mirror of
https://github.com/moparisthebest/pacman
synced 2024-12-23 08:18:51 -05:00
1d16875db7
* Fix typos/capitalization * Make sure large blocks of text are translated in one unit Signed-off-by: Dan McGee <dan@archlinux.org>
422 lines
14 KiB
Bash
422 lines
14 KiB
Bash
#!/bin/bash -e
|
|
#
|
|
# pacman-key - manages pacman's keyring
|
|
# Based on apt-key, from Debian
|
|
# @configure_input@
|
|
#
|
|
# Copyright (c) 2010-2011 Pacman Development Team <pacman-dev@archlinux.org>
|
|
#
|
|
# This program is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation; either version 2 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
#
|
|
|
|
# gettext initialization
|
|
export TEXTDOMAIN='pacman-scripts'
|
|
export TEXTDOMAINDIR='@localedir@'
|
|
|
|
myver="@PACKAGE_VERSION@"
|
|
|
|
# Options
|
|
ADD=0
|
|
DELETE=0
|
|
EDITKEY=0
|
|
EXPORT=0
|
|
FINGER=0
|
|
IMPORT=0
|
|
IMPORT_TRUSTDB=0
|
|
INIT=0
|
|
LISTKEYS=0
|
|
LISTSIGS=0
|
|
RECEIVE=0
|
|
RELOAD=0
|
|
UPDATEDB=0
|
|
VERIFY=0
|
|
|
|
m4_include(library/output_format.sh)
|
|
|
|
m4_include(library/parse_options.sh)
|
|
|
|
usage() {
|
|
printf "pacman-key (pacman) %s\n" ${myver}
|
|
echo
|
|
printf "$(gettext "Usage: %s [options]")\n" $(basename $0)
|
|
echo
|
|
printf "$(gettext "Manage pacman\'s list of trusted keys")\n"
|
|
echo
|
|
echo "$(gettext "Options:")"
|
|
echo "$(gettext " -a, --add [<file(s)>] Add the specified keys (empty for stdin)")"
|
|
echo "$(gettext " -d, --delete <keyid(s)> Remove the specified keyids")"
|
|
echo "$(gettext " -e, --export [<keyid(s)>] Export the specified or all keyids")"
|
|
echo "$(gettext " -f, --finger [<keyid(s)>] List fingerprint for specified or all keyids")"
|
|
echo "$(gettext " -h, --help Show this help message and exit")"
|
|
echo "$(gettext " -l, --list-keys [<keyid(s)>] List the specified or all keys")"
|
|
echo "$(gettext " -r, --receive <keyserver> <keyid(s)> Fetch the specified keyids")"
|
|
echo "$(gettext " -u, --updatedb Update the trustdb of pacman")"
|
|
echo "$(gettext " -v, --verify <signature> Verify the file specified by the signature")"
|
|
echo "$(gettext " -V, --version Show program version")"
|
|
printf "$(gettext " --config <file> Use an alternate config file (instead of\n\
|
|
'%s')")\n" "@sysconfdir@/pacman.conf"
|
|
echo "$(gettext " --edit-key <keyid(s)> Present a menu for key management task on keyids")"
|
|
printf "$(gettext " --gpgdir <dir> Set an alternate directory for GnuPG (instead\n\
|
|
of '%s')")\n" "@sysconfdir@/pacman.d/gnupg"
|
|
echo "$(gettext " --import <dir(s)> Imports pubring.gpg and trustdb.gpg from dir(s)")"
|
|
echo "$(gettext " --import-trustdb <dir(s)> Imports ownertrust values from trustdb.gpg in dir(s)")"
|
|
echo "$(gettext " --init Ensure the keyring is properly initialized")"
|
|
echo "$(gettext " --list-sigs [<keyid(s)>] List keys and their signatures")"
|
|
echo "$(gettext " --reload Reload the default keys")"
|
|
}
|
|
|
|
version() {
|
|
printf "pacman-key (pacman) %s\n" "${myver}"
|
|
printf "$(gettext "\
|
|
Copyright (c) 2010-2011 Pacman Development Team <pacman-dev@archlinux.org>.\n\
|
|
This is free software; see the source for copying conditions.\n\
|
|
There is NO WARRANTY, to the extent permitted by law.\n")"
