pacman/scripts/pacman-key.sh.in

#!/bin/bash -e
#
#   pacman-key - manages pacman's keyring
#                Based on apt-key, from Debian
#   @configure_input@
#
#   Copyright (c) 2010-2011 Pacman Development Team <pacman-dev@archlinux.org>
#
#   This program is free software; you can redistribute it and/or modify
#   it under the terms of the GNU General Public License as published by
#   the Free Software Foundation; either version 2 of the License, or
#   (at your option) any later version.
#
#   This program is distributed in the hope that it will be useful,
#   but WITHOUT ANY WARRANTY; without even the implied warranty of
#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#   GNU General Public License for more details.
#
#   You should have received a copy of the GNU General Public License
#   along with this program.  If not, see <http://www.gnu.org/licenses/>.
#

# gettext initialization
export TEXTDOMAIN='pacman-scripts'
export TEXTDOMAINDIR='@localedir@'

myver="@PACKAGE_VERSION@"

# Options
ADD=0
DELETE=0
EDITKEY=0
EXPORT=0
FINGER=0
IMPORT=0
IMPORT_TRUSTDB=0
INIT=0
KEYSERVER=''
LISTKEYS=0
LISTSIGS=0
LSIGNKEY=0
POPULATE=0
RECEIVE=0
REFRESH=0
UPDATEDB=0
VERIFY=0

DEFAULT_KEYSERVER='hkp://keys.gnupg.net'

m4_include(library/output_format.sh)

m4_include(library/parse_options.sh)

usage() {
	printf "pacman-key (pacman) %s\n" ${myver}
	echo
	printf "$(gettext "Usage: %s [options]")\n" $(basename $0)
	echo
	printf "$(gettext "Manage pacman\'s list of trusted keys")\n"
	echo
	echo "$(gettext "Options:")"
	echo "$(gettext "  -a, --add [file(s)]       Add the specified keys (empty for stdin)")"
	echo "$(gettext "  -d, --delete <keyid(s)>   Remove the specified keyids")"
	echo "$(gettext "  -e, --export [keyid(s)]   Export the specified or all keyids")"
	echo "$(gettext "  -f, --finger [keyid(s)]   List fingerprint for specified or all keyids")"
	echo "$(gettext "  -h, --help                Show this help message and exit")"
	echo "$(gettext "  -l, --list-keys [keyid(s)] List the specified or all keys")"
	echo "$(gettext "  -r, --recv-keys <keyid(s)> Fetch the specified keyids")"
	echo "$(gettext "  -u, --updatedb            Update the trustdb of pacman")"
	echo "$(gettext "  -v, --verify <signature>  Verify the file specified by the signature")"
	echo "$(gettext "  -V, --version             Show program version")"
	printf "$(gettext "  --config <file>           Use an alternate config file (instead of\n\
                            '%s')")\n" "@sysconfdir@/pacman.conf"
	echo "$(gettext "  --edit-key <keyid(s)>     Present a menu for key management task on keyids")"
	printf "$(gettext "  --gpgdir <dir>            Set an alternate directory for GnuPG (instead\n\
                            of '%s')")\n" "@sysconfdir@/pacman.d/gnupg"
	echo "$(gettext "  --import <dir(s)>         Imports pubring.gpg and trustdb.gpg from dir(s)")"
	echo "$(gettext "  --import-trustdb <dir(s)> Imports ownertrust values from trustdb.gpg in dir(s)")"
	echo "$(gettext "  --init                    Ensure the keyring is properly initialized")"
	echo "$(gettext "  --keyserver               Specify a keyserver to use if necessary")"
	echo "$(gettext "  --list-sigs [keyid(s)]    List keys and their signatures")"
	echo "$(gettext "  --lsign-key <keyid>       Locally sign the specified keyid")"
	printf "$(gettext "  --populate [keyring(s)] Reload the default keys from the (given) keyrings\n\
                            in '%s'")\n" "@pkgdatadir@/keyrings"
	echo "$(gettext "  --refresh-keys [keyid(s)] Update specified or all keys from a keyserver")"
}

version() {
	printf "pacman-key (pacman) %s\n" "${myver}"
	printf "$(gettext "\
Copyright (c) 2010-2011 Pacman Development Team <pacman-dev@archlinux.org>.\n\
This is free software; see the source for copying conditions.\n\
There is NO WARRANTY, to the extent permitted by law.\n")"
}

