On Mon, Jul 26, 2010 at 3:26 PM, Denis A. Altoé Falqueto wrote:

The script pacman-key will manage pacman's keyring. It imports, exports, fetches from keyservers, helps in the process of trusting and updates the trust database.

Signed-off-by: Denis A. Altoé Falqueto ---  scripts/.gitignore       |    1 +  scripts/Makefile.am      |    3 +  scripts/pacman-key.sh.in |  296 ++++++++++++++++++++++++++++++++++++++++++++++  3 files changed, 300 insertions(+), 0 deletions(-)  create mode 100644 scripts/pacman-key.sh.in

diff --git a/scripts/.gitignore b/scripts/.gitignore index eafc493..1c662de 100644 --- a/scripts/.gitignore +++ b/scripts/.gitignore @@ -4,3 +4,4 @@ rankmirrors  repo-add  repo-remove  pkgdelta +pacman-key diff --git a/scripts/Makefile.am b/scripts/Makefile.am index 31e8fb5..c81f703 100644 --- a/scripts/Makefile.am +++ b/scripts/Makefile.am @@ -7,6 +7,7 @@ bin_SCRIPTS = \

 OURSCRIPTS = \        makepkg \ +       pacman-key \        pacman-optimize \        pkgdelta \        rankmirrors \ @@ -14,6 +15,7 @@ OURSCRIPTS = \

 EXTRA_DIST = \        makepkg.sh.in \ +       pacman-key.sh.in \        pacman-optimize.sh.in \        pkgdelta.sh.in \        rankmirrors.sh.in \ @@ -60,6 +62,7 @@ $(OURSCRIPTS): Makefile        @mv $@.tmp $@

 makepkg: $(srcdir)/makepkg.sh.in +pacman-key: ${srcdir}/pacman-key.sh.in  pacman-optimize: $(srcdir)/pacman-optimize.sh.in  pkgdelta: $(srcdir)/pkgdelta.sh.in  rankmirrors: $(srcdir)/rankmirrors.sh.in diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in new file mode 100644 index 0000000..5cb4066 --- /dev/null +++ b/scripts/pacman-key.sh.in @@ -0,0 +1,296 @@ +#!/bin/bash -e +# +#   pacman-key - manages pacman's keyring +#   @configure_input@ +# +#   Copyright (c) 2010 - Denis A. Altoé Falqueto +# +#   This program is free software; you can redistribute it and/or modify +#   it under the terms of the GNU General Public License as published by +#   the Free Software Foundation; either version 2 of the License, or +#   (at your option) any later version. +# +#   This program is distributed in the hope that it will be useful, +#   but WITHOUT ANY WARRANTY; without even the implied warranty of +#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the +#   GNU General Public License for more details. +# +#   You should have received a copy of the GNU General Public License +#   along with this program.  If not, see http://www.gnu.org/licenses/. +# + +# gettext initialization +export TEXTDOMAIN='pacman' +export TEXTDOMAINDIR='@localedir@' You don't end up actually using gettext anywhere. A script like this actually should.

+ +# Based on apt-key, from Debian +# Author: Denis A. Altoé Falqueto <denisfalqueto at gmail dot com> These quickly become outdated- I'm fine with the copyright, but if you want this you also need to fix every single problem that comes up with the script. git does a perfectly fine job at telling you who the original author is.

+PACMAN_KEY_VERSION="@PACKAGE_VERSION@" + +# According to apt-key, gpg doesn't like to be called without a secret keyring. +# We will not really need one, because pacman will not sign packages, just verify +# their integrities. +PACMAN_SHARE_DIR="/usr/share/pacman" This needs to be autoconf-ed. See doc/Makefile.am and pkgdatadir and use that like @sysconfdir@ in makepkg.sh.in.

+ +# Default parameters for the command gpg. Some more will be added when needed +GPG="gpg" +GPG_NOKEYRING="${GPG} --ignore-time-conflict --no-options --no-default-keyring" +SIG_EXT=".sig" Would we ever change this? I'd rather have .sig hardcoded just like we killed other things that will never really change because they are convention outside of just this package.

+ +# Read-only keyring with keys to be added to the keyring +ADDED_KEYS="${PACMAN_SHARE_DIR}/addedkeys.gpg" + +# Read-only keyring with keys removed from the keyring. They need to be removed before +# the keys from the added keyring be really imported +REMOVED_KEYS="${PACMAN_SHARE_DIR}/removedkeys.gpg" + +usage() { +       echo "pacman-key - Pacman's keyring management utility" +       echo "Usage: $(basename $0) [options] command [arguments]" +       echo +       echo "Manage pacman's list of trusted keys" +       echo +       echo "Options must be placed before commands. The abailable options are:" +       echo " --config    - set an alternative configuraton file to use. " +       echo "               Default is @sysconfdir@/pacman.conf" +       echo " --gpgdir    - set an alternativ home directory for gnupg. " +       echo "               Default is @sysconfdir@/pacman.d/gnupg" +       echo +       echo "The available commands are:" +       echo "  pacman-key add <file> ...                  - add the key contained in <file> ('-' for stdin)" +       echo "  pacman-key del <keyid> ...                 - remove the key <keyid>" +       echo "  pacman-key export <keyid> ...              - output the key <keyid>" +       echo "  pacman-key exportall                       - output all trusted keys" +       echo "  pacman-key receive <keyserver> <keyid> ... - fetch the keyids from the specified keyserver URL" +       echo "  pacman-key trust <keyid> ...               - set the truslevel of the given key" +       echo "  pacman-key updatedb                        - update the trustdb of pacman" +       echo "  pacman-key reload                          - reloads the keys from the keyring package" +       echo "  pacman-key list                            - list keys" +       echo "  pacman-key finger <keyid> ...              - list fingerprints" +       echo "  pacman-key adv <params>                    - pass advanced options to gpg" +       echo "  pacman-key help                            - displays this message" +       echo "  pacman-key version                         - displays the current version" +} I forgot we did this in makepkg; I don't really like it there. This stuff seems like it belongs in a manpage with a shorter usage() such as the one in repo-add. Anyone else have thoughts?