|
|
}
|
|
|
|
# read the config file "$1" which has key=value pairs, and return the key which
|
|
# matches "$2". the equals sign between pairs may be surrounded by any amount
|
|
# of whitespace.
|
|
get_from() {
|
|
while IFS='=' read -r key value; do
|
|
[[ -z $key || ${key:0:1} = '#' ]] && continue
|
|
|
|
if [[ ${key%% *} = "$2" && -n ${value##* } ]]; then
|
|
echo "${value##* }"
|
|
return 0
|
|
fi
|
|
done < "$1"
|
|
return 1
|
|
}
|
|
|
|
initialize() {
|
|
# Check for simple existence rather than for a directory as someone
|
|
# may want to use a symlink here
|
|
[[ -e ${PACMAN_KEYRING_DIR} ]] || mkdir -p -m 755 "${PACMAN_KEYRING_DIR}"
|
|
|
|
# keyring files
|
|
[[ -f ${PACMAN_KEYRING_DIR}/pubring.gpg ]] || touch ${PACMAN_KEYRING_DIR}/pubring.gpg
|
|
[[ -f ${PACMAN_KEYRING_DIR}/secring.gpg ]] || touch ${PACMAN_KEYRING_DIR}/secring.gpg
|
|
[[ -f ${PACMAN_KEYRING_DIR}/trustdb.gpg ]] || "${GPG_PACMAN[@]}" --update-trustdb
|
|
chmod 644 ${PACMAN_KEYRING_DIR}/{{pub,sec}ring,trustdb}.gpg
|
|
|
|
# gpg.conf
|
|
[[ -f ${PACMAN_KEYRING_DIR}/gpg.conf ]] || touch ${PACMAN_KEYRING_DIR}/gpg.conf
|
|
chmod 644 ${PACMAN_KEYRING_DIR}/gpg.conf
|
|
if ! grep -w -q "lock-never" ${PACMAN_KEYRING_DIR}/gpg.conf &>/dev/null; then
|
|
echo "lock-never" >> ${PACMAN_KEYRING_DIR}/gpg.conf
|
|
fi
|
|
}
|
|
|
|
check_keyring() {
|
|
if [[ ! -r ${PACMAN_KEYRING_DIR}/pubring.gpg || \
|
|
! -r ${PACMAN_KEYRING_DIR}/secring.gpg || \
|
|
! -r ${PACMAN_KEYRING_DIR}/trustdb.gpg ]]; then
|
|
error "$(gettext "You do not have sufficient permissions to read the %s keyring...")" "pacman"
|
|
msg "$(gettext "Use '%s' to correct the keyring permissions.")" "pacman-key --init"
|
|
exit 1
|
|
fi
|
|
|
|
if (( (EXPORT || FINGER || LIST || VERIFY) && EUID != 0 )); then
|
|
if ! grep -w -q "lock-never" ${PACMAN_KEYRING_DIR}/gpg.conf &>/dev/null; then
|
|
error "$(gettext "You do not have sufficient permissions to run this command...")"
|
|
msg "$(gettext "Use '%s' to correct the keyring permissions.")" "pacman-key --init"
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
}
|
|
|
|
verify_keyring_input() {
|
|
local ret=0;
|
|
|
|
# Verify signatures of related files, if they exist
|
|
if [[ -r "${ADDED_KEYS}" ]]; then
|
|
msg "$(gettext "Verifying official keys file signature...")"
|
|
if ! "${GPG_PACMAN[@]}" --verify "${ADDED_KEYS}.sig" &>/dev/null; then
|
|
error "$(gettext "The signature of file %s is not valid.")" "${ADDED_KEYS}"
|
|
ret=1
|
|
fi
|
|
fi
|
|
|
|
if [[ -r "${DEPRECATED_KEYS}" ]]; then
|
|
msg "$(gettext "Verifying deprecated keys file signature...")"
|
|
if ! "${GPG_PACMAN[@]}" --verify "${DEPRECATED_KEYS}.sig" &>/dev/null; then
|
|
error "$(gettext "The signature of file %s is not valid.")" "${DEPRECATED_KEYS}"
|
|
ret=1
|
|
fi
|
|
fi
|
|
|
|
if [[ -r "${REMOVED_KEYS}" ]]; then
|
|
msg "$(gettext "Verifying deleted keys file signature...")"
