- Pacman-dev - lists.archlinux.org

[pacman-dev] [PATCH v3] pacman-key: ignore already lsigned/deleted keys
by Matthew Sexton 05 Nov '19

05 Nov '19

Added two new functions, key_is_lsigned() and key_is_revoked() that check whether a key has been locally signed or revoked respectively during --populate. If the key is already signed or revoked, it is quietly ignored. Suggested-by: Eli Schwartz <eschwartz(a)archlinux.org> Signed-off-by: Matthew Sexton <wsdmatty(a)gmail.com> --- v3. Fixed spaced to tabs, renamed functions, moved functions to the proper location, key_is_lsigned now ensures it's reading from the 'sig' line, and a few stylistic corrections suggested by Allan and Morgan. scripts/pacman-key.sh.in | 42 +++++++++++++++++++++++++++++++++++++--- 1 file changed, 39 insertions(+), 3 deletions(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 3627a805..d1c9a456 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -190,6 +190,32 @@ check_keyids_exist() { fi } +key_is_lsigned() { + secret_key=$("${GPG_PACMAN[@]}" --with-colons --list-secret-key | awk -F : 'NR==1 {print $5}') + while IFS=: read -r type valid _ _ sign_key _; do + if [[ $type != "sig" ]] || [[ $valid != "!" ]]; then + continue + fi + if [[ "$sign_key" == "$secret_key" ]]; then + return 0 + fi + done < <("${GPG_PACMAN[@]}" --with-colons --check-signatures "$1") + return 1 + +} + +key_is_revoked() { + while IFS=: read -r type _ _ _ _ _ _ _ _ _ _ flags _; do + if [[ $type != "pub" ]]; then + continue + fi + if [[ $flags == *"D"* ]]; then + return 0 + fi + done < <("${GPG_PACMAN[@]}" --with-colons --list-key "$1") + return 1 +} + initialize() { local conffile keyserv # Check for simple existence rather than for a directory as someone @@ -247,7 +273,7 @@ check_keyring() { fi fi - if (( LSIGNKEY )); then + if (( LSIGNKEY || POPULATE )); then if [[ $(secret_keys_available) -lt 1 ]]; then error "$(gettext "There is no secret key available to sign with.")" msg "$(gettext "Use '%s' to generate a default secret key.")" "pacman-key --init" @@ -337,13 +363,18 @@ populate_keyring() { local key_count=0 msg "$(gettext "Disabling revoked keys in keyring...")" for key_id in "${!revoked_ids[@]}"; do + if key_is_revoked "$key_id" ; then + continue + fi if (( VERBOSE )); then msg2 "$(gettext "Disabling key %s...")" "${key_id}" fi printf 'disable\nquit\n' | LANG=C "${GPG_PACMAN[@]}" --command-fd 0 --quiet --batch --edit-key "${key_id}" 2>/dev/null key_count=$((key_count+1)) done - msg2 "$(gettext "Disabled %s keys.")" "${key_count}" + if (( key_count )); then + msg2 "$(gettext "Disabled %s keys.")" "${key_count}" + fi fi } @@ -454,6 +485,9 @@ lsign_keys() { local ret=0 local key_count=0 for key_id in "$@"; do + if key_is_lsigned "$key_id" ; then + continue + fi if (( VERBOSE )); then msg2 "$(gettext "Locally signing key %s...")" "${key_id}" fi @@ -469,7 +503,9 @@ lsign_keys() { if (( ret )); then exit 1 fi - msg2 "$(gettext "Locally signed %s keys.")" "${key_count}" + if (( key_count )); then + msg2 "$(gettext "Locally signed %s keys.")" "${key_count}" + fi } receive_keys() { -- 2.23.0

1 0

[pacman-dev] [PATCH v2] pacman-key: ignores keys already lsigned/deleted
by Matthew Sexton 05 Nov '19