Either way, for a essential tool, we will need a manpage.

+ +prepare_homedir() { +       if [[ ! -d ${PACMAN_KEYRING_DIR} ]] ; then +               mkdir -p "${PACMAN_KEYRING_DIR}" +               [[ ! -f "${PACMAN_KEYRING_DIR}/secring.gpg" ]] && touch "${PACMAN_KEYRING_DIR}/secring.gpg" +               [[ ! -f "${PACMAN_KEYRING_DIR}/pubring.gpg" ]] && touch "${PACMAN_KEYRING_DIR}/pubring.gpg" If the dir didn't exist, why this -f check? +               chmod 700 "${PACMAN_KEYRING_DIR}" +               chmod 600 "${PACMAN_KEYRING_DIR}"/* Why the glob? Can't we just explicitly list the two files previously touched? Minor nitpick but seems more sensible to me. +       fi +} + +add_key() { +       ${GPG_PACMAN} --quiet --batch --import "$1" +} + +remove_key() { +       ${GPG_PACMAN} --quiet --batch --delete-key --yes "$1" +} + +update_trustdb() { +       ${GPG_PACMAN} --batch --check-trustdb +} + +list_sigs() { +       ${GPG_PACMAN} --batch --list-sigs +} + +list_fingerprints() { +       ${GPG_PACMAN} --batch --fingerprint $* +} + +export_key() { +       ${GPG_PACMAN} --armor --export "$1" +} + +export_all() { +       ${GPG_PACMAN} --armor --export +} If these are all one-liners, it would seem to make more sense to inline them if they are only called from one place. Ignore me if they are not.

+ +trust_key() { +       # Verify if the key exists in pacman's keyring +       if ${GPG_PACMAN} --list-key "$1" > /dev/null 2>&1 ; then +               ${GPG_PACMAN} --edit-key "$1" +       else +               echo >&2 "The key identified by $1 doesn't exist" I'd rather find a way to reuse msg/msg2/warning/error from repo-add then do this. We might want to move those into a sourced common utilities file.

+               exit 1 +       fi +} + +reload_keyring() { +       # Verify the signature of removed keys file +       if [[ -f ${REMOVED_KEYS} ]] && ! ${GPG_PACMAN} --quiet --verify ${REMOVED_KEYS}${SIG_EXT} ; then You quoted paths elsewhere but then didn't quote here or many of the following places.

