- Pacman-dev - lists.archlinux.org

[pacman-dev] [Git][pacman/pacman][master] 7 commits: repo-add: add --include-sigs option
by Allan McRae (＠allan) 04 Sep '21

04 Sep '21

Allan McRae pushed to branch master at Pacman / Pacman Commits: fbb29b50 by Allan McRae at 2021-09-04T19:52:23+10:00 repo-add: add --include-sigs option Pacman now downloads the signature files for all packages when present in a repository. That makes distributing signatures within repository databases redundant and costly. Do not distribute the package signature files within the repo databases by default and add an --include-sigs to revert to the old behaviour. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 2109de61 by morganamilo at 2021-09-04T19:52:23+10:00 libalpm: take alpm_trans_t out of the public API this type is only used internally by alpm Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - c5c6633d by morganamilo at 2021-09-04T19:52:23+10:00 libalpm: rename __foo tyes to _foo __foo is reserved in c and should not be used. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - e187aa9b by morganamilo at 2021-09-04T19:52:23+10:00 libalpm: use else when setting fingerprint The docs [1] say keyid will always be there, so no need to check if it exists. [1] https://www.gnupg.org/documentation/manuals/gpgme/Key-objects.html Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 625f3d64 by morganamilo at 2021-09-04T20:43:16+10:00 libalpm: don't use alpm_pgpkey_t in import question When constructing an import question we never really used a proper gpg key. We just zero initialize the key, set the uid and fingerprint, and sent that to the front end. Instead lets just give the import question a uid and fingerprint field. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - be76f8bf by morganamilo at 2021-09-04T20:46:47+10:00 libalpm: add ALPM_TRANS_FLAG_NOHOOKS Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 165e4924 by morganamilo at 2021-09-04T20:46:57+10:00 pacman: don't run hooks when using --dbonly --dbonly is meant to only touch the database and not the actual system. However hooks still run which can leave files in place or run commands you may not want. The hooks being run also means `fakeroot pacman -S --dbpath test/ foo --dbonly` fails because alpm tries to chroot for hooks which requires real root. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 15 changed files: - doc/repo-add.8.asciidoc - lib/libalpm/alpm.h - lib/libalpm/alpm_list.h - lib/libalpm/db.h - lib/libalpm/diskspace.h - lib/libalpm/graph.h - lib/libalpm/handle.h - lib/libalpm/package.h - lib/libalpm/pkghash.h - lib/libalpm/signing.c - lib/libalpm/trans.c - lib/libalpm/trans.h - scripts/repo-add.sh.in - src/pacman/callback.c - src/pacman/pacman.c View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/0a6fecd07271a54d9009ea… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/0a6fecd07271a54d9009ea… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[pacman-dev] [PATCH 1/2] libalpm: add ALPM_TRANS_FLAG_NOHOOKS
by morganamilo 04 Sep '21