05 Nov '19

Added two new functions, lsigned_already() and revoked_already() that check whether a key has been locally signed or revoked respectively during --populate. If the key is already signed or revoked, it is quietly ignored. Suggested-by: Eli Schwartz <eschwartz(a)archlinux.org> Signed-off-by: Matthew Sexton <wsdmatty(a)gmail.com> --- v2. (ACTUAL v2.) Previous email was erroneous, I attached the wrong patch. Corrected some inconsistencies. Gave proper attribution to Eli, scripts/pacman-key.sh.in | 43 +++++++++++++++++++++++++++++++++++++--- 1 file changed, 40 insertions(+), 3 deletions(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 3627a805..25bcb3de 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -247,7 +247,7 @@ check_keyring() { fi fi - if (( LSIGNKEY )); then + if (( LSIGNKEY || POPULATE )); then if [[ $(secret_keys_available) -lt 1 ]]; then error "$(gettext "There is no secret key available to sign with.")" msg "$(gettext "Use '%s' to generate a default secret key.")" "pacman-key --init" @@ -337,13 +337,18 @@ populate_keyring() { local key_count=0 msg "$(gettext "Disabling revoked keys in keyring...")" for key_id in "${!revoked_ids[@]}"; do + if revoked_already "$key_id" ; then + continue + fi if (( VERBOSE )); then msg2 "$(gettext "Disabling key %s...")" "${key_id}" fi printf 'disable\nquit\n' | LANG=C "${GPG_PACMAN[@]}" --command-fd 0 --quiet --batch --edit-key "${key_id}" 2>/dev/null key_count=$((key_count+1)) done - msg2 "$(gettext "Disabled %s keys.")" "${key_count}" + if (( key_count )); then + msg2 "$(gettext "Disabled %s keys.")" "${key_count}" + fi fi } @@ -447,6 +452,22 @@ list_sigs() { exit 1 fi } +lsigned_already() { + # Determines whether a key has already been signed locally by getting the + # local pacman secret key and comparing it against signatures on the key + # returns 0 if key is signed, 1 if it is unsigned + secret_key=$("${GPG_PACMAN[@]}" --with-colons --list-secret-key | head -n1 | awk -F : '{print $5}') + while IFS=: read -r _ valid _ _ signkey _; do + if [[ "$valid" != "!" ]]; then + continue + fi + if [[ "$signkey" = "$secret_key" ]]; then + return 0 + fi + done < <("${GPG_PACMAN[@]}" --with-colons --check-signatures "$1") + return 1 + +} lsign_keys() { check_keyids_exist @@ -454,6 +475,7 @@ lsign_keys() { local ret=0 local key_count=0 for key_id in "$@"; do + if lsigned_already "$key_id" ; then continue; fi if (( VERBOSE )); then msg2 "$(gettext "Locally signing key %s...")" "${key_id}" fi @@ -469,7 +491,9 @@ lsign_keys() { if (( ret )); then exit 1 fi - msg2 "$(gettext "Locally signed %s keys.")" "${key_count}" + if (( key_count )); then + msg2 "$(gettext "Locally signed %s keys.")" "${key_count}" + fi } receive_keys() { @@ -511,6 +535,19 @@ refresh_keys() { fi } +revoked_already() { + + while IFS=: read -r type _ _ _ _ _ _ _ _ _ _ flags _; do + if [[ "$type" != "pub" ]]; then + continue + fi + if [[ "$flags" = *"D"* ]]; then + return 0 + fi + done < <("${GPG_PACMAN[@]}" --with-colons --list-key "$1") + return 1 +} + verify_sig() { local ret=0 sig=$1 file=$2 if [[ -z $file && -f ${sig%.*} ]]; then -- 2.23.0

3 3

[pacman-dev] Alternatives system brainstorm
by Allan McRae 04 Nov '19

04 Nov '19

Hi all, Some further brainstorming on alternatives system. Last time, I suggested something like: alternatives=(python->python3) But as was pointed out, there may be many other things you want to bring along with the python binary. Some directly related: /usr/share/man/man1/python3.1.gz -> python.1.gz Some less directly related: /usr/bin/idle /usr/bin/pydoc /usr/bin/python-config Another example would be lua, where you want to set the main interpreter and the header directory. In Debian & Fedora land, these additional files are called slaves. Note that both those distros use the "same" tool to manage these things. In addition, each alternative is given a priority. So if (e.g.) two python2 and python3 are installed at the same time, it would select the one with the higher priority. Fedora also has "ghost" files (not sure about Debian). I.e. the python3 package contains a ghost /usr/bin/python, so searching file databases gives a match. Now how does that inform our potential implementation? Mostly, I don't like that they set up all the alternatives in the post install with one long command passed to their tool. I'd prefer we had a file with a list of needed symlinks so this could happen automatically. So here is a starting point for discussion: In the PKGBUILD: alternatives=('python::python3') that would look for a file in our build root called "python3.alternatives" and include it in the package root. Note we could have more than one such entry. This file could look like: /usr/bin/python3 -> python /usr/bin/idle3 -> idle /usr/include/example3/ -> example/ Could also include an optional priority statement? Or should that be captured in the PKGBUILD? The file would be placed at /var/lib/pacman/alternatives/python/python3. Any comments on that as a starting point. Cheers, Allan

