mirror of
https://github.com/moparisthebest/pacman
synced 2024-11-10 19:45:01 -05:00
a4a7006a13
This is the first step at separating the pacman message catalog and the scripts message catalog. Makefiles, configure.ac, and other such files are adjusted accordingly, as well as renaming files. The TEXTDOMAIN of scripts is also adjusted. Note that no actual pot or po files get changed here; these will get pruned in a future commit so each catalog contains only the necessary messages. Signed-off-by: Dan McGee <dan@archlinux.org>
314 lines
10 KiB
Bash
314 lines
10 KiB
Bash
#!@BASH_SHELL@ -e
|
|
#
|
|
# pacman-key - manages pacman's keyring
|
|
# Based on apt-key, from Debian
|
|
# @configure_input@
|
|
#
|
|
# Copyright (c) 2010-2011 Pacman Development Team <pacman-dev@archlinux.org>
|
|
#
|
|
# This program is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation; either version 2 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
#
|
|
|
|
# gettext initialization
|
|
export TEXTDOMAIN='pacman-scripts'
|
|
export TEXTDOMAINDIR='@localedir@'
|
|
|
|
myver="@PACKAGE_VERSION@"
|
|
|
|
m4_include(library/output_format.sh)
|
|
|
|
usage() {
|
|
printf "pacman-key (pacman) %s\n" ${myver}
|
|
echo
|
|
printf "$(gettext "Usage: %s [options] <command> [arguments]")\n" $(basename $0)
|
|
echo
|
|
echo "$(gettext "Manage pacman's list of trusted keys")"
|
|
echo
|
|
echo "$(gettext "Options must be placed before commands. The available options are:")"
|
|
printf "$(gettext " --config <file> Use an alternate config file (instead of '%s')")\n" "$CONFIG"
|
|
printf "$(gettext " --gpgdir Set an alternate directory for gnupg (instead of '%s')")\n" "$PACMAN_KEYRING_DIR"
|
|
echo
|
|
echo "$(gettext "The available commands are:")"
|
|
echo "$(gettext " -a, --add [<file(s)>] Add the specified keys (empty for stdin)")"
|
|
echo "$(gettext " -d, --del <keyid(s)> Remove the specified keyids")"
|
|
echo "$(gettext " -e, --export <keyid(s)> Export the specified keyids")"
|
|
echo "$(gettext " -f, --finger [<keyid(s)>] List fingerprint for specified or all keyids")"
|
|
echo "$(gettext " -h, --help Show this help message and exit")"
|
|
echo "$(gettext " -l, --list List keys")"
|
|
echo "$(gettext " -r, --receive <keyserver> <keyid(s)> Fetch the specified keyids")"
|
|
echo "$(gettext " -t, --trust <keyid(s)> Set the trust level of the given keyids")"
|
|
echo "$(gettext " -u, --updatedb Update the trustdb of pacman")"
|
|
echo "$(gettext " -V, --version Show program version")"
|
|
echo "$(gettext " --adv <params> Use pacman's keyring with advanced gpg commands")"
|
|
printf "$(gettext " --reload Reload the default keys")"
|
|
echo
|
|
}
|
|
|
|
version() {
|
|
printf "pacman-key (pacman) %s\n" "${myver}"
|
|
printf "$(gettext "\
|
|
Copyright (c) 2010-2011 Pacman Development Team <pacman-dev@archlinux.org>.\n\
|
|
This is free software; see the source for copying conditions.\n\
|
|
There is NO WARRANTY, to the extent permitted by law.\n")"
|
|
}
|
|
|
|
# Read provided file and search for values matching the given key
|
|
# The contents of the file are expected to be in this format: key = value
|
|
# 'key', 'equal sign' and 'value' can be surrounded by random whitespace
|
|
# Usage: get_from "$file" "$key" # returns the value for the first matching key in the file
|
|
get_from() {
|
|
while read key _ value; do
|
|
if [[ $key = $2 ]]; then
|
|
echo "$value"
|
|
break
|
|
fi
|
|
done < "$1"
|
|
}
|
|
|
|
reload_keyring() {
|
|
local PACMAN_SHARE_DIR='@prefix@/share/pacman'
|
|
local GPG_NOKEYRING="gpg --batch --quiet --ignore-time-conflict --no-options --no-default-keyring --homedir ${PACMAN_KEYRING_DIR}"
|
|
|
|
# Variable used for iterating on keyrings
|
|
local key
|
|
local key_id
|
|
|
|
# Keyring with keys to be added to the keyring
|
|
local ADDED_KEYS="${PACMAN_SHARE_DIR}/addedkeys.gpg"
|
|
|
|
# Keyring with keys that were deprecated and will eventually be deleted
|
|
local DEPRECATED_KEYS="${PACMAN_SHARE_DIR}/deprecatedkeys.gpg"
|
|
|
|
# List of keys removed from the keyring. This file is not a keyring, unlike the others.
|
|
# It is a textual list of values that gpg recogniezes as identifiers for keys.
|
|
local REMOVED_KEYS="${PACMAN_SHARE_DIR}/removedkeys"
|
|
|
|
# Verify signatures of related files, if they exist
|
|
if [[ -r "${ADDED_KEYS}" ]]; then
|
|
msg "$(gettext "Verifying official keys file signature...")"
