From ae20f8820278d285400afb7c3b7f2ba3c789c61a Mon Sep 17 00:00:00 2001 From: "Denis A. Altoé Falqueto" Date: Thu, 16 Sep 2010 00:40:35 -0300 Subject: pacman-key: keyring management tool MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The script pacman-key will manage pacman's keyring. It imports, exports, fetches from keyservers, helps in the process of trusting and updates the trust database. Signed-off-by: Denis A. Altoé Falqueto Signed-off-by: Allan McRae --- scripts/.gitignore | 1 + scripts/Makefile.am | 3 + scripts/pacman-key.sh.in | 274 +++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 278 insertions(+) create mode 100644 scripts/pacman-key.sh.in (limited to 'scripts') diff --git a/scripts/.gitignore b/scripts/.gitignore index fe4616f2..927b14c8 100644 --- a/scripts/.gitignore +++ b/scripts/.gitignore @@ -5,3 +5,4 @@ rankmirrors repo-add repo-remove pkgdelta +pacman-key diff --git a/scripts/Makefile.am b/scripts/Makefile.am index ae6ce366..7c64e81c 100644 --- a/scripts/Makefile.am +++ b/scripts/Makefile.am @@ -8,6 +8,7 @@ bin_SCRIPTS = \ OURSCRIPTS = \ makepkg \ pacman-db-upgrade \ + pacman-key \ pacman-optimize \ pkgdelta \ rankmirrors \ @@ -16,6 +17,7 @@ OURSCRIPTS = \ EXTRA_DIST = \ makepkg.sh.in \ pacman-db-upgrade.sh.in \ + pacman-key.sh.in \ pacman-optimize.sh.in \ pkgdelta.sh.in \ rankmirrors.sh.in \ @@ -64,6 +66,7 @@ $(OURSCRIPTS): Makefile makepkg: $(srcdir)/makepkg.sh.in pacman-db-upgrade: $(srcdir)/pacman-db-upgrade.sh.in +pacman-key: ${srcdir}/pacman-key.sh.in pacman-optimize: $(srcdir)/pacman-optimize.sh.in pkgdelta: $(srcdir)/pkgdelta.sh.in rankmirrors: $(srcdir)/rankmirrors.sh.in diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in new file mode 100644 index 00000000..3efcb177 --- /dev/null +++ b/scripts/pacman-key.sh.in @@ -0,0 +1,274 @@ +#!@BASH_SHELL@ -e +# +# pacman-key - manages pacman's keyring +# Based on apt-key, from Debian +# @configure_input@ +# +# Copyright (c) 2010 - Pacman Development Team +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# + +# gettext initialization +export TEXTDOMAIN='pacman' +export TEXTDOMAINDIR='@localedir@' + +myver="@PACKAGE_VERSION@" + +msg() { + local mesg=$1; shift + printf "==> ${mesg}\n" "$@" >&1 +} + +msg2() { + (( QUIET )) && return + local mesg=$1; shift + printf " -> ${mesg}\n" "$@" >&1 +} + +warning() { + local mesg=$1; shift + printf "==> $(gettext "WARNING:") ${mesg}\n" "$@" >&2 +} + +error() { + local mesg=$1; shift + printf "==> $(gettext "ERROR:") ${mesg}\n" "$@" >&2 +} + +usage() { + printf "pacman-key (pacman) %s\n" ${myver} + echo + printf "$(gettext "Usage: %s [options] command [arguments]")\n" $(basename $0) + echo + echo "$(gettext "Manage pacman's list of trusted keys")" + echo + echo "$(gettext "Options must be placed before commands. The available options are:")" + echo "$(gettext " --config - set an alternative configuration file to use. ")" + printf "$(gettext " Default is %s")\n" "@sysconfdir@/pacman.conf" + echo "$(gettext " --gpgdir - set an alternative home directory for gnupg. ")" + printf "$(gettext " Default is set in %s")\n" "@sysconfdir@/pacman.conf" + echo + echo "$(gettext "The available commands are:")" + echo "$(gettext " pacman-key -a | --add [] ... - add the key contained ")" + echo "$(gettext " in (empty for stdin)")" + echo "$(gettext " pacman-key -d | --del ... - remove the key ")" + echo "$(gettext " pacman-key -e | --export ... - output the key ")" + echo "$(gettext " pacman-key -r | --receive ... - fetch the keyids from")" + echo "$(gettext " the specified keyserver URL")" + echo "$(gettext " pacman-key -t | --trust ... - set the trust level of the given key")" + echo "$(gettext " pacman-key -u | --updatedb - update the trustdb of pacman")" + echo "$(gettext " pacman-key --reload - reloads the keys from the keyring package")" + echo "$(gettext " pacman-key -l | --list - list keys")" + echo "$(gettext " pacman-key -f | --finger [ ... - list fingerprint for specified keyids (or for all, if none is specified)")" + echo "$(gettext " pacman-key --adv - use pacman's keyring as target for advanced commands")" + echo "$(gettext " pacman-key -h | --help - displays this message")" + echo "$(gettext " pacman-key -v | --version - displays the current version")" +} + +version() { + printf "pacman-key (pacman) %s\n" "${myver}" + printf "$(gettext "\ +Copyright (c) 2010 Pacman Development Team .\n\ +This is free software; see the source for copying conditions.\n\ +There is NO WARRANTY, to the extent permitted by law.