moparisthebest
/
pacman
mirror of https://github.com/moparisthebest/pacman
1
0
Fork 0
Code Issues Releases Wiki Activity

pacman-key: import everything then revoke on --populate 

The optimization of only importing keys that were not to be later
revoked was a not smart enough.  For example, if a key was
in both a repos keyring and its revoke list, alternate runs of
pacman-key --populate would add then remove the key from the pacman
keyring.  This problem is made worse when considering the possibility
of multiple keyrings being imported.

Instead, import all keys followed by the revoking of all keys.  This
may result in a key being added then revoked, but that is not much of
an issue given that is a very fast operation.

Signed-off-by: Allan McRae <allan@archlinux.org>
This commit is contained in:
Allan McRae 2011-08-23 15:00:19 +10:00
parent d1240f67ea
commit 710e83999b
1 changed files with 10 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
scripts/pacman-key.sh.in
View File

@ -199,7 +199,16 @@ populate_keyring() {
local key
local key_id
# Read the key ids to an array. The conversion from whatever is inside the file
# Add keys from requested keyrings
for keyring in ${KEYRINGIDS[@]}; do
msg "$(gettext "Appending keys from %s.gpg...")" "$keyring"
local add_keys="$("${GPG_NOKEYRING[@]}" --keyring "${KEYRING_IMPORT_DIR}/${keyring}.gpg" --with-colons --list-keys | grep ^pub | cut -d: -f5)"
for key_id in ${add_keys}; do
"${GPG_NOKEYRING[@]}" --keyring "${KEYRING_IMPORT_DIR}/${keyring}.gpg" --export "${key_id}" | "${GPG_PACMAN[@]}" --import
done
done
# Read the revoked key IDs to an array. The conversion from whatever is inside the file
# to key ids is important, because key ids are the only guarantee of identification
# for the keys.
local -A removed_ids
@ -236,18 +245,6 @@ populate_keyring() {
done
fi
# Add keys from requested keyrings
for keyring in ${KEYRINGIDS[@]}; do
msg "$(gettext "Appending keys from %s.gpg...")" "$keyring"
local add_keys="$("${GPG_NOKEYRING[@]}" --keyring "${KEYRING_IMPORT_DIR}/${keyring}.gpg" --with-colons --list-keys | grep ^pub | cut -d: -f5)"
for key_id in ${add_keys}; do
# There is no point in adding a key that will be deleted right after
if [[ -z "${removed_ids[$key_id]}" ]]; then
"${GPG_NOKEYRING[@]}" --keyring "${KEYRING_IMPORT_DIR}/${keyring}.gpg" --export "${key_id}" | "${GPG_PACMAN[@]}" --import
fi
done
done
# Remove the keys not marked to keep
if (( ${#removed_ids[@]} > 0 )); then
msg "$(gettext "Removing revoked keys from keyring...")"