|
|
if ! ${GPG_PACMAN} --quiet --batch --verify "${ADDED_KEYS}.sig" 1>/dev/null; then
|
|
error "$(gettext "The signature of file %s is not valid.")" "${ADDED_KEYS}"
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
if [[ -r "${DEPRECATED_KEYS}" ]]; then
|
|
msg "$(gettext "Verifying deprecated keys file signature...")"
|
|
if ! ${GPG_PACMAN} --quiet --batch --verify "${DEPRECATED_KEYS}.sig" 1>/dev/null; then
|
|
error "$(gettext "The signature of file %s is not valid.")" "${DEPRECATED_KEYS}"
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
if [[ -r "${REMOVED_KEYS}" ]]; then
|
|
msg "$(gettext "Verifying deleted keys file signature...")"
|
|
if ! ${GPG_PACMAN} --quiet --batch --verify "${REMOVED_KEYS}.sig"; then
|
|
error "$(gettext "The signature of file %s is not valid.")" "${REMOVED_KEYS}"
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
# Read the key ids to an array. The conversion from whatever is inside the file
|
|
# to key ids is important, because key ids are the only guarantee of identification
|
|
# for the keys.
|
|
local -A removed_ids
|
|
if [[ -r "${REMOVED_KEYS}" ]]; then
|
|
while read key; do
|
|
local key_values name
|
|
key_values=$(${GPG_PACMAN} --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5,10 --output-delimiter=' ')
|
|
if [[ -n $key_values ]]; then
|
|
# The first word is the key_id
|
|
key_id=${key_values%% *}
|
|
# the rest if the name of the owner
|
|
name=${key_values#* }
|
|
if [[ -n ${key_id} ]]; then
|
|
# Mark this key to be deleted
|
|
removed_ids[$key_id]="$name"
|
|
fi
|
|
fi
|
|
done < "${REMOVED_KEYS}"
|
|
fi
|
|
|
|
# List of keys that must be kept installed, even if in the list of keys to be removed
|
|
local HOLD_KEYS=$(get_from "$CONFIG" "HoldKeys")
|
|
|
|
# Remove the keys that must be kept from the set of keys that should be removed
|
|
if [[ -n ${HOLD_KEYS} ]]; then
|
|
for key in ${HOLD_KEYS}; do
|
|
key_id=$(${GPG_PACMAN} --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5)
|
|
if [[ -n "${removed_ids[$key_id]}" ]]; then
|
|
unset removed_ids[$key_id]
|
|
fi
|
|
done
|
|
fi
|
|
|
|
# Add keys from the current set of keys from pacman-keyring package. The web of trust will
|
|
# be updated automatically.
|
|
if [[ -r "${ADDED_KEYS}" ]]; then
|
|
msg "$(gettext "Appending official keys...")"
|
|
local add_keys=$(${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5)
|
|
for key_id in ${add_keys}; do
|
|
# There is no point in adding a key that will be deleted right after
|
|
if [[ -z "${removed_ids[$key_id]}" ]]; then
|
|
${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --export "${key_id}" | ${GPG_PACMAN} --import
|
|
fi
|
|
done
|
|
fi
|
|
|
|
if [[ -r "${DEPRECATED_KEYS}" ]]; then
|
|
msg "$(gettext "Appending deprecated keys...")"
|
|
local add_keys=$(${GPG_NOKEYRING} --keyring "${DEPRECATED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5)
|
|
for key_id in ${add_keys}; do
|
|
# There is no point in adding a key that will be deleted right after
|
|
if [[ -z "${removed_ids[$key_id]}" ]]; then
|
|
${GPG_NOKEYRING} --keyring "${DEPRECATED_KEYS}" --export "${key_id}" | ${GPG_PACMAN} --import
|
|
fi
|
|
done
|
|
fi
|
|
|
|
# Remove the keys not marked to keep
|
|
if (( ${#removed_ids[@]} > 0 )); then
|
|
msg "$(gettext "Removing deleted keys from keyring...")"
|
|
for key_id in "${!removed_ids[@]}"; do
|
|
echo " removing key $key_id - ${removed_ids[$key_id]}"
|
|
${GPG_PACMAN} --quiet --batch --yes --delete-key "${key_id}"
|
|
done
|
|
fi
|
|
|
|
# Update trustdb, just to be sure
|
|
msg "$(gettext "Updating trust database...")"
|
|
${GPG_PACMAN} --batch --check-trustdb
|
|
}
|
|
|
|
# PROGRAM START
|
|
if ! type gettext &>/dev/null; then
|
|
gettext() {
|
|
echo "$@"
|
|
}
|
|
fi
|
|
|
|
if [[ $1 != "--version" && $1 != "-V" && $1 != "--help" && $1 != "-h" && $1 != "" ]]; then
|
|
if type -p gpg >/dev/null 2>&1 = 1; then
|
|
error "$(gettext "gnupg does not seem to be installed.")"
|
|
msg2 "$(gettext "pacman-key requires gnupg for most operations.")"
|
|
exit 1
|
|
elif (( EUID != 0 )); then
|
|
error "$(gettext "pacman-key needs to be run as root.")"
