- Pacman-dev - lists.archlinux.org

[pacman-dev] [PATCH v3] pacman-key: Add --import and --import-trustdb
by Pang Yan Han 10 Jul '11

10 Jul '11

Currently, pacman-key allows the user to import their keys using the --add option. However, no similar functionality exists for importing ownertrust values. The --import-trustdb option takes a list of directories and imports ownertrust values if the directories have a trustdb.gpg database. The --import option takes a list of directories and imports keys from pubring.gpg and ownertrust values from trustdb.gpg. Think of it as a combination of --add and --import-trustdb Signed-off-by: Pang Yan Han <pangyanhan(a)gmail.com> --- NOTE: To be applied on top of allan/working There is an issue with this patch and pacman -U See http://mailman.archlinux.org/pipermail/pacman-dev/2011-July/013780.html for more info. doc/pacman-key.8.txt | 7 +++++++ scripts/pacman-key.sh.in | 36 +++++++++++++++++++++++++++++++++--- 2 files changed, 40 insertions(+), 3 deletions(-) diff --git a/doc/pacman-key.8.txt b/doc/pacman-key.8.txt index cf72b83..6314287 100644 --- a/doc/pacman-key.8.txt +++ b/doc/pacman-key.8.txt @@ -60,6 +60,13 @@ Options *-h, \--help*:: Output syntax and command line options. +*\--import* <dir(s)>:: + Adds keys from pubring.gpg into pacman's keyring and imports ownertrust + values from trustdb.gpg in the specified directories. + +*\--import-trustdb* <dir(s)>:: + Imports ownertrust values from trustdb.gpg in the specified directories. + *--init*:: Ensure the keyring is properly initialized and has the required access permissions. diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index cb108ac..91c3d87 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -32,6 +32,8 @@ DELETE=0 EDITKEY=0 EXPORT=0 FINGER=0 +IMPORT=0 +IMPORT_TRUSTDB=0 INIT=0 LIST=0 RECEIVE=0 @@ -66,6 +68,8 @@ usage() { echo "$(gettext " --edit-key <keyid(s)> Present a menu for key management task on keyids")" echo "$(gettext " --gpgdir <dir> Set an alternate directory for gnupg")" printf "$(gettext " (instead of '%s')")\n" "@sysconfdir@/pacman.d/gnupg" + echo "$(gettext " --import <dir(s)> Imports pubring.gpg and trustdb.gpg from dir(s)")" + echo "$(gettext " --import-trustdb <dir(s)> Imports ownertrust values from trustdb.gpg in dir(s)")" echo "$(gettext " --init Ensure the keyring is properly initialized")" echo "$(gettext " --reload Reload the default keys")" } @@ -278,6 +282,27 @@ edit_keys() { done } +import_trustdb() { + local importdir + for importdir in "${IMPORT_DIRS[@]}"; do + if [[ -f "${importdir}/trustdb.gpg" ]]; then + gpg --homedir "${importdir}" --export-ownertrust | ${GPG_PACMAN} --import-ownertrust + fi + done +} + +import() { + local importdir + for importdir in "${IMPORT_DIRS[@]}"; do + if [[ -f "${importdir}/trustdb.gpg" ]]; then + import_trustdb "${import_dir}" + fi + if [[ -f "${importdir}/pubring.gpg" ]]; then + ${GPG_PACMAN} --quiet --batch --import "${importdir}/pubring.gpg" + fi + done +} + # PROGRAM START if ! type gettext &>/dev/null; then gettext() { @@ -287,7 +312,8 @@ fi OPT_SHORT="a::d:e:f::hlr:uv:V" OPT_LONG="add::,config:,delete:,edit-key:,export::,finger::,gpgdir:" -OPT_LONG+=",help,init,list,receive:,reload,updatedb,verify:,version" +OPT_LONG+=",help,import:,import-trustdb:,init,list,receive:,reload,updatedb" +OPT_LONG+=",verify:,version" if ! OPT_TEMP="$(parse_options $OPT_SHORT $OPT_LONG "$@")"; then echo; usage; exit 1 # E_INVALID_OPTION; fi @@ -308,6 +334,8 @@ while true; do -e|--export) EXPORT=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;; -f|--finger) FINGER=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;; --gpgdir) shift; PACMAN_KEYRING_DIR=$1 ;; + --import) IMPORT=1; shift; IMPORT_DIRS=($1) ;; + --import-trustdb) IMPORT_TRUSTDB=1; shift; IMPORT_DIRS=($1) ;; --init) INIT=1 ;; -l|--list) LIST=1 ;; -r|--receive) RECEIVE=1; shift; KEYSERVER="${1[0]}"; KEYIDS=("${1[@]:1}") ;; @@ -330,7 +358,7 @@ if ! type -p gpg >/dev/null; then exit 1 fi -if (( (ADD || DELETE || EDITKEY || INIT || RECEIVE || RELOAD || UPDATEDB) && EUID != 0 )); then +if (( (ADD || DELETE || EDITKEY || IMPORT || IMPORT_TRUSTDB || INIT || RECEIVE || RELOAD || UPDATEDB) && EUID != 0 )); then error "$(gettext "%s needs to be run as root for this operation.")" "pacman-key" exit 1 fi @@ -348,7 +376,7 @@ PACMAN_KEYRING_DIR=${PACMAN_KEYRING_DIR:-$(get_from "$CONFIG" "GPGDir" || echo " GPG_PACMAN="gpg --homedir ${PACMAN_KEYRING_DIR} --no-permission-warning" # check only a single operation has been given -numopt=$(( ADD + DELETE + EDITKEY + EXPORT + FINGER + INIT + LIST + RECEIVE + RELOAD + UPDATEBD + VERIFY )) +numopt=$(( ADD + DELETE + EDITKEY + EXPORT + FINGER + IMPORT + IMPORT_TRUSTDB + INIT + LIST + RECEIVE + RELOAD + UPDATEBD + VERIFY )) if (( ! numopt )); then error "$(gettext "No operations specified")" @@ -370,6 +398,8 @@ fi (( EDITKEY )) && edit_keys (( EXPORT )) && ${GPG_PACMAN} --armor --export "${KEYIDS[@]}" (( FINGER )) && ${GPG_PACMAN} --batch --fingerprint "${KEYIDS[@]}" +(( IMPORT )) && import +(( IMPORT_TRUSTDB)) && import_trustdb (( INIT )) && initialize (( LIST )) && ${GPG_PACMAN} --batch --list-sigs "${KEYIDS[@]}" (( RECEIVE )) && receive_keys -- 1.7.6.132.g8b11f