|
|
if ! "${GPG_PACMAN[@]}" --verify "${REMOVED_KEYS}.sig" &>/dev/null; then
|
|
error "$(gettext "The signature of file %s is not valid.")" "${REMOVED_KEYS}"
|
|
ret=1
|
|
fi
|
|
fi
|
|
|
|
return $ret
|
|
}
|
|
|
|
reload_keyring() {
|
|
local PACMAN_SHARE_DIR='@prefix@/share/pacman'
|
|
local GPG_NOKEYRING=(gpg --batch --quiet --ignore-time-conflict --no-options --no-default-keyring --homedir ${PACMAN_KEYRING_DIR})
|
|
|
|
# Variable used for iterating on keyrings
|
|
local key
|
|
local key_id
|
|
|
|
# Keyring with keys to be added to the keyring
|
|
local ADDED_KEYS="${PACMAN_SHARE_DIR}/addedkeys.gpg"
|
|
|
|
# Keyring with keys that were deprecated and will eventually be deleted
|
|
local DEPRECATED_KEYS="${PACMAN_SHARE_DIR}/deprecatedkeys.gpg"
|
|
|
|
# List of keys removed from the keyring. This file is not a keyring, unlike the others.
|
|
# It is a textual list of values that gpg recogniezes as identifiers for keys.
|
|
local REMOVED_KEYS="${PACMAN_SHARE_DIR}/removedkeys"
|
|
|
|
verify_keyring_input || exit 1
|
|
|
|
# Read the key ids to an array. The conversion from whatever is inside the file
|
|
# to key ids is important, because key ids are the only guarantee of identification
|
|
# for the keys.
|
|
local -A removed_ids
|
|
if [[ -r "${REMOVED_KEYS}" ]]; then
|
|
while read key; do
|
|
local key_values name
|
|
key_values="$("${GPG_PACMAN[@]}" --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5,10 --output-delimiter=' ')"
|
|
if [[ -n $key_values ]]; then
|
|
# The first word is the key_id
|
|
key_id="${key_values%% *}"
|
|
# the rest if the name of the owner
|
|
name="${key_values#* }"
|
|
if [[ -n ${key_id} ]]; then
|
|
# Mark this key to be deleted
|
|
removed_ids[$key_id]="$name"
|
|
fi
|
|
fi
|
|
done < "${REMOVED_KEYS}"
|
|
fi
|
|
|
|
# List of keys that must be kept installed, even if in the list of keys to be removed
|
|
local HOLD_KEYS="$(get_from "$CONFIG" "HoldKeys")"
|
|
|
|
# Remove the keys that must be kept from the set of keys that should be removed
|
|
if [[ -n ${HOLD_KEYS} ]]; then
|
|
for key in ${HOLD_KEYS}; do
|
|
key_id="$("${GPG_PACMAN[@]}" --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5)"
|
|
if [[ -n "${removed_ids[$key_id]}" ]]; then
|
|
unset removed_ids[$key_id]
|
|
fi
|
|
done
|
|
fi
|
|
|
|
# Add keys from the current set of keys from pacman-keyring package. The web of trust will
|
|
# be updated automatically.
|
|
if [[ -r "${ADDED_KEYS}" ]]; then
|
|
msg "$(gettext "Appending official keys...")"
|
|
local add_keys="$("${GPG_NOKEYRING[@]}" --keyring "${ADDED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5)"
|
|
for key_id in ${add_keys}; do
|
|
# There is no point in adding a key that will be deleted right after
|
|
if [[ -z "${removed_ids[$key_id]}" ]]; then
|
|
"${GPG_NOKEYRING[@]}" --keyring "${ADDED_KEYS}" --export "${key_id}" | "${GPG_PACMAN[@]}" --import
|
|
fi
|
|
done
|
|
fi
|
|
|
|
if [[ -r "${DEPRECATED_KEYS}" ]]; then
|
|
msg "$(gettext "Appending deprecated keys...")"
|
|
local add_keys="$("${GPG_NOKEYRING[@]}" --keyring "${DEPRECATED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5)"
|
|
for key_id in ${add_keys}; do
|
|
# There is no point in adding a key that will be deleted right after
|
|
if [[ -z "${removed_ids[$key_id]}" ]]; then
|
|
"${GPG_NOKEYRING[@]}" --keyring "${DEPRECATED_KEYS}" --export "${key_id}" | "${GPG_PACMAN[@]}" --import
|
|
fi
|
|
done
|
|
fi
|
|
|
|
# Remove the keys not marked to keep
|
|
if (( ${#removed_ids[@]} > 0 )); then
|
|
msg "$(gettext "Removing deleted keys from keyring...")"