+               echo >&2 "The signature of file ${REMOVED_KEYS} is not valid." +               exit 1 +       fi + +       # Verify the signature of the added keys file +       if [[ -f ${ADDED_KEYS} ]] && ! ${GPG_PACMAN} --quiet --verify ${ADDED_KEYS}${SIG_EXT} ; then +               echo >&2 "The signature of file ${ADDED_KEYS} is not valid." +               exit 1 +       fi + +       # Remove the keys from REMOVED_KEYS keyring +       [[ -r ${REMOVED_KEYS} ]] && cat "${REMOVED_KEYS}" | while read key ; do +               ${GPG_PACMAN} --quiet --batch --yes --delete-keys ${key} +       done + +       # Add keys from the current set of keys from pacman-keyring package. The web of trust will +       # be updated automatically. +       if [[ -r ${ADDED_KEYS} ]] ; then +               add_keys=$(${GPG_NOKEYRING} --keyring ${ADDED_KEYS} --with-colons --list-keys | grep ^pub | cut -d: -f5) +               for add_key in $add_keys; do +                       ${GPG_NOKEYRING} --quiet --batch --keyring $ADDED_KEYS --export $add_key | ${GPG_PACMAN} --import +               done +       fi + +       # Update trustdb, just to be sure +       update_trustdb +} + +receive() { +       keyserver="$1" +       shift +       ${GPG_PACMAN} --keyserver ${keyserver} $* +} + +# PROGRAM START + +if ! type gettext &>/dev/null; then +       gettext() { +               echo "$@" +       } +fi + +if [[ "$command" != "version" && "$command" != "help" ]] && ! which "${GPG}" >/dev/null 2>&1; then +       echo >&2 "Warning: gnupg does not seem to be installed." +       echo >&2 "Warning: pacman-key requires gnupg for most operations." +       echo >&2 +       exit 1 +fi + +# Parse global options +CONFIG="@sysconfdir@/pacman.conf" +PACMAN_KEYRING_DIR="@sysconfdir@/pacman.d/gnupg" +while [[ $1 =~ ^- ]] ; do +       case "$1" in +               --config) shift; CONFIG="$1" ;; +               --gpgdir) shift; PACMAN_KEYRING_DIR="$1" ;; +       esac +       shift +done + +if [[ ! -r "$CONFIG" ]] ; then +       echo >&2 "It is not possible to read $CONFIG." +       exit 1 +fi +# Read GPGDIR from $CONFIG +GPGDIR=$(grep "^ *GPGDir *=" "$CONFIG" | cut -d= -f2) +if [[ "$GPGDIR" ]] ; then +       PACMAN_KEYRING_DIR="$GPGDIR" +fi Hmm, this is kinda ugly but not sure what to suggest just yet. +GPG_PACMAN="${GPG} --homedir ${PACMAN_KEYRING_DIR}" + +prepare_homedir + +# Parse and execute command +command="$1" +if [[ -z "$command" ]]; then +       usage +       exit 1 +fi +shift + +case "$command" in +       add) +               if (( $# == 0 )) ; then +                   echo >&2 "You need to specify at least one key identifier" +                   usage +                   exit 1 +               fi +               while (( $# > 0 )) ; do +                 add_key $1 +                 shift +               done +               ;; +       del|rm|remove) +               if (( $# == 0 )) ; then +                   echo >&2 "You need to specify at least one key identifier" +                   usage +                   exit 1 +               fi +               while (( $# > 0 )) ; do +                   remove_key $1 +                   shift +               done +               ;; +       updatedb) +               update_trustdb +               ;; +       reload) +               reload_keyring +               ;; +       list) +               list_sigs +               ;; +       finger*) +               if (( $# == 0 )) ; then +                   echo >&2 "You need to specify at least one key identifier" +                   usage +                   exit 1 +               fi +               list_fingerprints $* +               ;; +       export) +               if (( $# == 0 )) ; then +                   echo >&2 "You need to specify at least one key identifier" +                   usage +                   exit 1 +               fi +               while (( $# > 0 )) ; do +                   export_key $1 +                   shift +               done +               ;; +       exportall) +               export_all +               ;; +       receive) +               if (( $# < 2 )) ; then +                   echo >&2 "You need to specify the keyserver and at least one key identifier" +                   usage +                   exit 1 +               fi +               receive $* +               ;; +       trust) +               if (( $# == 0 )) ; then +                   echo >&2 "You need to specify at least one key identifier" +                   usage +                   exit 1 +               fi +               while (( $# > 0 )) ; do +                   trust_key $1 +                   shift +               done +               ;; +       adv*) +               echo "Executing: ${GPG_PACMAN} $*" +               ${GPG_PACMAN} $* || ret=$? +               exit $ret +               ;; +       --help) +               usage +               ;; +       --version) +               echo "pacman-key v${PACMAN_KEY_VERSION}" +               echo " This program can be freely distributed under the GPL v2" +               ;; Please use a similar version() function to makepkg/repo-add.

You also have help/version above, and --help/--version here.

+       *) +               usage +               exit 1 +               ;; +esac -- 1.7.1.1

General thoughts: 1. We don't use the non-dashed option type commands in any other utility. I'm not necessarily against it but thought it was worth pointing out. 2. A lot of times our style in shell scripts has tended towards omitting braces, e.g. ${foobar} would be just $foobar if possible. 3. This was a static code analysis, I need to actually run this and give it a shot. 4. Don't get discouraged at my review here, I'm just trying to make sure when we introduce something new we don't have to spend the next few iterations making it a solid core piece of code. I'd rather get it right the first time. -Dan -Dan