1 0

[pacman-dev] [PATCH] pacman-key: --init: correct creation of gpg.conf
by Pang Yan Han 10 Jul '11

10 Jul '11

Signed-off-by: Pang Yan Han <pangyanhan(a)gmail.com> --- NOTE: To be applied on top of allan/working scripts/pacman-key.sh.in | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 3ed42e6..cb108ac 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -105,7 +105,7 @@ initialize() { chmod 644 ${PACMAN_KEYRING_DIR}/{{pub,sec}ring,trustdb}.gpg # gpg.conf - [[ ! -f ${PACMAN_KEYRING_DIR}/gpg.conf ]] || touch ${PACMAN_KEYRING_DIR}/gpg.conf + [[ -f ${PACMAN_KEYRING_DIR}/gpg.conf ]] || touch ${PACMAN_KEYRING_DIR}/gpg.conf chmod 644 ${PACMAN_KEYRING_DIR}/gpg.conf if ! grep -w -q "lock-never" ${PACMAN_KEYRING_DIR}/gpg.conf &>/dev/null; then echo "lock-never" >> ${PACMAN_KEYRING_DIR}/gpg.conf -- 1.7.6.132.g8b11f

1 0

[pacman-dev] [PATCH] pacman-key: correct spelling mistake
by Pang Yan Han 10 Jul '11

