|
|
[[ -z $key || ${key:0:1} = '#' ]] && continue
|
|
|
|
|
|
|
|
if [[ ${key%% *} = "$2" && -n ${value##* } ]]; then
|
|
|
|
echo "${value##* }"
|
|
|
|
return 0
|
2011-06-08 02:48:56 -04:00
|
|
|
fi
|
|
|
|
done < "$1"
|
2011-09-29 23:40:00 -04:00
|
|
|
if [[ -n "$3" ]]; then
|
|
|
|
printf '%s\n' "$3"
|
|
|
|
return 0
|
|
|
|
fi
|
2011-07-08 22:40:25 -04:00
|
|
|
return 1
|
pacman-key: remake of --reload command
The --reload command was refactored to allow a more flexible management.
There are two sets of keys that will be added, one that will be
removed and one that will be kept.
The set of keys to be kept are configured in pacman.conf, with the
option HoldKeys, with the same meaning of HoldPkgs. It can be repeated
and several values can be put in the same entry.
The new behavior allows a key to be marked for removal, but the user
can decide if that key must be kept. For example, if a developer has
a public repository, signed with his own key, that key must be added
to the HoldKeys option. If the key is marked for removal from pacman's
keyring, it will not be removed for the users that have configured
HoldKeys correctly.
There are other minor fixes, mainly in the handling of --add command
when there is no aditional parameter. In that case, pacman-key will
behave just like gpg, adding the contents of stdin into pacman's keyring.
Signed-off-by: Denis A. Altoé Falqueto <denisfalqueto@gmail.com>
2010-10-07 20:13:13 -04:00
|
|
|
}
|
|
|
|
|
2012-04-14 19:56:03 -04:00
|
|
|
key_lookup_from_name() {
|
|
|
|
local ids
|
|
|
|
|
|
|
|
mapfile -t ids < \
|
|
|
|
<("${GPG_PACMAN[@]}" --search-keys --batch --with-colons "$1" 2>/dev/null |
|
|
|
|
awk -F: '$1 == "pub" { print $2 }')
|
|
|
|
|
|
|
|
# only return success on non-ambiguous lookup
|
|
|
|
case ${#ids[*]} in
|
|
|
|
0)
|
|
|
|
error "$(gettext "Failed to lookup key by name:") %s" "$name"
|
|
|
|
return 1
|
|
|
|
;;
|
|
|
|
1)
|
|
|
|
printf '%s' "${ids[0]}"
|
|
|
|
return 0
|
|
|
|
;;
|
|
|
|
*)
|
|
|
|
error "$(gettext "Key name is ambiguous:") %s" "$name"
|
|
|
|
return 1
|
|
|
|
;;
|
|
|
|
esac
|
|
|
|
}
|
|
|
|
|
2011-08-25 19:39:11 -04:00
|
|
|
generate_master_key() {
|
|
|
|
# Generate the master key, which will be in both pubring and secring
|
|
|
|
"${GPG_PACMAN[@]}" --gen-key --batch <<EOF
|
2012-02-02 09:29:50 -05:00
|
|
|
%echo Generating pacman keyring master key...