The script pacman-key will manage pacman's keyring. It imports, exports, fetches from keyservers, helps in the process of trusting and updates the trust database. Signed-off-by: Denis A. Altoé Falqueto --- scripts/.gitignore | 1 + scripts/Makefile.am | 3 + scripts/pacman-key.sh.in | 280 ++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 284 insertions(+), 0 deletions(-) create mode 100644 scripts/pacman-key.sh.in diff --git a/scripts/.gitignore b/scripts/.gitignore index eafc493..1c662de 100644 --- a/scripts/.gitignore +++ b/scripts/.gitignore @@ -4,3 +4,4 @@ rankmirrors repo-add repo-remove pkgdelta +pacman-key diff --git a/scripts/Makefile.am b/scripts/Makefile.am index 31e8fb5..c81f703 100644 --- a/scripts/Makefile.am +++ b/scripts/Makefile.am @@ -7,6 +7,7 @@ bin_SCRIPTS = \ OURSCRIPTS = \ makepkg \ + pacman-key \ pacman-optimize \ pkgdelta \ rankmirrors \ @@ -14,6 +15,7 @@ OURSCRIPTS = \ EXTRA_DIST = \ makepkg.sh.in \ + pacman-key.sh.in \ pacman-optimize.sh.in \ pkgdelta.sh.in \ rankmirrors.sh.in \ @@ -60,6 +62,7 @@ $(OURSCRIPTS): Makefile @mv $@.tmp $@ makepkg: $(srcdir)/makepkg.sh.in +pacman-key: ${srcdir}/pacman-key.sh.in pacman-optimize: $(srcdir)/pacman-optimize.sh.in pkgdelta: $(srcdir)/pkgdelta.sh.in rankmirrors: $(srcdir)/rankmirrors.sh.in diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in new file mode 100644 index 0000000..05745a9 --- /dev/null +++ b/scripts/pacman-key.sh.in @@ -0,0 +1,280 @@ +#!/bin/bash -e +# +# pacman-key - manages pacman's keyring +# @configure_input@ +# +# Copyright (c) 2010 - Pacman Development Team +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# + +# gettext initialization +export TEXTDOMAIN='pacman' +export TEXTDOMAINDIR='@localedir@' + +# Based on apt-key, from Debian +myver="@PACKAGE_VERSION@" + +# According to apt-key, gpg doesn't like to be called without a secret keyring. +# We will not really need one, because pacman will not sign packages, just verify +# their integrities. +PACMAN_SHARE_DIR="@pkgdatadir@" + +# Default parameters for the command gpg. Some more will be added when needed +GPG="gpg" +GPG_NOKEYRING="${GPG} --ignore-time-conflict --no-options --no-default-keyring" +SIG_EXT=".sig" + +# Read-only keyring with keys to be added to the keyring +ADDED_KEYS="${PACMAN_SHARE_DIR}/addedkeys.gpg" + +# Read-only keyring with keys removed from the keyring. They need to be removed before +# the keys from the added keyring be really imported +REMOVED_KEYS="${PACMAN_SHARE_DIR}/removedkeys.gpg" + +usage() { + printf "pacman-key (pacman) %s\n" ${myver} + echo + printf $(gettext "Usage: %s [options] command [arguments]") $(basename $0) + echo + echo $(gettext "Manage pacman's list of trusted keys") + echo + echo $(gettext "Options must be placed before commands. The abailable options are:") + echo $(gettext " --config - set an alternative configuraton file to use. ") + echo $(gettext " Default is @sysconfdir@/pacman.conf") + echo $(gettext " --gpgdir - set an alternativ home directory for gnupg. ") + echo $(gettext " Default is @sysconfdir@/pacman.d/gnupg") + echo + echo $(gettext "The available commands are:") + echo $(gettext " pacman-key -a | --add <file> ... - add the key contained ") + echo $(gettext " in <file> ('-' for stdin)") + echo $(gettext " pacman-key -d | --del <keyid> ... - remove the key <keyid>") + echo $(gettext " pacman-key -e | --export <keyid> ... - output the key <keyid>") + echo $(gettext " pacman-key -x | --exportall - output all trusted keys") + echo $(gettext " pacman-key -r | --receive <keyserver> <keyid> ... - fetch the keyids from") + echo $(gettext " the specified keyserver URL") + echo $(gettext " pacman-key -t | --trust <keyid> ... - set the truslevel of the given key") + echo $(gettext " pacman-key -u | --updatedb - update the trustdb of pacman") + echo $(gettext " pacman-key --reload - reloads the keys from the keyring package") + echo $(gettext " pacman-key -l | --list - list keys") + echo $(gettext " pacman-key -f | --finger <keyid> ... - list fingerprints") + echo $(gettext " pacman-key --adv <params> - pass advanced options to gpg") + echo $(gettext " pacman-key -h | --help - displays this message") + echo $(gettext " pacman-key -v | --version - displays the current version") +} + +version() { + printf "pacman-key (pacman) %s\n" "${myver}" + printf "$(gettext "\ +Copyright (c) 2010 Pacman Development Team .\n\ +This is free software; see the source for copying conditions.\n\ +There is NO WARRANTY, to the extent permitted by law.