10 Jul '11

Signed-off-by: Pang Yan Han <pangyanhan(a)gmail.com> --- NOTE: To be applied on top of allan/working scripts/pacman-key.sh.in | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 972749f..3ed42e6 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -66,7 +66,7 @@ usage() { echo "$(gettext " --edit-key <keyid(s)> Present a menu for key management task on keyids")" echo "$(gettext " --gpgdir <dir> Set an alternate directory for gnupg")" printf "$(gettext " (instead of '%s')")\n" "@sysconfdir@/pacman.d/gnupg" - echo "$(gettest " --init Ensure the keyring is properly initialized")" + echo "$(gettext " --init Ensure the keyring is properly initialized")" echo "$(gettext " --reload Reload the default keys")" } -- 1.7.6.132.g8b11f

1 0

[pacman-dev] [PATCH 00/25] Rename types from pmfoo_t to alpm_foo_t
by Allan McRae 09 Jul '11

09 Jul '11

After discussion here and on IRC, it was decided that rather than changing the one struct from alpm_foo_t to pmfoo_t for consistency, it would instead be better to rename all the other structs to follow the alpm_foo_t scheme. Given we are pushing towards 4.0, now is the best (only?) time to do this. I am not going to send the enitre patchset here as that would just be overkill. Take a look at the patches in my repo: http://projects.archlinux.org/users/allan/pacman.git/log/?h=breakshit Allan McRae (25): Rename pmpkgreason_t to alpm_pkgreason_t Rename pmdepmod_t to alpm_depmod_t Rename pmfileconflicttype_t to alpm_fileconflicttype_t Rename pmhandle_t to alpm_handle_t Rename pmdb_t to alpm_db_t Rename pmtrans_t to alpm_trans_t Rename pmdepend_t to alpm_depend_t Rename pmdepmissing_t to alpm_depmissing_t Rename pmconflict_t to alpm_conflict_t Rename pmfileconflict_t to alpm_fileconflict_t Rename pmgrp_t to alpm_grp_t Rename pmdelta_t to alpm_delta_t Rename pmbackup_t to alpm_backup_t Rename pmloglevel_t to alpm_loglevel_t Rename pmtransflag_t to alpm_transflag_t Rename pmtransevt_t to alpm_transevt_t Rename pmtransconv_t to alpm_transconv_t Rename pmtransprog_t to alpm_transprog_t Rename pmerrno_t to alpm_errno_t Rename pmpkgfrom_t to alpm_pkgfrom_t Rename pmgraph_t to alpm_graph_t Rename pmpkghash_t to alpm_pkghash_t Rename pmtransstate_t to alpm_transstate_t Rename pmdbinfrq_t to alpm_dbinfrq_t Rename _pmdbstatus_t to _alpm_dbstatus_t lib/libalpm/add.c | 34 +++--- lib/libalpm/add.h | 2 +- lib/libalpm/alpm.c | 12 +- lib/libalpm/alpm.h | 354 +++++++++++++++++++++++----------------------- lib/libalpm/backup.c | 16 +- lib/libalpm/backup.h | 8 +- lib/libalpm/be_local.c | 82 ++++++------ lib/libalpm/be_package.c | 30 ++-- lib/libalpm/be_sync.c | 34 +++--- lib/libalpm/conflict.c | 62 ++++---- lib/libalpm/conflict.h | 12 +- lib/libalpm/db.c | 92 ++++++------ lib/libalpm/db.h | 62 ++++---- lib/libalpm/delta.c | 68 +++++----- lib/libalpm/delta.h | 8 +- lib/libalpm/deps.c | 136 +++++++++--------- lib/libalpm/deps.h | 16 +- lib/libalpm/diskspace.c | 18 ++-- lib/libalpm/diskspace.h | 2 +- lib/libalpm/dload.c | 6 +- lib/libalpm/dload.h | 4 +- lib/libalpm/error.c | 4 +- lib/libalpm/graph.c | 8 +- lib/libalpm/graph.h | 8 +- lib/libalpm/group.c | 8 +- lib/libalpm/group.h | 4 +- lib/libalpm/handle.c | 108 +++++++------- lib/libalpm/handle.h | 20 ++-- lib/libalpm/log.c | 4 +- lib/libalpm/log.h | 2 +- lib/libalpm/package.c | 154 ++++++++++---------- lib/libalpm/package.h | 86 ++++++------ lib/libalpm/pkghash.c | 36 +++--- lib/libalpm/pkghash.h | 18 ++-- lib/libalpm/remove.c | 48 +++--- lib/libalpm/remove.h | 8 +- lib/libalpm/signing.c | 12 +- lib/libalpm/signing.h | 4 +- lib/libalpm/sync.c | 108 +++++++------- lib/libalpm/sync.h | 4 +- lib/libalpm/trans.c | 38 +++--- lib/libalpm/trans.h | 20 ++-- lib/libalpm/util.c | 14 +- lib/libalpm/util.h | 18 ++-- src/pacman/callback.c | 10 +- src/pacman/callback.h | 8 +- src/pacman/conf.c | 8 +- src/pacman/conf.h | 4 +- src/pacman/database.c | 4 +- src/pacman/deptest.c | 2 +- src/pacman/package.c | 14 +- src/pacman/package.h | 8 +- src/pacman/query.c | 36 +++--- src/pacman/remove.c | 14 +- src/pacman/sync.c | 80 +++++----- src/pacman/upgrade.c | 12 +- src/pacman/util.c | 40 +++--- src/pacman/util.h | 14 +- src/util/cleanupdelta.c | 10 +- src/util/pactree.c | 18 ++-- src/util/testdb.c | 14 +- src/util/testpkg.c | 8 +- 62 files changed, 1048 insertions(+), 1048 deletions(-) -- 1.7.6