9 38

[pacman-dev] [PATCH] pacman-key: ignores keys already lsigned/deleted
by Matthew Sexton 04 Nov '19

04 Nov '19

Added two new functions, lsigned_already() and revoked_already() that check whether a key has been locally signed or revoked respectively during --populate. If the key is already signed or revoked, it is quietly ignored. Signed-off-by: Matthew Sexton <wsdmatty(a)gmail.com> --- Final version of patch. This patch depends on my previous patch: v2-0001-pacman-key-hide-lsign-and-revoke-output-behind-ve.patch This finishes the implementation of: FS#64142 - pacman-key: make populate less noisy Most of the credit for this goes to Eli, who did the hard part of figuring out gpg wizardry. All I did was bash some stuff. v2. Fixed some inconsistencies in [ vs [[ and removed unnecessary parantheses. scripts/pacman-key.sh.in | 31 +++++++++++++++++++++++++++++-- 1 file changed, 29 insertions(+), 2 deletions(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 3627a805..ba56a3ac 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -247,7 +247,7 @@ check_keyring() { fi fi - if (( LSIGNKEY )); then + if (( LSIGNKEY || POPULATE )); then if [[ $(secret_keys_available) -lt 1 ]]; then error "$(gettext "There is no secret key available to sign with.")" msg "$(gettext "Use '%s' to generate a default secret key.")" "pacman-key --init" @@ -337,13 +337,16 @@ populate_keyring() { local key_count=0 msg "$(gettext "Disabling revoked keys in keyring...")" for key_id in "${!revoked_ids[@]}"; do + if ( revoked_already "$key_id" ) ; then continue; fi if (( VERBOSE )); then msg2 "$(gettext "Disabling key %s...")" "${key_id}" fi printf 'disable\nquit\n' | LANG=C "${GPG_PACMAN[@]}" --command-fd 0 --quiet --batch --edit-key "${key_id}" 2>/dev/null key_count=$((key_count+1)) done - msg2 "$(gettext "Disabled %s keys.")" "${key_count}" + if (( key_count )); then + msg2 "$(gettext "Disabled %s keys.")" "${key_count}" + fi fi } @@ -447,6 +450,18 @@ list_sigs() { exit 1 fi } +lsigned_already() { + # Determines whether a key has already been signed locally by getting the + # local pacman secret key and comparing it against signatures on the key + # returns 0 if key is signed, 1 if it is unsigned + secret_key=$("${GPG_PACMAN[@]}" --with-colons --list-secret-key | head -n1 | awk -F : '{print $5}') + while IFS=: read -r _ valid _ _ signkey _; do + if [ "$valid" != "!" ]; then continue; fi + if [[ "$signkey" == "$secret_key" ]]; then return 0; fi + done < <("${GPG_PACMAN[@]}" --with-colons --check-signatures "$1") + return 1 + +} lsign_keys() { check_keyids_exist @@ -454,6 +469,7 @@ lsign_keys() { local ret=0 local key_count=0 for key_id in "$@"; do + if ( lsigned_already "$key_id" ) ; then continue; fi if (( VERBOSE )); then msg2 "$(gettext "Locally signing key %s...")" "${key_id}" fi @@ -469,7 +485,9 @@ lsign_keys() { if (( ret )); then exit 1 fi + if (( key_count )); then msg2 "$(gettext "Locally signed %s keys.")" "${key_count}" + fi } receive_keys() { @@ -511,6 +529,15 @@ refresh_keys() { fi } +revoked_already() { + + while IFS=: read -r type _ _ _ _ _ _ _ _ _ _ flags _; do + if [ "$type" != "pub" ]; then continue; fi + if [[ "$flags" == *"D"* ]]; then return 0; fi + done < <("${GPG_PACMAN[@]}" --with-colons --list-key "$1") + return 1 +} + verify_sig() { local ret=0 sig=$1 file=$2 if [[ -z $file && -f ${sig%.*} ]]; then -- 2.23.0

1 0

[pacman-dev] [PATCH] pacman-key: ignores keys already lsigned/deleted
by Matthew Sexton 04 Nov '19