\n")" +} + +reload_keyring() { + local PACMAN_SHARE_DIR='@prefix@/share/pacman' + local GPG_NOKEYRING="gpg --batch --quiet --ignore-time-conflict --no-options --no-default-keyring --homedir ${PACMAN_KEYRING_DIR}" + + # Read-only keyring with keys to be added to the keyring + local ADDED_KEYS="${PACMAN_SHARE_DIR}/addedkeys.gpg" + + # Read-only list of keys removed from the keyring. + local REMOVED_KEYS="${PACMAN_SHARE_DIR}/removedkeys" + + # Add keys from the current set of keys from pacman-keyring package. The web of trust will + # be updated automatically. + if [[ -r "${ADDED_KEYS}" ]]; then + msg "$(gettext "Verifying official keys file signature...")" + if ! ${GPG_PACMAN} --quiet --verify "${ADDED_KEYS}.sig" 1>/dev/null; then + error "$(gettext "The signature of file %s is not valid.")" "${ADDED_KEYS}" + exit 1 + fi + + msg "$(gettext "Appending official keys...")" + local add_keys=$(${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5) + for key in ${add_keys}; do + msg "$(gettext " key id: %s")" "$key" + ${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --export "${key}" | ${GPG_PACMAN} --import + done + fi + + # Remove the keys from REMOVED_KEYS keyring + if [[ -r "${REMOVED_KEYS}" ]]; then + msg "$(gettext "Verifying deleted keys file signature...")" + if ! ${GPG_PACMAN} --quiet --verify "${REMOVED_KEYS}.sig"; then + error "$(gettext "The signature of file %s is not valid.")" "${REMOVED_KEYS}" + exit 1 + fi + + msg "$(gettext "Removing deleted keys from keyring...")" + cat "${REMOVED_KEYS}" | while read key; do + msg "$(gettext " key id: %s")" "$key" + ${GPG_PACMAN} --quiet --batch --yes --delete-key "${key}" + done + fi + + # Update trustdb, just to be sure + msg "$(gettext "Updating trust database...")" + ${GPG_PACMAN} --batch --check-trustdb +} + +# PROGRAM START +if ! type gettext &>/dev/null; then + gettext() { + echo "$@" + } +fi + +if [[ $1 != "--version" && $1 != "-v" && $1 != "--help" && $1 != "-h" ]]; then + if type -p gpg >/dev/null 2>&1 = 1; then + error "$(gettext "gnupg does not seem to be installed.")" + msg2 "$(gettext "pacman-key requires gnupg for most operations.")" + exit 1 + elif (( EUID != 0 )); then + error "$(gettext "pacman-key needs to be run as root.")" + exit 1 + fi +fi + +# Parse global options +CONFIG="@sysconfdir@/pacman.conf" +PACMAN_KEYRING_DIR="@sysconfdir@/pacman.d/gnupg" +while [[ $1 =~ ^--(config|gpgdir)$ ]]; do + case "$1" in + --config) shift; CONFIG="$1" ;; + --gpgdir) shift; PACMAN_KEYRING_DIR="$1" ;; + esac + shift +done + +if [[ ! -r "${CONFIG}" ]]; then + error "$(gettext "It is not possible to read %s")" "${CONFIG}" + exit 1 +fi + +# Read GPGDIR from $CONFIG. +# The pattern is: any spaces or tabs, GPGDir, any spaces or tabs, equal sign +# and the rest of the line. The string is splitted after the first occurrence of = +if [[ GPGDIR=$(grep -e '^[[:blank:]]*GPGDir[[:blank:]]*=.*' "$CONFIG") == 0 ]]; then + GPGDIR=${GPGDIR#*=} + PACMAN_KEYRING_DIR="${GPGDIR}" +fi +GPG_PACMAN="gpg --homedir ${PACMAN_KEYRING_DIR}" + +# Parse and execute command +command="$1" +if [[ -z "${command}" ]]; then + usage + exit 1 +fi +shift + +case "${command}" in + -a|--add) + if (( $# == 0 )); then + error "$(gettext "You need to specify at least one key identifier")" + usage + exit 1 + fi + while (( $# > 0 )); do + ${GPG_PACMAN} --quiet --batch --import "$1" + shift + done + ;; + -d|--del) + if (( $# == 0 )); then + error "$(gettext "You need to specify at least one key identifier")" + usage + exit 1 + fi + while (( $# > 0 )); do + ${GPG_PACMAN} --quiet --batch --delete-key --yes "$1" + shift + done + ;; + -u|--updatedb) + ${GPG_PACMAN} --batch --check-trustdb + ;; + --reload) + reload_keyring + ;; + -l|--list) + ${GPG_PACMAN} --batch --list-sigs + ;; + -f|--finger) + ${GPG_PACMAN} --batch --fingerprint $* + ;; + -e|--export) + if (( $# == 0 )); then + ${GPG_PACMAN} --armor --export + else + while (( $# > 0 )); do + ${GPG_PACMAN} --armor --export "$1" + shift + done + fi + ;; + -r|--receive) + if (( $# < 2 )); then + error "$(gettext "You need to specify the keyserver and at least one key identifier")" + usage + exit 1 + fi + keyserver="$1" + shift + ${GPG_PACMAN} --keyserver "${keyserver}" --recv-keys $* + ;; + -t|--trust) + if (( $# == 0 )); then + error "$(gettext "You need to specify at least one key identifier")" + usage + exit 1 + fi + while (( $# > 0 )); do + # Verify if the key exists in pacman's keyring + if ${GPG_PACMAN} --list-keys "$1" > /dev/null 2>&1; then + ${GPG_PACMAN} --edit-key "$1" + else + error "$(gettext "The key identified by %s doesn't exist")" "$1" + exit 1 + fi + shift + done + ;; + --adv) + msg "$(gettext "Executing: %s ")$*" "${GPG_PACMAN}" + ${GPG_PACMAN} $* || ret=$? + exit $ret + ;; + --help) + usage + ;; + --version) + version + exit 0 + ;; + *) + usage + exit 1 + ;; +esac -- cgit v1.2.3-24-g4f1b