November 2019 - Pacman-dev - lists.archlinux.org

[pacman-dev] [PATCH] libmakepkg: fix empty arguments in parseopts
by Ethan Sommer 05 Nov '19

05 Nov '19

Previously parseopts checked if there was an argument by checking that the string was non-empty, resulting in empty arguments being incorrectly considered non-existent. This change makes parseopts check if arguments exist at all, rather than checking that they are non-empty Signed-off-by: Ethan Sommer <e5ten.arch(a)gmail.com> --- scripts/libmakepkg/util/parseopts.sh.in | 8 ++++---- test/scripts/parseopts_test.sh | 5 ++++- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/scripts/libmakepkg/util/parseopts.sh.in b/scripts/libmakepkg/util/parseopts.sh.in index c056cb1e..8fb862d8 100644 --- a/scripts/libmakepkg/util/parseopts.sh.in +++ b/scripts/libmakepkg/util/parseopts.sh.in @@ -102,7 +102,7 @@ parseopts() { OPTRET+=("${1:i+1}") break # if we're at the end, grab the the next positional, if it exists - elif (( i == ${#1} - 1 )) && [[ $2 ]]; then + elif (( i == ${#1} - 1 && $# > 1 )); then OPTRET+=("$2") shift break @@ -121,7 +121,7 @@ parseopts() { case $? in 0) # parse failure - if [[ $optarg ]]; then + if [[ $1 = *=* ]]; then printf "${0##*/}: $(gettext "option '%s' does not allow an argument")\n" "--$opt" >&2 OPTRET=(--) return 1 @@ -132,10 +132,10 @@ parseopts() { ;; 1) # --longopt=optarg - if [[ $optarg ]]; then + if [[ $1 = *=* ]]; then OPTRET+=("--$opt" "$optarg") # --longopt optarg - elif [[ $2 ]]; then + elif (( $# > 1 )); then OPTRET+=("--$opt" "$2" ) shift # parse failure diff --git a/test/scripts/parseopts_test.sh b/test/scripts/parseopts_test.sh index 9674c6a6..1d76f1ad 100755 --- a/test/scripts/parseopts_test.sh +++ b/test/scripts/parseopts_test.sh @@ -31,7 +31,7 @@ tap_parse() { unset OPTRET } -tap_plan 50 +tap_plan 52 # usage: tap_parse <expected result> <token count> test-params... # a failed tap_parse will match only the end of options marker '--' @@ -111,4 +111,7 @@ tap_parse '--force --' 2 --force # exact match on possible stem (opt has optarg) tap_parse '--clean foo --' 3 --clean=foo +# all possible ways to specify empty optargs +tap_parse '--key --pkg -p --' 7 --key '' --pkg='' -p '' + tap_finish -- 2.23.0

2 5

[pacman-dev] [GIT] The official pacman repository branch, master, updated. v5.2.1-3-g091b244d
by Allan McRae 05 Nov '19