3 8

[pacman-dev] pacman-key status
by Allan McRae 09 Jul '11

09 Jul '11

Hi, With the patches towards pacman-key now on my working branch ([1] - 16 patches in total!), I have completed everything that I had on my TODO list for pacman-key. This should also cover all patches submitted to the mailing list except the --import{,-trustdb} ones by Pang Yan Han (see below). Please let me know if anything submitted here has been omitted. For the --import{,-trustdb} patches, I am not entirely sure of the status... It would appear that the original patch [2] was reviewd by Dan [3] and a revision submitted [4]. The revised patch looks fine and I am happy to get it applying on top of my current work but is has this comment in it: > NOTE: There is this very strange bug such that when new keys are added, > previously imported keys will fail for signature verification. This happens with > both --add and --import. > > Eg. Say you want to import trustdb.gpg and pubring.gpg from directories "first", > "second" and "third", you'd have to: > > # pacman-key --import first second third > # pacman-key --import first second third However, I am not seeing this behavior with --add, so I am unsure whether it is just this --import patch that is an issue. So that patch is somewhat in limbo at the moment. I will follow this up in reply to the patch. Allan [1] http://projects.archlinux.org/users/allan/pacman.git/log/?h=working [2] http://mailman.archlinux.org/pipermail/pacman-dev/2011-May/013159.html [3] http://mailman.archlinux.org/pipermail/pacman-dev/2011-June/013190.html [4] http://mailman.archlinux.org/pipermail/pacman-dev/2011-June/013321.html

1 0

[pacman-dev] [PATCH] pacman-key: check required permissions on keyring
by Allan McRae 09 Jul '11