|
|
for key_id in "${!removed_ids[@]}"; do
|
|
echo " removing key $key_id - ${removed_ids[$key_id]}"
|
|
"${GPG_PACMAN[@]}" --quiet --batch --yes --delete-key "${key_id}"
|
|
done
|
|
fi
|
|
|
|
# Update trustdb, just to be sure
|
|
msg "$(gettext "Updating trust database...")"
|
|
"${GPG_PACMAN[@]}" --batch --check-trustdb
|
|
}
|
|
|
|
receive_keys() {
|
|
if [[ -z ${KEYIDS[@]} ]]; then
|
|
error "$(gettext "You need to specify the keyserver and at least one key identifier")"
|
|
exit 1
|
|
fi
|
|
"${GPG_PACMAN[@]}" --keyserver "$KEYSERVER" --recv-keys "${KEYIDS[@]}"
|
|
}
|
|
|
|
edit_keys() {
|
|
local errors=0;
|
|
for key in ${KEYIDS[@]}; do
|
|
# Verify if the key exists in pacman's keyring
|
|
if ! "${GPG_PACMAN[@]}" --list-keys "$key" &>/dev/null; then
|
|
error "$(gettext "The key identified by %s does not exist")" "$key"
|
|
errors=1;
|
|
fi
|
|
done
|
|
(( errors )) && exit 1;
|
|
|
|
for key in ${KEYIDS[@]}; do
|
|
"${GPG_PACMAN[@]}" --edit-key "$key"
|
|
done
|
|
}
|
|
|
|
import_trustdb() {
|
|
local importdir
|
|
local trustdb=$(mktemp)
|
|
"${GPG_PACMAN[@]}" --export-ownertrust > ${trustdb}
|
|
|
|
for importdir in "${IMPORT_DIRS[@]}"; do
|
|
if [[ -f "${importdir}/trustdb.gpg" ]]; then
|
|
gpg --homedir "${importdir}" --export-ownertrust >> ${trustdb}
|
|
fi
|
|
done
|
|
|
|
"${GPG_PACMAN[@]}" --import-ownertrust ${trustdb}
|
|
rm -f ${trustdb}
|
|
}
|
|
|
|
import() {
|
|
local importdir
|
|
|
|
# Imports public keys, then import trustdbs
|
|
for importdir in "${IMPORT_DIRS[@]}"; do
|
|
if [[ -f "${importdir}/pubring.gpg" ]]; then
|
|
"${GPG_PACMAN[@]}" --quiet --batch --import "${importdir}/pubring.gpg"
|
|
fi
|
|
done
|
|
|
|
import_trustdb
|
|
}
|
|
|
|
# PROGRAM START
|
|
if ! type gettext &>/dev/null; then
|
|
gettext() {
|
|
echo "$@"
|
|
}
|
|
fi
|
|
|
|
OPT_SHORT="a::d:e:f::hl::r:uv:V"
|
|
OPT_LONG="add::,config:,delete:,edit-key:,export::,finger::,gpgdir:"
|
|
OPT_LONG+=",help,import:,import-trustdb:,init,list-keys::,list-sigs::,,receive:"
|
|
OPT_LONG+=",reload,updatedb,verify:,version"
|
|
if ! OPT_TEMP="$(parse_options $OPT_SHORT $OPT_LONG "$@")"; then
|
|
echo; usage; exit 1 # E_INVALID_OPTION;
|
|
fi
|
|
eval set -- "$OPT_TEMP"
|
|
unset OPT_SHORT OPT_LONG OPT_TEMP
|
|
|
|
if [[ $1 == "--" ]]; then
|
|
usage;
|
|
exit 0;
|
|
fi
|
|
|
|
while true; do
|
|
case "$1" in
|
|
-a|--add) ADD=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYFILES=($1) ;;
|
|
--config) shift; CONFIG=$1 ;;
|
|
-d|--delete) DELETE=1; shift; KEYIDS=($1) ;;
|
|
--edit-key) EDITKEY=1; shift; KEYIDS=($1) ;;
|
|
-e|--export) EXPORT=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
|
|
-f|--finger) FINGER=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
|
|
--gpgdir) shift; PACMAN_KEYRING_DIR=$1 ;;
|
|
--import) IMPORT=1; shift; IMPORT_DIRS=($1) ;;
|
|
--import-trustdb) IMPORT_TRUSTDB=1; shift; IMPORT_DIRS=($1) ;;