# read the config file "$1" which has key=value pairs, and return the key which
# matches "$2". the equals sign between pairs may be surrounded by any amount
# of whitespace.
get_from() {
	while IFS='=' read -r key value; do
		[[ -z $key || ${key:0:1} = '#' ]] && continue

		if [[ ${key%% *} = "$2" && -n ${value##* } ]]; then
			echo "${value##* }"
			return 0
		fi
	done < "$1"
	return 1
}

generate_master_key() {
	# Generate the master key, which will be in both pubring and secring
	"${GPG_PACMAN[@]}" --gen-key --batch <<EOF
%echo Generating pacman keychain master key...
Key-Type: RSA
Key-Length: 2048
Key-Usage: sign
Name-Real: Pacman Keychain Master Key
Name-Email: pacman@localhost
Expire-Date: 0
%commit
%echo Done
EOF
}

secret_keys_available() {
	"${GPG_PACMAN[@]}" -K --with-colons | wc -l
}

# Adds the given gpg.conf option if it is not present in the file.
# Note that if we find it commented out, we won't add the option.
# args: $1 conffile, $2 option-name, $3 (optional) option-value
add_gpg_conf_option() {
	local confline
	# looking for the option 'bare', only leading spaces or # chars allowed,
	# followed by at least one space and any other text or the end of line.
	if ! grep -q "^[[:space:]#]*$2\([[:space:]].*\)*$" "$1" &>/dev/null; then
		confline="$2"
		[[ -n $3 ]] && confline="$2 $3"
		echo "$confline" >> "$1"
	fi
}

initialize() {
	local conffile keyserv
	# Check for simple existence rather than for a directory as someone
	# may want to use a symlink here
	[[ -e ${PACMAN_KEYRING_DIR} ]] || mkdir -p -m 755 "${PACMAN_KEYRING_DIR}"

	# keyring files
	[[ -f ${PACMAN_KEYRING_DIR}/pubring.gpg ]] || touch ${PACMAN_KEYRING_DIR}/pubring.gpg
	[[ -f ${PACMAN_KEYRING_DIR}/secring.gpg ]] || touch ${PACMAN_KEYRING_DIR}/secring.gpg
	[[ -f ${PACMAN_KEYRING_DIR}/trustdb.gpg ]] || "${GPG_PACMAN[@]}" --update-trustdb
	chmod 644 ${PACMAN_KEYRING_DIR}/{pubring,trustdb}.gpg
	chmod 600 ${PACMAN_KEYRING_DIR}/secring.gpg

	# gpg.conf
	conffile="${PACMAN_KEYRING_DIR}/gpg.conf"
	[[ -f $conffile ]] || touch "$conffile"
	chmod 644 "$conffile"
	add_gpg_conf_option "$conffile" 'no-greeting'
	add_gpg_conf_option "$conffile" 'no-permission-warning'
	add_gpg_conf_option "$conffile" 'lock-never'
	keyserv=${KEYSERVER:-$DEFAULT_KEYSERVER}
	add_gpg_conf_option "$conffile" 'keyserver' "$keyserv"

	# set up a private signing key (if none available)
	if [[ $(secret_keys_available) -lt 1 ]]; then
		generate_master_key
		UPDATEDB=1
	fi
}

check_keyring() {
	if [[ ! -r ${PACMAN_KEYRING_DIR}/pubring.gpg || \
			! -r ${PACMAN_KEYRING_DIR}/trustdb.gpg ]]; then
		error "$(gettext "You do not have sufficient permissions to read the %s keyring...")" "pacman"
		msg "$(gettext "Use '%s' to correct the keyring permissions.")" "pacman-key --init"
		exit 1
	fi

	if (( (EXPORT || FINGER || LIST || VERIFY) && EUID != 0 )); then
		if ! grep -q "^[[:space:]]*lock-never[[:space:]]*$" ${PACMAN_KEYRING_DIR}/gpg.conf &>/dev/null; then
			error "$(gettext "You do not have sufficient permissions to run this command...")"
			msg "$(gettext "Use '%s' to correct the keyring permissions.")" "pacman-key --init"
			exit 1
		fi
	fi

	if (( LSIGNKEY )); then
		if [[ $(secret_keys_available) -lt 1 ]]; then
			error "$(gettext "There is no secret key available to sign with.")"
			msg "$(gettext "Use '%s' to generate a default secret key.")" "pacman-key --init"
			exit 1
		fi
	fi
}

verify_keyring_input() {
	local ret=0;
	local KEYRING_IMPORT_DIR='@pkgdatadir@/keyrings'

