pacman-key: keyring management tool
The script pacman-key will manage pacman's keyring. It imports, exports, fetches from keyservers, helps in the process of trusting and updates the trust database. Signed-off-by: Denis A. Altoé Falqueto <denisfalqueto@gmail.com> Signed-off-by: Allan McRae <allan@archlinux.org>
This commit is contained in:
Denis A. Altoé Falqueto
Dan McGee
parent
0ff52b6845
commit
ae20f88202
|
|
@ -5,3 +5,4 @@ rankmirrors
|
|||
repo-add
|
||||
repo-remove
|
||||
pkgdelta
|
||||
pacman-key
|
||||
|
|
|
|||
|
|
@ -8,6 +8,7 @@ bin_SCRIPTS = \
|
|||
OURSCRIPTS = \
|
||||
makepkg \
|
||||
pacman-db-upgrade \
|
||||
pacman-key \
|
||||
pacman-optimize \
|
||||
pkgdelta \
|
||||
rankmirrors \
|
||||
|
|
@ -16,6 +17,7 @@ OURSCRIPTS = \
|
|||
EXTRA_DIST = \
|
||||
makepkg.sh.in \
|
||||
pacman-db-upgrade.sh.in \
|
||||
pacman-key.sh.in \
|
||||
pacman-optimize.sh.in \
|
||||
pkgdelta.sh.in \
|
||||
rankmirrors.sh.in \
|
||||
|
|
@ -64,6 +66,7 @@ $(OURSCRIPTS): Makefile
|
|||
|
||||
makepkg: $(srcdir)/makepkg.sh.in
|
||||
pacman-db-upgrade: $(srcdir)/pacman-db-upgrade.sh.in
|
||||
pacman-key: ${srcdir}/pacman-key.sh.in
|
||||
pacman-optimize: $(srcdir)/pacman-optimize.sh.in
|
||||
pkgdelta: $(srcdir)/pkgdelta.sh.in
|
||||
rankmirrors: $(srcdir)/rankmirrors.sh.in
|
||||
|
|
|
|||
|
|
@ -0,0 +1,274 @@
|
|||
#!@BASH_SHELL@ -e
|
||||
#
|
||||
# pacman-key - manages pacman's keyring
|
||||
# Based on apt-key, from Debian
|
||||
# @configure_input@
|
||||
#
|
||||
# Copyright (c) 2010 - Pacman Development Team <pacman-dev@archlinux.org>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
# gettext initialization
|
||||
export TEXTDOMAIN='pacman'
|
||||
export TEXTDOMAINDIR='@localedir@'
|
||||
|
||||
myver="@PACKAGE_VERSION@"
|
||||
|
||||
msg() {
|
||||
local mesg=$1; shift
|
||||
printf "==> ${mesg}\n" "$@" >&1
|
||||
}
|
||||
|
||||
msg2() {
|
||||
(( QUIET )) && return
|
||||
local mesg=$1; shift
|
||||
printf " -> ${mesg}\n" "$@" >&1
|
||||
}
|
||||
|
||||
warning() {
|
||||
local mesg=$1; shift
|
||||
printf "==> $(gettext "WARNING:") ${mesg}\n" "$@" >&2
|
||||
}
|
||||
|
||||
error() {
|
||||
local mesg=$1; shift
|
||||
printf "==> $(gettext "ERROR:") ${mesg}\n" "$@" >&2
|
||||
}
|
||||
|
||||
usage() {
|
||||
printf "pacman-key (pacman) %s\n" ${myver}
|
||||
echo
|
||||
printf "$(gettext "Usage: %s [options] command [arguments]")\n" $(basename $0)
|
||||
echo
|
||||
echo "$(gettext "Manage pacman's list of trusted keys")"
|
||||
echo
|
||||
echo "$(gettext "Options must be placed before commands. The available options are:")"
|
||||
echo "$(gettext " --config - set an alternative configuration file to use. ")"
|
||||
printf "$(gettext " Default is %s")\n" "@sysconfdir@/pacman.conf"
|
||||
echo "$(gettext " --gpgdir - set an alternative home directory for gnupg. ")"
|
||||
printf "$(gettext " Default is set in %s")\n" "@sysconfdir@/pacman.conf"
|
||||
echo
|
||||
echo "$(gettext "The available commands are:")"
|
||||
echo "$(gettext " pacman-key -a | --add [<file>] ... - add the key contained ")"
|
||||
echo "$(gettext " in <file> (empty for stdin)")"
|
||||
echo "$(gettext " pacman-key -d | --del <keyid> ... - remove the key <keyid>")"
|
||||
echo "$(gettext " pacman-key -e | --export <keyid> ... - output the key <keyid>")"
|
||||
echo "$(gettext " pacman-key -r | --receive <keyserver> <keyid> ... - fetch the keyids from")"
|
||||
echo "$(gettext " the specified keyserver URL")"
|
||||