04 Nov '19

Added two new functions, lsigned_already() and revoked_already() that check whether a key has been locally signed or revoked respectively during --populate. If the key is already signed or revoked, it is quietly ignored. Signed-off-by: Matthew Sexton <wsdmatty(a)gmail.com> --- Final version of patch. This patch depends on my previous patch: v2-0001-pacman-key-hide-lsign-and-revoke-output-behind-ve.patch This finishes the implementation of: FS#64142 - pacman-key: make populate less noisy Most of the credit for this goes to Eli, who did the hard part of figuring out gpg wizardry. All I did was bash some stuff. scripts/pacman-key.sh.in | 31 +++++++++++++++++++++++++++++-- 1 file changed, 29 insertions(+), 2 deletions(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 3627a805..ba56a3ac 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -247,7 +247,7 @@ check_keyring() { fi fi - if (( LSIGNKEY )); then + if (( LSIGNKEY || POPULATE )); then if [[ $(secret_keys_available) -lt 1 ]]; then error "$(gettext "There is no secret key available to sign with.")" msg "$(gettext "Use '%s' to generate a default secret key.")" "pacman-key --init" @@ -337,13 +337,16 @@ populate_keyring() { local key_count=0 msg "$(gettext "Disabling revoked keys in keyring...")" for key_id in "${!revoked_ids[@]}"; do + if ( revoked_already "$key_id" ) ; then continue; fi if (( VERBOSE )); then msg2 "$(gettext "Disabling key %s...")" "${key_id}" fi printf 'disable\nquit\n' | LANG=C "${GPG_PACMAN[@]}" --command-fd 0 --quiet --batch --edit-key "${key_id}" 2>/dev/null key_count=$((key_count+1)) done - msg2 "$(gettext "Disabled %s keys.")" "${key_count}" + if (( key_count )); then + msg2 "$(gettext "Disabled %s keys.")" "${key_count}" + fi fi } @@ -447,6 +450,18 @@ list_sigs() { exit 1 fi } +lsigned_already() { + # Determines whether a key has already been signed locally by getting the + # local pacman secret key and comparing it against signatures on the key + # returns 0 if key is signed, 1 if it is unsigned + secret_key=$("${GPG_PACMAN[@]}" --with-colons --list-secret-key | head -n1 | awk -F : '{print $5}') + while IFS=: read -r _ valid _ _ signkey _; do + if [ "$valid" != "!" ]; then continue; fi + if [[ "$signkey" == "$secret_key" ]]; then return 0; fi + done < <("${GPG_PACMAN[@]}" --with-colons --check-signatures "$1") + return 1 + +} lsign_keys() { check_keyids_exist @@ -454,6 +469,7 @@ lsign_keys() { local ret=0 local key_count=0 for key_id in "$@"; do + if ( lsigned_already "$key_id" ) ; then continue; fi if (( VERBOSE )); then msg2 "$(gettext "Locally signing key %s...")" "${key_id}" fi @@ -469,7 +485,9 @@ lsign_keys() { if (( ret )); then exit 1 fi + if (( key_count )); then msg2 "$(gettext "Locally signed %s keys.")" "${key_count}" + fi } receive_keys() { @@ -511,6 +529,15 @@ refresh_keys() { fi } +revoked_already() { + + while IFS=: read -r type _ _ _ _ _ _ _ _ _ _ flags _; do + if [ "$type" != "pub" ]; then continue; fi + if [[ "$flags" == *"D"* ]]; then return 0; fi + done < <("${GPG_PACMAN[@]}" --with-colons --list-key "$1") + return 1 +} + verify_sig() { local ret=0 sig=$1 file=$2 if [[ -z $file && -f ${sig%.*} ]]; then -- 2.23.0

1 0

[pacman-dev] [PATCH v2] pacman-key: ignores keys already lsigned during populate
by Matthew Sexton 04 Nov '19