	# Verify signatures of keyring files and association revocation files if they exist
	msg "$(gettext "Verifying keyring file signatures...")"
	local keyring
	for keyring in ${KEYRINGIDS[@]}; do
		if ! "${GPG_PACMAN[@]}" --verify "${KEYRING_IMPORT_DIR}/${keyring}.gpg.sig" &>/dev/null; then
			error "$(gettext "The signature of file %s is not valid.")" "${ADDED_KEYS}"
			ret=1
		fi

		if [[ -f "${KEYRING_IMPORT_DIR}/${keyring}-revoked" ]]; then
			if ! "${GPG_PACMAN[@]}" --verify "${KEYRING_IMPORT_DIR}/${keyring}-revoked.sig" &>/dev/null; then
				error "$(gettext "The signature of file %s is not valid.")" "${KEYRING_IMPORT_DIR}/${keyring}-revoked"
				ret=1
			fi
		fi
	done

	return $ret
}

populate_keyring() {
	local KEYRING_IMPORT_DIR='@pkgdatadir@/keyrings'
	local GPG_NOKEYRING=(gpg --batch --quiet --ignore-time-conflict --no-options --no-default-keyring --homedir ${PACMAN_KEYRING_DIR} --no-permission-warning)

	local keyring
	local ret=0
	if [[ -z ${KEYRINGIDS[@]} ]]; then
		# get list of all available keyrings
		shopt -s nullglob
		KEYRINGIDS=("$KEYRING_IMPORT_DIR"/*.gpg)
		shopt -u nullglob
		KEYRINGIDS=("${KEYRINGIDS[@]##*/}")
		KEYRINGIDS=("${KEYRINGIDS[@]%.gpg}")
		if [[ -z ${KEYRINGIDS[@]} ]]; then
			error "$(gettext "No keyring files exist in %s.")" "$KEYRING_IMPORT_DIR"
			ret=1
		fi
	else
		# verify listed keyrings exist
		for keyring in ${KEYRINGIDS[@]}; do
			if [[ ! -f "$KEYRING_IMPORT_DIR/$keyring.gpg" ]]; then
				error "$(gettext "The keyring file %s does not exist.")" "$KEYRING_IMPORT_DIR/$keyring.gpg"
				ret=1
			fi
		done
	fi

	if (( ret )); then
		exit 1
	fi

	verify_keyring_input || exit 1

	# Variable used for iterating on keyrings
	local key
	local key_id

	# Add keys from requested keyrings
	for keyring in ${KEYRINGIDS[@]}; do
		msg "$(gettext "Appending keys from %s.gpg...")" "$keyring"
		local add_keys="$("${GPG_NOKEYRING[@]}" --keyring "${KEYRING_IMPORT_DIR}/${keyring}.gpg" --with-colons --list-keys | grep ^pub | cut -d: -f5)"
		for key_id in ${add_keys}; do
			"${GPG_NOKEYRING[@]}" --keyring "${KEYRING_IMPORT_DIR}/${keyring}.gpg" --export "${key_id}" | "${GPG_PACMAN[@]}" --import
		done
	done

	# Read the revoked key IDs to an array. The conversion from whatever is inside the file
	# to key ids is important, because key ids are the only guarantee of identification
	# for the keys.
	local -A removed_ids
	for keyring in ${KEYRINGIDS[@]}; do
		if [[ -f "${KEYRING_IMPORT_DIR}/${keyring}-revoked" ]]; then
			while read key; do
				local key_values name
				# extract key ID (field 5) and the name of owner (field 10)
				key_values="$("${GPG_PACMAN[@]}" --quiet --with-colons --list-key "${key}" 2>/dev/null | grep ^pub | cut -d: -f5,10 --output-delimiter=' ')"
				if [[ -n $key_values ]]; then
					# The first word is the key_id
					key_id="${key_values%% *}"
					# the rest is the name of the owner
					name="${key_values#* }"
					if [[ -n ${key_id} ]]; then
						# Mark this key to be deleted
						removed_ids[$key_id]="$name"
					fi
				fi
			done < "${KEYRING_IMPORT_DIR}/${keyring}-revoked"
		fi
	done