09 Jul '11

Makes sure that the pacman keyring is readable and that the user has permissions to create a lock file if lock-never is not specified in the gpg.conf file. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- scripts/pacman-key.sh.in | 20 ++++++++++++++++++++ 1 files changed, 20 insertions(+), 0 deletions(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 4ea9842..b4e7abc 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -112,6 +112,25 @@ initialize() { fi } +check_keyring() { + if [[ ! -r ${PACMAN_KEYRING_DIR}/pubring.gpg || \ + ! -r ${PACMAN_KEYRING_DIR}/secring.gpg || \ + ! -r ${PACMAN_KEYRING_DIR}/trustdb.gpg ]]; then + error "$(gettext "You do not have sufficient permissions to read the %s keyring...")" "pacman" + msg "$(gettext "Use '%s' to correct the keyring permissions.")" "pacman-key --init" + exit 1 + fi + + if (( (EXPORT || FINGER || LIST || VERIFY) && EUID != 0 )); then + if ! grep -w -q "lock-never" ${PACMAN_KEYRING_DIR}/gpg.conf &>/dev/null; then + error "$(gettext "You do not have sufficient permissions to run this command...")" + msg "$(gettext "Use '%s' to correct the keyring permissions.")" "pacman-key --init" + exit 1 + fi + fi + +} + verify_keyring_input() { local ret=0; @@ -344,6 +363,7 @@ if (( numopt != 1 )); then exit 1 fi +(( ! INIT )) && check_keyring (( ADD )) && ${GPG_PACMAN} --quiet --batch --import "${KEYFILES[@]}" (( DELETE )) && ${GPG_PACMAN} --quiet --batch --delete-key --yes "${KEYIDS[@]}" -- 1.7.6