05 Nov '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, master has been updated via 091b244d0ffa281ba9968606184d709e59c2a2d5 (commit) via e1f5f2198370400565c1eb4ca342299767383f65 (commit) via 7be75523297875dacfad9083b0663a04bf823a3e (commit) from f6564377a2b0a0dd6294fb366a3f91a31142e124 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 091b244d0ffa281ba9968606184d709e59c2a2d5 Author: Matthew Sexton <wsdmatty(a)gmail.com> Date: Mon Nov 4 22:30:06 2019 -0500 pacman-key: ignore already lsigned/deleted keys Added two new functions, key_is_lsigned() and key_is_revoked() that check whether a key has been locally signed or revoked respectively during --populate. If the key is already signed or revoked, it is quietly ignored. Suggested-by: Eli Schwartz <eschwartz(a)archlinux.org> Signed-off-by: Matthew Sexton <wsdmatty(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit e1f5f2198370400565c1eb4ca342299767383f65 Author: Matthew Sexton <wsdmatty(a)gmail.com> Date: Sun Nov 3 23:43:00 2019 -0500 pacman-key: hide lsign and revoke output behind --verbose To cut down on spam during --populate, both locally signing and revoking keys now hide the specific keys being signed or revoked, but can be shown with --verbose. A count was added, to show the number of keys signed/revoked during the process. Partially Implements: FS#64142 - pacman-key: make populate less noisy Signed-off-by: Matthew Sexton <wsdmatty(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 7be75523297875dacfad9083b0663a04bf823a3e Author: Ethan Sommer <e5ten.arch(a)gmail.com> Date: Sun Nov 3 19:45:04 2019 -0500 libmakepkg: add optional argument support to parseopts Adds a "?" suffix that can be used to indicate that an option's argument is optional. This allows options to have a default behaviour when the user doesn't specify one, e.g.: --color=[when] being able to behave like --color=auto when only --color is passed Options with optional arguments given on the command line will be returned in the form "--opt=optarg" and "-o=optarg". Despite that not being the syntax for passing an argument with a shortopt (trying to pass -o=foo would make -o's argument "=foo"), this is done to allow the caller to split the option and its optarg easily Signed-off-by: Ethan Sommer <e5ten.arch(a)gmail.com> Reviewed-by: Dave Reisner <dreisner(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: scripts/libmakepkg/util/parseopts.sh.in | 116 ++++++++++++++++++++------------ scripts/pacman-key.sh.in | 56 +++++++++++++-- test/scripts/parseopts_test.sh | 12 +++- 3 files changed, 135 insertions(+), 49 deletions(-) hooks/post-receive -- The official pacman repository

1 0

[pacman-dev] [PATCH v4] pacman-key: ignore already lsigned/deleted keys
by Matthew Sexton 05 Nov '19

05 Nov '19

Added two new functions, key_is_lsigned() and key_is_revoked() that check whether a key has been locally signed or revoked respectively during --populate. If the key is already signed or revoked, it is quietly ignored. Suggested-by: Eli Schwartz <eschwartz(a)archlinux.org> Signed-off-by: Matthew Sexton <wsdmatty(a)gmail.com> --- v4. More bash syntax corrections scripts/pacman-key.sh.in | 42 +++++++++++++++++++++++++++++++++++++--- 1 file changed, 39 insertions(+), 3 deletions(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 3627a805..f02cf3e6 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -190,6 +190,32 @@ check_keyids_exist() { fi } +key_is_lsigned() { + secret_key=$("${GPG_PACMAN[@]}" --with-colons --list-secret-key | awk -F : 'NR==1 {print $5}') + while IFS=: read -r type valid _ _ sign_key _; do + if [[ $type != "sig" || $valid != "!" ]]; then + continue + fi + if [[ "$sign_key" == "$secret_key" ]]; then + return 0 + fi + done < <("${GPG_PACMAN[@]}" --with-colons --check-signatures "$1") + return 1 + +} + +key_is_revoked() { + while IFS=: read -r type _ _ _ _ _ _ _ _ _ _ flags _; do + if [[ $type != "pub" ]]; then + continue + fi + if [[ $flags == *"D"* ]]; then + return 0 + fi + done < <("${GPG_PACMAN[@]}" --with-colons --list-key "$1") + return 1 +} + initialize() { local conffile keyserv # Check for simple existence rather than for a directory as someone @@ -247,7 +273,7 @@ check_keyring() { fi fi - if (( LSIGNKEY )); then + if (( LSIGNKEY || POPULATE )); then if [[ $(secret_keys_available) -lt 1 ]]; then error "$(gettext "There is no secret key available to sign with.")" msg "$(gettext "Use '%s' to generate a default secret key.")" "pacman-key --init" @@ -337,13 +363,18 @@ populate_keyring() { local key_count=0 msg "$(gettext "Disabling revoked keys in keyring...")" for key_id in "${!revoked_ids[@]}"; do + if key_is_revoked "$key_id" ; then + continue + fi if (( VERBOSE )); then msg2 "$(gettext "Disabling key %s...")" "${key_id}" fi printf 'disable\nquit\n' | LANG=C "${GPG_PACMAN[@]}" --command-fd 0 --quiet --batch --edit-key "${key_id}" 2>/dev/null key_count=$((key_count+1)) done - msg2 "$(gettext "Disabled %s keys.")" "${key_count}" + if (( key_count )); then + msg2 "$(gettext "Disabled %s keys.")" "${key_count}" + fi fi } @@ -454,6 +485,9 @@ lsign_keys() { local ret=0 local key_count=0 for key_id in "$@"; do + if key_is_lsigned "$key_id" ; then + continue + fi if (( VERBOSE )); then msg2 "$(gettext "Locally signing key %s...")" "${key_id}" fi @@ -469,7 +503,9 @@ lsign_keys() { if (( ret )); then exit 1 fi - msg2 "$(gettext "Locally signed %s keys.")" "${key_count}" + if (( key_count )); then + msg2 "$(gettext "Locally signed %s keys.")" "${key_count}" + fi } receive_keys() { -- 2.23.0