	# Read list of keys that must be kept installed and remove them from the list
	# of keys to be removed
	if [[ -f "${PACMAN_KEYRING_DIR}/holdkeys" ]]; then
		while read key; do
			key_id="$("${GPG_PACMAN[@]}" --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5)"
			if [[ -n "${removed_ids[$key_id]}" ]]; then
				unset removed_ids[$key_id]
			fi
		done < "${PACMAN_KEYRING_DIR}/holdkeys"
	fi

	# Remove the keys not marked to keep
	if (( ${#removed_ids[@]} > 0 )); then
		msg "$(gettext "Removing revoked keys from keyring...")"
		for key_id in "${!removed_ids[@]}"; do
			echo "  removing key $key_id - ${removed_ids[$key_id]}"
			"${GPG_PACMAN[@]}" --quiet --batch --yes --delete-key "${key_id}"
		done
	fi
}

edit_keys() {
	local errors=0;
	for key in ${KEYIDS[@]}; do
		# Verify if the key exists in pacman's keyring
		if ! "${GPG_PACMAN[@]}" --list-keys "$key" &>/dev/null; then
			error "$(gettext "The key identified by %s does not exist")" "$key"
			errors=1;
		fi
	done
	(( errors )) && exit 1;

	for key in ${KEYIDS[@]}; do
		"${GPG_PACMAN[@]}" --edit-key "$key"
	done
}

import_trustdb() {
	local importdir
	local trustdb=$(mktemp)
	"${GPG_PACMAN[@]}" --export-ownertrust > ${trustdb}

	for importdir in "${IMPORT_DIRS[@]}"; do
		if [[ -f "${importdir}/trustdb.gpg" ]]; then
			gpg --homedir "${importdir}" --export-ownertrust >> ${trustdb}
		fi
	done

	"${GPG_PACMAN[@]}" --import-ownertrust ${trustdb}
	rm -f ${trustdb}
}

import() {
	local importdir

	# Imports public keys, then import trustdbs
	for importdir in "${IMPORT_DIRS[@]}"; do
		if [[ -f "${importdir}/pubring.gpg" ]]; then
			"${GPG_PACMAN[@]}" --quiet --batch --import "${importdir}/pubring.gpg"
		fi
	done

	import_trustdb
}

# PROGRAM START
if ! type gettext &>/dev/null; then
	gettext() {
		echo "$@"
	}
fi

OPT_SHORT="a::d:e:f::hl::r:uv:V"
OPT_LONG="add::,config:,delete:,edit-key:,export::,finger::,gpgdir:"
OPT_LONG+=",help,import:,import-trustdb:,init,keyserver:,list-keys::,list-sigs::"
OPT_LONG+=",lsign-key:,populate::,recv-keys:,refresh-keys::,updatedb"
OPT_LONG+=",verify:,version"
if ! OPT_TEMP="$(parse_options $OPT_SHORT $OPT_LONG "$@")"; then
	echo; usage; exit 1 # E_INVALID_OPTION;
fi
eval set -- "$OPT_TEMP"
unset OPT_SHORT OPT_LONG OPT_TEMP

if [[ $1 == "--" ]]; then
	usage;
	exit 0;
fi

while true; do
	case "$1" in
		-a|--add)         ADD=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYFILES=($1); UPDATEDB=1 ;;
		--config)         shift; CONFIG=$1 ;;
		-d|--delete)      DELETE=1; shift; KEYIDS=($1); UPDATEDB=1 ;;
		--edit-key)       EDITKEY=1; shift; KEYIDS=($1); UPDATEDB=1 ;;
		-e|--export)      EXPORT=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
		-f|--finger)      FINGER=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
		--gpgdir)         shift; PACMAN_KEYRING_DIR=$1 ;;
		--import)         IMPORT=1; shift; IMPORT_DIRS=($1); UPDATEDB=1 ;;
		--import-trustdb) IMPORT_TRUSTDB=1; shift; IMPORT_DIRS=($1); UPDATEDB=1 ;;
		--init)           INIT=1 ;;
		--keyserver)      shift; KEYSERVER=$1 ;;
		-l|--list-keys)   LISTKEYS=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
		--list-sigs)      LISTSIGS=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
		--lsign-key)      LSIGNKEY=1; shift; KEYIDS=($1); UPDATEDB=1 ;;
		--populate)       POPULATE=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYRINGIDS=($1); UPDATEDB=1 ;;
		-r|--recv-keys)   RECEIVE=1; shift; KEYIDS=($1); UPDATEDB=1 ;;
		--refresh-keys)   REFRESH=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
		-u|--updatedb)    UPDATEDB=1 ;;
		-v|--verify)      VERIFY=1; shift; SIGNATURE=$1 ;;

