On 16 September 2010 05:40, Denis A. Altoé Falqueto denisfalqueto@gmail.com wrote:
The script pacman-key will manage pacman's keyring. It imports, exports, fetches from keyservers, helps in the process of trusting and updates the trust database.
Signed-off-by: Denis A. Altoé Falqueto denisfalqueto@gmail.com
scripts/.gitignore | 1 + scripts/Makefile.am | 3 + scripts/pacman-key.sh.in | 275 ++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 279 insertions(+), 0 deletions(-) create mode 100644 scripts/pacman-key.sh.in
diff --git a/scripts/.gitignore b/scripts/.gitignore index eafc493..1c662de 100644 --- a/scripts/.gitignore +++ b/scripts/.gitignore @@ -4,3 +4,4 @@ rankmirrors repo-add repo-remove pkgdelta +pacman-key diff --git a/scripts/Makefile.am b/scripts/Makefile.am index 31e8fb5..c81f703 100644 --- a/scripts/Makefile.am +++ b/scripts/Makefile.am @@ -7,6 +7,7 @@ bin_SCRIPTS = \
OURSCRIPTS = \ makepkg \
- pacman-key \
pacman-optimize \ pkgdelta \ rankmirrors \ @@ -14,6 +15,7 @@ OURSCRIPTS = \
EXTRA_DIST = \ makepkg.sh.in \
- pacman-key.sh.in \
pacman-optimize.sh.in \ pkgdelta.sh.in \ rankmirrors.sh.in \ @@ -60,6 +62,7 @@ $(OURSCRIPTS): Makefile @mv $@.tmp $@
makepkg: $(srcdir)/makepkg.sh.in +pacman-key: ${srcdir}/pacman-key.sh.in pacman-optimize: $(srcdir)/pacman-optimize.sh.in pkgdelta: $(srcdir)/pkgdelta.sh.in rankmirrors: $(srcdir)/rankmirrors.sh.in diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in new file mode 100644 index 0000000..7b5fb29 --- /dev/null +++ b/scripts/pacman-key.sh.in @@ -0,0 +1,275 @@ +#!/bin/bash -e +# +# pacman-key - manages pacman's keyring +# Based on apt-key, from Debian +# @configure_input@ +# +# Copyright (c) 2010 - Pacman Development Team pacman-dev@archlinux.org +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +#
+# gettext initialization +export TEXTDOMAIN='pacman' +export TEXTDOMAINDIR='@localedir@'
+myver="@PACKAGE_VERSION@"
+msg() {
- local mesg=$1; shift
- printf "==> ${mesg}\n" "$@" >&1
+}
+msg2() {
- (( QUIET )) && return
- local mesg=$1; shift
- printf " -> ${mesg}\n" "$@" >&1
+}
+warning() {
- local mesg=$1; shift
- printf "==> $(gettext "WARNING:") ${mesg}\n" "$@" >&2
+}
+error() {
- local mesg=$1; shift
- printf "==> $(gettext "ERROR:") ${mesg}\n" "$@" >&2
+}
+usage() {
- printf "pacman-key (pacman) %s\n" ${myver}
- echo
- printf "$(gettext "Usage: %s [options] command [arguments]")\n" $(basename $0)
- echo
- echo "$(gettext "Manage pacman's list of trusted keys")"
- echo
- echo "$(gettext "Options must be placed before commands. The available options are:")"
- echo "$(gettext " --config - set an alternative configuration file to use. ")"
- printf "$(gettext " Default is %s")\n" "@sysconfdir@/pacman.conf"
- echo "$(gettext " --gpgdir - set an alternative home directory for gnupg. ")"
- printf "$(gettext " Default is set in %s")\n" "@sysconfdir@/pacman.conf"
- echo
- echo "$(gettext "The available commands are:")"
- echo "$(gettext " pacman-key -a | --add [<file>] ... - add the key contained ")"
- echo "$(gettext " in <file> (empty for stdin)")"
- echo "$(gettext " pacman-key -d | --del <keyid> ... - remove the key <keyid>")"
- echo "$(gettext " pacman-key -e | --export <keyid> ... - output the key <keyid>")"
- echo "$(gettext " pacman-key -r | --receive <keyserver> <keyid> ... - fetch the keyids from")"