1 0

[pacman-dev] [PATCH v3] pacman-key: ignore already lsigned/deleted keys
by Matthew Sexton 05 Nov '19

05 Nov '19

Added two new functions, key_is_lsigned() and key_is_revoked() that check whether a key has been locally signed or revoked respectively during --populate. If the key is already signed or revoked, it is quietly ignored. Suggested-by: Eli Schwartz <eschwartz(a)archlinux.org> Signed-off-by: Matthew Sexton <wsdmatty(a)gmail.com> --- v3. Fixed spaced to tabs, renamed functions, moved functions to the proper location, key_is_lsigned now ensures it's reading from the 'sig' line, and a few stylistic corrections suggested by Allan and Morgan. scripts/pacman-key.sh.in | 42 +++++++++++++++++++++++++++++++++++++--- 1 file changed, 39 insertions(+), 3 deletions(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 3627a805..d1c9a456 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -190,6 +190,32 @@ check_keyids_exist() { fi } +key_is_lsigned() { + secret_key=$("${GPG_PACMAN[@]}" --with-colons --list-secret-key | awk -F : 'NR==1 {print $5}') + while IFS=: read -r type valid _ _ sign_key _; do + if [[ $type != "sig" ]] || [[ $valid != "!" ]]; then + continue + fi + if [[ "$sign_key" == "$secret_key" ]]; then + return 0 + fi + done < <("${GPG_PACMAN[@]}" --with-colons --check-signatures "$1") + return 1 + +} + +key_is_revoked() { + while IFS=: read -r type _ _ _ _ _ _ _ _ _ _ flags _; do + if [[ $type != "pub" ]]; then + continue + fi + if [[ $flags == *"D"* ]]; then + return 0 + fi + done < <("${GPG_PACMAN[@]}" --with-colons --list-key "$1") + return 1 +} + initialize() { local conffile keyserv # Check for simple existence rather than for a directory as someone @@ -247,7 +273,7 @@ check_keyring() { fi fi - if (( LSIGNKEY )); then + if (( LSIGNKEY || POPULATE )); then if [[ $(secret_keys_available) -lt 1 ]]; then error "$(gettext "There is no secret key available to sign with.")" msg "$(gettext "Use '%s' to generate a default secret key.")" "pacman-key --init" @@ -337,13 +363,18 @@ populate_keyring() { local key_count=0 msg "$(gettext "Disabling revoked keys in keyring...")" for key_id in "${!revoked_ids[@]}"; do + if key_is_revoked "$key_id" ; then + continue + fi if (( VERBOSE )); then msg2 "$(gettext "Disabling key %s...")" "${key_id}" fi printf 'disable\nquit\n' | LANG=C "${GPG_PACMAN[@]}" --command-fd 0 --quiet --batch --edit-key "${key_id}" 2>/dev/null key_count=$((key_count+1)) done - msg2 "$(gettext "Disabled %s keys.")" "${key_count}" + if (( key_count )); then + msg2 "$(gettext "Disabled %s keys.")" "${key_count}" + fi fi } @@ -454,6 +485,9 @@ lsign_keys() { local ret=0 local key_count=0 for key_id in "$@"; do + if key_is_lsigned "$key_id" ; then + continue + fi if (( VERBOSE )); then msg2 "$(gettext "Locally signing key %s...")" "${key_id}" fi @@ -469,7 +503,9 @@ lsign_keys() { if (( ret )); then exit 1 fi - msg2 "$(gettext "Locally signed %s keys.")" "${key_count}" + if (( key_count )); then + msg2 "$(gettext "Locally signed %s keys.")" "${key_count}" + fi } receive_keys() { -- 2.23.0