\n")" +} + +prepare_homedir() { + if [[ ! -d "${PACMAN_KEYRING_DIR}" ]] ; then + mkdir -p "${PACMAN_KEYRING_DIR}" + touch "${PACMAN_KEYRING_DIR}/secring.gpg" + touch "${PACMAN_KEYRING_DIR}/pubring.gpg" + chmod 700 "${PACMAN_KEYRING_DIR}" + chmod 600 "${PACMAN_KEYRING_DIR}"/{sec,pub}ring.gpg + fi +} + +update_trustdb() { + ${GPG_PACMAN} --batch --check-trustdb +} + +reload_keyring() { + # Verify the signature of removed keys file + if [[ -f "${REMOVED_KEYS}" ]] && ! ${GPG_PACMAN} --quiet --verify "${REMOVED_KEYS}${SIG_EXT}" ; then + echo >&2 $(gettext "The signature of file ${REMOVED_KEYS} is not valid.") + exit 1 + fi + + # Verify the signature of the added keys file + if [[ -f "${ADDED_KEYS}" ]] && ! ${GPG_PACMAN} --quiet --verify "${ADDED_KEYS}${SIG_EXT}" ; then + echo >&2 $(gettext "The signature of file ${ADDED_KEYS} is not valid.") + exit 1 + fi + + # Remove the keys from REMOVED_KEYS keyring + [[ -r "${REMOVED_KEYS}" ]] && cat "${REMOVED_KEYS}" | while read key ; do + ${GPG_PACMAN} --quiet --batch --yes --delete-keys "${key}" + done + + # Add keys from the current set of keys from pacman-keyring package. The web of trust will + # be updated automatically. + if [[ -r "${ADDED_KEYS}" ]] ; then + add_keys=$(${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5) + for key in ${add_keys}; do + ${GPG_NOKEYRING} --quiet --batch --keyring "${ADDED_KEYS}" --export "${key}" | ${GPG_PACMAN} --import + done + fi + + # Update trustdb, just to be sure + update_trustdb +} + +receive() { + keyserver="$1" + shift + ${GPG_PACMAN} --keyserver "${keyserver}" $* +} + +# PROGRAM START + +if ! type gettext &>/dev/null; then + gettext() { + echo "$@" + } +fi + +if [[ "$command" != "version" && "$command" != "help" ]] && ! which "${GPG}" >/dev/null 2>&1; then + echo >&2 $(gettext "Warning: gnupg does not seem to be installed.") + echo >&2 $(gettext "Warning: pacman-key requires gnupg for most operations.") + exit 1 +fi + +# Parse global options +CONFIG="@sysconfdir@/pacman.conf" +PACMAN_KEYRING_DIR="@sysconfdir@/pacman.d/gnupg" +while [[ $1 =~ ^--(config|gpgdir)$ ]] ; do + case "$1" in + --config) shift; CONFIG="$1" ;; + --gpgdir) shift; PACMAN_KEYRING_DIR="$1" ;; + esac + shift +done + +if [[ ! -r "${CONFIG}" ]] ; then + echo >&2 $(gettext "It is not possible to read ${CONFIG}.") + exit 1 +fi + +# Read GPGDIR from $CONFIG. +# The pattern is: any spaces or tabs, GPGDir, any spaces or tabs, equal sign +# and the rest of the line. The string is splitted after the first occurrence of = +GPGDIR=$(cat ${CONFIG} | awk '/^(\t| )*GPGDir(\t| )*=.*/ { print substr($0,index($0, "=")+1) }') +if [[ "${GPGDIR}" ]] ; then + PACMAN_KEYRING_DIR="${GPGDIR}" +fi +GPG_PACMAN="${GPG} --homedir ${PACMAN_KEYRING_DIR}" + +prepare_homedir + +# Parse and execute command +command="$1" +if [[ -z "${command}" ]]; then + usage + exit 1 +fi +shift + +case "${command}" in + -a|--add) + if (( $# == 0 )) ; then + echo >&2 $(gettext "You need to specify at least one key identifier") + usage + exit 1 + fi + while (( $# > 0 )) ; do + ${GPG_PACMAN} --quiet --batch --import "$1" + shift + done + ;; + -d|--del) + if (( $# == 0 )) ; then + echo >&2 $(gettext "You need to specify at least one key identifier") + usage + exit 1 + fi + while (( $# > 0 )) ; do + ${GPG_PACMAN} --quiet --batch --delete-key --yes "$1" + shift + done + ;; + -u|--updatedb) + update_trustdb + ;; + --reload) + reload_keyring + ;; + -l|-list) + ${GPG_PACMAN} --batch --list-sigs + ;; + -f|--finger) + if (( $# == 0 )) ; then + echo >&2 $(gettext "You need to specify at least one key identifier") + usage + exit 1 + fi + ${GPG_PACMAN} --batch --fingerprint $* + ;; + -e|--export) + if (( $# == 0 )) ; then + echo >&2 $(gettext "You need to specify at least one key identifier") + usage + exit 1 + fi + while (( $# > 0 )) ; do + ${GPG_PACMAN} --armor --export "$1" + shift + done + ;; + -x|--exportall) + ${GPG_PACMAN} --armor --export + ;; + -r|--receive) + if (( $# < 2 )) ; then + echo >&2 $(gettext "You need to specify the keyserver and at least one key identifier") + usage + exit 1 + fi + receive $* + ;; + -t|--trust) + if (( $# == 0 )) ; then + echo >&2 $(gettext "You need to specify at least one key identifier") + usage + exit 1 + fi + while (( $# > 0 )) ; do + # Verify if the key exists in pacman's keyring + if ${GPG_PACMAN} --list-key "$1" > /dev/null 2>&1 ; then + ${GPG_PACMAN} --edit-key "$1" + else + echo >&2 $(gettext "The key identified by $1 doesn't exist") + exit 1 + fi + shift + done + ;; + --adv) + echo $(gettext "Executing: ${GPG_PACMAN} $*") + ${GPG_PACMAN} $* || ret=$? + exit $ret + ;; + --help) + usage + ;; + --version) + version + exit 0 + ;; + *) + usage + exit 1 + ;; +esac -- 1.7.2

