summaryrefslogtreecommitdiffstats
path: root/scripts
diff options
context:
space:
mode:
Diffstat (limited to 'scripts')
-rw-r--r--scripts/makepkg.sh.in23
1 files changed, 18 insertions, 5 deletions
diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in
index 21bb289c..96e53499 100644
--- a/scripts/makepkg.sh.in
+++ b/scripts/makepkg.sh.in
@@ -1245,9 +1245,9 @@ check_checksums() {
}
parse_gpg_statusfile() {
- local type arg1 arg6
+ local type arg1 arg6 arg10
- while read -r _ type arg1 _ _ _ _ arg6 _; do
+ while read -r _ type arg1 _ _ _ _ arg6 _ _ _ arg10 _; do
case "$type" in
GOODSIG)
pubkey=$arg1
@@ -1283,6 +1283,15 @@ parse_gpg_statusfile() {
status="error"
fi
;;
+ VALIDSIG)
+ if [[ $arg10 ]]; then
+ # If the file was signed with a subkey, arg10 contains
+ # the fingerprint of the primary key
+ fingerprint=$arg10
+ else
+ fingerprint=$arg1
+ fi
+ ;;
TRUST_UNDEFINED|TRUST_NEVER)
trusted=0
;;
@@ -1299,7 +1308,7 @@ check_pgpsigs() {
msg "$(gettext "Verifying source file signatures with %s...")" "gpg"
- local file ext decompress found pubkey success status trusted
+ local file ext decompress found pubkey success status fingerprint trusted
local warning=0
local errors=0
local statusfile=$(mktemp)
@@ -1346,6 +1355,7 @@ check_pgpsigs() {
success=0
status=
pubkey=
+ fingerprint=
trusted=
parse_gpg_statusfile "$statusfile"
if (( ! $success )); then
@@ -1366,9 +1376,12 @@ check_pgpsigs() {
esac
errors=1
else
- if (( ! $trusted )); then
+ if (( ${#validpgpkeys[@]} == 0 && ! $trusted )); then
printf "%s ($(gettext "the public key %s is not trusted"))" $(gettext "FAILED") "$pubkey" >&2
errors=1
+ elif (( ${#validpgpkeys[@]} > 0 )) && ! in_array "$fingerprint" "${validpgpkeys[@]}"; then
+ printf "%s (%s $pubkey)" "$(gettext "FAILED")" "$(gettext "invalid public key")"
+ errors=1
else
printf '%s' "$(gettext "Passed")" >&2
case "$status" in
@@ -2881,7 +2894,7 @@ fi
unset pkgname pkgbase pkgver pkgrel epoch pkgdesc url license groups provides
unset md5sums replaces depends conflicts backup source install changelog build
-unset makedepends optdepends options noextract
+unset makedepends optdepends options noextract validpgpkeys
BUILDFILE=${BUILDFILE:-$BUILDSCRIPT}
if [[ ! -f $BUILDFILE ]]; then