04 Sep '21

--- lib/libalpm/alpm.h | 3 ++- lib/libalpm/trans.c | 8 ++++++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/lib/libalpm/alpm.h b/lib/libalpm/alpm.h index c4acc062..8dab8c62 100644 --- a/lib/libalpm/alpm.h +++ b/lib/libalpm/alpm.h @@ -2721,7 +2721,8 @@ typedef enum _alpm_transflag_t { ALPM_TRANS_FLAG_RECURSE = (1 << 5), /** Modify database but do not commit changes to the filesystem. */ ALPM_TRANS_FLAG_DBONLY = (1 << 6), - /* (1 << 7) flag can go here */ + /** Do not run hooks during a transaction */ + ALPM_TRANS_FLAG_NOHOOKS = (1 << 7), /** Use ALPM_PKG_REASON_DEPEND when installing packages. */ ALPM_TRANS_FLAG_ALLDEPS = (1 << 8), /** Only download packages and do not actually install. */ diff --git a/lib/libalpm/trans.c b/lib/libalpm/trans.c index f22f9bf9..ae5c72ae 100644 --- a/lib/libalpm/trans.c +++ b/lib/libalpm/trans.c @@ -198,7 +198,8 @@ int SYMEXPORT alpm_trans_commit(alpm_handle_t *handle, alpm_list_t **data) } } - if(_alpm_hook_run(handle, ALPM_HOOK_PRE_TRANSACTION) != 0) { + if(!(trans->flags & ALPM_TRANS_FLAG_NOHOOKS) && + _alpm_hook_run(handle, ALPM_HOOK_PRE_TRANSACTION) != 0) { RET_ERR(handle, ALPM_ERR_TRANS_HOOK_FAILED, -1); } @@ -232,7 +233,10 @@ int SYMEXPORT alpm_trans_commit(alpm_handle_t *handle, alpm_list_t **data) event.type = ALPM_EVENT_TRANSACTION_DONE; EVENT(handle, (void *)&event); alpm_logaction(handle, ALPM_CALLER_PREFIX, "transaction completed\n"); - _alpm_hook_run(handle, ALPM_HOOK_POST_TRANSACTION); + + if(!(trans->flags & ALPM_TRANS_FLAG_NOHOOKS)) { + _alpm_hook_run(handle, ALPM_HOOK_POST_TRANSACTION); + } } trans->state = STATE_COMMITED; -- 2.32.0

2 3

[pacman-dev] [PATCH 1/2] libalpm: don't use alpm_pgpkey_t in import question
by morganamilo 04 Sep '21

04 Sep '21

When constructing an import question we never really used a proper gpg key. We just zero initialize the key, set the uid and fingerprint, and sent that to the front end. Instead lets just give the import question a uid and fingerprint field. --- lib/libalpm/alpm.h | 6 ++++-- lib/libalpm/signing.c | 10 +++------- src/pacman/callback.c | 6 +++--- 3 files changed, 10 insertions(+), 12 deletions(-) diff --git a/lib/libalpm/alpm.h b/lib/libalpm/alpm.h index c4acc062..07833346 100644 --- a/lib/libalpm/alpm.h +++ b/lib/libalpm/alpm.h @@ -1082,8 +1082,10 @@ typedef struct _alpm_question_import_key_t { alpm_question_type_t type; /** Answer: whether or not to import key */ int import; - /** The key to import */ - alpm_pgpkey_t *key; + /** UID of the key to import */ + const char *uid; + /** Fingerprint the key to import */ + const char *fingerprint; } alpm_question_import_key_t; /** diff --git a/lib/libalpm/signing.c b/lib/libalpm/signing.c index a7be3a1a..bba4e991 100644 --- a/lib/libalpm/signing.c +++ b/lib/libalpm/signing.c @@ -495,7 +495,7 @@ static int email_from_uid(const char *uid, char **email) int _alpm_key_import(alpm_handle_t *handle, const char *uid, const char *fpr) { int ret = -1; - alpm_pgpkey_t fetch_key = {0}; + alpm_pgpkey_t fetch_key; char *email; if(_alpm_access(handle, handle->gpgdir, "pubring.gpg", W_OK)) { @@ -504,19 +504,15 @@ int _alpm_key_import(alpm_handle_t *handle, const char *uid, const char *fpr) return -1; } - STRDUP(fetch_key.uid, uid, return -1); - STRDUP(fetch_key.fingerprint, fpr, free(fetch_key.uid); return -1); alpm_question_import_key_t question = { .type = ALPM_QUESTION_IMPORT_KEY, .import = 0, - .key = &fetch_key + .uid = uid, + .fingerprint = fpr }; QUESTION(handle, &question); - free(fetch_key.uid); - free(fetch_key.fingerprint); - if(question.import) { /* Try to import the key from a WKD first */ if(email_from_uid(uid, &email) == 0) { diff --git a/src/pacman/callback.c b/src/pacman/callback.c index 99ad716e..c9fe4b2e 100644 --- a/src/pacman/callback.c +++ b/src/pacman/callback.c @@ -541,12 +541,12 @@ void cb_question(void *ctx, alpm_question_t *question) { alpm_question_import_key_t *q = &question->import_key; /* the uid is unknown with db signatures */ - if (q->key->uid == NULL) { + if (q->uid == NULL) { q->import = yesno(_("Import PGP key %s?"), - q->key->fingerprint); + q->fingerprint); } else { q->import = yesno(_("Import PGP key %s, \"%s\"?"), - q->key->fingerprint, q->key->uid); + q->fingerprint, q->uid); } } break; -- 2.31.1