1 0

[pacman-dev] [PATCH v2] pacman-key: ignores keys already lsigned/deleted
by Matthew Sexton 05 Nov '19

05 Nov '19

Added two new functions, lsigned_already() and revoked_already() that check whether a key has been locally signed or revoked respectively during --populate. If the key is already signed or revoked, it is quietly ignored. Suggested-by: Eli Schwartz <eschwartz(a)archlinux.org> Signed-off-by: Matthew Sexton <wsdmatty(a)gmail.com> --- v2. (ACTUAL v2.) Previous email was erroneous, I attached the wrong patch. Corrected some inconsistencies. Gave proper attribution to Eli, scripts/pacman-key.sh.in | 43 +++++++++++++++++++++++++++++++++++++--- 1 file changed, 40 insertions(+), 3 deletions(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 3627a805..25bcb3de 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -247,7 +247,7 @@ check_keyring() { fi fi - if (( LSIGNKEY )); then + if (( LSIGNKEY || POPULATE )); then if [[ $(secret_keys_available) -lt 1 ]]; then error "$(gettext "There is no secret key available to sign with.")" msg "$(gettext "Use '%s' to generate a default secret key.")" "pacman-key --init" @@ -337,13 +337,18 @@ populate_keyring() { local key_count=0 msg "$(gettext "Disabling revoked keys in keyring...")" for key_id in "${!revoked_ids[@]}"; do + if revoked_already "$key_id" ; then + continue + fi if (( VERBOSE )); then msg2 "$(gettext "Disabling key %s...")" "${key_id}" fi printf 'disable\nquit\n' | LANG=C "${GPG_PACMAN[@]}" --command-fd 0 --quiet --batch --edit-key "${key_id}" 2>/dev/null key_count=$((key_count+1)) done - msg2 "$(gettext "Disabled %s keys.")" "${key_count}" + if (( key_count )); then + msg2 "$(gettext "Disabled %s keys.")" "${key_count}" + fi fi } @@ -447,6 +452,22 @@ list_sigs() { exit 1 fi } +lsigned_already() { + # Determines whether a key has already been signed locally by getting the + # local pacman secret key and comparing it against signatures on the key + # returns 0 if key is signed, 1 if it is unsigned + secret_key=$("${GPG_PACMAN[@]}" --with-colons --list-secret-key | head -n1 | awk -F : '{print $5}') + while IFS=: read -r _ valid _ _ signkey _; do + if [[ "$valid" != "!" ]]; then + continue + fi + if [[ "$signkey" = "$secret_key" ]]; then + return 0 + fi + done < <("${GPG_PACMAN[@]}" --with-colons --check-signatures "$1") + return 1 + +} lsign_keys() { check_keyids_exist @@ -454,6 +475,7 @@ lsign_keys() { local ret=0 local key_count=0 for key_id in "$@"; do + if lsigned_already "$key_id" ; then continue; fi if (( VERBOSE )); then msg2 "$(gettext "Locally signing key %s...")" "${key_id}" fi @@ -469,7 +491,9 @@ lsign_keys() { if (( ret )); then exit 1 fi - msg2 "$(gettext "Locally signed %s keys.")" "${key_count}" + if (( key_count )); then + msg2 "$(gettext "Locally signed %s keys.")" "${key_count}" + fi } receive_keys() { @@ -511,6 +535,19 @@ refresh_keys() { fi } +revoked_already() { + + while IFS=: read -r type _ _ _ _ _ _ _ _ _ _ flags _; do + if [[ "$type" != "pub" ]]; then + continue + fi + if [[ "$flags" = *"D"* ]]; then + return 0 + fi + done < <("${GPG_PACMAN[@]}" --with-colons --list-key "$1") + return 1 +} + verify_sig() { local ret=0 sig=$1 file=$2 if [[ -z $file && -f ${sig%.*} ]]; then -- 2.23.0