|
2011-08-25 19:39:11 -04:00
|
|
|
Key-Type: RSA
|
|
|
|
Key-Length: 2048
|
|
|
|
Key-Usage: sign
|
2012-02-02 09:29:50 -05:00
|
|
|
Name-Real: Pacman Keyring Master Key
|
2011-08-25 19:39:11 -04:00
|
|
|
Name-Email: pacman@localhost
|
|
|
|
Expire-Date: 0
|
2014-11-21 05:54:58 -05:00
|
|
|
%no-protection
|
2011-08-25 19:39:11 -04:00
|
|
|
%commit
|
|
|
|
%echo Done
|
|
|
|
EOF
|
|
|
|
}
|
|
|
|
|
|
|
|
secret_keys_available() {
|
|
|
|
"${GPG_PACMAN[@]}" -K --with-colons | wc -l
|
|
|
|
}
|
|
|
|
|
2011-08-25 13:59:27 -04:00
|
|
|
# Adds the given gpg.conf option if it is not present in the file.
|
|
|
|
# Note that if we find it commented out, we won't add the option.
|
|
|
|
# args: $1 conffile, $2 option-name, $3 (optional) option-value
|
|
|
|
add_gpg_conf_option() {
|
2011-09-25 14:34:36 -04:00
|
|
|
local conffile=$1; shift
|
2011-08-25 13:59:27 -04:00
|
|
|
# looking for the option 'bare', only leading spaces or # chars allowed,
|
|
|
|
# followed by at least one space and any other text or the end of line.
|
2011-09-25 14:34:36 -04:00
|
|
|
if ! grep -q "^[[:space:]#]*$1\([[:space:]].*\)*$" "$conffile" &>/dev/null; then
|
|
|
|
printf '%s\n' "$*" >> "$conffile"
|
2011-08-25 13:59:27 -04:00
|
|
|
fi
|
|
|
|
}
|
|
|
|
|
2012-01-16 19:12:41 -05:00
|
|
|
check_keyids_exist() {
|
|
|
|
local ret=0
|
2012-04-08 14:51:28 -04:00
|
|
|
for key in "$@"; do
|
2012-01-16 19:12:41 -05:00
|
|
|
# Verify if the key exists in pacman's keyring
|
|
|
|
if ! "${GPG_PACMAN[@]}" --list-keys "$key" &>/dev/null ; then
|
|
|
|
error "$(gettext "The key identified by %s could not be found locally.")" "$key"
|
|
|
|
ret=1
|
|
|
|
fi
|
|
|
|
done
|
|
|
|
if (( ret )); then
|
|
|
|
exit 1
|
|
|
|
fi
|
|
|
|
}
|
|
|
|
|
2011-07-09 03:26:17 -04:00
|
|
|
initialize() {
|
2011-09-01 16:20:53 -04:00
|
|
|
local conffile keyserv
|
2011-07-09 03:26:17 -04:00
|
|
|
# Check for simple existence rather than for a directory as someone
|
|
|
|
# may want to use a symlink here
|
|
|
|
[[ -e ${PACMAN_KEYRING_DIR} ]] || mkdir -p -m 755 "${PACMAN_KEYRING_DIR}"
|
|
|
|
|
|
|
|
# keyring files
|
|
|
|
[[ -f ${PACMAN_KEYRING_DIR}/pubring.gpg ]] || touch ${PACMAN_KEYRING_DIR}/pubring.gpg
|
|
|
|
[[ -f ${PACMAN_KEYRING_DIR}/secring.gpg ]] || touch ${PACMAN_KEYRING_DIR}/secring.gpg
|
2011-07-20 00:28:39 -04:00
|
|
|
[[ -f ${PACMAN_KEYRING_DIR}/trustdb.gpg ]] || "${GPG_PACMAN[@]}" --update-trustdb
|
2011-08-25 13:59:26 -04:00
|
|
|
chmod 644 ${PACMAN_KEYRING_DIR}/{pubring,trustdb}.gpg
|
|
|
|
chmod 600 ${PACMAN_KEYRING_DIR}/secring.gpg
|
2011-07-09 03:26:17 -04:00
|
|
|
|
|
|
|
# gpg.conf
|
2011-08-25 13:59:27 -04:00
|
|
|
conffile="${PACMAN_KEYRING_DIR}/gpg.conf"
|
|
|
|
[[ -f $conffile ]] || touch "$conffile"
|
|
|
|
chmod 644 "$conffile"
|
|
|
|
add_gpg_conf_option "$conffile" 'no-greeting'
|
|
|
|
add_gpg_conf_option "$conffile" 'no-permission-warning'
|
|
|
|
add_gpg_conf_option "$conffile" 'lock-never'
|
2011-09-01 16:20:53 -04:00
|
|
|
keyserv=${KEYSERVER:-$DEFAULT_KEYSERVER}
|
|
|
|
add_gpg_conf_option "$conffile" 'keyserver' "$keyserv"
|
2011-10-17 10:42:46 -04:00
|
|
|
add_gpg_conf_option "$conffile" 'keyserver-options' 'timeout=10'
|
2011-08-25 19:39:11 -04:00
|
|
|
|
|
|
|
# set up a private signing key (if none available)
|
|
|
|
if [[ $(secret_keys_available) -lt 1 ]]; then
|
|
|
|
generate_master_key
|
|
|
|
UPDATEDB=1
|
|
|
|
fi
|
2011-07-09 03:26:17 -04:00
|
|
|
}
|
|
|
|
|
2011-07-09 07:51:01 -04:00
|
|
|
check_keyring() {
|
|
|
|
if [[ ! -r ${PACMAN_KEYRING_DIR}/pubring.gpg || \
|
|
|
|
! -r ${PACMAN_KEYRING_DIR}/trustdb.gpg ]]; then
|
2011-09-26 14:23:00 -04:00
|
|
|
error "$(gettext "You do not have sufficient permissions to read the %s keyring.")" "pacman"
|
2011-07-09 07:51:01 -04:00
|
|
|
msg "$(gettext "Use '%s' to correct the keyring permissions.")" "pacman-key --init"
|
|
|
|
exit 1
|
|
|
|
fi
|
|
|
|
|
|
|
|
if (( (EXPORT || FINGER || LIST || VERIFY) && EUID != 0 )); then
|
2011-08-25 13:59:26 -04:00
|
|
|
if ! grep -q "^[[:space:]]*lock-never[[:space:]]*$" ${PACMAN_KEYRING_DIR}/gpg.conf &>/dev/null; then
|
2011-09-26 14:23:00 -04:00
|
|
|
error "$(gettext "You do not have sufficient permissions to run this command.")"
|
2011-07-09 07:51:01 -04:00
|
|
|
msg "$(gettext "Use '%s' to correct the keyring permissions.")" "pacman-key --init"
|
|
|
|
exit 1
|
|
|
|
fi
|
|
|
|
fi
|
|
|
|
|
2011-08-29 13:52:51 -04:00
|
|
|
if (( LSIGNKEY )); then
|
|
|
|
if [[ $(secret_keys_available) -lt 1 ]]; then
|
|
|
|
error "$(gettext "There is no secret key available to sign with.")"