04 Nov '19

WORK IN PROGRESS. I'm only emailing this patch to get some feedback. I added a function that checks whether a key being imported has already been signed, and if it has been, skip lsigning it. I'm not 100% sure this line is entirely necessary: if (( LSIGNKEY || POPULATE )); then I wanted to ensure that there -was- a signing key to check against. It might be a superfluous check, but I couldn't find where --populate implies having run --init. I may've missed it. --- v2. Removed a redundant nested while loop and fixed the handling of lsigned_already return value checking. Also did a little cleanup for neater code. scripts/pacman-key.sh.in | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 3627a805..a152f992 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -247,7 +247,7 @@ check_keyring() { fi fi - if (( LSIGNKEY )); then + if (( LSIGNKEY || POPULATE )); then if [[ $(secret_keys_available) -lt 1 ]]; then error "$(gettext "There is no secret key available to sign with.")" msg "$(gettext "Use '%s' to generate a default secret key.")" "pacman-key --init" @@ -447,6 +447,18 @@ list_sigs() { exit 1 fi } +lsigned_already() { + # Determines whether a key has already been signed locally by getting the + # local pacman secret key and comparing it against signatures on the key + # returns 0 if key is signed, 1 if it is unsigned + secret_key=$("${GPG_PACMAN[@]}" --with-colons --list-secret-key | head -n1 | awk -F : '{print $5}') + while IFS=: read -r _ valid _ _ signkey _; do + if [ "$valid" != "!" ]; then continue; fi + if [[ "$signkey" == "$secret_key" ]]; then return 0; fi + done < <("${GPG_PACMAN[@]}" --with-colons --check-signatures "$1") + return 1 + +} lsign_keys() { check_keyids_exist @@ -454,6 +466,9 @@ lsign_keys() { local ret=0 local key_count=0 for key_id in "$@"; do + if ( lsigned_already "$key_id" ) ; then + continue + fi if (( VERBOSE )); then msg2 "$(gettext "Locally signing key %s...")" "${key_id}" fi @@ -469,7 +484,9 @@ lsign_keys() { if (( ret )); then exit 1 fi + if (( key_count )); then msg2 "$(gettext "Locally signed %s keys.")" "${key_count}" + fi } receive_keys() { -- 2.23.0

1 0

[pacman-dev] [PATCH] pacman-key: ignores keys already lsigned during populate
by Matthew Sexton 04 Nov '19

04 Nov '19

WORK IN PROGRESS. I'm only emailing this patch to get some feedback. I added a function that checks whether a key being imported has already been signed, and if it has been, skip lsigning it. I'm not 100% sure this line is entirely necessary: if (( LSIGNKEY || POPULATE )); then I wanted to ensure that there -was- a signing key to check against. It might be a superfluous check, but I couldn't find where --populate implies having run --init. I may've missed it. Otherwise, just looking for feedback before I move on to step 2 which is not disabling already disabled keys. Let me know if there are any glaring errors you see, or if there is a more elegant way of doing what I did. Signed-off-by: Matthew Sexton <wsdmatty(a)gmail.com> --- scripts/pacman-key.sh.in | 27 ++++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 3627a805..796375a5 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -247,7 +247,7 @@ check_keyring() { fi fi - if (( LSIGNKEY )); then + if (( LSIGNKEY || POPULATE )); then if [[ $(secret_keys_available) -lt 1 ]]; then error "$(gettext "There is no secret key available to sign with.")" msg "$(gettext "Use '%s' to generate a default secret key.")" "pacman-key --init" @@ -447,6 +447,25 @@ list_sigs() { exit 1 fi } +lsigned_already() { + # Determines whether a key has already been signed locally by getting the + # local pacman secret key and comparing it against signatures on the key + # returns 1 if key is not signed, 0 if signed + secret_key=$("${GPG_PACMAN[@]}" --with-colons --list-secret-key | head -n1 | awk -F : '{print $5}') + NEEDS_SIGNED=1 + while read line; do + while IFS=: read -r _ valid _ _ signkey _; do + if [ "$valid" != "!" ]; then + continue + fi + if [[ "$signkey" == "$secret_key" ]]; then + NEEDS_SIGNED=0 + break + fi + done + done < <("${GPG_PACMAN[@]}" --with-colons --check-signatures "$1") + +} lsign_keys() { check_keyids_exist @@ -454,6 +473,10 @@ lsign_keys() { local ret=0 local key_count=0 for key_id in "$@"; do + lsigned_already "$key_id" + if [[ "$NEEDS_SIGNED" == 0 ]]; then + continue + fi if (( VERBOSE )); then msg2 "$(gettext "Locally signing key %s...")" "${key_id}" fi @@ -469,7 +492,9 @@ lsign_keys() { if (( ret )); then exit 1 fi + if (( key_count )); then msg2 "$(gettext "Locally signed %s keys.")" "${key_count}" + fi } receive_keys() { -- 2.23.0

1 1

[pacman-dev] [PATCH v2] pacman-key: hide lsign and revoke output behind --verbose
by Matthew Sexton 04 Nov '19