3 3

[pacman-dev] Alternatives system brainstorm
by Allan McRae 04 Nov '19

04 Nov '19

Hi all, Some further brainstorming on alternatives system. Last time, I suggested something like: alternatives=(python->python3) But as was pointed out, there may be many other things you want to bring along with the python binary. Some directly related: /usr/share/man/man1/python3.1.gz -> python.1.gz Some less directly related: /usr/bin/idle /usr/bin/pydoc /usr/bin/python-config Another example would be lua, where you want to set the main interpreter and the header directory. In Debian & Fedora land, these additional files are called slaves. Note that both those distros use the "same" tool to manage these things. In addition, each alternative is given a priority. So if (e.g.) two python2 and python3 are installed at the same time, it would select the one with the higher priority. Fedora also has "ghost" files (not sure about Debian). I.e. the python3 package contains a ghost /usr/bin/python, so searching file databases gives a match. Now how does that inform our potential implementation? Mostly, I don't like that they set up all the alternatives in the post install with one long command passed to their tool. I'd prefer we had a file with a list of needed symlinks so this could happen automatically. So here is a starting point for discussion: In the PKGBUILD: alternatives=('python::python3') that would look for a file in our build root called "python3.alternatives" and include it in the package root. Note we could have more than one such entry. This file could look like: /usr/bin/python3 -> python /usr/bin/idle3 -> idle /usr/include/example3/ -> example/ Could also include an optional priority statement? Or should that be captured in the PKGBUILD? The file would be placed at /var/lib/pacman/alternatives/python/python3. Any comments on that as a starting point. Cheers, Allan

9 38

[pacman-dev] [PATCH] pacman-key: ignores keys already lsigned/deleted
by Matthew Sexton 04 Nov '19