|
|
|
|
msg "$(gettext "Use '%s' to generate a default secret key.")" "pacman-key --init"
|
|
|
|
exit 1
|
|
|
|
fi
|
|
|
|
fi
|
2011-07-09 07:51:01 -04:00
|
|
|
}
|
|
|
|
|
2011-08-15 08:51:58 -04:00
|
|
|
populate_keyring() {
|
|
|
|
local KEYRING_IMPORT_DIR='@pkgdatadir@/keyrings'
|
|
|
|
|
2012-04-08 14:51:28 -04:00
|
|
|
local keyring KEYRINGIDS=("$@")
|
2011-08-15 08:51:58 -04:00
|
|
|
local ret=0
|
2012-04-08 14:51:28 -04:00
|
|
|
if (( ${#KEYRINGIDS[*]} == 0 )); then
|
2011-08-15 08:51:58 -04:00
|
|
|
# get list of all available keyrings
|
|
|
|
shopt -s nullglob
|
|
|
|
KEYRINGIDS=("$KEYRING_IMPORT_DIR"/*.gpg)
|
|
|
|
shopt -u nullglob
|
|
|
|
KEYRINGIDS=("${KEYRINGIDS[@]##*/}")
|
|
|
|
KEYRINGIDS=("${KEYRINGIDS[@]%.gpg}")
|
2012-04-08 14:51:28 -04:00
|
|
|
if (( ${#KEYRINGIDS[*]} == 0 )); then
|
2011-08-15 08:51:58 -04:00
|
|
|
error "$(gettext "No keyring files exist in %s.")" "$KEYRING_IMPORT_DIR"
|
2011-07-08 21:16:12 -04:00
|
|
|
ret=1
|
2010-09-15 23:40:35 -04:00
|
|
|
fi
|
2011-08-15 08:51:58 -04:00
|
|
|
else
|
|
|
|
# verify listed keyrings exist
|
2011-09-20 20:35:11 -04:00
|
|
|
for keyring in "${KEYRINGIDS[@]}"; do
|
2011-08-15 08:51:58 -04:00
|
|
|
if [[ ! -f "$KEYRING_IMPORT_DIR/$keyring.gpg" ]]; then
|
|
|
|
error "$(gettext "The keyring file %s does not exist.")" "$KEYRING_IMPORT_DIR/$keyring.gpg"
|
|
|
|
ret=1
|
|
|
|
fi
|
|
|
|
done
|
pacman-key: remake of --reload command
The --reload command was refactored to allow a more flexible management.
There are two sets of keys that will be added, one that will be
removed and one that will be kept.
The set of keys to be kept are configured in pacman.conf, with the
option HoldKeys, with the same meaning of HoldPkgs. It can be repeated
and several values can be put in the same entry.
The new behavior allows a key to be marked for removal, but the user
can decide if that key must be kept. For example, if a developer has
a public repository, signed with his own key, that key must be added
to the HoldKeys option. If the key is marked for removal from pacman's
keyring, it will not be removed for the users that have configured
HoldKeys correctly.
There are other minor fixes, mainly in the handling of --add command
when there is no aditional parameter. In that case, pacman-key will
behave just like gpg, adding the contents of stdin into pacman's keyring.
Signed-off-by: Denis A. Altoé Falqueto <denisfalqueto@gmail.com>
2010-10-07 20:13:13 -04:00
|
|
|
fi
|
|
|
|
|
2011-08-15 08:51:58 -04:00
|
|
|
if (( ret )); then
|
|
|
|
exit 1
|
|
|
|
fi
|
2011-07-08 21:16:12 -04:00
|
|
|
|
|
|
|
# Variable used for iterating on keyrings
|
2011-11-25 15:16:46 -05:00
|
|
|
local keys key_id
|
2011-07-08 21:16:12 -04:00
|
|
|
|
2011-08-23 01:00:19 -04:00
|
|
|
# Add keys from requested keyrings
|
2011-09-20 20:35:11 -04:00
|
|
|
for keyring in "${KEYRINGIDS[@]}"; do
|
2011-08-23 01:00:19 -04:00
|
|
|
msg "$(gettext "Appending keys from %s.gpg...")" "$keyring"
|
2012-06-18 10:46:26 -04:00
|
|
|
"${GPG_PACMAN[@]}" --quiet --import "${KEYRING_IMPORT_DIR}/${keyring}.gpg"
