mirror of
https://github.com/moparisthebest/pacman
synced 2024-11-10 19:45:01 -05:00
8129b93afe
Any option that flips UPDATEDB=1 doesn't work right now due to what we
thought was a good idea in commit cab1379a1a. Fix this by not
including the update operation in the option count and special casing
it where necessary.
Also, bring back the helpful "Updating trust database" message.
Signed-off-by: Dan McGee <dan@archlinux.org>
439 lines
15 KiB
Bash
439 lines
15 KiB
Bash
#!/bin/bash -e
|
|
#
|
|
# pacman-key - manages pacman's keyring
|
|
# Based on apt-key, from Debian
|
|
# @configure_input@
|
|
#
|
|
# Copyright (c) 2010-2011 Pacman Development Team <pacman-dev@archlinux.org>
|
|
#
|
|
# This program is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation; either version 2 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
#
|
|
|
|
# gettext initialization
|
|
export TEXTDOMAIN='pacman-scripts'
|
|
export TEXTDOMAINDIR='@localedir@'
|
|
|
|
myver="@PACKAGE_VERSION@"
|
|
|
|
# Options
|
|
ADD=0
|
|
DELETE=0
|
|
EDITKEY=0
|
|
EXPORT=0
|
|
FINGER=0
|
|
IMPORT=0
|
|
IMPORT_TRUSTDB=0
|
|
INIT=0
|
|
LISTKEYS=0
|
|
LISTSIGS=0
|
|
POPULATE=0
|
|
RECEIVE=0
|
|
UPDATEDB=0
|
|
VERIFY=0
|
|
|
|
m4_include(library/output_format.sh)
|
|
|
|
m4_include(library/parse_options.sh)
|
|
|
|
usage() {
|
|
printf "pacman-key (pacman) %s\n" ${myver}
|
|
echo
|
|
printf "$(gettext "Usage: %s [options]")\n" $(basename $0)
|
|
echo
|
|
printf "$(gettext "Manage pacman\'s list of trusted keys")\n"
|
|
echo
|
|
echo "$(gettext "Options:")"
|
|
echo "$(gettext " -a, --add [<file(s)>] Add the specified keys (empty for stdin)")"
|
|
echo "$(gettext " -d, --delete <keyid(s)> Remove the specified keyids")"
|
|
echo "$(gettext " -e, --export [<keyid(s)>] Export the specified or all keyids")"
|
|
echo "$(gettext " -f, --finger [<keyid(s)>] List fingerprint for specified or all keyids")"
|
|
echo "$(gettext " -h, --help Show this help message and exit")"
|
|
echo "$(gettext " -l, --list-keys [<keyid(s)>] List the specified or all keys")"
|
|
echo "$(gettext " -r, --receive <keyserver> <keyid(s)> Fetch the specified keyids")"
|
|
echo "$(gettext " -u, --updatedb Update the trustdb of pacman")"
|
|
echo "$(gettext " -v, --verify <signature> Verify the file specified by the signature")"
|
|
echo "$(gettext " -V, --version Show program version")"
|
|
printf "$(gettext " --config <file> Use an alternate config file (instead of\n\
|
|
'%s')")\n" "@sysconfdir@/pacman.conf"
|
|
echo "$(gettext " --edit-key <keyid(s)> Present a menu for key management task on keyids")"
|
|
printf "$(gettext " --gpgdir <dir> Set an alternate directory for GnuPG (instead\n\
|
|
of '%s')")\n" "@sysconfdir@/pacman.d/gnupg"
|
|
echo "$(gettext " --import <dir(s)> Imports pubring.gpg and trustdb.gpg from dir(s)")"
|
|
echo "$(gettext " --import-trustdb <dir(s)> Imports ownertrust values from trustdb.gpg in dir(s)")"
|
|
echo "$(gettext " --init Ensure the keyring is properly initialized")"
|
|
echo "$(gettext " --list-sigs [<keyid(s)>] List keys and their signatures")"
|
|
printf "$(gettext " --populate [<keyring(s)] Reload the default keys from the (given) keyrings\n\
|
|
in '%s'")\n" "@pkgdatadir@/keyrings"
|
|
}
|
|
|
|
version() {
|
|
printf "pacman-key (pacman) %s\n" "${myver}"
|
|
printf "$(gettext "\
|
|
Copyright (c) 2010-2011 Pacman Development Team <pacman-dev@archlinux.org>.\n\
|
|
This is free software; see the source for copying conditions.\n\
|
|
There is NO WARRANTY, to the extent permitted by law.\n")"