04 Nov '19

To cut down on spam during --populate, both locally signing and revoking keys now hide the specific keys being signed or revoked, but can be shown with --verbose. A count was added, to show the number of keys signed/revoked during the process. Partially Implements: FS#64142 - pacman-key: make populate less noisy Signed-off-by: Matthew Sexton <wsdmatty(a)gmail.com> --- v2: Corrected some issues identified by Allan. Squashed the two commits into one. scripts/pacman-key.sh.in | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 05aab0c2..3627a805 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -51,6 +51,7 @@ REFRESH=0 UPDATEDB=0 USE_COLOR='y' VERIFY=0 +VERBOSE=0 usage() { printf "pacman-key (pacman) %s\n" ${myver} @@ -77,6 +78,7 @@ usage() { printf -- "$(gettext " --populate Reload the default keys from the (given) keyrings\n\ in '%s'")\n" "@pkgdatadir@/keyrings" printf -- "$(gettext " --refresh-keys Update specified or all keys from a keyserver")\n" + printf -- "$(gettext " --verbose Show extra information")\n" echo printf -- "$(gettext "Options:")\n" printf -- "$(gettext " --config <file> Use an alternate config file (instead of\n\ @@ -332,11 +334,16 @@ populate_keyring() { done if (( ${#revoked_ids[@]} > 0 )); then + local key_count=0 msg "$(gettext "Disabling revoked keys in keyring...")" for key_id in "${!revoked_ids[@]}"; do - msg2 "$(gettext "Disabling key %s...")" "${key_id}" + if (( VERBOSE )); then + msg2 "$(gettext "Disabling key %s...")" "${key_id}" + fi printf 'disable\nquit\n' | LANG=C "${GPG_PACMAN[@]}" --command-fd 0 --quiet --batch --edit-key "${key_id}" 2>/dev/null + key_count=$((key_count+1)) done + msg2 "$(gettext "Disabled %s keys.")" "${key_count}" fi } @@ -445,19 +452,24 @@ lsign_keys() { check_keyids_exist local ret=0 + local key_count=0 for key_id in "$@"; do - msg2 "$(gettext "Locally signing key %s...")" "${key_id}" + if (( VERBOSE )); then + msg2 "$(gettext "Locally signing key %s...")" "${key_id}" + fi # we cannot use --yes here as gpg would still ask for confirmation if a key has more than one uid printf 'y\ny\n' | LANG=C "${GPG_PACMAN[@]}" --command-fd 0 --quiet --batch --lsign-key "${key_id}" 2>/dev/null if (( PIPESTATUS[1] )); then error "$(gettext "%s could not be locally signed.")" "${key_id}" ret=1 fi + key_count=$((key_count+1)) done if (( ret )); then exit 1 fi + msg2 "$(gettext "Locally signed %s keys.")" "${key_count}" } receive_keys() { @@ -541,7 +553,7 @@ OPT_SHORT="adefhlruvV" OPT_LONG=('add' 'config:' 'delete' 'edit-key' 'export' 'finger' 'gpgdir:' 'help' 'import' 'import-trustdb' 'init' 'keyserver:' 'list-keys' 'list-sigs' 'lsign-key' 'nocolor' 'populate' 'recv-keys' 'refresh-keys' 'updatedb' - 'verify' 'version') + 'verbose' 'verify' 'version') if ! parseopts "$OPT_SHORT" "${OPT_LONG[@]}" -- "$@"; then exit 1 # E_INVALID_OPTION fi @@ -574,6 +586,7 @@ while (( $# )); do -r|--recv-keys) RECEIVE=1 UPDATEDB=1 ;; --refresh-keys) REFRESH=1 ;; -u|--updatedb) UPDATEDB=1 ;; + --verbose) VERBOSE=1 ;; -v|--verify) VERIFY=1 ;; -h|--help) usage; exit 0 ;; -- 2.23.0

1 0

[pacman-dev] [PATCH 1/2] pacman-key: added verbose to commandline options
by Matthew Sexton 04 Nov '19

04 Nov '19

Signed-off-by: Matthew Sexton <wsdmatty(a)gmail.com> --- scripts/pacman-key.sh.in | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 05aab0c2..a59dba52 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -51,6 +51,7 @@ REFRESH=0 UPDATEDB=0 USE_COLOR='y' VERIFY=0 +VERBOSE=0 usage() { printf "pacman-key (pacman) %s\n" ${myver} @@ -77,6 +78,7 @@ usage() { printf -- "$(gettext " --populate Reload the default keys from the (given) keyrings\n\ in '%s'")\n" "@pkgdatadir@/keyrings" printf -- "$(gettext " --refresh-keys Update specified or all keys from a keyserver")\n" + printf -- "$(gettext " --verbose Show extra information")\n" echo printf -- "$(gettext "Options:")\n" printf -- "$(gettext " --config <file> Use an alternate config file (instead of\n\ @@ -541,7 +543,7 @@ OPT_SHORT="adefhlruvV" OPT_LONG=('add' 'config:' 'delete' 'edit-key' 'export' 'finger' 'gpgdir:' 'help' 'import' 'import-trustdb' 'init' 'keyserver:' 'list-keys' 'list-sigs' 'lsign-key' 'nocolor' 'populate' 'recv-keys' 'refresh-keys' 'updatedb' - 'verify' 'version') + 'verify' 'version' 'verbose') if ! parseopts "$OPT_SHORT" "${OPT_LONG[@]}" -- "$@"; then exit 1 # E_INVALID_OPTION fi @@ -575,6 +577,7 @@ while (( $# )); do --refresh-keys) REFRESH=1 ;; -u|--updatedb) UPDATEDB=1 ;; -v|--verify) VERIFY=1 ;; + --verbose) VERBOSE=1 ;; -h|--help) usage; exit 0 ;; -V|--version) version; exit 0 ;; -- 2.23.0