04 Nov '19

Added two new functions, lsigned_already() and revoked_already() that check whether a key has been locally signed or revoked respectively during --populate. If the key is already signed or revoked, it is quietly ignored. Signed-off-by: Matthew Sexton <wsdmatty(a)gmail.com> --- Final version of patch. This patch depends on my previous patch: v2-0001-pacman-key-hide-lsign-and-revoke-output-behind-ve.patch This finishes the implementation of: FS#64142 - pacman-key: make populate less noisy Most of the credit for this goes to Eli, who did the hard part of figuring out gpg wizardry. All I did was bash some stuff. v2. Fixed some inconsistencies in [ vs [[ and removed unnecessary parantheses. scripts/pacman-key.sh.in | 31 +++++++++++++++++++++++++++++-- 1 file changed, 29 insertions(+), 2 deletions(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 3627a805..ba56a3ac 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -247,7 +247,7 @@ check_keyring() { fi fi - if (( LSIGNKEY )); then + if (( LSIGNKEY || POPULATE )); then if [[ $(secret_keys_available) -lt 1 ]]; then error "$(gettext "There is no secret key available to sign with.")" msg "$(gettext "Use '%s' to generate a default secret key.")" "pacman-key --init" @@ -337,13 +337,16 @@ populate_keyring() { local key_count=0 msg "$(gettext "Disabling revoked keys in keyring...")" for key_id in "${!revoked_ids[@]}"; do + if ( revoked_already "$key_id" ) ; then continue; fi if (( VERBOSE )); then msg2 "$(gettext "Disabling key %s...")" "${key_id}" fi printf 'disable\nquit\n' | LANG=C "${GPG_PACMAN[@]}" --command-fd 0 --quiet --batch --edit-key "${key_id}" 2>/dev/null key_count=$((key_count+1)) done - msg2 "$(gettext "Disabled %s keys.")" "${key_count}" + if (( key_count )); then + msg2 "$(gettext "Disabled %s keys.")" "${key_count}" + fi fi } @@ -447,6 +450,18 @@ list_sigs() { exit 1 fi } +lsigned_already() { + # Determines whether a key has already been signed locally by getting the + # local pacman secret key and comparing it against signatures on the key + # returns 0 if key is signed, 1 if it is unsigned + secret_key=$("${GPG_PACMAN[@]}" --with-colons --list-secret-key | head -n1 | awk -F : '{print $5}') + while IFS=: read -r _ valid _ _ signkey _; do + if [ "$valid" != "!" ]; then continue; fi + if [[ "$signkey" == "$secret_key" ]]; then return 0; fi + done < <("${GPG_PACMAN[@]}" --with-colons --check-signatures "$1") + return 1 + +} lsign_keys() { check_keyids_exist @@ -454,6 +469,7 @@ lsign_keys() { local ret=0 local key_count=0 for key_id in "$@"; do + if ( lsigned_already "$key_id" ) ; then continue; fi if (( VERBOSE )); then msg2 "$(gettext "Locally signing key %s...")" "${key_id}" fi @@ -469,7 +485,9 @@ lsign_keys() { if (( ret )); then exit 1 fi + if (( key_count )); then msg2 "$(gettext "Locally signed %s keys.")" "${key_count}" + fi } receive_keys() { @@ -511,6 +529,15 @@ refresh_keys() { fi } +revoked_already() { + + while IFS=: read -r type _ _ _ _ _ _ _ _ _ _ flags _; do + if [ "$type" != "pub" ]; then continue; fi + if [[ "$flags" == *"D"* ]]; then return 0; fi + done < <("${GPG_PACMAN[@]}" --with-colons --list-key "$1") + return 1 +} + verify_sig() { local ret=0 sig=$1 file=$2 if [[ -z $file && -f ${sig%.*} ]]; then -- 2.23.0

1 0

[pacman-dev] [PATCH] pacman-key: ignores keys already lsigned/deleted
by Matthew Sexton 04 Nov '19

