summaryrefslogtreecommitdiffstats
path: root/scripts/pacman-key.sh.in
AgeCommit message (Collapse)AuthorFilesLines
2019-10-07pacman-key: receive keys from WKD with -r/--recv-keysJonas Witschel1-8/+17
If an email address is specified, we use --locate-key to look up the key using WKD and keyserver as a fallback. If the key is specified as a key ID, this doesn't work, so we use the normal keyserver-based --recv-keys. Note that --refresh-keys still uses the keyservers exclusively for refreshing, though the situation might potentially be improved in a new version of GnuPG: https://lists.gnupg.org/pipermail/gnupg-users/2019-July/062169.html Signed-off-by: Jonas Witschel <diabonas@archlinux.org> Signed-off-by: Allan McRae <allan@archlinux.org>
2019-10-07pacman-key: clean keys on import to remove unknown signaturesEli Schwartz1-0/+1
There is no good reason to bloat the keyring by importing tons of signatures we cannot use; drop any signatures that don't validate against another available key (probably the master keys). If any desired signatures get cleaned, the key can be refreshed after importing the new signing public key. Signed-off-by: Eli Schwartz <eschwartz@archlinux.org> Signed-off-by: Allan McRae <allan@archlinux.org>
2019-10-07pacman-key: make sure we actually use the Web of Trust, which GnuPG doesn't.Eli Schwartz1-0/+5
By default, the latest versions of GnuPG disable the Web of Trust and refuse to import signatures from public keyservers. This is to prevent denial of service attacks, because refusing to import signatures only if the key size is too big, is apparently too silly to consider. Either way, pacman needs the WoT. If pacman imports a key at all, it means everything failed and we are in fallback mode, trying to overcome a shortcoming in the availability of keys in the keyring package. (This commonly means the user needs to acquire a new key during the same transaction that updates archlinux-keyring.) In order for that new key to be usable, it *must* also import signatures from the Master Keys. I don't give credence to this supposed DoS, since the worst case scenario is nothing happening and needing to CTRL+C in order to exit the program. In the case of pacman, this is better than being unable to install anything at all (which is gnupg doing a much more harmful DoS to pacman), and in the already unusual case where something like --refresh-keys is being used directly instead of depending on the keyring package itself, gnupg supports WKD out of the box and will prefer that for people whose keys are marketed as being non-DOSable. Signed-off-by: Eli Schwartz <eschwartz@archlinux.org> Signed-off-by: Allan McRae <allan@archlinux.org>
2019-10-07pacman-key: when refreshing gpg.conf, don't truncate option checkingEli Schwartz1-1/+1
If an option is a two-part option, we print both (separated by IFS=' '), but when grepping to see if it already exists, we only checked the first component. This means that something like keyserver-options could only check if there were existing keyserver options of any sort, but not which ones. Signed-off-by: Eli Schwartz <eschwartz@archlinux.org> Signed-off-by: Allan McRae <allan@archlinux.org>
2018-11-03pacman-key: just accept one file to verify, and enforce detached sigsEli Schwartz1-12/+19
Simply pass options on to gpg the same way gpg uses them -- no looping through and checking lots of signatures. This prevents a situation where the signature file to be verified is manipulated to contain an embedded signature which is valid, but not a detached signature for the file you are actually trying to verify. gpg does not offer an option to verify many files at once by naming each signature/file pair, and there's no reason for us to do so either, since it would be quite tiresome to do so. In the event that there is no signature/file pair specified to pacman-key itself, - preserve gpg's behavior, *if* the matching file does not exist, by - assuming the signature is an embedded signature - deviate from gpg's behavior, by - offering a security warning about which one is happening - when there is an embedded signature *and* a matching detached file, assume the latter is desired Signed-off-by: Eli Schwartz <eschwartz@archlinux.org> Signed-off-by: Allan McRae <allan@archlinux.org>
2018-10-21Port scripts to use libmakepkg's messaging code.Eli Schwartz1-4/+8
Remove all remnants of library/{output_format,term_colors}.sh Signed-off-by: Eli Schwartz <eschwartz@archlinux.org> Signed-off-by: Allan McRae <allan@archlinux.org>
2018-09-18scripts: deduplicate localized copyright messagesEli Schwartz1-1/+2
We don't need to translate the "Copyright YEAR AUTHOR" part, no part of it should probably be translated and it definitely shouldn't turn every single license terms notice into a separate translation just because the author/year is different. Fixes FS#58452 Also consistently add a blank line after the copyright and before the license terms. Signed-off-by: Eli Schwartz <eschwartz@archlinux.org> Signed-off-by: Allan McRae <allan@archlinux.org>