|
|
--init) INIT=1 ;;
|
|
-l|--list-keys) LISTKEYS=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
|
|
--list-sigs) LISTSIGS=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
|
|
-r|--receive) RECEIVE=1; shift; TMP=($1); KEYSERVER=${TMP[0]}; KEYIDS=(${TMP[@]:1}); unset TMP;;
|
|
--reload) RELOAD=1 ;;
|
|
-u|--updatedb) UPDATEDB=1 ;;
|
|
-v|--verify) VERIFY=1; shift; SIGNATURE=$1 ;;
|
|
|
|
-h|--help) usage; exit 0 ;;
|
|
-V|--version) version; exit 0 ;;
|
|
|
|
--) OPT_IND=0; shift; break;;
|
|
*) usage; exit 1 ;;
|
|
esac
|
|
shift
|
|
done
|
|
|
|
|
|
if ! type -p gpg >/dev/null; then
|
|
error "$(gettext "Cannot find the %s binary required for all %s operations.")" "gpg" "pacman-key"
|
|
exit 1
|
|
fi
|
|
|
|
if (( (ADD || DELETE || EDITKEY || IMPORT || IMPORT_TRUSTDB || INIT || RECEIVE || RELOAD || UPDATEDB) && EUID != 0 )); then
|
|
error "$(gettext "%s needs to be run as root for this operation.")" "pacman-key"
|
|
exit 1
|
|
fi
|
|
|
|
CONFIG=${CONFIG:-@sysconfdir@/pacman.conf}
|
|
if [[ ! -r "${CONFIG}" ]]; then
|
|
error "$(gettext "%s configuration file '%s' not found.")" "pacman" "$CONFIG"
|
|
exit 1
|
|
fi
|
|
|
|
# if PACMAN_KEYRING_DIR isn't assigned, try to get it from the config
|
|
# file, falling back on a hard default
|
|
PACMAN_KEYRING_DIR=${PACMAN_KEYRING_DIR:-$(get_from "$CONFIG" "GPGDir" || echo "@sysconfdir@/pacman.d/gnupg")}
|
|
|
|
GPG_PACMAN=(gpg --homedir ${PACMAN_KEYRING_DIR} --no-permission-warning)
|
|
|
|
# check only a single operation has been given
|
|
numopt=$(( ADD + DELETE + EDITKEY + EXPORT + FINGER + IMPORT + IMPORT_TRUSTDB +
|
|
INIT + LISTKEYS + LISTSIGS + RECEIVE + RELOAD + UPDATEDB + VERIFY ))
|
|
|
|
case $numopt in
|
|
0)
|
|
error "$(gettext "no operation specified (use -h for help)")"
|
|
exit 1
|
|
;;
|
|
[!1])
|
|
error "$(gettext "Multiple operations specified")"
|
|
printf "$(gettext "Please run %s with each operation separately\n")" "pacman-key"
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
(( ! INIT )) && check_keyring
|
|
|
|
(( ADD )) && "${GPG_PACMAN[@]}" --quiet --batch --import "${KEYFILES[@]}"
|
|
(( DELETE )) && "${GPG_PACMAN[@]}" --quiet --batch --delete-key --yes "${KEYIDS[@]}"
|
|
(( EDITKEY )) && edit_keys
|
|
(( EXPORT )) && "${GPG_PACMAN[@]}" --armor --export "${KEYIDS[@]}"
|
|
(( FINGER )) && "${GPG_PACMAN[@]}" --batch --fingerprint "${KEYIDS[@]}"
|
|
(( IMPORT )) && import
|
|
(( IMPORT_TRUSTDB)) && import_trustdb
|
|
(( INIT )) && initialize
|
|
(( LISTKEYS )) && "${GPG_PACMAN[@]}" --batch --list-keys "${KEYIDS[@]}"
|
|
(( LISTSIGS )) && "${GPG_PACMAN[@]}" --batch --list-sigs "${KEYIDS[@]}"
|
|
(( RECEIVE )) && receive_keys
|
|
(( RELOAD )) && reload_keyring
|
|
(( UPDATEDB )) && "${GPG_PACMAN[@]}" --batch --check-trustdb
|
|
(( VERIFY )) && "${GPG_PACMAN[@]}" --verify $SIGNATURE
|
|
|
|
# vim: set ts=2 sw=2 noet:
|