On 16 September 2010 05:40, Denis A. Altoé Falqueto wrote:

The script pacman-key will manage pacman's keyring. It imports, exports, fetches from keyservers, helps in the process of trusting and updates the trust database.

Signed-off-by: Denis A. Altoé Falqueto ---  scripts/.gitignore       |    1 +  scripts/Makefile.am      |    3 +  scripts/pacman-key.sh.in |  275 ++++++++++++++++++++++++++++++++++++++++++++++  3 files changed, 279 insertions(+), 0 deletions(-)  create mode 100644 scripts/pacman-key.sh.in

diff --git a/scripts/.gitignore b/scripts/.gitignore index eafc493..1c662de 100644 --- a/scripts/.gitignore +++ b/scripts/.gitignore @@ -4,3 +4,4 @@ rankmirrors  repo-add  repo-remove  pkgdelta +pacman-key diff --git a/scripts/Makefile.am b/scripts/Makefile.am index 31e8fb5..c81f703 100644 --- a/scripts/Makefile.am +++ b/scripts/Makefile.am @@ -7,6 +7,7 @@ bin_SCRIPTS = \

 OURSCRIPTS = \        makepkg \ +       pacman-key \        pacman-optimize \        pkgdelta \        rankmirrors \ @@ -14,6 +15,7 @@ OURSCRIPTS = \