- echo "$(gettext " the specified keyserver URL")"
- echo "$(gettext " pacman-key -t | --trust <keyid> ... - set the trust level of the given key")"
- echo "$(gettext " pacman-key -u | --updatedb - update the trustdb of pacman")"
- echo "$(gettext " pacman-key --reload - reloads the keys from the keyring package")"
- echo "$(gettext " pacman-key -l | --list - list keys")"
- echo "$(gettext " pacman-key -f | --finger [<keyid]> ... - list fingerprint for specified keyids (or for all, if none is specified)")"
- echo "$(gettext " pacman-key --adv <params> - use pacman's keyring as target for advanced commands")"
- echo "$(gettext " pacman-key -h | --help - displays this message")"
- echo "$(gettext " pacman-key -v | --version - displays the current version")"
+}
+version() {
- printf "pacman-key (pacman) %s\n" "${myver}"
- printf "$(gettext "\
+Copyright (c) 2010 Pacman Development Team pacman-dev@archlinux.org.\n\ +This is free software; see the source for copying conditions.\n\ +There is NO WARRANTY, to the extent permitted by law.\n")" +}
+reload_keyring() {
- local PACMAN_SHARE_DIR='@prefix@/share/pacman'
- local GPG_NOKEYRING="gpg --batch --quiet --ignore-time-conflict --no-options --no-default-keyring --homedir ${PACMAN_KEYRING_DIR}"
- # Read-only keyring with keys to be added to the keyring
- local ADDED_KEYS="${PACMAN_SHARE_DIR}/addedkeys.gpg"
- # Read-only list of keys removed from the keyring.
- local REMOVED_KEYS="${PACMAN_SHARE_DIR}/removedkeys"
- # Add keys from the current set of keys from pacman-keyring package. The web of trust will
- # be updated automatically.
- if [[ -r "${ADDED_KEYS}" ]]; then
- msg "$(gettext "Verifying official keys file signature...")"
- if ! ${GPG_PACMAN} --quiet --verify "${ADDED_KEYS}.sig" 1>/dev/null; then
- error "$(gettext "The signature of file %s is not valid.")" "${ADDED_KEYS}"
- exit 1
- fi
- msg "$(gettext "Appending official keys...")"
- local add_keys=$(${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5)
- for key in ${add_keys}; do
- msg "$(gettext " key id: %s")" "$key"
- ${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --export "${key}" | ${GPG_PACMAN} --import
- done
- fi
- # Remove the keys from REMOVED_KEYS keyring
- if [[ -r "${REMOVED_KEYS}" ]]; then
- msg "$(gettext "Verifying deleted keys file signature...")"
- if ! ${GPG_PACMAN} --quiet --verify "${REMOVED_KEYS}.sig"; then
- error "$(gettext "The signature of file %s is not valid.")" "${REMOVED_KEYS}"
- exit 1
- fi
- msg "$(gettext "Removing deleted keys from keyring...")"
- cat "${REMOVED_KEYS}" | while read key; do
- msg "$(gettext " key id: %s")" "$key"
- ${GPG_PACMAN} --quiet --batch --yes --delete-key "${key}"
- done
- fi
- # Update trustdb, just to be sure
- msg "$(gettext "Updating trust database...")"
- ${GPG_PACMAN} --batch --check-trustdb
+}
+# PROGRAM START +if ! type gettext &>/dev/null; then
- gettext() {
- echo "$@"
- }
+fi
+if [[ $1 != "--version" && $1 != "-v" && $1 != "--help" && $1 != "-h" ]]; then
- if type -p gpg >/dev/null 2>&1 = 1; then
- error "$(gettext "gnupg does not seem to be installed.")"
- msg2 "$(gettext "pacman-key requires gnupg for most operations.")"
- exit 1
- elif (( EUID != 0 )); then
- error "$(gettext "pacman-key needs to be run as root.")"