2018-08-10scripts: Remove trailing semicolonsJan Alexander Steffens (heftig)1-3/+3
Signed-off-by: Allan McRae <allan@archlinux.org>
2018-05-14Remove all modelines from the projectEli Schwartz1-2/+0
Many of these are pointless (e.g. there is no need to explicitly turn on spellchecking and language dictionaries for the manpages by default). The only useful modelines are the ones enforcing the project coding standards for indentation style (and "maybe" filetype/syntax, but everything except the asciidoc manpages and makepkg.conf is already autodetected), and indent style can be applied more easily with .editorconfig Signed-off-by: Eli Schwartz <eschwartz@archlinux.org> Signed-off-by: Allan McRae <allan@archlinux.org>
2018-05-12remove unneeded break argument from option parsingRafael Ascensão1-1/+1
Some scripts are using `break 2` to break out of the option parsing loop. Since a single `break` is sufficient in these cases, remove the extra argument. Signed-off-by: Rafael Ascensão <rafa.almas@gmail.com> Signed-off-by: Allan McRae <allan@archlinux.org>
2018-03-14Added gpg-agent.conf to disable the gnupg scdaemonEric Renfro via pacman-dev1-0/+6
This fixes an issue where smartcards, such a Yubikey, would cause the keyring to fail locally signing, thus also failing to verify signed packages. Signed-off-by: Eric Renfro <psi-jack@linux-help.org> Signed-off-by: Allan McRae <allan@archlinux.org>
2018-03-14Update coyrights for 2018Allan McRae1-2/+2
make update-copyright OLD=2017 NEW=201 Signed-off-by: Allan McRae <allan@archlinux.org>
2018-01-19pacman-key: do not set a default keyserverEli Schwartz1-4/+0
Recent versions of GnuPG are perfectly capable of using sane defaults, and the default SKS keyserver over hkps:// is better than hardcoding the same keyserver over hkp:// anyway. Fixes FS#55278 Signed-off-by: Eli Schwartz <eschwartz@archlinux.org> Signed-off-by: Allan McRae <allan@archlinux.org>
2018-01-19use pacman-conf in scriptsAndrew Gregory1-1/+1
Because parsing pacman.conf is so difficult that even we can't do it right. Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com> Signed-off-by: Allan McRae <allan@archlinux.org>
2017-01-04Update copyright yearsAllan McRae1-2/+2
Signed-off-by: Allan McRae <allan@archlinux.org>
2016-10-22makepkg: Move parseopts from library to libmakepkgAlad Wenter1-2/+5
parseopts is used in makepkg and other scripts such as pacman-key as a getopt replacement. Instead of including it in those scripts via a macro, move it to libmakepkg/util/parseopts.sh and have scripts source this file where appropriate. To keep the parseopts test, a new variable was introduced: PM_LIBMAKEPKG_DIR Signed-off-by: Alad Wenter <alad@archlinux.info> Signed-off-by: Allan McRae <allan@archlinux.org>
2016-08-30pacman-key: reject armored signaturesAllan McRae1-0/+4
pacman expects an unarmored signature. makepkg forces the generation of unarmored signatures, and repo-add will reject any armored signature. For consistency pacman-key should also reject armored signatures. Signed-off-by: Allan McRae <allan@archlinux.org>
2016-05-18Use a more generic regexp when parsing output of gpg(1) in signature ↵Leonid Isaev1-1/+1
verification. The current way of extracting key trust from output of gpg --verify is not very robust against changes in the format of said output. As a result, pacman-key can return an error even if the signature is actuall good. This change relaxes the regexp when parsing output of gpg. Signed-off-by: Leonid Isaev <leonid.isaev@jila.colorado.edu> Signed-off-by: Allan McRae <allan@archlinux.org>
2016-01-04Update copyright years for 2016Allan McRae1-2/+2
make update-copyright OLD=2015 NEW=2016 Signed-off-by: Allan McRae <allan@archlinux.org>
2015-10-19Remove space before ellipsesAllan McRae1-1/+1
Makes all use of ellipses consistent... Signed-off-by: Allan McRae <allan@archlinux.org>
2015-02-01Update copyright notices for 2015Allan McRae1-2/+2
Signed-off-by: Allan McRae <allan@archlinux.org>
2014-11-21pacman-key: compatibility with gnupg-2.1Tobias Powalowski1-0/+1
GnuPG 2.1 no longer allow empty passphrases by default. Signed-off-by: Allan McRae <allan@archlinux.org>
2014-08-09pacman-key: stricter parsing for -verifyAllan McRae1-1/+1
Prevents trust being spoofed by using TRUST_FULLY in the signatory's name or in an added notation. Fixes FS#41147. Signed-off-by: Allan McRae <allan@archlinux.org>
2014-01-28Remove ts and sw from vim modeline when noet is setFlorian Pritz1-1/+1
Forcing vim users to view files with a tabstop of 2 seems really unnecessary when noet is set. I find it much easier to read code with ts=4 and I dislike having to override the modeline by hand. Command run: find . -type f -exec sed -i '/vim.* noet/s# ts=2 sw=2##' {} + Signed-off-by: Florian Pritz <bluewind@xinu.at> Signed-off-by: Allan McRae <allan@archlinux.org>