		-h|--help)        usage; exit 0 ;;
		-V|--version)     version; exit 0 ;;

		--)               OPT_IND=0; shift; break;;
		*)                usage; exit 1 ;;
	esac
	shift
done


if ! type -p gpg >/dev/null; then
    error "$(gettext "Cannot find the %s binary required for all %s operations.")" "gpg" "pacman-key"
	exit 1
fi

if (( (ADD || DELETE || EDITKEY || IMPORT || IMPORT_TRUSTDB || INIT || LSIGNKEY || POPULATE || RECEIVE || REFRESH || UPDATEDB) && EUID != 0 )); then
	error "$(gettext "%s needs to be run as root for this operation.")" "pacman-key"
	exit 1
fi

CONFIG=${CONFIG:-@sysconfdir@/pacman.conf}
if [[ ! -r "${CONFIG}" ]]; then
	error "$(gettext "%s configuration file '%s' not found.")" "pacman" "$CONFIG"
	exit 1
fi

# if PACMAN_KEYRING_DIR isn't assigned, try to get it from the config
# file, falling back on a hard default
PACMAN_KEYRING_DIR=${PACMAN_KEYRING_DIR:-$(get_from "$CONFIG" "GPGDir" || echo "@sysconfdir@/pacman.d/gnupg")}

GPG_PACMAN=(gpg --homedir ${PACMAN_KEYRING_DIR} --no-permission-warning)
if [[ -n ${KEYSERVER} ]]; then
	GPG_PACMAN+=(--keyserver ${KEYSERVER})
fi

# check only a single operation has been given
# don't include UPDATEDB in here as other opts can induce it
numopt=$(( ADD + DELETE + EDITKEY + EXPORT + FINGER + IMPORT + IMPORT_TRUSTDB +
		INIT + LISTKEYS + LISTSIGS + LSIGNKEY + POPULATE + RECEIVE + REFRESH + VERIFY ))

case $numopt in
	0)
		if (( ! UPDATEDB )); then
			error "$(gettext "no operation specified (use -h for help)")"
			exit 1
		fi
		;;
	[!1])
		error "$(gettext "Multiple operations specified")"
		printf "$(gettext "Please run %s with each operation separately\n")" "pacman-key"
		exit 1
		;;
esac

(( ! INIT )) && check_keyring

(( ADD )) && "${GPG_PACMAN[@]}" --quiet --batch --import "${KEYFILES[@]}"
(( DELETE )) && "${GPG_PACMAN[@]}" --quiet --batch --delete-key --yes "${KEYIDS[@]}"
(( EDITKEY )) && edit_keys
(( EXPORT )) && "${GPG_PACMAN[@]}" --armor --export "${KEYIDS[@]}"
(( FINGER )) && "${GPG_PACMAN[@]}" --batch --fingerprint "${KEYIDS[@]}"
(( IMPORT )) && import
(( IMPORT_TRUSTDB)) && import_trustdb
(( INIT )) && initialize
(( LISTKEYS )) && "${GPG_PACMAN[@]}" --batch --list-keys "${KEYIDS[@]}"
(( LISTSIGS )) && "${GPG_PACMAN[@]}" --batch --list-sigs "${KEYIDS[@]}"
# TODO: we can't do --batch on lsign until we figure out --command-fd
(( LSIGNKEY )) && "${GPG_PACMAN[@]}" --lsign-key "${KEYIDS[@]}"
(( POPULATE )) && populate_keyring
(( RECEIVE )) && "${GPG_PACMAN[@]}" --recv-keys "${KEYIDS[@]}"
(( REFRESH )) && "${GPG_PACMAN[@]}" --refresh-keys "${KEYIDS[@]}"
(( VERIFY )) && "${GPG_PACMAN[@]}" --verify $SIGNATURE

if (( UPDATEDB )); then
	msg "$(gettext "Updating trust database...")"
	"${GPG_PACMAN[@]}" --batch --check-trustdb
fi

# vim: set ts=2 sw=2 noet: