The script pacman-key will manage pacman's keyring. It imports, exports, fetches from keyservers, helps in the process of trusting and updates the trust database. Signed-off-by: Denis A. Altoé Falqueto <denisfalqueto@gmail.com> --- scripts/.gitignore | 1 + scripts/Makefile.am | 3 + scripts/pacman-key.sh.in | 280 ++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 284 insertions(+), 0 deletions(-) create mode 100644 scripts/pacman-key.sh.in diff --git a/scripts/.gitignore b/scripts/.gitignore index eafc493..1c662de 100644 --- a/scripts/.gitignore +++ b/scripts/.gitignore @@ -4,3 +4,4 @@ rankmirrors repo-add repo-remove pkgdelta +pacman-key diff --git a/scripts/Makefile.am b/scripts/Makefile.am index 31e8fb5..c81f703 100644 --- a/scripts/Makefile.am +++ b/scripts/Makefile.am @@ -7,6 +7,7 @@ bin_SCRIPTS = \ OURSCRIPTS = \ makepkg \ + pacman-key \ pacman-optimize \ pkgdelta \ rankmirrors \ @@ -14,6 +15,7 @@ OURSCRIPTS = \ EXTRA_DIST = \ makepkg.sh.in \ + pacman-key.sh.in \ pacman-optimize.sh.in \ pkgdelta.sh.in \ rankmirrors.sh.in \ @@ -60,6 +62,7 @@ $(OURSCRIPTS): Makefile @mv $@.tmp $@ makepkg: $(srcdir)/makepkg.sh.in +pacman-key: ${srcdir}/pacman-key.sh.in pacman-optimize: $(srcdir)/pacman-optimize.sh.in pkgdelta: $(srcdir)/pkgdelta.sh.in rankmirrors: $(srcdir)/rankmirrors.sh.in diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in new file mode 100644 index 0000000..05745a9 --- /dev/null +++ b/scripts/pacman-key.sh.in @@ -0,0 +1,280 @@ +#!/bin/bash -e +# +# pacman-key - manages pacman's keyring +# @configure_input@ +# +# Copyright (c) 2010 - Pacman Development Team <pacman-dev@archlinux.org> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. +# + +# gettext initialization +export TEXTDOMAIN='pacman' +export TEXTDOMAINDIR='@localedir@' + +# Based on apt-key, from Debian +myver="@PACKAGE_VERSION@" + +# According to apt-key, gpg doesn't like to be called without a secret keyring. +# We will not really need one, because pacman will not sign packages, just verify +# their integrities. +PACMAN_SHARE_DIR="@pkgdatadir@" + +# Default parameters for the command gpg. Some more will be added when needed +GPG="gpg" +GPG_NOKEYRING="${GPG} --ignore-time-conflict --no-options --no-default-keyring" +SIG_EXT=".sig" + +# Read-only keyring with keys to be added to the keyring +ADDED_KEYS="${PACMAN_SHARE_DIR}/addedkeys.gpg" + +# Read-only keyring with keys removed from the keyring. They need to be removed before +# the keys from the added keyring be really imported +REMOVED_KEYS="${PACMAN_SHARE_DIR}/removedkeys.gpg" + +usage() { + printf "pacman-key (pacman) %s\n" ${myver} + echo + printf $(gettext "Usage: %s [options] command [arguments]") $(basename $0) + echo + echo $(gettext "Manage pacman's list of trusted keys") + echo + echo $(gettext "Options must be placed before commands. The abailable options are:") + echo $(gettext " --config - set an alternative configuraton file to use. ") + echo $(gettext " Default is @sysconfdir@/pacman.conf") + echo $(gettext " --gpgdir - set an alternativ home directory for gnupg. ") + echo $(gettext " Default is @sysconfdir@/pacman.d/gnupg") + echo + echo $(gettext "The available commands are:") + echo $(gettext " pacman-key -a | --add <file> ... - add the key contained ") + echo $(gettext " in <file> ('-' for stdin)") + echo $(gettext " pacman-key -d | --del <keyid> ... - remove the key <keyid>") + echo $(gettext " pacman-key -e | --export <keyid> ... - output the key <keyid>") + echo $(gettext " pacman-key -x | --exportall - output all trusted keys") + echo $(gettext " pacman-key -r | --receive <keyserver> <keyid> ... - fetch the keyids from") + echo $(gettext " the specified keyserver URL") + echo $(gettext " pacman-key -t | --trust <keyid> ... - set the truslevel of the given key") + echo $(gettext " pacman-key -u | --updatedb - update the trustdb of pacman") + echo $(gettext " pacman-key --reload - reloads the keys from the keyring package") + echo $(gettext " pacman-key -l | --list - list keys") + echo $(gettext " pacman-key -f | --finger <keyid> ... - list fingerprints") + echo $(gettext " pacman-key --adv <params> - pass advanced options to gpg") + echo $(gettext " pacman-key -h | --help - displays this message") + echo $(gettext " pacman-key -v | --version - displays the current version") +} + +version() { + printf "pacman-key (pacman) %s\n" "${myver}" + printf "$(gettext "\ +Copyright (c) 2010 Pacman Development Team <pacman-dev@archlinux.org>.\n\ +This is free software; see the source for copying conditions.\n\ +There is NO WARRANTY, to the extent permitted by law.