2014-01-06Update copyright years for 2014Allan McRae1-2/+2
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-06-04pacman-key: Do not reinterpret keys from revoked keyringsDave Reisner1-11/+4
Given a revoked keyring containing only: BC1FBE4D2826A0B51E47ED62E2539214C6C11350 We should only disable this specific keyid. This change enforces that the contents of the -revoked keyring file are full fingerprints which can uniquely identify a key. Before: # pacman-key --populate archlinux ==> Appending keys from archlinux.gpg... ==> Locally signing trusted keys in keyring... -> Locally signing key 0E8B644079F599DFC1DDC3973348882F6AC6A4C2... -> Locally signing key 684148BB25B49E986A4944C55184252D824B18E8... -> Locally signing key 44D4A033AC140143927397D47EFD567D4C7EA887... -> Locally signing key 27FFC4769E19F096D41D9265A04F9397CDFD6BB0... -> Locally signing key AB19265E5D7D20687D303246BA1DFB64FFF979E7... ==> Importing owner trust values... ==> Disabling revoked keys in keyring... -> Disabling key 1390420191... -> Disabling key E2539214C6C11350... -> Disabling key 8544EA82113502DE... ==> Updating trust database... gpg: next trustdb check due at 2014-01-22 After: # pacman-key --populate archlinux ==> Appending keys from archlinux.gpg... ==> Locally signing trusted keys in keyring... -> Locally signing key 0E8B644079F599DFC1DDC3973348882F6AC6A4C2... -> Locally signing key 684148BB25B49E986A4944C55184252D824B18E8... -> Locally signing key 44D4A033AC140143927397D47EFD567D4C7EA887... -> Locally signing key 27FFC4769E19F096D41D9265A04F9397CDFD6BB0... -> Locally signing key AB19265E5D7D20687D303246BA1DFB64FFF979E7... ==> Importing owner trust values... ==> Disabling revoked keys in keyring... -> Disabling key BC1FBE4D2826A0B51E47ED62E2539214C6C11350... ==> Updating trust database... gpg: next trustdb check due at 2014-01-22 Partially addresses FS#35478. This does nothing to confirm whether or not the key was successfully disabled -- a ridiculously simple request which appears to be far too difficult for gpg to manage. Signed-off-by: Dave Reisner <dreisner@archlinux.org> Signed-off-by: Allan McRae <allan@archlinux.org>
2013-03-08scripts: Add color to pacman-keyWilliam Giokas1-1/+4
Use --nocolor to suppress colored output from pacman-key, otherwise output will be in color. Signed-off-by: William Giokas <1007380@gmail.com> Signed-off-by: Allan McRae <allan@archlinux.org>
2013-01-04pacman-key: reduce verbosity of --populatePierre Schmitz1-1/+1
Do not bother the user with gpg's verbose output. Signed-off-by: Pierre Schmitz <pierre@archlinux.de> Signed-off-by: Allan McRae <allan@archlinux.org>
2013-01-04pacman-key: handle local signing of multiple keysAllan McRae1-8/+14
gpg --lsign-key does not like being given multiple keys to sign. Signed-off-by: Allan McRae <allan@archlinux.org>
2013-01-03Update copyright year for 2013Allan McRae1-2/+2
Signed-off-by: Allan McRae <allan@archlinux.org>
2012-08-02pacman-key: Use lsign_keys function in --populatePierre Schmitz1-1/+2
This reduces code duplication and also makes --populate a non-interactive function. Signed-off-by: Pierre Schmitz <pierre@archlinux.de>
2012-05-21Merge branch 'maint'Dan McGee1-8/+8
Conflicts: scripts/pacman-key.sh.in
2012-05-21pacman-key: use mapfile over readDave Reisner1-1/+1
Signed-off-by: Dave Reisner <dreisner@archlinux.org>
2012-05-21pacman-key: test for content in keyring filesDave Reisner1-3/+3
Test for file content (-s) rather than just existance (-f). This fixes a bug that manifests itself in the case of an empty -revoked file. A zero element 'keys' array would be passed to gpg, forcing it to list and, subsequently, revoke all known keys. Bug introduced in d1240f67eab6. Signed-off-by: Dave Reisner <dreisner@archlinux.org> Signed-off-by: Dan McGee <dan@archlinux.org>
2012-05-04pacman-key: clarify messages, s/keychain/keyring/Dan McGee1-5/+5
Signed-off-by: Dan McGee <dan@archlinux.org>
2012-04-24pacman-key: lookup keys before receivingDave Reisner1-1/+40
Perform a search for keys that clearly aren't key IDs. This allows receiving keys by name or email address, but only if the key resolves unambiguously. Signed-off-by: Dave Reisner <dreisner@archlinux.org>
2012-04-24pacman-key: allow verification of multiple sig filesDave Reisner1-5/+10
Loop through arguments passed to verify_sig and treat each as a signature to be verified against a source file. Output each file as its checked to avoid ambiguity. Signed-off-by: Dave Reisner <dreisner@archlinux.org>
2012-04-24scripts: avoid dumping usage on parser failDave Reisner1-1/+1
Avoid letting the error message from parseopts get lost in the usage output from pacman-key and makepkg (which is already verbose).