3 4

[pacman-dev] [PATCH v3] libmakepkg: add optional argument support to parseopts
by Ethan Sommer 04 Nov '19

04 Nov '19

Adds a "?" suffix that can be used to indicate that an option's argument is optional. This allows options to have a default behaviour when the user doesn't specify one, e.g.: --color=[when] being able to behave like --color=auto when only --color is passed Options with optional arguments given on the command line will be returned in the form "--opt=optarg" and "-o=optarg". Despite that not being the syntax for passing an argument with a shortopt (trying to pass -o=foo would make -o's argument "=foo"), this is done to allow the caller to split the option and its optarg easily Signed-off-by: Ethan Sommer <e5ten.arch(a)gmail.com> --- scripts/libmakepkg/util/parseopts.sh.in | 116 +++++++++++++++--------- test/scripts/parseopts_test.sh | 12 ++- 2 files changed, 83 insertions(+), 45 deletions(-) diff --git a/scripts/libmakepkg/util/parseopts.sh.in b/scripts/libmakepkg/util/parseopts.sh.in index c056cb1e..42540438 100644 --- a/scripts/libmakepkg/util/parseopts.sh.in +++ b/scripts/libmakepkg/util/parseopts.sh.in @@ -18,16 +18,23 @@ # along with this program. If not, see <http://www.gnu.org/licenses/>. # # A getopt_long-like parser which portably supports longopts and -# shortopts with some GNU extensions. It does not allow for options -# with optional arguments. For both short and long opts, options -# requiring an argument should be suffixed with a colon. After the -# first argument containing the short opts, any number of valid long -# opts may be be passed. The end of the options delimiter must then be -# added, followed by the user arguments to the calling program. +# shortopts with some GNU extensions. For both short and long opts, +# options requiring an argument should be suffixed with a colon, and +# options with optional arguments should be suffixed with a question +# mark. After the first argument containing the short opts, any number +# of valid long opts may be be passed. The end of the options delimiter +# must then be added, followed by the user arguments to the calling +# program. +# +# Options with optional arguments will be returned as "--longopt=optarg" +# for longopts, or "-o=optarg" for shortopts. This isn't actually a valid +# way to pass an optional argument with a shortopt on the command line, +# but is done by parseopts to enable the caller script to split the option +# and its optarg easily. # # Recommended Usage: -# OPT_SHORT='fb:z' -# OPT_LONG=('foo' 'bar:' 'baz') +# OPT_SHORT='fb:zq?' +# OPT_LONG=('foo' 'bar:' 'baz' 'qux?') # if ! parseopts "$OPT_SHORT" "${OPT_LONG[@]}" -- "$@"; then # exit 1 # fi @@ -49,29 +56,30 @@ parseopts() { longoptmatch() { local o longmatch=() for o in "${longopts[@]}"; do - if [[ ${o%:} = "$1" ]]; then + if [[ ${o%[:?]} = "$1" ]]; then longmatch=("$o") break fi - [[ ${o%:} = "$1"* ]] && longmatch+=("$o") + [[ ${o%[:?]} = "$1"* ]] && longmatch+=("$o") done case ${#longmatch[*]} in 1) - # success, override with opt and return arg req (0 == none, 1 == required) - opt=${longmatch%:} - if [[ $longmatch = *: ]]; then - return 1 - else - return 0 - fi ;; + # success, override with opt and return arg req (0 == none, 1 == required, 2 == optional) + opt=${longmatch%[:?]} + case $longmatch in + *:) return 1 ;; + *\?) return 2 ;; + *) return 0 ;; + esac + ;; 0) # fail, no match found return 255 ;; *) # fail, ambiguous match printf "${0##*/}: $(gettext "option '%s' is ambiguous; possibilities:")" "--$1" - printf " '%s'" "${longmatch[@]%:}" + printf " '%s'" "${longmatch[@]%[:?]