|
2011-08-23 01:00:19 -04:00
|
|
|
done
|
|
|
|
|
2011-09-26 14:18:19 -04:00
|
|
|
# Read the trusted key IDs to an array. Because this is an ownertrust
|
|
|
|
# file, we know we have the full 40 hex digit fingerprint values.
|
|
|
|
# Format of ownertrust dump file:
|
|
|
|
# 40CHARFINGERPRINTXXXXXXXXXXXXXXXXXXXXXXX:6:
|
|
|
|
# 40CHARFINGERPRINTXXXXXXXXXXXXXXXXXXXXXXX:5:
|
2011-09-21 18:51:02 -04:00
|
|
|
local -A trusted_ids
|
|
|
|
for keyring in "${KEYRINGIDS[@]}"; do
|
2012-05-13 13:05:58 -04:00
|
|
|
if [[ -s "${KEYRING_IMPORT_DIR}/${keyring}-trusted" ]]; then
|
2011-11-25 14:51:26 -05:00
|
|
|
while IFS=: read key_id _; do
|
|
|
|
# skip blank lines, comments; these are valid in this file
|
|
|
|
[[ -z $key_id || ${key_id:0:1} = \# ]] && continue
|
|
|
|
|
|
|
|
# Mark this key to be lsigned
|
|
|
|
trusted_ids[$key_id]=$keyring
|
2011-09-21 18:51:02 -04:00
|
|
|
done < "${KEYRING_IMPORT_DIR}/${keyring}-trusted"
|
|
|
|
fi
|
|
|
|
done
|
|
|
|
|
|
|
|
if (( ${#trusted_ids[@]} > 0 )); then
|
|
|
|
msg "$(gettext "Locally signing trusted keys in keyring...")"
|
2012-06-19 00:55:35 -04:00
|
|
|
lsign_keys "${!trusted_ids[@]}"
|
2011-09-26 14:18:19 -04:00
|
|
|
msg "$(gettext "Importing owner trust values...")"
|
|
|
|
for keyring in "${KEYRINGIDS[@]}"; do
|
2012-05-13 13:05:58 -04:00
|
|
|
if [[ -s "${KEYRING_IMPORT_DIR}/${keyring}-trusted" ]]; then
|
2011-09-26 14:18:19 -04:00
|
|
|
"${GPG_PACMAN[@]}" --import-ownertrust "${KEYRING_IMPORT_DIR}/${keyring}-trusted"
|
|
|
|
fi
|
|
|
|
done
|
2011-09-21 18:51:02 -04:00
|
|
|
fi
|
|
|
|
|
2011-09-21 17:19:12 -04:00
|
|
|
local -A revoked_ids
|
2011-09-20 20:35:11 -04:00
|
|
|
for keyring in "${KEYRINGIDS[@]}"; do
|
2013-06-03 14:13:08 -04:00
|
|
|
if [[ -s $KEYRING_IMPORT_DIR/$keyring-revoked ]]; then
|
|
|
|
while read -r key_id; do
|
|
|
|
revoked_ids["$key_id"]=1
|
|
|
|
done <"$KEYRING_IMPORT_DIR/$keyring-revoked"
|
2011-08-15 08:51:58 -04:00
|
|
|
fi
|
|
|
|
done
|
pacman-key: remake of --reload command
The --reload command was refactored to allow a more flexible management.
There are two sets of keys that will be added, one that will be
removed and one that will be kept.
The set of keys to be kept are configured in pacman.conf, with the
option HoldKeys, with the same meaning of HoldPkgs. It can be repeated
and several values can be put in the same entry.
The new behavior allows a key to be marked for removal, but the user
can decide if that key must be kept. For example, if a developer has
a public repository, signed with his own key, that key must be added
to the HoldKeys option. If the key is marked for removal from pacman's
keyring, it will not be removed for the users that have configured
HoldKeys correctly.
There are other minor fixes, mainly in the handling of --add command
when there is no aditional parameter. In that case, pacman-key will
behave just like gpg, adding the contents of stdin into pacman's keyring.
Signed-off-by: Denis A. Altoé Falqueto <denisfalqueto@gmail.com>
2010-10-07 20:13:13 -04:00
|
|
|
|
2011-09-21 17:19:12 -04:00
|
|
|
if (( ${#revoked_ids[@]} > 0 )); then
|
|
|
|
msg "$(gettext "Disabling revoked keys in keyring...")"
|
|
|
|
for key_id in "${!revoked_ids[@]}"; do
|
|
|
|
msg2 "$(gettext "Disabling key %s...")" "${key_id}"
|
|
|
|
printf 'disable\nquit\n' | LANG=C "${GPG_PACMAN[@]}" --command-fd 0 --quiet --batch --edit-key "${key_id}" 2>/dev/null
|
2010-09-15 23:40:35 -04:00
|
|
|
done
|
|
|
|
fi
|
|
|
|
}
|
|
|
|
|
2012-01-16 19:09:56 -05:00
|
|
|
add_keys() {
|
2012-04-08 14:51:28 -04:00
|
|
|
if ! "${GPG_PACMAN[@]}" --quiet --batch --import "$@" ; then
|
2012-02-02 09:29:50 -05:00
|
|
|
error "$(gettext "A specified keyfile could not be added to the keyring.")"
|
2012-01-16 19:12:41 -05:00
|
|
|
exit 1
|
|
|
|
fi
|
2012-01-16 19:09:56 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
delete_keys() {
|
2012-04-08 14:51:28 -04:00
|
|
|
check_keyids_exist "$@"
|
|
|
|
if ! "${GPG_PACMAN[@]}" --quiet --batch --delete-key --yes "$@" ; then
|
2012-02-02 09:29:50 -05:00
|
|
|
error "$(gettext "A specified key could not be removed from the keyring.")"