2 1

[pacman-dev] [Git][pacman/pacman] Pushed new branch release/6.0.x
by Allan McRae (＠allan) 04 Sep '21

04 Sep '21

Allan McRae pushed new branch release/6.0.x at Pacman / Pacman -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/tree/release/6.0.x You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[pacman-dev] [Git][pacman/pacman] Pushed new tag v6.0.1
by Allan McRae (＠allan) 04 Sep '21

04 Sep '21

Allan McRae pushed new tag v6.0.1 at Pacman / Pacman -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/tree/v6.0.1 You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[pacman-dev] [Git][pacman/pacman][master] 2 commits: Update NEWS for pacman-6.0.1 release
by Allan McRae (＠allan) 04 Sep '21

04 Sep '21

Allan McRae pushed to branch master at Pacman / Pacman Commits: d5e2c0a5 by Allan McRae at 2021-09-04T19:36:20+10:00 Update NEWS for pacman-6.0.1 release Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 0a6fecd0 by Allan McRae at 2021-09-04T19:36:22+10:00 Release pacman-6.0.1 Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 3 changed files: - NEWS - doc/index.asciidoc - meson.build View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/70d0b2c4b92443a96217be… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/70d0b2c4b92443a96217be… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[pacman-dev] [PATCH] Update NEWS for pacman-6.0.1 release
by Allan McRae 04 Sep '21

04 Sep '21

Signed-off-by: Allan McRae <allan(a)archlinux.org> --- NEWS | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/NEWS b/NEWS index ae936661..223f84b6 100644 --- a/NEWS +++ b/NEWS @@ -1,5 +1,20 @@ VERSION DESCRIPTION ----------------------------------------------------------------------------- +6.0.1 - Prevent download error pages ending up in package files + (FS#71083) + - Give -U downloads a random .part file name if needed + W(FS#71464) + - Fix downloading signatures with redirecting URLs (FS#71148) + - Fix double free when importing PGP keys (FS#71107) + - Ensure signature files are named after original file + following redirects (FS#71274) + - Order downloads by size - largest to smallest (FS#70172) + - Fix reproducibility of man pages (FS#71154) + - makepkg: + - Fix stripping debug symbols with binutils 2.37 (FS#71722) + - Export PYTHONHASHSEED for reproducible python packages + - pacman-key: + - Quieten trust db checks. 6.0.0 - internal downloader can retrieve files in parallel (FS#20056) - an additional progress bar is added to track total download progress. This replaces the previous TotalDownload option. -- 2.33.0

1 0

[pacman-dev] [Git][pacman/pacman][master] Include az_AZ translation files
by Allan McRae (＠allan) 04 Sep '21

04 Sep '21

Allan McRae pushed to branch master at Pacman / Pacman Commits: 70d0b2c4 by Allan McRae at 2021-09-04T18:02:39+10:00 Include az_AZ translation files Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 3 changed files: - + lib/libalpm/po/az_AZ.po - + scripts/po/az_AZ.po - + src/pacman/po/az_AZ.po View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/70d0b2c4b92443a96217be0… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/70d0b2c4b92443a96217be0… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[pacman-dev] [Git][pacman/pacman][master] 3 commits: pacman-key: Add --quiet to a few more gpg invocations
by Allan McRae (＠allan) 04 Sep '21