|
|
}
|
|
|
|
# read the config file "$1" which has key=value pairs, and return the key which
|
|
# matches "$2". the equals sign between pairs may be surrounded by any amount
|
|
# of whitespace.
|
|
get_from() {
|
|
while IFS='=' read -r key value; do
|
|
[[ -z $key || ${key:0:1} = '#' ]] && continue
|
|
|
|
if [[ ${key%% *} = "$2" && -n ${value##* } ]]; then
|
|
echo "${value##* }"
|
|
return 0
|
|
fi
|
|
done < "$1"
|
|
return 1
|
|
}
|
|
|
|
# Adds the given gpg.conf option if it is not present in the file.
|
|
# Note that if we find it commented out, we won't add the option.
|
|
# args: $1 conffile, $2 option-name, $3 (optional) option-value
|
|
add_gpg_conf_option() {
|
|
local confline
|
|
# looking for the option 'bare', only leading spaces or # chars allowed,
|
|
# followed by at least one space and any other text or the end of line.
|
|
if ! grep -q "^[[:space:]#]*$2\([[:space:]].*\)*$" "$1" &>/dev/null; then
|
|
confline="$2"
|
|
[[ -n $3 ]] && confline="$2 $3"
|
|
echo "$confline" >> "$1"
|
|
fi
|
|
}
|
|
|
|
initialize() {
|
|
local conffile
|
|
# Check for simple existence rather than for a directory as someone
|
|
# may want to use a symlink here
|
|
[[ -e ${PACMAN_KEYRING_DIR} ]] || mkdir -p -m 755 "${PACMAN_KEYRING_DIR}"
|
|
|
|
# keyring files
|
|
[[ -f ${PACMAN_KEYRING_DIR}/pubring.gpg ]] || touch ${PACMAN_KEYRING_DIR}/pubring.gpg
|
|
[[ -f ${PACMAN_KEYRING_DIR}/secring.gpg ]] || touch ${PACMAN_KEYRING_DIR}/secring.gpg
|
|
[[ -f ${PACMAN_KEYRING_DIR}/trustdb.gpg ]] || "${GPG_PACMAN[@]}" --update-trustdb
|
|
chmod 644 ${PACMAN_KEYRING_DIR}/{pubring,trustdb}.gpg
|
|
chmod 600 ${PACMAN_KEYRING_DIR}/secring.gpg
|
|
|
|
# gpg.conf
|
|
conffile="${PACMAN_KEYRING_DIR}/gpg.conf"
|
|
[[ -f $conffile ]] || touch "$conffile"
|
|
chmod 644 "$conffile"
|
|
add_gpg_conf_option "$conffile" 'no-greeting'
|
|
add_gpg_conf_option "$conffile" 'no-permission-warning'
|
|
add_gpg_conf_option "$conffile" 'lock-never'
|
|
add_gpg_conf_option "$conffile" 'keyserver' 'hkp://keys.gnupg.net'
|
|
}
|
|
|
|
check_keyring() {
|
|
if [[ ! -r ${PACMAN_KEYRING_DIR}/pubring.gpg || \
|
|
! -r ${PACMAN_KEYRING_DIR}/trustdb.gpg ]]; then
|
|
error "$(gettext "You do not have sufficient permissions to read the %s keyring...")" "pacman"
|
|
msg "$(gettext "Use '%s' to correct the keyring permissions.")" "pacman-key --init"
|
|
exit 1
|
|
fi
|
|
|
|
if (( (EXPORT || FINGER || LIST || VERIFY) && EUID != 0 )); then
|
|
if ! grep -q "^[[:space:]]*lock-never[[:space:]]*$" ${PACMAN_KEYRING_DIR}/gpg.conf &>/dev/null; then
|
|
error "$(gettext "You do not have sufficient permissions to run this command...")"
|
|
msg "$(gettext "Use '%s' to correct the keyring permissions.")" "pacman-key --init"
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
}
|
|
|
|
verify_keyring_input() {
|
|
local ret=0;
|
|
local KEYRING_IMPORT_DIR='@pkgdatadir@/keyrings'
|
|
|
|
# Verify signatures of keyring files and association revocation files if they exist
|
|
msg "$(gettext "Verifying keyring file signatures...")"