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
# Parse global options
|
|
CONFIG="@sysconfdir@/pacman.conf"
|
|
PACMAN_KEYRING_DIR="@sysconfdir@/pacman.d/gnupg"
|
|
while [[ $1 =~ ^--(config|gpgdir)$ ]]; do
|
|
case "$1" in
|
|
--config) shift; CONFIG="$1" ;;
|
|
--gpgdir) shift; PACMAN_KEYRING_DIR="$1" ;;
|
|
esac
|
|
shift
|
|
done
|
|
|
|
if [[ ! -r "${CONFIG}" ]]; then
|
|
error "$(gettext "%s not found.")" "$CONFIG"
|
|
exit 1
|
|
fi
|
|
|
|
# Read GPGDIR from $CONFIG.
|
|
if [[ GPGDIR=$(get_from "$CONFIG" "GPGDir") == 0 ]]; then
|
|
PACMAN_KEYRING_DIR="${GPGDIR}"
|
|
fi
|
|
GPG_PACMAN="gpg --homedir ${PACMAN_KEYRING_DIR} --no-permission-warning"
|
|
|
|
# Try to create $PACMAN_KEYRING_DIR if non-existent
|
|
# Check for simple existence rather than for a directory as someone may want
|
|
# to use a symlink here
|
|
[[ -e ${PACMAN_KEYRING_DIR} ]] || mkdir -p -m 755 "${PACMAN_KEYRING_DIR}"
|
|
|
|
# Parse and execute command
|
|
command="$1"
|
|
if [[ -z "${command}" ]]; then
|
|
usage
|
|
exit 1
|
|
fi
|
|
shift
|
|
|
|
case "${command}" in
|
|
-a|--add)
|
|
# If there is no extra parameter, gpg will read stdin
|
|
${GPG_PACMAN} --quiet --batch --import "$@"
|
|
;;
|
|
-d|--del)
|
|
if (( $# == 0 )); then
|
|
error "$(gettext "You need to specify at least one key identifier")"
|
|
exit 1
|
|
fi
|
|
${GPG_PACMAN} --quiet --batch --delete-key --yes "$@"
|
|
;;
|
|
-u|--updatedb)
|
|
${GPG_PACMAN} --batch --check-trustdb
|
|
;;
|
|
--reload)
|
|
reload_keyring
|
|
;;
|
|
-l|--list)
|
|
${GPG_PACMAN} --batch --list-sigs "$@"
|
|
;;
|
|
-f|--finger)
|
|
${GPG_PACMAN} --batch --fingerprint "$@"
|
|
;;
|
|
-e|--export)
|
|
${GPG_PACMAN} --armor --export "$@"
|
|
;;
|
|
-r|--receive)
|
|
if (( $# < 2 )); then
|
|
error "$(gettext "You need to specify the keyserver and at least one key identifier")"
|
|
exit 1
|
|
fi
|
|
keyserver="$1"
|
|
shift
|
|
${GPG_PACMAN} --keyserver "${keyserver}" --recv-keys "$@"
|
|
;;
|
|
-t|--trust)
|
|
if (( $# == 0 )); then
|
|
error "$(gettext "You need to specify at least one key identifier")"
|
|
exit 1
|
|
fi
|
|
while (( $# > 0 )); do
|
|
# Verify if the key exists in pacman's keyring
|
|
if ${GPG_PACMAN} --list-keys "$1" > /dev/null 2>&1; then
|
|
${GPG_PACMAN} --edit-key "$1"
|
|
else
|
|
error "$(gettext "The key identified by %s doesn't exist")" "$1"
|
|
exit 1
|
|
fi
|
|
shift
|
|
done
|
|
;;
|
|
--adv)
|
|
msg "$(gettext "Executing: %s ")$*" "${GPG_PACMAN}"
|
|
${GPG_PACMAN} "$@" || ret=$?
|
|
exit $ret
|
|
;;
|
|
-h|--help)
|
|
usage; exit 0 ;;
|
|
-V|--version)
|
|
version; exit 0 ;;
|
|
*)
|
|
error "$(gettext "Unknown command:") $command"
|
|
usage; exit 1 ;;
|
|
esac
|
|
|
|
# vim: set ts=2 sw=2 noet:
|