\n")" +} + +prepare_homedir() { + if [[ ! -d "${PACMAN_KEYRING_DIR}" ]] ; then + mkdir -p "${PACMAN_KEYRING_DIR}" + touch "${PACMAN_KEYRING_DIR}/secring.gpg" + touch "${PACMAN_KEYRING_DIR}/pubring.gpg" + chmod 700 "${PACMAN_KEYRING_DIR}" + chmod 600 "${PACMAN_KEYRING_DIR}"/{sec,pub}ring.gpg + fi +} + +update_trustdb() { + ${GPG_PACMAN} --batch --check-trustdb +} + +reload_keyring() { + # Verify the signature of removed keys file + if [[ -f "${REMOVED_KEYS}" ]] && ! ${GPG_PACMAN} --quiet --verify "${REMOVED_KEYS}${SIG_EXT}" ; then + echo >&2 $(gettext "The signature of file ${REMOVED_KEYS} is not valid.") + exit 1 + fi + + # Verify the signature of the added keys file + if [[ -f "${ADDED_KEYS}" ]] && ! ${GPG_PACMAN} --quiet --verify "${ADDED_KEYS}${SIG_EXT}" ; then + echo >&2 $(gettext "The signature of file ${ADDED_KEYS} is not valid.") + exit 1 + fi + + # Remove the keys from REMOVED_KEYS keyring + [[ -r "${REMOVED_KEYS}" ]] && cat "${REMOVED_KEYS}" | while read key ; do + ${GPG_PACMAN} --quiet --batch --yes --delete-keys "${key}" + done + + # Add keys from the current set of keys from pacman-keyring package. The web of trust will + # be updated automatically. + if [[ -r "${ADDED_KEYS}" ]] ; then + add_keys=$(${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5) + for key in ${add_keys}; do + ${GPG_NOKEYRING} --quiet --batch --keyring "${ADDED_KEYS}" --export "${key}" | ${GPG_PACMAN} --import + done + fi + + # Update trustdb, just to be sure + update_trustdb +} + +receive() { + keyserver="$1" + shift + ${GPG_PACMAN} --keyserver "${keyserver}" $* +} + +# PROGRAM START + +if ! type gettext &>/dev/null; then + gettext() { + echo "$@" + } +fi + +if [[ "$command" != "version" && "$command" != "help" ]] && ! which "${GPG}" >/dev/null 2>&1; then + echo >&2 $(gettext "Warning: gnupg does not seem to be installed.") + echo >&2 $(gettext "Warning: pacman-key requires gnupg for most operations.") + exit 1 +fi + +# Parse global options +CONFIG="@sysconfdir@/pacman.conf" +PACMAN_KEYRING_DIR="@sysconfdir@/pacman.d/gnupg" +while [[ $1 =~ ^--(config|gpgdir)$ ]] ; do + case "$1" in + --config) shift; CONFIG="$1" ;; + --gpgdir) shift; PACMAN_KEYRING_DIR="$1" ;; + esac + shift +done + +if [[ ! -r "${CONFIG}" ]] ; then + echo >&2 $(gettext "It is not possible to read ${CONFIG}.") + exit 1 +fi + +# Read GPGDIR from $CONFIG. +# The pattern is: any spaces or tabs, GPGDir, any spaces or tabs, equal sign +# and the rest of the line. The string is splitted after the first occurrence of = +GPGDIR=$(cat ${CONFIG} | awk '/^(\t| )*GPGDir(\t| )*=.*/ { print substr($0,index($0, "=")+1) }') +if [[ "${GPGDIR}" ]] ; then + PACMAN_KEYRING_DIR="${GPGDIR}" +fi +GPG_PACMAN="${GPG} --homedir ${PACMAN_KEYRING_DIR}" + +prepare_homedir + +# Parse and execute command +command="$1" +if [[ -z "${command}" ]]; then + usage + exit 1 +fi +shift + +case "${command}" in + -a|--add) + if (( $# == 0 )) ; then + echo >&2 $(gettext "You need to specify at least one key identifier") + usage + exit 1 + fi + while (( $# > 0 )) ; do + ${GPG_PACMAN} --quiet --batch --import "$1" + shift + done + ;; + -d|--del) + if (( $# == 0 )) ; then + echo >&2 $(gettext "You need to specify at least one key identifier") + usage + exit 1 + fi + while (( $# > 0 )) ; do + ${GPG_PACMAN} --quiet --batch --delete-key --yes "$1" + shift + done + ;; + -u|--updatedb) + update_trustdb + ;; + --reload) + reload_keyring + ;; + -l|-list) + ${GPG_PACMAN} --batch --list-sigs + ;; + -f|--finger) + if (( $# == 0 )) ; then + echo >&2 $(gettext "You need to specify at least one key identifier") + usage + exit 1 + fi + ${GPG_PACMAN} --batch --fingerprint $* + ;; + -e|--export) + if (( $# == 0 )) ; then + echo >&2 $(gettext "You need to specify at least one key identifier") + usage + exit 1 + fi + while (( $# > 0 )) ; do + ${GPG_PACMAN} --armor --export "$1" + shift + done + ;; + -x|--exportall) + ${GPG_PACMAN} --armor --export + ;; + -r|--receive) + if (( $# < 2 )) ; then + echo >&2 $(gettext "You need to specify the keyserver and at least one key identifier") + usage + exit 1 + fi + receive $* + ;; + -t|--trust) + if (( $# == 0 )) ; then + echo >&2 $(gettext "You need to specify at least one key identifier") + usage + exit 1 + fi + while (( $# > 0 )) ; do + # Verify if the key exists in pacman's keyring + if ${GPG_PACMAN} --list-key "$1" > /dev/null 2>&1 ; then + ${GPG_PACMAN} --edit-key "$1" + else + echo >&2 $(gettext "The key identified by $1 doesn't exist") + exit 1 + fi + shift + done + ;; + --adv) + echo $(gettext "Executing: ${GPG_PACMAN} $*") + ${GPG_PACMAN} $* || ret=$? + exit $ret + ;; + --help) + usage + ;; + --version) + version + exit 0 + ;; + *) + usage + exit 1 + ;; +esac -- 1.7.2