04 Nov '19

Added two new functions, lsigned_already() and revoked_already() that check whether a key has been locally signed or revoked respectively during --populate. If the key is already signed or revoked, it is quietly ignored. Signed-off-by: Matthew Sexton <wsdmatty(a)gmail.com> --- Final version of patch. This patch depends on my previous patch: v2-0001-pacman-key-hide-lsign-and-revoke-output-behind-ve.patch This finishes the implementation of: FS#64142 - pacman-key: make populate less noisy Most of the credit for this goes to Eli, who did the hard part of figuring out gpg wizardry. All I did was bash some stuff. scripts/pacman-key.sh.in | 31 +++++++++++++++++++++++++++++-- 1 file changed, 29 insertions(+), 2 deletions(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 3627a805..ba56a3ac 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -247,7 +247,7 @@ check_keyring() { fi fi - if (( LSIGNKEY )); then + if (( LSIGNKEY || POPULATE )); then if [[ $(secret_keys_available) -lt 1 ]]; then error "$(gettext "There is no secret key available to sign with.")" msg "$(gettext "Use '%s' to generate a default secret key.")" "pacman-key --init" @@ -337,13 +337,16 @@ populate_keyring() { local key_count=0 msg "$(gettext "Disabling revoked keys in keyring...")" for key_id in "${!revoked_ids[@]}"; do + if ( revoked_already "$key_id" ) ; then continue; fi if (( VERBOSE )); then msg2 "$(gettext "Disabling key %s...")" "${key_id}" fi printf 'disable\nquit\n' | LANG=C "${GPG_PACMAN[@]}" --command-fd 0 --quiet --batch --edit-key "${key_id}" 2>/dev/null key_count=$((key_count+1)) done - msg2 "$(gettext "Disabled %s keys.")" "${key_count}" + if (( key_count )); then + msg2 "$(gettext "Disabled %s keys.")" "${key_count}" + fi fi } @@ -447,6 +450,18 @@ list_sigs() { exit 1 fi } +lsigned_already() { + # Determines whether a key has already been signed locally by getting the + # local pacman secret key and comparing it against signatures on the key + # returns 0 if key is signed, 1 if it is unsigned + secret_key=$("${GPG_PACMAN[@]}" --with-colons --list-secret-key | head -n1 | awk -F : '{print $5}') + while IFS=: read -r _ valid _ _ signkey _; do + if [ "$valid" != "!" ]; then continue; fi + if [[ "$signkey" == "$secret_key" ]]; then return 0; fi + done < <("${GPG_PACMAN[@]}" --with-colons --check-signatures "$1") + return 1 + +} lsign_keys() { check_keyids_exist @@ -454,6 +469,7 @@ lsign_keys() { local ret=0 local key_count=0 for key_id in "$@"; do + if ( lsigned_already "$key_id" ) ; then continue; fi if (( VERBOSE )); then msg2 "$(gettext "Locally signing key %s...")" "${key_id}" fi @@ -469,7 +485,9 @@ lsign_keys() { if (( ret )); then exit 1 fi + if (( key_count )); then msg2 "$(gettext "Locally signed %s keys.")" "${key_count}" + fi } receive_keys() { @@ -511,6 +529,15 @@ refresh_keys() { fi } +revoked_already() { + + while IFS=: read -r type _ _ _ _ _ _ _ _ _ _ flags _; do + if [ "$type" != "pub" ]; then continue; fi + if [[ "$flags" == *"D"* ]]; then return 0; fi + done < <("${GPG_PACMAN[@]}" --with-colons --list-key "$1") + return 1 +} + verify_sig() { local ret=0 sig=$1 file=$2 if [[ -z $file && -f ${sig%.*} ]]; then -- 2.23.0

1 0

[pacman-dev] [PATCH v2] pacman-key: ignores keys already lsigned during populate
by Matthew Sexton 04 Nov '19