echo "$(gettext " pacman-key -t | --trust <keyid> ... - set the trust level of the given key")"
|
||||
echo "$(gettext " pacman-key -u | --updatedb - update the trustdb of pacman")"
|
||||
echo "$(gettext " pacman-key --reload - reloads the keys from the keyring package")"
|
||||
echo "$(gettext " pacman-key -l | --list - list keys")"
|
||||
echo "$(gettext " pacman-key -f | --finger [<keyid]> ... - list fingerprint for specified keyids (or for all, if none is specified)")"
|
||||
echo "$(gettext " pacman-key --adv <params> - use pacman's keyring as target for advanced commands")"
|
||||
echo "$(gettext " pacman-key -h | --help - displays this message")"
|
||||
echo "$(gettext " pacman-key -v | --version - displays the current version")"
|
||||
}
|
||||
|
||||
version() {
|
||||
printf "pacman-key (pacman) %s\n" "${myver}"
|
||||
printf "$(gettext "\
|
||||
Copyright (c) 2010 Pacman Development Team <pacman-dev@archlinux.org>.\n\
|
||||
This is free software; see the source for copying conditions.\n\
|
||||
There is NO WARRANTY, to the extent permitted by law.\n")"
|
||||
}
|
||||
|
||||
reload_keyring() {
|
||||
local PACMAN_SHARE_DIR='@prefix@/share/pacman'
|
||||
local GPG_NOKEYRING="gpg --batch --quiet --ignore-time-conflict --no-options --no-default-keyring --homedir ${PACMAN_KEYRING_DIR}"
|
||||
|
||||
# Read-only keyring with keys to be added to the keyring
|
||||
local ADDED_KEYS="${PACMAN_SHARE_DIR}/addedkeys.gpg"
|
||||
|
||||
# Read-only list of keys removed from the keyring.
|
||||
local REMOVED_KEYS="${PACMAN_SHARE_DIR}/removedkeys"
|
||||
|
||||
# Add keys from the current set of keys from pacman-keyring package. The web of trust will
|
||||
# be updated automatically.
|
||||
if [[ -r "${ADDED_KEYS}" ]]; then
|
||||
msg "$(gettext "Verifying official keys file signature...")"
|
||||
if ! ${GPG_PACMAN} --quiet --verify "${ADDED_KEYS}.sig" 1>/dev/null; then
|
||||
error "$(gettext "The signature of file %s is not valid.")" "${ADDED_KEYS}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
msg "$(gettext "Appending official keys...")"
|
||||
local add_keys=$(${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5)
|
||||
for key in ${add_keys}; do
|
||||
msg "$(gettext " key id: %s")" "$key"
|
||||
${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --export "${key}" | ${GPG_PACMAN} --import
|
||||
done
|
||||
fi
|
||||
|
||||
# Remove the keys from REMOVED_KEYS keyring
|
||||
if [[ -r "${REMOVED_KEYS}" ]]; then
|
||||
msg "$(gettext "Verifying deleted keys file signature...")"
|
||||
if ! ${GPG_PACMAN} --quiet --verify "${REMOVED_KEYS}.sig"; then
|
||||
error "$(gettext "The signature of file %s is not valid.")" "${REMOVED_KEYS}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
msg "$(gettext "Removing deleted keys from keyring...")"
|
||||
cat "${REMOVED_KEYS}" | while read key; do
|
||||
msg "$(gettext " key id: %s")" "$key"
|
||||
${GPG_PACMAN} --quiet --batch --yes --delete-key "${key}"
|
||||
done
|
||||
fi
|
||||
|
||||
# Update trustdb, just to be sure
|
||||
msg "$(gettext "Updating trust database...")"
|
||||
${GPG_PACMAN} --batch --check-trustdb
|
||||
}
|
||||
|
||||
# PROGRAM START
|
||||
if ! type gettext &>/dev/null; then
|
||||
gettext() {
|
||||
echo "$@"
|
||||
}
|
||||
fi
|
||||
|
||||
if [[ $1 != "--version" && $1 != "-v" && $1 != "--help" && $1 != "-h" ]]; then
|
||||
if type -p gpg >/dev/null 2>&1 = 1; then
|
||||
error "$(gettext "gnupg does not seem to be installed.")"
|
||||
msg2 "$(gettext "pacman-key requires gnupg for most operations.")"