1 0

[pacman-dev] [PATCH] pacman-key: add --init option
by Allan McRae 09 Jul '11

09 Jul '11

Add an --init option that ensures that the pacman keyring has all the necessary files and they have the correct permissions for being read as a user. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- doc/pacman-key.8.txt | 4 ++++ scripts/pacman-key.sh.in | 34 ++++++++++++++++++++++++++-------- 2 files changed, 30 insertions(+), 8 deletions(-) diff --git a/doc/pacman-key.8.txt b/doc/pacman-key.8.txt index 2771ece..cf72b83 100644 --- a/doc/pacman-key.8.txt +++ b/doc/pacman-key.8.txt @@ -60,6 +60,10 @@ Options *-h, \--help*:: Output syntax and command line options. +*--init*:: + Ensure the keyring is properly initialized and has the required access + permissions. + *-l, \--list*:: Equivalent to --list-sigs from GnuPG. diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 3c0b5d9..ba817ca 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -32,6 +32,7 @@ DELETE=0 EDITKEY=0 EXPORT=0 FINGER=0 +INIT=0 LIST=0 RECEIVE=0 RELOAD=0 @@ -65,6 +66,7 @@ usage() { echo "$(gettext " --edit-key <keyid(s)> Present a menu for key management task on keyids")" echo "$(gettext " --gpgdir <dir> Set an alternate directory for gnupg")" printf "$(gettext " (instead of '%s')")\n" "@sysconfdir@/pacman.d/gnupg" + echo "$(gettest " --init Ensure the keyring is properly initialized")" echo "$(gettext " --reload Reload the default keys")" } @@ -91,6 +93,25 @@ get_from() { return 1 } +initialize() { + # Check for simple existence rather than for a directory as someone + # may want to use a symlink here + [[ -e ${PACMAN_KEYRING_DIR} ]] || mkdir -p -m 755 "${PACMAN_KEYRING_DIR}" + + # keyring files + [[ -f ${PACMAN_KEYRING_DIR}/pubring.gpg ]] || touch ${PACMAN_KEYRING_DIR}/pubring.gpg + [[ -f ${PACMAN_KEYRING_DIR}/secring.gpg ]] || touch ${PACMAN_KEYRING_DIR}/secring.gpg + [[ -f ${PACMAN_KEYRING_DIR}/trustdb.gpg ]] || ${GPG_PACMAN} --update-trustdb + chmod 644 ${PACMAN_KEYRING_DIR}/{{pub,sec}ring,trustdb}.gpg + + # gpg.conf + [[ ! -f ${PACMAN_KEYRING_DIR}/gpg.conf ]] || touch ${PACMAN_KEYRING_DIR}/gpg.conf + if ! grep -w -q "lock-never" ${PACMAN_KEYRING_DIR}/gpg.conf; then + echo "lock-never" >> ${PACMAN_KEYRING_DIR}/gpg.conf + fi + chmod 644 ${PACMAN_KEYRING_DIR}/gpg.conf +} + verify_keyring_input() { local ret=0; @@ -246,7 +267,7 @@ if ! type gettext &>/dev/null; then fi OPT_SHORT="a::d:e:f::hlr:t:uv:V" -OPT_LONG="add,adv:,config:,del:,export::,finger::,gpgdir:,help,list" +OPT_LONG="add,adv:,config:,del:,export::,finger::,gpgdir:,help,init,list" OPT_LONG+=",receive:,reload,trust:,updatedb,verify:,version" if ! OPT_TEMP="$(parse_options $OPT_SHORT $OPT_LONG "$@")"; then echo; usage; exit 1 # E_INVALID_OPTION; @@ -268,6 +289,7 @@ while true; do -e|--export) EXPORT=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;; -f|--finger) FINGER=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;; --gpgdir) shift; PACMAN_KEYRING_DIR=$1 ;; + --init) INIT=1 ;; -l|--list) LIST=1 ;; -r|--receive) RECEIVE=1; shift; KEYSERVER="${1[0]}"; KEYIDS=("${1[@]:1}") ;; --reload) RELOAD=1 ;; @@ -289,7 +311,7 @@ if ! type -p gpg >/dev/null; then exit 1 fi -if (( (ADD || DELETE || EDITKEY || RECEIVE || RELOAD || UPDATEDB) && EUID != 0 )); then +if (( (ADD || DELETE || EDITKEY || INIT || RECEIVE || RELOAD || UPDATEDB) && EUID != 0 )); then error "$(gettext "%s needs to be run as root for this operation.")" "pacman-key" exit 1 fi @@ -304,15 +326,10 @@ fi # file, falling back on a hard default PACMAN_KEYRING_DIR=${PACMAN_KEYRING_DIR:-$(get_from "$CONFIG" "GPGDir" || echo "@sysconfdir@/pacman.d/gnupg")} -# Try to create $PACMAN_KEYRING_DIR if non-existent -# Check for simple existence rather than for a directory as someone may want -# to use a symlink here -[[ -e ${PACMAN_KEYRING_DIR} ]] || mkdir -p -m 755 "${PACMAN_KEYRING_DIR}" - GPG_PACMAN="gpg --homedir ${PACMAN_KEYRING_DIR} --no-permission-warning" # check only a single operation has been given -numopt=$(( ADD + DELETE + EDITKEY + EXPORT + FINGER + LIST + RECEIVE + RELOAD + UPDATEBD + VERIFY )) +numopt=$(( ADD + DELETE + EDITKEY + EXPORT + FINGER + INIT + LIST + RECEIVE + RELOAD + UPDATEBD + VERIFY )) if (( ! numopt )); then error "$(gettext "No operations specified")" @@ -333,6 +350,7 @@ fi (( EDITKEY )) && edit_keys (( EXPORT )) && ${GPG_PACMAN} --armor --export "${KEYIDS[@]}" (( FINGER )) && ${GPG_PACMAN} --batch --fingerprint "${KEYIDS[@]}" +(( INIT )) && initialize (( LIST )) && ${GPG_PACMAN} --batch --list-sigs "${KEYIDS[@]}" (( RECEIVE )) && receive_keys (( RELOAD )) && reload_keyring -- 1.7.6