|
2012-01-16 19:12:41 -05:00
|
|
|
exit 1
|
|
|
|
fi
|
2012-01-16 19:09:56 -05:00
|
|
|
}
|
|
|
|
|
2011-07-08 21:07:29 -04:00
|
|
|
edit_keys() {
|
2012-04-08 14:51:28 -04:00
|
|
|
check_keyids_exist "$@"
|
2012-01-16 19:12:41 -05:00
|
|
|
local ret=0
|
2012-04-08 14:51:28 -04:00
|
|
|
for key in "$@"; do
|
2012-01-16 19:12:41 -05:00
|
|
|
if ! "${GPG_PACMAN[@]}" --edit-key "$key" ; then
|
|
|
|
error "$(gettext "The key identified by %s could not be edited.")" "$key"
|
|
|
|
ret=1
|
2011-07-08 21:07:29 -04:00
|
|
|
fi
|
|
|
|
done
|
2012-01-16 19:12:41 -05:00
|
|
|
if (( ret )); then
|
|
|
|
exit 1
|
|
|
|
fi
|
2011-07-08 21:07:29 -04:00
|
|
|
}
|
|
|
|
|
2012-01-16 19:09:56 -05:00
|
|
|
export_keys() {
|
2012-04-08 14:51:28 -04:00
|
|
|
check_keyids_exist "$@"
|
|
|
|
if ! "${GPG_PACMAN[@]}" --armor --export "$@" ; then
|
2012-02-02 09:29:50 -05:00
|
|
|
error "$(gettext "A specified key could not be exported from the keyring.")"
|
2012-01-16 19:12:41 -05:00
|
|
|
exit 1
|
|
|
|
fi
|
2012-01-16 19:09:56 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
finger_keys() {
|
2012-01-16 19:12:41 -05:00
|
|
|
check_keyids_exist
|
2012-04-08 14:51:28 -04:00
|
|
|
if ! "${GPG_PACMAN[@]}" --batch --fingerprint "$@" ; then
|
2012-01-16 19:12:41 -05:00
|
|
|
error "$(gettext "The fingerprint of a specified key could not be determined.")"
|
|
|
|
exit 1
|
|
|
|
fi
|
2011-07-08 21:07:29 -04:00
|
|
|
}
|
|
|
|
|
2011-07-19 08:52:07 -04:00
|
|
|
import_trustdb() {
|
|
|
|
local importdir
|
2012-01-16 19:12:41 -05:00
|
|
|
local ret=0
|
2012-04-08 14:51:28 -04:00
|
|
|
for importdir in "$@"; do
|
2011-07-19 08:52:07 -04:00
|
|
|
if [[ -f "${importdir}/trustdb.gpg" ]]; then
|
2011-09-26 13:41:27 -04:00
|
|
|
gpg --homedir "${importdir}" --export-ownertrust | \
|
|
|
|
"${GPG_PACMAN[@]}" --import-ownertrust -
|
2012-01-16 19:12:41 -05:00
|
|
|
if (( PIPESTATUS )); then
|
|
|
|
error "$(gettext "%s could not be imported.")" "${importdir}/trustdb.gpg"
|
|
|
|
ret=1
|
|
|
|
fi
|
|
|
|
else
|
|
|
|
error "$(gettext "File %s does not exist and could not be imported.")" "${importdir}/trustdb.gpg"
|
|
|
|
ret=1
|
2011-07-19 08:52:07 -04:00
|
|
|
fi
|
|
|
|
done
|
2012-01-16 19:12:41 -05:00
|
|
|
if (( ret )); then
|
|
|
|
exit 1
|
|
|
|
fi
|
2011-07-19 08:52:07 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
import() {
|
|
|
|
local importdir
|
2012-01-16 19:12:41 -05:00
|
|
|
local ret=0
|
2012-04-08 14:51:28 -04:00
|
|
|
for importdir in "$@"; do
|
2011-07-19 08:52:07 -04:00
|
|
|
if [[ -f "${importdir}/pubring.gpg" ]]; then
|
2012-01-16 19:12:41 -05:00
|
|
|
if ! "${GPG_PACMAN[@]}" --quiet --batch --import "${importdir}/pubring.gpg" ; then
|
|
|
|
error "$(gettext "%s could not be imported.")" "${importdir}/pubring.gpg"
|
|
|
|
ret=1
|
|
|
|
fi
|
|
|
|
else
|
|
|
|
error "$(gettext "File %s does not exist and could not be imported.")" "${importdir}/pubring.gpg"
|
|
|
|
ret=1
|
2011-07-19 08:52:07 -04:00
|
|
|
fi
|
|
|
|
done
|
2012-01-16 19:12:41 -05:00
|
|
|
if (( ret )); then
|
|
|
|
exit 1
|
|
|
|
fi
|
2011-07-19 08:52:07 -04:00
|
|
|
}
|
|
|
|
|
2012-01-16 19:09:56 -05:00
|
|
|
list_keys() {
|
2012-01-16 19:12:41 -05:00
|
|
|
check_keyids_exist
|
2012-04-08 14:51:28 -04:00
|
|
|
if ! "${GPG_PACMAN[@]}" --batch --list-keys "$@" ; then
|
2012-01-16 19:12:41 -05:00
|
|
|
error "$(gettext "A specified key could not be listed.")"