}" printf '\n' return 254 ;; esac >&2 @@ -87,32 +95,47 @@ parseopts() { for (( i = 1; i < ${#1}; i++ )); do opt=${1:i:1} - # option doesn't exist - if [[ $shortopts != *$opt* ]]; then - printf "${0##*/}: $(gettext "invalid option") -- '%s'\n" "$opt" >&2 - OPTRET=(--) - return 1 - fi - - OPTRET+=("-$opt") - # option requires optarg - if [[ $shortopts = *$opt:* ]]; then - # if we're not at the end of the option chunk, the rest is the optarg - if (( i < ${#1} - 1 )); then - OPTRET+=("${1:i+1}") - break - # if we're at the end, grab the the next positional, if it exists - elif (( i == ${#1} - 1 )) && [[ $2 ]]; then - OPTRET+=("$2") - shift - break - # parse failure - else - printf "${0##*/}: $(gettext "option requires an argument") -- '%s'\n" "$opt" >&2 + case $shortopts in + # option requires optarg + *$opt:*) + # if we're not at the end of the option chunk, the rest is the optarg + if (( i < ${#1} - 1 )); then + OPTRET+=("-$opt" "${1:i+1}") + break + # if we're at the end, grab the the next positional, if it exists + elif (( i == ${#1} - 1 )) && [[ $2 ]]; then + OPTRET+=("-$opt" "$2") + shift + break + # parse failure + else + printf "${0##*/}: $(gettext "option requires an argument") -- '%s'\n" "$opt" >&2 + OPTRET=(--) + return 1 + fi + ;; + # option's optarg is optional + *$opt\?*) + # if we're not at the end of the option chunk, the rest is the optarg + if (( i < ${#1} - 1 )); then + OPTRET+=("-$opt=${1:i+1}") + break + # option has no optarg + else + OPTRET+=("-$opt") + fi + ;; + # option has no optarg + *$opt*) + OPTRET+=("-$opt") + ;; + # option doesn't exist + *) + printf "${0##*/}: $(gettext "invalid option") -- '%s'\n" "$opt" >&2 OPTRET=(--) return 1 - fi - fi + ;; + esac done ;; --?*=*|--?*) # long option @@ -145,6 +168,15 @@ parseopts() { return 1 fi ;; + 2) + # --longopt=optarg + if [[ $1 = *=* ]]; then + OPTRET+=("--$opt=$optarg") + # --longopt + else + OPTRET+=("--$opt") + fi + ;; 254) # ambiguous option -- error was reported for us by longoptmatch() OPTRET=(--) diff --git a/test/scripts/parseopts_test.sh b/test/scripts/parseopts_test.sh index 9674c6a6..7d14bf29 100755 --- a/test/scripts/parseopts_test.sh +++ b/test/scripts/parseopts_test.sh @@ -16,12 +16,12 @@ if ! type -t parseopts &>/dev/null; then fi # borrow opts from makepkg -OPT_SHORT="AcdefFghiLmop:rRsV" +OPT_SHORT="AcdefFghiLmop:rRsVb;" OPT_LONG=('allsource' 'asroot' 'ignorearch' 'check' 'clean:' 'cleanall' 'nodeps' 'noextract' 'force' 'forcever:' 'geninteg' 'help' 'holdver' 'install' 'key:' 'log' 'nocolor' 'nobuild' 'nocheck' 'noprepare' 'nosign' 'pkg:' 'rmdeps' 'repackage' 'skipinteg' 'sign' 'source' 'syncdeps' 'version' 'config:' - 'noconfirm' 'noprogressbar') + 'noconfirm' 'noprogressbar' 'opt;') tap_parse() { local result=$1 tokencount=$2; shift 2 @@ -31,7 +31,7 @@ tap_parse() { unset OPTRET } -tap_plan 50 +tap_plan 54 # usage: tap_parse <expected result> <token count> test-params... # a failed tap_parse will match only the end of options marker '--' @@ -111,4 +111,10 @@ tap_parse '--force --' 2 --force # exact match on possible stem (opt has optarg) tap_parse '--clean foo --' 3 --clean=foo +# long opt with empty, non-empty, and no optional arg +tap_parse '--opt= --opt=foo --opt --' 4 --opt= --opt=foo --opt + +# short opt with and without optional arg, and non-option arg +tap_parse '-b=foo -A -b -- foo' 5 -bfoo -Ab foo + tap_finish -- 2.23.0

3 4