1 0

[pacman-dev] [PATCH] pacman-key: refactor get_from
by Dave Reisner 09 Jul '11

09 Jul '11

This function had a variety of pitfalls, including the inability to successfully find a key=value pair where no whitespace surrounded the equals sign. Make it more robust by splitting the line on the equals itself, and performing whitespace trimming on the resulting key/value pair. Signed-off-by: Dave Reisner <dreisner(a)archlinux.org> --- scripts/pacman-key.sh.in | 18 ++++++++++-------- 1 files changed, 10 insertions(+), 8 deletions(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index b884870..9fae0d8 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -74,17 +74,19 @@ This is free software; see the source for copying conditions.\n\ There is NO WARRANTY, to the extent permitted by law.\n")" } -# Read provided file and search for values matching the given key -# The contents of the file are expected to be in this format: key = value -# 'key', 'equal sign' and 'value' can be surrounded by random whitespace -# Usage: get_from "$file" "$key" # returns the value for the first matching key in the file +# read the config file "$1" which has key=value pairs, and return the key which +# matches "$2". the equals sign between pairs may be surrounded by any amount +# of whitespace. get_from() { - while read key _ value; do - if [[ $key = $2 ]]; then - echo "$value" - break + while IFS='=' read -r key value; do + [[ -z $key || ${key:0:1} = '#' ]] && continue + + if [[ ${key%% *} = "$2" && -n ${value##* } ]]; then + echo "${value##* }" + return 0 fi done < "$1" + return 1 } reload_keyring() { -- 1.7.6

2 1

[pacman-dev] [PATCH 4/4] pacman-key: add --verify option
by Allan McRae 09 Jul '11

09 Jul '11

Signed-off-by: Allan McRae <allan(a)archlinux.org> --- doc/pacman-key.8.txt | 5 ++++- scripts/pacman-key.sh.in | 10 +++++++--- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/doc/pacman-key.8.txt b/doc/pacman-key.8.txt index f961bc2..2771ece 100644 --- a/doc/pacman-key.8.txt +++ b/doc/pacman-key.8.txt @@ -72,7 +72,10 @@ Options *-u, \--updatedb*:: Equivalent to \--check-trustdb in GnuPG. -*-v, \--version*:: +* -v, \--verify* <signature>:: + Verify the given signature file. + +*-V, \--version*:: Displays the program version. diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 55c2abe..5324418 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -36,6 +36,7 @@ LIST=0 RECEIVE=0 RELOAD=0 UPDATEDB=0 +VERIFY=0 m4_include(library/output_format.sh) @@ -57,6 +58,7 @@ usage() { echo "$(gettext " -l, --list List keys")" echo "$(gettext " -r, --receive <keyserver> <keyid(s)> Fetch the specified keyids")" echo "$(gettext " -u, --updatedb Update the trustdb of pacman")" + echo "$(gettext " -v, --verify <signature> Verify the file specified by the signature")" echo "$(gettext " -V, --version Show program version")" echo "$(gettext " --config <file> Use an alternate config file")" printf "$(gettext " (instead of '%s')")\n" "@sysconfdir@/pacman.conf" @@ -241,9 +243,9 @@ if ! type gettext &>/dev/null; then } fi -OPT_SHORT="a::d:e:f::hlr:t:uV" +OPT_SHORT="a::d:e:f::hlr:t:uv:V" OPT_LONG="add,adv:,config:,del:,export::,finger::,gpgdir:,help,list" -OPT_LONG+=",receive:,reload,trust:,updatedb,version" +OPT_LONG+=",receive:,reload,trust:,updatedb,verify:,version" if ! OPT_TEMP="$(parse_options $OPT_SHORT $OPT_LONG "$@")"; then echo; usage; exit 1 # E_INVALID_OPTION; fi @@ -268,6 +270,7 @@ while true; do -r|--receive) RECEIVE=1; shift; KEYSERVER="${1[0]}"; KEYIDS=("${1[@]:1}") ;; --reload) RELOAD=1 ;; -u|--updatedb) UPDATEDB=1 ;; + -v|--verify) VERIFY=1; shift; SIGNATURE=$1 ;; -h|--help) usage; exit 0 ;; -V|--version) version; exit 0 ;; @@ -309,7 +312,7 @@ PACMAN_KEYRING_DIR=${PACMAN_KEYRING_DIR:-@sysconfdir@/pacman.d/gnupg} GPG_PACMAN="gpg --homedir ${PACMAN_KEYRING_DIR} --no-permission-warning" # check only a single operation has been given -numopt=$(( ADD + DELETE + EDITKEY + EXPORT + FINGER + LIST + RECEIVE + RELOAD + UPDATEBD )) +numopt=$(( ADD + DELETE + EDITKEY + EXPORT + FINGER + LIST + RECEIVE + RELOAD + UPDATEBD + VERIFY )) if (( ! numopt )); then error "$(gettext "No operations specified")" @@ -334,5 +337,6 @@ fi (( RECEIVE )) && receive_keys (( RELOAD )) && reload_keyring (( UPDATEDB )) && ${GPG_PACMAN} --batch --check-trustdb +(( VERIFY )) && ${GPG_PACMAN} --verify $SIGNATURE # vim: set ts=2 sw=2 noet: -- 1.7.6