 EXTRA_DIST = \        makepkg.sh.in \ +       pacman-key.sh.in \        pacman-optimize.sh.in \        pkgdelta.sh.in \        rankmirrors.sh.in \ @@ -60,6 +62,7 @@ $(OURSCRIPTS): Makefile        @mv $@.tmp $@

 makepkg: $(srcdir)/makepkg.sh.in +pacman-key: ${srcdir}/pacman-key.sh.in  pacman-optimize: $(srcdir)/pacman-optimize.sh.in  pkgdelta: $(srcdir)/pkgdelta.sh.in  rankmirrors: $(srcdir)/rankmirrors.sh.in diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in new file mode 100644 index 0000000..7b5fb29 --- /dev/null +++ b/scripts/pacman-key.sh.in @@ -0,0 +1,275 @@ +#!/bin/bash -e +# +#   pacman-key - manages pacman's keyring +#                Based on apt-key, from Debian +#   @configure_input@ +# +#   Copyright (c) 2010 - Pacman Development Team +# +#   This program is free software; you can redistribute it and/or modify +#   it under the terms of the GNU General Public License as published by +#   the Free Software Foundation; either version 2 of the License, or +#   (at your option) any later version. +# +#   This program is distributed in the hope that it will be useful, +#   but WITHOUT ANY WARRANTY; without even the implied warranty of +#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the +#   GNU General Public License for more details. +# +#   You should have received a copy of the GNU General Public License +#   along with this program.  If not, see http://www.gnu.org/licenses/. +# + +# gettext initialization +export TEXTDOMAIN='pacman' +export TEXTDOMAINDIR='@localedir@' + +myver="@PACKAGE_VERSION@" + +msg() { +       local mesg=$1; shift +       printf "==> ${mesg}\n" "$@" >&1 +} + +msg2() { +       (( QUIET )) && return +       local mesg=$1; shift +       printf "  -> ${mesg}\n" "$@" >&1 +} + +warning() { +       local mesg=$1; shift +       printf "==> $(gettext "WARNING:") ${mesg}\n" "$@" >&2 +} + +error() { +       local mesg=$1; shift +       printf "==> $(gettext "ERROR:") ${mesg}\n" "$@" >&2 +} + +usage() { +       printf "pacman-key (pacman) %s\n" ${myver} +       echo +       printf "$(gettext "Usage: %s [options] command [arguments]")\n" $(basename $0) +       echo +       echo "$(gettext "Manage pacman's list of trusted keys")" +       echo +       echo "$(gettext "Options must be placed before commands. The available options are:")" +       echo "$(gettext " --config    - set an alternative configuration file to use. ")" +       printf "$(gettext "               Default is %s")\n" "@sysconfdir@/pacman.conf" +       echo "$(gettext " --gpgdir    - set an alternative home directory for gnupg. ")" +       printf "$(gettext "               Default is set in %s")\n" "@sysconfdir@/pacman.conf" +       echo +       echo "$(gettext "The available commands are:")" +       echo "$(gettext "  pacman-key -a | --add [<file>] ...                - add the key contained ")" +       echo "$(gettext "                                                      in <file> (empty for stdin)")" +       echo "$(gettext "  pacman-key -d | --del <keyid> ...                 - remove the key <keyid>")" +       echo "$(gettext "  pacman-key -e | --export <keyid> ...              - output the key <keyid>")" +       echo "$(gettext "  pacman-key -r | --receive <keyserver> <keyid> ... - fetch the keyids from")" +       echo "$(gettext "                                                      the specified keyserver URL")" +       echo "$(gettext "  pacman-key -t | --trust <keyid> ...               - set the trust level of the given key")" +       echo "$(gettext "  pacman-key -u | --updatedb                        - update the trustdb of pacman")" +       echo "$(gettext "  pacman-key --reload                               - reloads the keys from the keyring package")" +       echo "$(gettext "  pacman-key -l | --list                            - list keys")" +       echo "$(gettext "  pacman-key -f | --finger [ ...            - list fingerprint for specified keyids (or for all, if none is specified)")" +       echo "$(gettext "  pacman-key --adv <params>                         - use pacman's keyring as target for advanced commands")" +       echo "$(gettext "  pacman-key -h | --help                            - displays this message")" +       echo "$(gettext "  pacman-key -v | --version                         - displays the current version")" +} + +version() { +       printf "pacman-key (pacman) %s\n" "${myver}" +       printf "$(gettext "\ +Copyright (c) 2010 Pacman Development Team .\n\ +This is free software; see the source for copying conditions.\n\ +There is NO WARRANTY, to the extent permitted by law.\n")" +} + +reload_keyring() { +       local PACMAN_SHARE_DIR='@prefix@/share/pacman' +       local GPG_NOKEYRING="gpg --batch --quiet --ignore-time-conflict --no-options --no-default-keyring --homedir ${PACMAN_KEYRING_DIR}" + +       # Read-only keyring with keys to be added to the keyring +       local ADDED_KEYS="${PACMAN_SHARE_DIR}/addedkeys.gpg" + +       # Read-only list of keys removed from the keyring. +       local REMOVED_KEYS="${PACMAN_SHARE_DIR}/removedkeys" + +       # Add keys from the current set of keys from pacman-keyring package. The web of trust will +       # be updated automatically. +       if [[ -r "${ADDED_KEYS}" ]]; then +               msg "$(gettext "Verifying official keys file signature...")" +               if ! ${GPG_PACMAN} --quiet --verify "${ADDED_KEYS}.sig" 1>/dev/null; then +                       error "$(gettext "The signature of file %s is not valid.")" "${ADDED_KEYS}" +                       exit 1 +               fi + +               msg "$(gettext "Appending official keys...")" +               local add_keys=$(${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5) +               for key in ${add_keys}; do +                       msg "$(gettext "  key id: %s")" "$key" +                       ${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --export "${key}" | ${GPG_PACMAN} --import +               done +       fi + +       # Remove the keys from REMOVED_KEYS keyring +       if [[ -r "${REMOVED_KEYS}" ]]; then +               msg "$(gettext "Verifying deleted keys file signature...")" +               if ! ${GPG_PACMAN} --quiet --verify "${REMOVED_KEYS}.sig"; then +                       error "$(gettext "The signature of file %s is not valid.")" "${REMOVED_KEYS}" +                       exit 1 +               fi + +               msg "$(gettext "Removing deleted keys from keyring...")" +               cat "${REMOVED_KEYS}" | while read key; do +                       msg "$(gettext "  key id: %s")" "$key" +                       ${GPG_PACMAN} --quiet --batch --yes --delete-key "${key}" +               done +       fi + +       # Update trustdb, just to be sure +       msg "$(gettext "Updating trust database...")" +       ${GPG_PACMAN} --batch --check-trustdb +} + +# PROGRAM START +if ! type gettext &>/dev/null; then +       gettext() { +               echo "$@" +       } +fi + +if [[ $1 != "--version" && $1 != "-v" && $1 != "--help" && $1 != "-h" ]]; then +       if type -p gpg >/dev/null 2>&1 = 1; then +               error "$(gettext "gnupg does not seem to be installed.")" +               msg2 "$(gettext "pacman-key requires gnupg for most operations.")" +               exit 1 +       elif (( EUID != 0 )); then +               error "$(gettext "pacman-key needs to be run as root.")" +               exit 1 +       fi +fi + +# Parse global options +CONFIG="@sysconfdir@/pacman.conf" +PACMAN_KEYRING_DIR="@sysconfdir@/pacman.d/gnupg" +while [[ $1 =~ ^--(config|gpgdir)$ ]]; do +       case "$1" in +               --config) shift; CONFIG="$1" ;; +               --gpgdir) shift; PACMAN_KEYRING_DIR="$1" ;; +       esac +       shift +done + +if [[ ! -r "${CONFIG}" ]]; then +       error "$(gettext "It is not possible to read %s")" "${CONFIG}" +       exit 1 +fi + +# Read GPGDIR from $CONFIG. +# The pattern is: any spaces or tabs, GPGDir, any spaces or tabs, equal sign +# and the rest of the line. The string is splitted after the first occurrence of = +if [[ GPGDIR=$(grep -e '^[[:blank:]]*GPGDir[[:blank:]]*=.*' "$CONFIG") == 0 ]]; then +  GPGDIR=${GPGDIR#*=} +       PACMAN_KEYRING_DIR="${GPGDIR}" +fi +GPG_PACMAN="gpg --homedir ${PACMAN_KEYRING_DIR}" + +# Parse and execute command +command="$1" +if [[ -z "${command}" ]]; then +       usage +       exit 1 +fi +shift + +case "${command}" in +       -a|--add) +               if (( $# == 0 )); then +                       error "$(gettext "You need to specify at least one key identifier")" +                       usage +                       exit 1 +               fi +               while (( $# > 0 )); do +                       ${GPG_PACMAN} --quiet --batch --import "$1" +                       shift +               done +               ;; +       -d|--del) +               if (( $# == 0 )); then +                       error "$(gettext "You need to specify at least one key identifier")" +                       usage +                       exit 1 +               fi +               while (( $# > 0 )); do +                       ${GPG_PACMAN} --quiet --batch --delete-key --yes "$1" +                       shift +               done +               ;; +       -u|--updatedb) +               ${GPG_PACMAN} --batch --check-trustdb +               ;; +       --reload) +               reload_keyring +               ;; +       -l|--list) +               ${GPG_PACMAN} --batch --list-sigs +               ;; +       -f|--finger) +               ${GPG_PACMAN} --batch --fingerprint $* +               ;; +       -e|--export) +               if (( $# == 0 )); then +                       ${GPG_PACMAN} --armor --export +               else +                       while (( $# > 0 )); do +                               ${GPG_PACMAN} --armor --export "$1" +                               shift +                       done +               fi +               ;; +       -r|--receive) +               if (( $# < 2 )); then +                       error "$(gettext "You need to specify the keyserver and at least one key identifier")" +                       usage +                       exit 1 +               fi +               keyserver="$1" +               shift +               ${GPG_PACMAN} --keyserver "${keyserver}" --recv-keys $* +               ;; +       -t|--trust) +               if (( $# == 0 )); then +                       error "$(gettext "You need to specify at least one key identifier")" +                       usage +                       exit 1 +               fi +               while (( $# > 0 )); do +                       # Verify if the key exists in pacman's keyring +                       if ${GPG_PACMAN} --list-keys "$1" > /dev/null 2>&1; then +                               ${GPG_PACMAN} --edit-key "$1" +                       else +                               error "$(gettext "The key identified by %s doesn't exist")" "$1" +                               exit 1 +                       fi +                       shift +               done +               ;; +       --adv) +               msg "$(gettext "Executing: %s ")$*" "${GPG_PACMAN}" +               ${GPG_PACMAN} $* || ret=$? +               exit $ret +               ;; +       --help) +               usage +               ;; +       --version) +               version +               exit 0 +               ;; +       *) +               usage +               exit 1 +               ;; +esac + -- 1.7.2.3

Hi Denis, Hi everyone, I'm really pleased to see you're back on track.