|
|
|
|
exit 1
|
|
|
|
fi
|
2012-01-16 19:09:56 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
list_sigs() {
|
2012-01-16 19:12:41 -05:00
|
|
|
check_keyids_exist
|
2012-04-08 14:51:28 -04:00
|
|
|
if ! "${GPG_PACMAN[@]}" --batch --list-sigs "$@" ; then
|
2012-01-16 19:12:41 -05:00
|
|
|
error "$(gettext "A specified signature could not be listed.")"
|
|
|
|
exit 1
|
|
|
|
fi
|
2012-01-16 19:09:56 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
lsign_keys() {
|
2012-01-16 19:12:41 -05:00
|
|
|
check_keyids_exist
|
2012-06-19 00:55:35 -04:00
|
|
|
|
|
|
|
local ret=0
|
|
|
|
for key_id in "$@"; do
|
|
|
|
msg2 "$(gettext "Locally signing key %s...")" "${key_id}"
|
|
|
|
# we cannot use --yes here as gpg would still ask for confirmation if a key has more than one uid
|
|
|
|
printf 'y\ny\n' | LANG=C "${GPG_PACMAN[@]}" --command-fd 0 --quiet --batch --lsign-key "${key_id}" 2>/dev/null
|
|
|
|
if (( PIPESTATUS[1] )); then
|
|
|
|
error "$(gettext "%s could not be locally signed.")" "${key_id}"
|
|
|
|
ret=1
|
|
|
|
fi
|
|
|
|
done
|
|
|
|
|
|
|
|
if (( ret )); then
|
2012-01-16 19:12:41 -05:00
|
|
|
exit 1
|
|
|
|
fi
|
2012-01-16 19:09:56 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
receive_keys() {
|
2012-04-14 19:56:03 -04:00
|
|
|
local name id keyids
|
|
|
|
|
|
|
|
# if the key is not a hex ID, do a lookup
|
|
|
|
for name; do
|
|
|
|
if [[ $name = ?(0x)+([0-9a-fA-F]) ]]; then
|
|
|
|
keyids+=("$name")
|
|
|
|
else
|
|
|
|
if id=$(key_lookup_from_name "$name"); then
|
|
|
|
keyids+=("$id")
|
|
|
|
fi
|
|
|
|
fi
|
|
|
|
done
|
|
|
|
|
|
|
|
(( ${#keyids[*]} > 0 )) || exit 1
|
|
|
|
|
|
|
|
if ! "${GPG_PACMAN[@]}" --recv-keys "${keyids[@]}" ; then
|
2012-01-16 19:12:41 -05:00
|
|
|
error "$(gettext "Remote key not fetched correctly from keyserver.")"
|
|
|
|
exit 1
|
|
|
|
fi
|
2012-01-16 19:09:56 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
refresh_keys() {
|
2012-04-08 14:51:28 -04:00
|
|
|
check_keyids_exist "$@"
|
|
|
|
if ! "${GPG_PACMAN[@]}" --refresh-keys "$@" ; then
|
2012-01-16 19:12:41 -05:00
|
|
|
error "$(gettext "A specified local key could not be updated from a keyserver.")"
|
|
|
|
exit 1
|
|
|
|
fi
|
2012-01-16 19:09:56 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
verify_sig() {
|
2012-04-08 15:40:18 -04:00
|
|
|
local ret=0
|
|
|
|
for sig; do
|
2015-10-18 23:47:19 -04:00
|
|
|
msg "Checking %s..." "$sig"
|
2016-06-12 00:18:24 -04:00
|
|
|
if grep -q 'BEGIN PGP SIGNATURE' "$sig"; then
|
|
|
|
error "$(gettext "Cannot use armored signatures for packages: %s")" "$sig"
|
|
|
|
return 1
|
|
|
|
fi
|
2016-05-07 19:24:17 -04:00
|
|
|
if ! "${GPG_PACMAN[@]}" --status-fd 1 --verify "$sig" | grep -qE '^\[GNUPG:\] TRUST_(FULLY|ULTIMATE).*$'; then
|
2012-04-08 15:40:18 -04:00
|
|
|
error "$(gettext "The signature identified by %s could not be verified.")" "$sig"
|
|
|
|
ret=1
|
|
|
|
fi
|
|
|
|
done
|
|
|
|
exit $ret
|
2012-01-16 19:09:56 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
updatedb() {
|
|
|
|
msg "$(gettext "Updating trust database...")"
|
2012-01-16 19:12:41 -05:00
|
|
|
if ! "${GPG_PACMAN[@]}" --batch --check-trustdb ; then
|
|
|
|
error "$(gettext "Trust database could not be updated.")"