|
|
local keyring
|
|
for keyring in ${KEYRINGIDS[@]}; do
|
|
if ! "${GPG_PACMAN[@]}" --verify "${KEYRING_IMPORT_DIR}/${keyring}.gpg.sig" &>/dev/null; then
|
|
error "$(gettext "The signature of file %s is not valid.")" "${ADDED_KEYS}"
|
|
ret=1
|
|
fi
|
|
|
|
if [[ -f "${KEYRING_IMPORT_DIR}/${keyring}-revoked" ]]; then
|
|
if ! "${GPG_PACMAN[@]}" --verify "${KEYRING_IMPORT_DIR}/${keyring}-revoked.sig" &>/dev/null; then
|
|
error "$(gettext "The signature of file %s is not valid.")" "${KEYRING_IMPORT_DIR}/${keyring}-revoked"
|
|
ret=1
|
|
fi
|
|
fi
|
|
done
|
|
|
|
return $ret
|
|
}
|
|
|
|
populate_keyring() {
|
|
local KEYRING_IMPORT_DIR='@pkgdatadir@/keyrings'
|
|
local GPG_NOKEYRING=(gpg --batch --quiet --ignore-time-conflict --no-options --no-default-keyring --homedir ${PACMAN_KEYRING_DIR} --no-permission-warning)
|
|
|
|
local keyring
|
|
local ret=0
|
|
if [[ -z ${KEYRINGIDS[@]} ]]; then
|
|
# get list of all available keyrings
|
|
shopt -s nullglob
|
|
KEYRINGIDS=("$KEYRING_IMPORT_DIR"/*.gpg)
|
|
shopt -u nullglob
|
|
KEYRINGIDS=("${KEYRINGIDS[@]##*/}")
|
|
KEYRINGIDS=("${KEYRINGIDS[@]%.gpg}")
|
|
if [[ -z ${KEYRINGIDS[@]} ]]; then
|
|
error "$(gettext "No keyring files exist in %s.")" "$KEYRING_IMPORT_DIR"
|
|
ret=1
|
|
fi
|
|
else
|
|
# verify listed keyrings exist
|
|
for keyring in ${KEYRINGIDS[@]}; do
|
|
if [[ ! -f "$KEYRING_IMPORT_DIR/$keyring.gpg" ]]; then
|
|
error "$(gettext "The keyring file %s does not exist.")" "$KEYRING_IMPORT_DIR/$keyring.gpg"
|
|
ret=1
|
|
fi
|
|
done
|
|
fi
|
|
|
|
if (( ret )); then
|
|
exit 1
|
|
fi
|
|
|
|
verify_keyring_input || exit 1
|
|
|
|
# Variable used for iterating on keyrings
|
|
local key
|
|
local key_id
|
|
|
|
# Add keys from requested keyrings
|
|
for keyring in ${KEYRINGIDS[@]}; do
|
|
msg "$(gettext "Appending keys from %s.gpg...")" "$keyring"
|
|
local add_keys="$("${GPG_NOKEYRING[@]}" --keyring "${KEYRING_IMPORT_DIR}/${keyring}.gpg" --with-colons --list-keys | grep ^pub | cut -d: -f5)"
|
|
for key_id in ${add_keys}; do
|
|
"${GPG_NOKEYRING[@]}" --keyring "${KEYRING_IMPORT_DIR}/${keyring}.gpg" --export "${key_id}" | "${GPG_PACMAN[@]}" --import
|
|
done
|
|
done
|
|
|
|
# Read the revoked key IDs to an array. The conversion from whatever is inside the file
|
|
# to key ids is important, because key ids are the only guarantee of identification
|
|
# for the keys.
|
|
local -A removed_ids
|
|
for keyring in ${KEYRINGIDS[@]}; do
|
|
if [[ -f "${KEYRING_IMPORT_DIR}/${keyring}-revoked" ]]; then
|
|
while read key; do
|
|
local key_values name
|
|
# extract key ID (field 5) and the name of owner (field 10)
|
|
key_values="$("${GPG_PACMAN[@]}" --quiet --with-colons --list-key "${key}" 2>/dev/null | grep ^pub | cut -d: -f5,10 --output-delimiter=' ')"
|
|
if [[ -n $key_values ]]; then
|
|
# The first word is the key_id
|
|
key_id="${key_values%% *}"
|
|
# the rest is the name of the owner
|
|
name="${key_values#* }"
|
|
if [[ -n ${key_id} ]]; then
|
|
# Mark this key to be deleted
|
|
removed_ids[$key_id]="$name"
|
|
fi
|
|
fi
|
|
done < "${KEYRING_IMPORT_DIR}/${keyring}-revoked"
|
|
fi
|
|
done
|
|
|
|
# Read list of keys that must be kept installed and remove them from the list
|
|
# of keys to be removed
|
|
if [[ -f "${PACMAN_KEYRING_DIR}/holdkeys" ]]; then
|
|
while read key; do
|
|
key_id="$("${GPG_PACMAN[@]}" --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5)"
|
|
if [[ -n "${removed_ids[$key_id]}" ]]; then
|
|
unset removed_ids[$key_id]
|
|
fi
|
|
done < "${PACMAN_KEYRING_DIR}/holdkeys"
|
|
fi
|
|
|
|
# Remove the keys not marked to keep
|
|
if (( ${#removed_ids[@]} > 0 )); then
|
|
msg "$(gettext "Removing revoked keys from keyring...")"