If any of the collaborators want to help, this is the time I would be glad to. I see you need help to write the man right? Is this the number one task? Because I could also help with some more technical things if needed.

Just let me know. -- Guillaume

On 27/07/10 06:26, Denis A. Altoé Falqueto wrote:

There is a possibility of another key being used, instead of the user's default. For exemple, the pacman-keyring package will be signed by a master key, because it needs to be trusted explicitly by the user before the installation of that package. So, the parameter --signwithkey will be used to supply an id of a key that will be used to sign a database or package.

Signed-off-by: Denis A. Altoé Falqueto --- scripts/makepkg.sh.in | 38 ++++++++++++++++++++-------- scripts/repo-add.sh.in | 63 +++++++++++++++++++++++++++++++++++------------- 2 files changed, 73 insertions(+), 28 deletions(-)

I would prefer this patch to be split into makepkg and repo-add parts and have the documentation patch similarly split and then the changes and documentation merged together.

diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 080e530..f6f9dfe 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -28,7 +28,7 @@ # makepkg uses quite a few external programs during its execution. You # need to have at least the following installed for makepkg to function: # bsdtar (libarchive), bzip2, coreutils, fakeroot, find (findutils), -# gettext, grep, gzip, openssl, sed, tput (ncurses), xz +# gettext, grep, gzip, openssl, sed, tput (ncurses), xz, gpg

Try keeping this alphabetical.

# gettext initialization export TEXTDOMAIN='pacman' @@ -43,6 +43,8 @@ BUILDSCRIPT='@BUILDSCRIPT@' startdir="$PWD" srcdir="$startdir/src" pkgdir="$startdir/pkg" +GPG="gpg2"

Why change to gpg2? In fact, I would prefer a separate patch that changes the "gpg" references to $GPG (=gpg by default) but allows the value to be overridden by environmental variables. So if someone wants to use gpg2 they would do something like "GPG=gpg2 makepkg".

+SIG_EXT=".sig" We consider ".sig" hard-coded in pacman. We should do the same here.

<snip> otherwise makepkg changes are fine.

diff --git a/scripts/repo-add.sh.in b/scripts/repo-add.sh.in index 4ee63d8..ac734aa 100644 --- a/scripts/repo-add.sh.in +++ b/scripts/repo-add.sh.in @@ -26,6 +26,8 @@ export TEXTDOMAINDIR='@localedir@'

myver='@PACKAGE_VERSION@' confdir='@sysconfdir@' +GPG="gpg2" +SIG_EXT=".sig"

Same comments as applied to makepkg.

QUIET=0 SIGN=0 @@ -62,8 +64,8 @@ error() { # print usage instructions usage() { printf "repo-add, repo-remove (pacman) %s\n\n" "$myver" - printf "$(gettext "Usage: repo-add [-q] [-s] [-v]<path-to-db> ...\n")" - printf "$(gettext "Usage: repo-remove [-q]<path-to-db> ...\n\n")" + printf "$(gettext "Usage: repo-add [-q] [-s [-k|--signwithkey key]] [-v]<path-to-db> ...\n")" + printf "$(gettext "Usage: repo-remove [-q] [-s [-k|--signwithkey key]]<path-to-db> ...\n\n")"

Just list the short option here as is done with all other options. <snip>

@@ -492,10 +505,24 @@ trap 'trap_exit "$(gettext "An unknown error has occured. Exiting...")"' ERR

success=0 # parse arguments -for arg in "$@"; do +while [[ $#> 0 ]] ; do + arg="$1" case "$arg" in -q|--quiet) QUIET=1;; - -s|--sign) SIGN=1;; + -s|--sign) + SIGN=1 + # The signature will be made, even if there are no operations + success=1 + ;; + -k|--signwithkey) + shift + SIGNKEY="$1" + # Check if key really exists

We have not done any checks for the gpg binary at this stage...

+ if ! ${GPG} --list-key ${SIGNKEY} 1> /dev/null 2>&1; then + error "$(gettext "Cannot find key $SIGNKEY.")" + exit 1 + fi + ;; -v|--verify) VERIFY=1;; *) if [[ -z $REPO_DB_FILE ]]; then @@ -510,6 +537,7 @@ for arg in "$@"; do fi ;; esac + shift done

# if at least one operation was a success, re-zip database @@ -529,18 +557,19 @@ if (( success )); then cd "$tmpdir" if [[ -n $(ls) ]]; then bsdtar -c${TAR_OPT}f "$filename" * - create_signature "$filename" else # we have no packages remaining? zip up some emptyness warning "$(gettext "No packages remain, creating empty database.")" bsdtar -c${TAR_OPT}f "$filename" -T /dev/null fi + # The signature must be dealt with in both cases, empty repo or not. + create_signature "$filename"

Good catch