- exit 1
- fi
+fi
+# Parse global options +CONFIG="@sysconfdir@/pacman.conf" +PACMAN_KEYRING_DIR="@sysconfdir@/pacman.d/gnupg" +while [[ $1 =~ ^--(config|gpgdir)$ ]]; do
- case "$1" in
- --config) shift; CONFIG="$1" ;;
- --gpgdir) shift; PACMAN_KEYRING_DIR="$1" ;;
- esac
- shift
+done
+if [[ ! -r "${CONFIG}" ]]; then
- error "$(gettext "It is not possible to read %s")" "${CONFIG}"
- exit 1
+fi
+# Read GPGDIR from $CONFIG. +# The pattern is: any spaces or tabs, GPGDir, any spaces or tabs, equal sign +# and the rest of the line. The string is splitted after the first occurrence of = +if [[ GPGDIR=$(grep -e '^[[:blank:]]*GPGDir[[:blank:]]*=.*' "$CONFIG") == 0 ]]; then
- GPGDIR=${GPGDIR#*=}
- PACMAN_KEYRING_DIR="${GPGDIR}"
+fi +GPG_PACMAN="gpg --homedir ${PACMAN_KEYRING_DIR}"
+# Parse and execute command +command="$1" +if [[ -z "${command}" ]]; then
- usage
- exit 1
+fi +shift
+case "${command}" in
- -a|--add)
- if (( $# == 0 )); then
- error "$(gettext "You need to specify at least one key identifier")"
- usage
- exit 1
- fi
- while (( $# > 0 )); do
- ${GPG_PACMAN} --quiet --batch --import "$1"
- shift
- done
- ;;
- -d|--del)
- if (( $# == 0 )); then
- error "$(gettext "You need to specify at least one key identifier")"
- usage
- exit 1
- fi
- while (( $# > 0 )); do
- ${GPG_PACMAN} --quiet --batch --delete-key --yes "$1"
- shift
- done
- ;;
- -u|--updatedb)
- ${GPG_PACMAN} --batch --check-trustdb
- ;;
- --reload)
- reload_keyring
- ;;
- -l|--list)
- ${GPG_PACMAN} --batch --list-sigs
- ;;
- -f|--finger)
- ${GPG_PACMAN} --batch --fingerprint $*
- ;;
- -e|--export)
- if (( $# == 0 )); then
- ${GPG_PACMAN} --armor --export
- else
- while (( $# > 0 )); do
- ${GPG_PACMAN} --armor --export "$1"
- shift
- done
- fi
- ;;
- -r|--receive)
- if (( $# < 2 )); then
- error "$(gettext "You need to specify the keyserver and at least one key identifier")"
- usage
- exit 1
- fi
- keyserver="$1"
- shift
- ${GPG_PACMAN} --keyserver "${keyserver}" --recv-keys $*
- ;;
- -t|--trust)
- if (( $# == 0 )); then
- error "$(gettext "You need to specify at least one key identifier")"
- usage
- exit 1
- fi
- while (( $# > 0 )); do
- # Verify if the key exists in pacman's keyring
- if ${GPG_PACMAN} --list-keys "$1" > /dev/null 2>&1; then
- ${GPG_PACMAN} --edit-key "$1"
- else
- error "$(gettext "The key identified by %s doesn't exist")" "$1"
- exit 1
- fi
- shift
- done
- ;;
- --adv)
- msg "$(gettext "Executing: %s ")$*" "${GPG_PACMAN}"
- ${GPG_PACMAN} $* || ret=$?
- exit $ret
- ;;
- --help)
- usage
- ;;
- --version)
- version
- exit 0
- ;;
- *)
- usage
- exit 1
- ;;
+esac
-- 1.7.2.3
Hi Denis, Hi everyone,
I'm really pleased to see you're back on track.
If any of the collaborators want to help, this is the time
I would be glad to. I see you need help to write the man right? Is this the number one task? Because I could also help with some more technical things if needed.
Just let me know.
-- Guillaume