04 Sep '21

Allan McRae pushed to branch master at Pacman / Pacman Commits: 160f5bec by Daan De Meyer at 2021-09-04T13:34:58+10:00 pacman-key: Add --quiet to a few more gpg invocations Currently, when running pacman-key --populate, gpg prints the trustdb check output once for each locally signed and revoked key. When bootstrapping a new container image, about 50 keys get signed and revoked which leads to a huge amount of output when running pacman-key which is repeated 50x. To avoid overloading the user with gpg output, we add --quiet to the gpg calls generating the trustdb checking output to silence those calls which gets rid of the trustdb check output on the terminal. Signed-off-by: Daan De Meyer <daan.j.demeyer(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - c7e4f459 by Daan De Meyer at 2021-09-04T13:43:26+10:00 pacman-key: Reduce gpg trustdb checks Every time we modify gpg's state by signing or revoking a key, gpg marks the trustdb as stale and rechecks it the next time key_is_lsigned() or key_is_revoked() is called. Currently, we alternate calls signing of keys and calling key_is_lsigned() (idem for revoking) which means that for each key we sign (or revoke), gpg will check the trustdb once. To avoid checking the trustb so many times, we can simply do all the key_is_lsigned() and key_is_revoked() checks upfront. Inbetween read operations the trustdb is not marked stale and inbetween write operations the trustdb is also not marked stale. This reduces the amount of trustdb checks from 50 to 1. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 4c3c0e06 by Allan McRae at 2021-09-04T16:16:20+10:00 Update translations from Transifex Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 25 changed files: - lib/libalpm/po/LINGUAS - lib/libalpm/po/ar.po - lib/libalpm/po/ast.po - lib/libalpm/po/bg.po - lib/libalpm/po/br.po - lib/libalpm/po/ca.po - lib/libalpm/po/cs.po - lib/libalpm/po/da.po - lib/libalpm/po/de.po - lib/libalpm/po/el.po - lib/libalpm/po/en_GB.po - lib/libalpm/po/eo.po - lib/libalpm/po/es.po - lib/libalpm/po/es_419.po - lib/libalpm/po/eu.po - lib/libalpm/po/eu_ES.po - lib/libalpm/po/fi.po - lib/libalpm/po/fr.po - lib/libalpm/po/gl.po - lib/libalpm/po/hi.po - lib/libalpm/po/hr.po - lib/libalpm/po/hu.po - lib/libalpm/po/id.po - lib/libalpm/po/it.po - lib/libalpm/po/ja.po View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/5da4af2b5dcb6f214a93fd… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/5da4af2b5dcb6f214a93fd… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[pacman-dev] [PATCH] pacman-key: Reorder key_is_lsigned() and key_is_revoked() checks to reduce gpg trustdb checks
by Daan De Meyer 04 Sep '21