|
||||
exit 1
|
||||
elif (( EUID != 0 )); then
|
||||
error "$(gettext "pacman-key needs to be run as root.")"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# Parse global options
|
||||
CONFIG="@sysconfdir@/pacman.conf"
|
||||
PACMAN_KEYRING_DIR="@sysconfdir@/pacman.d/gnupg"
|
||||
while [[ $1 =~ ^--(config|gpgdir)$ ]]; do
|
||||
case "$1" in
|
||||
--config) shift; CONFIG="$1" ;;
|
||||
--gpgdir) shift; PACMAN_KEYRING_DIR="$1" ;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
if [[ ! -r "${CONFIG}" ]]; then
|
||||
error "$(gettext "It is not possible to read %s")" "${CONFIG}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Read GPGDIR from $CONFIG.
|
||||
# The pattern is: any spaces or tabs, GPGDir, any spaces or tabs, equal sign
|
||||
# and the rest of the line. The string is splitted after the first occurrence of =
|
||||
if [[ GPGDIR=$(grep -e '^[[:blank:]]*GPGDir[[:blank:]]*=.*' "$CONFIG") == 0 ]]; then
|
||||
GPGDIR=${GPGDIR#*=}
|
||||
PACMAN_KEYRING_DIR="${GPGDIR}"
|
||||
fi
|
||||
GPG_PACMAN="gpg --homedir ${PACMAN_KEYRING_DIR}"
|
||||
|
||||
# Parse and execute command
|
||||
command="$1"
|
||||
if [[ -z "${command}" ]]; then
|
||||
usage
|
||||
exit 1
|
||||
fi
|
||||
shift
|
||||
|
||||
case "${command}" in
|
||||
-a|--add)
|
||||
if (( $# == 0 )); then
|
||||
error "$(gettext "You need to specify at least one key identifier")"
|
||||
usage
|
||||
exit 1
|
||||
fi
|
||||
while (( $# > 0 )); do
|
||||
${GPG_PACMAN} --quiet --batch --import "$1"
|
||||
shift
|
||||
done
|
||||
;;
|
||||
-d|--del)
|
||||
if (( $# == 0 )); then
|
||||
error "$(gettext "You need to specify at least one key identifier")"
|
||||
usage
|
||||
exit 1
|
||||
fi
|
||||
while (( $# > 0 )); do
|
||||
${GPG_PACMAN} --quiet --batch --delete-key --yes "$1"
|
||||
shift
|
||||
done
|
||||
;;
|
||||
-u|--updatedb)
|
||||
${GPG_PACMAN} --batch --check-trustdb
|
||||
;;
|
||||
--reload)
|
||||
reload_keyring
|
||||
;;
|
||||
-l|--list)
|
||||
${GPG_PACMAN} --batch --list-sigs
|
||||
;;
|
||||
-f|--finger)
|
||||
${GPG_PACMAN} --batch --fingerprint $*
|
||||
;;
|
||||
-e|--export)
|
||||
if (( $# == 0 )); then
|
||||
${GPG_PACMAN} --armor --export
|
||||
else
|
||||
while (( $# > 0 )); do
|
||||
${GPG_PACMAN} --armor --export "$1"
|
||||
shift
|
||||
done
|
||||
fi
|
||||
;;
|
||||
-r|--receive)
|
||||
if (( $# < 2 )); then
|
||||
error "$(gettext "You need to specify the keyserver and at least one key identifier")"
|
||||
usage
|
||||
exit 1
|
||||
fi
|
||||
keyserver="$1"
|
||||
shift
|
||||
${GPG_PACMAN} --keyserver "${keyserver}" --recv-keys $*
|
||||
;;
|
||||
-t|--trust)
|
||||
if (( $# == 0 )); then
|
||||
error "$(gettext "You need to specify at least one key identifier")"
|
||||
usage
|
||||
exit 1
|
||||
fi
|
||||
while (( $# > 0 )); do
|
||||
# Verify if the key exists in pacman's keyring
|
||||
if ${GPG_PACMAN} --list-keys "$1" > /dev/null 2>&1; then
|
||||
${GPG_PACMAN} --edit-key "$1"
|
||||
else
|
||||
error "$(gettext "The key identified by %s doesn't exist")" "$1"
|
||||
exit 1
|
||||
fi
|
||||
shift
|
||||
done
|
||||
;;
|
||||
--adv)
|
||||
msg "$(gettext "Executing: %s ")$*" "${GPG_PACMAN}"
|
||||
${GPG_PACMAN} $* || ret=$?
|
||||
exit $ret
|
||||
;;
|
||||
--help)
|
||||
usage
|
||||
;;
|
||||
--version)
|
||||
version
|
||||
exit 0
|
||||
;;
|
||||
*)
|
||||
usage
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
Loading…
Reference in New Issue