04 Nov '19

WORK IN PROGRESS. I'm only emailing this patch to get some feedback. I added a function that checks whether a key being imported has already been signed, and if it has been, skip lsigning it. I'm not 100% sure this line is entirely necessary: if (( LSIGNKEY || POPULATE )); then I wanted to ensure that there -was- a signing key to check against. It might be a superfluous check, but I couldn't find where --populate implies having run --init. I may've missed it. --- v2. Removed a redundant nested while loop and fixed the handling of lsigned_already return value checking. Also did a little cleanup for neater code. scripts/pacman-key.sh.in | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 3627a805..a152f992 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -247,7 +247,7 @@ check_keyring() { fi fi - if (( LSIGNKEY )); then + if (( LSIGNKEY || POPULATE )); then if [[ $(secret_keys_available) -lt 1 ]]; then error "$(gettext "There is no secret key available to sign with.")" msg "$(gettext "Use '%s' to generate a default secret key.")" "pacman-key --init" @@ -447,6 +447,18 @@ list_sigs() { exit 1 fi } +lsigned_already() { + # Determines whether a key has already been signed locally by getting the + # local pacman secret key and comparing it against signatures on the key + # returns 0 if key is signed, 1 if it is unsigned + secret_key=$("${GPG_PACMAN[@]}" --with-colons --list-secret-key | head -n1 | awk -F : '{print $5}') + while IFS=: read -r _ valid _ _ signkey _; do + if [ "$valid" != "!" ]; then continue; fi + if [[ "$signkey" == "$secret_key" ]]; then return 0; fi + done < <("${GPG_PACMAN[@]}" --with-colons --check-signatures "$1") + return 1 + +} lsign_keys() { check_keyids_exist @@ -454,6 +466,9 @@ lsign_keys() { local ret=0 local key_count=0 for key_id in "$@"; do + if ( lsigned_already "$key_id" ) ; then + continue + fi if (( VERBOSE )); then msg2 "$(gettext "Locally signing key %s...")" "${key_id}" fi @@ -469,7 +484,9 @@ lsign_keys() { if (( ret )); then exit 1 fi + if (( key_count )); then msg2 "$(gettext "Locally signed %s keys.")" "${key_count}" + fi } receive_keys() { -- 2.23.0

1 0

[pacman-dev] [PATCH] pacman-key: ignores keys already lsigned during populate
by Matthew Sexton 04 Nov '19

04 Nov '19

WORK IN PROGRESS. I'm only emailing this patch to get some feedback. I added a function that checks whether a key being imported has already been signed, and if it has been, skip lsigning it. I'm not 100% sure this line is entirely necessary: if (( LSIGNKEY || POPULATE )); then I wanted to ensure that there -was- a signing key to check against. It might be a superfluous check, but I couldn't find where --populate implies having run --init. I may've missed it. Otherwise, just looking for feedback before I move on to step 2 which is not disabling already disabled keys. Let me know if there are any glaring errors you see, or if there is a more elegant way of doing what I did. Signed-off-by: Matthew Sexton <wsdmatty(a)gmail.com> --- scripts/pacman-key.sh.in | 27 ++++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 3627a805..796375a5 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -247,7 +247,7 @@ check_keyring() { fi fi - if (( LSIGNKEY )); then + if (( LSIGNKEY || POPULATE )); then if [[ $(secret_keys_available) -lt 1 ]]; then error "$(gettext "There is no secret key available to sign with.")" msg "$(gettext "Use '%s' to generate a default secret key.")" "pacman-key --init" @@ -447,6 +447,25 @@ list_sigs() { exit 1 fi } +lsigned_already() { + # Determines whether a key has already been signed locally by getting the + # local pacman secret key and comparing it against signatures on the key + # returns 1 if key is not signed, 0 if signed + secret_key=$("${GPG_PACMAN[@]}" --with-colons --list-secret-key | head -n1 | awk -F : '{print $5}') + NEEDS_SIGNED=1 + while read line; do + while IFS=: read -r _ valid _ _ signkey _; do + if [ "$valid" != "!" ]; then + continue + fi + if [[ "$signkey" == "$secret_key" ]]; then + NEEDS_SIGNED=0 + break + fi + done + done < <("${GPG_PACMAN[@]}" --with-colons --check-signatures "$1") + +} lsign_keys() { check_keyids_exist @@ -454,6 +473,10 @@ lsign_keys() { local ret=0 local key_count=0 for key_id in "$@"; do + lsigned_already "$key_id" + if [[ "$NEEDS_SIGNED" == 0 ]]; then + continue + fi if (( VERBOSE )); then msg2 "$(gettext "Locally signing key %s...")" "${key_id}" fi @@ -469,7 +492,9 @@ lsign_keys() { if (( ret )); then exit 1 fi + if (( key_count )); then msg2 "$(gettext "Locally signed %s keys.")" "${key_count}" + fi } receive_keys() { -- 2.23.0

1 1