|
|
|
|
exit 1
|
|
|
|
fi
|
2011-07-19 08:52:07 -04:00
|
|
|
}
|
|
|
|
|
2010-09-15 23:40:35 -04:00
|
|
|
# PROGRAM START
|
|
|
|
if ! type gettext &>/dev/null; then
|
|
|
|
gettext() {
|
|
|
|
echo "$@"
|
|
|
|
}
|
|
|
|
fi
|
|
|
|
|
2012-04-08 14:51:28 -04:00
|
|
|
OPT_SHORT="adefhlruvV"
|
|
|
|
OPT_LONG=('add' 'config:' 'delete' 'edit-key' 'export' 'finger' 'gpgdir:'
|
|
|
|
'help' 'import' 'import-trustdb' 'init' 'keyserver:' 'list-keys' 'list-sigs'
|
2013-03-04 03:23:31 -05:00
|
|
|
'lsign-key' 'nocolor' 'populate' 'recv-keys' 'refresh-keys' 'updatedb'
|
2012-04-08 14:51:28 -04:00
|
|
|
'verify' 'version')
|
|
|
|
if ! parseopts "$OPT_SHORT" "${OPT_LONG[@]}" -- "$@"; then
|
2012-04-17 00:27:37 -04:00
|
|
|
exit 1 # E_INVALID_OPTION;
|
2011-07-05 13:05:08 -04:00
|
|
|
fi
|
2012-04-08 14:51:28 -04:00
|
|
|
set -- "${OPTRET[@]}"
|
|
|
|
unset OPT_SHORT OPT_LONG OPTRET
|
2011-07-05 13:05:08 -04:00
|
|
|
|
|
|
|
if [[ $1 == "--" ]]; then
|
|
|
|
usage;
|
|
|
|
exit 0;
|
2010-09-15 23:40:35 -04:00
|
|
|
fi
|
|
|
|
|
2012-04-08 14:51:28 -04:00
|
|
|
while (( $# )); do
|
|
|
|
case $1 in
|
|
|
|
-a|--add) ADD=1 UPDATEDB=1 ;;
|
2011-07-05 13:05:08 -04:00
|
|
|
--config) shift; CONFIG=$1 ;;
|
2012-04-08 14:51:28 -04:00
|
|
|
-d|--delete) DELETE=1 UPDATEDB=1 ;;
|
|
|
|
--edit-key) EDITKEY=1 UPDATEDB=1 ;;
|
|
|
|
-e|--export) EXPORT=1 ;;
|
|
|
|
-f|--finger) FINGER=1 ;;
|
2011-07-05 13:05:08 -04:00
|
|
|
--gpgdir) shift; PACMAN_KEYRING_DIR=$1 ;;
|
2012-04-08 14:51:28 -04:00
|
|
|
--import) IMPORT=1 UPDATEDB=1 ;;
|
|
|
|
--import-trustdb) IMPORT_TRUSTDB=1 UPDATEDB=1 ;;
|
2011-07-09 03:26:17 -04:00
|
|
|
--init) INIT=1 ;;
|
2011-09-01 16:20:53 -04:00
|
|
|
--keyserver) shift; KEYSERVER=$1 ;;
|
2012-04-08 14:51:28 -04:00
|
|
|
-l|--list-keys) LISTKEYS=1 ;;
|
|
|
|
--list-sigs) LISTSIGS=1 ;;
|
|
|
|
--lsign-key) LSIGNKEY=1 UPDATEDB=1 ;;
|
2013-03-04 03:23:31 -05:00
|
|
|
--nocolor) USE_COLOR='n';;
|
2012-04-08 14:51:28 -04:00
|
|
|
--populate) POPULATE=1 UPDATEDB=1 ;;
|
|
|
|
-r|--recv-keys) RECEIVE=1 UPDATEDB=1 ;;
|
|
|
|
--refresh-keys) REFRESH=1 ;;
|
2011-07-05 13:05:08 -04:00
|
|
|
-u|--updatedb) UPDATEDB=1 ;;
|
2012-04-08 14:51:28 -04:00
|
|
|
-v|--verify) VERIFY=1 ;;
|
2011-07-05 13:05:08 -04:00
|
|
|
|
|
|
|
-h|--help) usage; exit 0 ;;
|
|
|
|
-V|--version) version; exit 0 ;;
|
|
|
|
|
2012-04-08 14:51:28 -04:00
|
|
|
--) shift; break 2 ;;
|
2010-09-15 23:40:35 -04:00
|
|
|
esac
|
|
|
|
shift
|
|
|
|
done
|
|
|
|
|
2013-03-04 03:23:31 -05:00
|
|
|
m4_include(library/term_colors.sh)
|
2011-07-05 13:05:08 -04:00
|
|
|
|
|
|
|
if ! type -p gpg >/dev/null; then
|
2012-04-08 14:51:28 -04:00
|
|
|
error "$(gettext "Cannot find the %s binary required for all %s operations.")" "gpg" "pacman-key"
|
2011-07-05 13:05:08 -04:00
|
|
|
exit 1
|
|
|
|
fi
|
|
|
|
|
2011-09-01 16:29:25 -04:00
|
|
|
if (( (ADD || DELETE || EDITKEY || IMPORT || IMPORT_TRUSTDB || INIT || LSIGNKEY || POPULATE || RECEIVE || REFRESH || UPDATEDB) && EUID != 0 )); then
|
2011-07-05 13:05:08 -04:00
|
|
|
error "$(gettext "%s needs to be run as root for this operation.")" "pacman-key"
|
|
|
|
exit 1
|
|
|
|
fi
|
|
|
|
|
|
|
|
CONFIG=${CONFIG:-@sysconfdir@/pacman.conf}