1 0

[pacman-dev] [PATCH 1/4] pacman-key: move --edit-key and --receive processing to functions
by Allan McRae 09 Jul '11

09 Jul '11

This moves the processing of the --edit-key and --receive options to functions, keeping the final option processing to be all single line statements. Also rework the --edit-key option to validate all input before processing. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- scripts/pacman-key.sh.in | 47 +++++++++++++++++++++++++-------------------- 1 files changed, 26 insertions(+), 21 deletions(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index b2b5669..c8f5111 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -202,6 +202,30 @@ reload_keyring() { ${GPG_PACMAN} --batch --check-trustdb } +receive_keys() { + if [[ -z ${KEYIDS[@]} ]]; then + error "$(gettext "You need to specify the keyserver and at least one key identifier")" + exit 1 + fi + ${GPG_PACMAN} --keyserver "$KEYSERVER" --recv-keys "${KEYIDS[@]}" +} + +edit_keys() { + local errors=0; + for key in ${KEYIDS[@]}; do + # Verify if the key exists in pacman's keyring + if ! ${GPG_PACMAN} --list-keys "$key" &>/dev/null; then + error "$(gettext "The key identified by %s does not exist")" "$key" + errors=1; + fi + done + (( errors )) && exit 1; + + for key in ${KEYIDS[@]}; do + ${GPG_PACMAN} --edit-key "$key" + done +} + # PROGRAM START if ! type gettext &>/dev/null; then gettext() { @@ -279,31 +303,12 @@ GPG_PACMAN="gpg --homedir ${PACMAN_KEYRING_DIR} --no-permission-warning" (( ADD )) && ${GPG_PACMAN} --quiet --batch --import "${KEYFILES[@]}" (( DELETE )) && ${GPG_PACMAN} --quiet --batch --delete-key --yes "${KEYIDS[@]}" +(( EDITKEY )) && edit_keys (( EXPORT )) && ${GPG_PACMAN} --armor --export "${KEYIDS[@]}" (( FINGER )) && ${GPG_PACMAN} --batch --fingerprint "${KEYIDS[@]}" (( LIST )) && ${GPG_PACMAN} --batch --list-sigs "${KEYIDS[@]}" +(( RECEIVE )) && receive_keys (( RELOAD )) && reload_keyring (( UPDATEDB )) && ${GPG_PACMAN} --batch --check-trustdb -if (( RECEIVE )); then - if [[ -z ${KEYIDS[@]} ]]; then - error "$(gettext "You need to specify the keyserver and at least one key identifier")" - exit 1 - fi - ${GPG_PACMAN} --keyserver "$KEYSERVER" --recv-keys "${KEYIDS[@]}" -fi - -if (( EDITKEY )); then - for key in ${KEYIDS[@]}; do - # Verify if the key exists in pacman's keyring - if ${GPG_PACMAN} --list-keys "$key" &>/dev/null; then - ${GPG_PACMAN} --edit-key "$key" - else - error "$(gettext "The key identified by %s does not exist")" "$key" - exit 1 - fi - shift - done -fi - # vim: set ts=2 sw=2 noet: -- 1.7.6

1 2