04 Sep '21

Every time we modify gpg's state by signing or revoking a key, gpg marks the trustdb as stale and rechecks it the next time key_is_lsigned() or key_is_revoked() is called. Currently, we alternate calls signing of keys and calling key_is_lsigned() (idem for revoking) which means that for each key we sign (or revoke), gpg will check the trustdb once. When populating the keyring, this means the trustdb is checked roughly 50 times. Each time the trustdb is checked, we get the following output once: ``` gpg: checking the trustdb gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 1EB2638FF56C0C53: no user ID for key signature packet of class 10 gpg: key 1EB2638FF56C0C53: no user ID for key signature packet of class 10 gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 6 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: depth: 1 valid: 6 signed: 83 trust: 0-, 0q, 0n, 6m, 0f, 0u gpg: depth: 2 valid: 78 signed: 25 trust: 78-, 0q, 0n, 0m, 0f, 0u gpg: next trustdb check due at 2021-12-01 ``` This repeated 50x leads to incredibly verbose output from pacman-key. To avoid checking the trustb so many times, we can simply do all the key_is_lsigned() and key_is_revoked() checks upfront. Inbetween read operations the trustdb is not marked stale and inbetween write operations the trustdb is also not marked stale. This reduces the amount of trustdb checks from 50 to 1. The output of pacman-key --populate now looks as follows: ``` gpg: /var/tmp/mkosi-pqii6f64/root/etc/pacman.d/gnupg/trustdb.gpg: trustdb created gpg: no ultimately trusted keys found gpg: starting migration from earlier GnuPG versions gpg: porting secret keys from '/var/tmp/mkosi-pqii6f64/root/etc/pacman.d/gnupg/secring.gpg' to gpg-agent gpg: migration succeeded ==> Generating pacman master key. This may take some time. gpg: Generating pacman keyring master key... gpg: key D429469316A97B49 marked as ultimately trusted gpg: directory '/var/tmp/mkosi-pqii6f64/root/etc/pacman.d/gnupg/openpgp-revocs.d' created gpg: revocation certificate stored as '/var/tmp/mkosi-pqii6f64/root/etc/pacman.d/gnupg/openpgp-revocs.d/059BC618296EDA8B4614FAD4D429469316A97B49.rev' gpg: Done ==> Updating trust database... gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u ==> Appending keys from archlinux.gpg... ==> Locally signing trusted keys in keyring... -> Locally signed 6 keys. ==> Importing owner trust values... gpg: setting ownertrust to 4 gpg: setting ownertrust to 4 gpg: setting ownertrust to 4 gpg: setting ownertrust to 4 gpg: inserting ownertrust of 4 gpg: setting ownertrust to 4 ==> Disabling revoked keys in keyring... -> Disabled 44 keys. ==> Updating trust database... gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 1EB2638FF56C0C53: no user ID for key signature packet of class 10 gpg: key 1EB2638FF56C0C53: no user ID for key signature packet of class 10 gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 6 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: depth: 1 valid: 6 signed: 83 trust: 0-, 0q, 0n, 6m, 0f, 0u gpg: depth: 2 valid: 78 signed: 25 trust: 78-, 0q, 0n, 0m, 0f, 0u gpg: next trustdb check due at 2021-12-01 ``` --- scripts/pacman-key.sh.in | 32 +++++++++++++++++--------------- 1 file changed, 17 insertions(+), 15 deletions(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 50342649..721079b7 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -333,12 +333,29 @@ populate_keyring() { # skip blank lines, comments; these are valid in this file [[ -z $key_id || ${key_id:0:1} = \# ]] && continue + if key_is_lsigned "$key_id" ; then + continue + fi + # Mark this key to be lsigned trusted_ids[$key_id]=$keyring done < "${KEYRING_IMPORT_DIR}/${keyring}-trusted" fi done + local -A revoked_ids + for keyring in "${KEYRINGIDS[@]}"; do + if [[ -s $KEYRING_IMPORT_DIR/$keyring-revoked ]]; then + while read -r key_id; do + if key_is_revoked "$key_id" ; then + continue + fi + + revoked_ids["$key_id"]=1 + done <"$KEYRING_IMPORT_DIR/$keyring-revoked" + fi + done + if (( ${#trusted_ids[@]} > 0 )); then msg "$(gettext "Locally signing trusted keys in keyring...")" lsign_keys "${!trusted_ids[@]}" @@ -350,22 +367,10 @@ populate_keyring() { done fi - local -A revoked_ids - for keyring in "${KEYRINGIDS[@]}"; do - if [[ -s $KEYRING_IMPORT_DIR/$keyring-revoked ]]; then - while read -r key_id; do - revoked_ids["$key_id"]=1 - done <"$KEYRING_IMPORT_DIR/$keyring-revoked" - fi - done - if (( ${#revoked_ids[@]} > 0 )); then local key_count=0 msg "$(gettext "Disabling revoked keys in keyring...")" for key_id in "${!revoked_ids[@]}"; do - if key_is_revoked "$key_id" ; then - continue - fi if (( VERBOSE )); then msg2 "$(gettext "Disabling key %s...")" "${key_id}" fi @@ -485,9 +490,6 @@ lsign_keys() { local ret=0 local key_count=0 for key_id in "$@"; do - if key_is_lsigned "$key_id" ; then - continue - fi if (( VERBOSE )); then msg2 "$(gettext "Locally signing key %s...")" "${key_id}" fi -- 2.33.0

2 2