|
|
for key_id in "${!removed_ids[@]}"; do
|
|
echo " removing key $key_id - ${removed_ids[$key_id]}"
|
|
"${GPG_PACMAN[@]}" --quiet --batch --yes --delete-key "${key_id}"
|
|
done
|
|
fi
|
|
}
|
|
|
|
receive_keys() {
|
|
if [[ -z ${KEYIDS[@]} ]]; then
|
|
error "$(gettext "You need to specify the keyserver and at least one key identifier")"
|
|
exit 1
|
|
fi
|
|
"${GPG_PACMAN[@]}" --keyserver "$KEYSERVER" --recv-keys "${KEYIDS[@]}"
|
|
}
|
|
|
|
edit_keys() {
|
|
local errors=0;
|
|
for key in ${KEYIDS[@]}; do
|
|
# Verify if the key exists in pacman's keyring
|
|
if ! "${GPG_PACMAN[@]}" --list-keys "$key" &>/dev/null; then
|
|
error "$(gettext "The key identified by %s does not exist")" "$key"
|
|
errors=1;
|
|
fi
|
|
done
|
|
(( errors )) && exit 1;
|
|
|
|
for key in ${KEYIDS[@]}; do
|
|
"${GPG_PACMAN[@]}" --edit-key "$key"
|
|
done
|
|
}
|
|
|
|
import_trustdb() {
|
|
local importdir
|
|
local trustdb=$(mktemp)
|
|
"${GPG_PACMAN[@]}" --export-ownertrust > ${trustdb}
|
|
|
|
for importdir in "${IMPORT_DIRS[@]}"; do
|
|
if [[ -f "${importdir}/trustdb.gpg" ]]; then
|
|
gpg --homedir "${importdir}" --export-ownertrust >> ${trustdb}
|
|
fi
|
|
done
|
|
|
|
"${GPG_PACMAN[@]}" --import-ownertrust ${trustdb}
|
|
rm -f ${trustdb}
|
|
}
|
|
|
|
import() {
|
|
local importdir
|
|
|
|
# Imports public keys, then import trustdbs
|
|
for importdir in "${IMPORT_DIRS[@]}"; do
|
|
if [[ -f "${importdir}/pubring.gpg" ]]; then
|
|
"${GPG_PACMAN[@]}" --quiet --batch --import "${importdir}/pubring.gpg"
|
|
fi
|
|
done
|
|
|
|
import_trustdb
|
|
}
|
|
|
|
# PROGRAM START
|
|
if ! type gettext &>/dev/null; then
|
|
gettext() {
|
|
echo "$@"
|
|
}
|
|
fi
|
|
|
|
OPT_SHORT="a::d:e:f::hl::r:uv:V"
|
|
OPT_LONG="add::,config:,delete:,edit-key:,export::,finger::,gpgdir:"
|
|
OPT_LONG+=",help,import:,import-trustdb:,init,list-keys::,list-sigs::"
|
|
OPT_LONG+=",populate::,receive:,updatedb,verify:,version"
|
|
if ! OPT_TEMP="$(parse_options $OPT_SHORT $OPT_LONG "$@")"; then
|
|
echo; usage; exit 1 # E_INVALID_OPTION;
|
|
fi
|
|
eval set -- "$OPT_TEMP"
|
|
unset OPT_SHORT OPT_LONG OPT_TEMP
|
|
|
|
if [[ $1 == "--" ]]; then
|
|
usage;
|
|
exit 0;
|
|
fi
|
|
|
|
while true; do
|
|
case "$1" in
|
|
-a|--add) ADD=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYFILES=($1); UPDATEDB=1 ;;
|
|
--config) shift; CONFIG=$1 ;;
|
|
-d|--delete) DELETE=1; shift; KEYIDS=($1); UPDATEDB=1 ;;
|
|
--edit-key) EDITKEY=1; shift; KEYIDS=($1); UPDATEDB=1 ;;
|
|
-e|--export) EXPORT=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
|
|
-f|--finger) FINGER=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
|
|
--gpgdir) shift; PACMAN_KEYRING_DIR=$1 ;;
|
|
--import) IMPORT=1; shift; IMPORT_DIRS=($1); UPDATEDB=1 ;;
|
|
--import-trustdb) IMPORT_TRUSTDB=1; shift; IMPORT_DIRS=($1); UPDATEDB=1 ;;
|
|
--init) INIT=1 ;;
|
|
-l|--list-keys) LISTKEYS=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
|
|
--list-sigs) LISTSIGS=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