|
2010-09-15 23:40:35 -04:00
|
|
|
if [[ ! -r "${CONFIG}" ]]; then
|
2011-08-08 20:01:26 -04:00
|
|
|
error "$(gettext "%s configuration file '%s' not found.")" "pacman" "$CONFIG"
|
2010-09-15 23:40:35 -04:00
|
|
|
exit 1
|
|
|
|
fi
|
|
|
|
|
2011-07-08 22:48:41 -04:00
|
|
|
# if PACMAN_KEYRING_DIR isn't assigned, try to get it from the config
|
|
|
|
# file, falling back on a hard default
|
2011-09-25 15:24:53 -04:00
|
|
|
PACMAN_KEYRING_DIR=${PACMAN_KEYRING_DIR:-$(get_from "$CONFIG" "GPGDir" "@sysconfdir@/pacman.d/gnupg")}
|
2011-03-27 12:14:15 -04:00
|
|
|
|
2011-12-23 11:52:11 -05:00
|
|
|
GPG_PACMAN=(gpg --homedir "${PACMAN_KEYRING_DIR}" --no-permission-warning)
|
2011-09-01 16:20:53 -04:00
|
|
|
if [[ -n ${KEYSERVER} ]]; then
|
2011-12-23 11:52:11 -05:00
|
|
|
GPG_PACMAN+=(--keyserver "${KEYSERVER}")
|
2011-09-01 16:20:53 -04:00
|
|
|
fi
|
2011-07-05 13:05:08 -04:00
|
|
|
|
2011-07-08 21:28:57 -04:00
|
|
|
# check only a single operation has been given
|
2011-08-29 11:52:12 -04:00
|
|
|
# don't include UPDATEDB in here as other opts can induce it
|
2011-07-29 22:24:46 -04:00
|
|
|
numopt=$(( ADD + DELETE + EDITKEY + EXPORT + FINGER + IMPORT + IMPORT_TRUSTDB +
|
2011-09-01 16:29:25 -04:00
|
|
|
INIT + LISTKEYS + LISTSIGS + LSIGNKEY + POPULATE + RECEIVE + REFRESH + VERIFY ))
|
2011-07-08 21:28:57 -04:00
|
|
|
|
2011-07-20 13:26:44 -04:00
|
|
|
case $numopt in
|
|
|
|
0)
|
2011-08-29 11:52:12 -04:00
|
|
|
if (( ! UPDATEDB )); then
|
|
|
|
error "$(gettext "no operation specified (use -h for help)")"
|
|
|
|
exit 1
|
|
|
|
fi
|
2011-07-20 13:26:44 -04:00
|
|
|
;;
|
|
|
|
[!1])
|
2011-09-26 14:23:00 -04:00
|
|
|
error "$(gettext "Multiple operations specified.")"
|
|
|
|
msg "$(gettext "Please run %s with each operation separately.")" "pacman-key"
|
2011-07-20 13:26:44 -04:00
|
|
|
exit 1
|
|
|
|
;;
|
|
|
|
esac
|
2011-07-08 21:28:57 -04:00
|
|
|
|
2012-04-08 14:51:28 -04:00
|
|
|
# check for targets where needed
|
|
|
|
if (( (ADD || DELETE || EDIT || IMPORT || IMPORT_TRUSTDB ||
|
|
|
|
LSIGNKEY || RECEIVE || VERIFY) && $# == 0 )); then
|
|
|
|
error "$(gettext "No targets specified")"
|
|
|
|
exit 1
|
|
|
|
fi
|
|
|
|
|
2011-07-09 07:51:01 -04:00
|
|
|
(( ! INIT )) && check_keyring
|
2011-07-05 13:05:08 -04:00
|
|
|
|
2012-04-08 14:51:28 -04:00
|
|
|
(( ADD )) && add_keys "$@"
|
|
|
|
(( DELETE )) && delete_keys "$@"
|
|
|
|
(( EDITKEY )) && edit_keys "$@"
|
|
|
|
(( EXPORT )) && export_keys "$@"
|
|
|
|
(( FINGER )) && finger_keys "$@"
|
|
|
|
(( IMPORT )) && import "$@"
|
|
|
|
(( IMPORT_TRUSTDB)) && import_trustdb "$@"
|
2011-07-09 03:26:17 -04:00
|
|
|
(( INIT )) && initialize
|
2012-04-08 14:51:28 -04:00
|
|
|
(( LISTKEYS )) && list_keys "$@"
|
|
|
|
(( LISTSIGS )) && list_sigs "$@"
|
|
|
|
(( LSIGNKEY )) && lsign_keys "$@"
|
|
|
|
(( POPULATE )) && populate_keyring "$@"
|
|
|
|
(( RECEIVE )) && receive_keys "$@"
|
|
|
|
(( REFRESH )) && refresh_keys "$@"
|
|
|
|
(( VERIFY )) && verify_sig "$@"
|
2011-07-05 13:05:08 -04:00
|
|
|
|
2012-01-16 19:09:56 -05:00
|
|
|
(( UPDATEDB )) && updatedb
|
|
|
|
|
|
|
|
exit 0
|
2011-08-23 01:12:08 -04:00
|
|
|
|
2014-01-22 18:06:11 -05:00
|
|
|
# vim: set noet:
|