2012-04-24pacman-key: adopt parseopts for option parsingDave Reisner1-85/+94
This requires an ugly amount of reworking of how pacman-key handles options. The change simply to avoid passing keys, files, and directories as arguments to options, but to leave them as arguments to the overall program. This is reasonable since pacman-key limits the user to essentially one operation per invocation (like pacman). Since we now pass around the positional parameters to the various operations, we can add some better sanity checking. Each operation is responsible for testing input and making sure it can operate properly, otherwise it throws an error and exits. The doc is updated to reflect this, and uses similar verbiage as pacman, describing the non-option arguments now passed to pacman-key as targets. Similar to the doc, --help is reorganized to separate operations and options and remove argument tokens from operations. Signed-off-by: Dave Reisner <dreisner@archlinux.org>
2012-04-09Merge branch 'maint'Dan McGee1-5/+1
2012-04-09pacman-key: avoid use of tempfile in verify_sigDave Reisner1-5/+1
Use --status-fd rather than --status-file to keep this contained in a pipeline. Signed-off-by: Dave Reisner <dreisner@archlinux.org>
2012-04-09pacman-key: verify TRUST_ULTIMATE keys as goodDave Reisner1-1/+1
Extend our grep pattern to match TRUST_ULTIMATE, not just TRUST_FULLY, as these keys are to be trusted as well. Signed-off-by: Dave Reisner <dreisner@archlinux.org> Signed-off-by: Dan McGee <dan@archlinux.org>
2012-04-07Merge branch 'maint'Dan McGee1-6/+10
Conflicts: lib/libalpm/signing.c lib/libalpm/sync.c
2012-04-07Revert "parseopts: normalize options into an array"Dave Reisner1-3/+3
This was really only half a fix for FS#28445, as it still doesn't correctly handle the case of filenames with spaces. In the short term, there is no obvious fix for this. In the long term, I believe the correct decision is to rewrite the options parser to be more in line with GNU getopt_long. This reverts commits: ca4142714137b16feabac09c4cda86b0a75036f8. 969dcddbdf9d5dbd91aa414cdd193f3fb26b644b.
2012-04-07pacman-key: Actually verify signatures and exit with correct codesPierre Schmitz1-1/+5
We cannot rely on gpg's exit code. Instead we have to check the status-fd to figure out whether a signature is valid or not. In addition to this pacman-key --verify can now be used in scripts as it will return an exit code of 1 if the signature is invalid. Signed-off-by: Pierre Schmitz <pierre@archlinux.de> Signed-off-by: Dan McGee <dan@archlinux.org>
2012-03-29pacman-key: change to more reliable default keyserverAllan McRae1-1/+1
User reports indicate that the SKS keyservers are more reliable than both the gnupg.net and mit.edu ones. Signed-off-by: Allan McRae <allan@archlinux.org> Signed-off-by: Dan McGee <dan@archlinux.org>
2012-03-29pacman-key: make the -e option work as advertisedAllan McRae1-1/+1
Using -e without arguments failed to export all keys. Using --export worked as expected. Signed-off-by: Allan McRae <allan@archlinux.org> Signed-off-by: Dan McGee <dan@archlinux.org>
2012-03-09Merge branch 'maint'Dan McGee1-39/+0
Conflicts: lib/libalpm/be_package.c
2012-03-05pacman-key: Remove useless signature verification in --populate commandPierre Schmitz1-39/+0
Verifing the keyring at this point is useless as a malicious package is already installed and as such has several options to bypass this check anyway. Signed-off-by: Pierre Schmitz <pierre@archlinux.de> Signed-off-by: Dan McGee <dan@archlinux.org>
2012-02-21Merge branch 'maint'Dan McGee1-3/+3
Conflicts: contrib/pacsysclean.in src/pacman/conf.h
generated by cgit v1.2.3-24-g4f1b (git 2.32.0) at 2024-12-19 15:07:34 +0100