|
|
--populate) POPULATE=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYRINGIDS=($1); UPDATEDB=1 ;;
|
|
-r|--receive) RECEIVE=1; shift; TMP=($1); KEYSERVER=${TMP[0]}; KEYIDS=(${TMP[@]:1}); unset TMP; UPDATEDB=1 ;;
|
|
-u|--updatedb) UPDATEDB=1 ;;
|
|
-v|--verify) VERIFY=1; shift; SIGNATURE=$1 ;;
|
|
|
|
-h|--help) usage; exit 0 ;;
|
|
-V|--version) version; exit 0 ;;
|
|
|
|
--) OPT_IND=0; shift; break;;
|
|
*) usage; exit 1 ;;
|
|
esac
|
|
shift
|
|
done
|
|
|
|
|
|
if ! type -p gpg >/dev/null; then
|
|
error "$(gettext "Cannot find the %s binary required for all %s operations.")" "gpg" "pacman-key"
|
|
exit 1
|
|
fi
|
|
|
|
if (( (ADD || DELETE || EDITKEY || IMPORT || IMPORT_TRUSTDB || INIT || POPULATE || RECEIVE || UPDATEDB) && EUID != 0 )); then
|
|
error "$(gettext "%s needs to be run as root for this operation.")" "pacman-key"
|
|
exit 1
|
|
fi
|
|
|
|
CONFIG=${CONFIG:-@sysconfdir@/pacman.conf}
|
|
if [[ ! -r "${CONFIG}" ]]; then
|
|
error "$(gettext "%s configuration file '%s' not found.")" "pacman" "$CONFIG"
|
|
exit 1
|
|
fi
|
|
|
|
# if PACMAN_KEYRING_DIR isn't assigned, try to get it from the config
|
|
# file, falling back on a hard default
|
|
PACMAN_KEYRING_DIR=${PACMAN_KEYRING_DIR:-$(get_from "$CONFIG" "GPGDir" || echo "@sysconfdir@/pacman.d/gnupg")}
|
|
|
|
GPG_PACMAN=(gpg --homedir ${PACMAN_KEYRING_DIR} --no-permission-warning)
|
|
|
|
# check only a single operation has been given
|
|
# don't include UPDATEDB in here as other opts can induce it
|
|
numopt=$(( ADD + DELETE + EDITKEY + EXPORT + FINGER + IMPORT + IMPORT_TRUSTDB +
|
|
INIT + LISTKEYS + LISTSIGS + POPULATE + RECEIVE + VERIFY ))
|
|
|
|
case $numopt in
|
|
0)
|
|
if (( ! UPDATEDB )); then
|
|
error "$(gettext "no operation specified (use -h for help)")"
|
|
exit 1
|
|
fi
|
|
;;
|
|
[!1])
|
|
error "$(gettext "Multiple operations specified")"
|
|
printf "$(gettext "Please run %s with each operation separately\n")" "pacman-key"
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
(( ! INIT )) && check_keyring
|
|
|
|
(( ADD )) && "${GPG_PACMAN[@]}" --quiet --batch --import "${KEYFILES[@]}"
|
|
(( DELETE )) && "${GPG_PACMAN[@]}" --quiet --batch --delete-key --yes "${KEYIDS[@]}"
|
|
(( EDITKEY )) && edit_keys
|
|
(( EXPORT )) && "${GPG_PACMAN[@]}" --armor --export "${KEYIDS[@]}"
|
|
(( FINGER )) && "${GPG_PACMAN[@]}" --batch --fingerprint "${KEYIDS[@]}"
|
|
(( IMPORT )) && import
|
|
(( IMPORT_TRUSTDB)) && import_trustdb
|
|
(( INIT )) && initialize
|
|
(( LISTKEYS )) && "${GPG_PACMAN[@]}" --batch --list-keys "${KEYIDS[@]}"
|
|
(( LISTSIGS )) && "${GPG_PACMAN[@]}" --batch --list-sigs "${KEYIDS[@]}"
|
|
(( POPULATE )) && populate_keyring
|
|
(( RECEIVE )) && receive_keys
|
|
(( VERIFY )) && "${GPG_PACMAN[@]}" --verify $SIGNATURE
|
|
|
|
if (( UPDATEDB )); then
|
|
msg "$(gettext "Updating trust database...")"
|
|
"${GPG_PACMAN[@]}" --batch --check-trustdb
|
|
fi
|
|
|
|
# vim: set ts=2 sw=2 noet:
|