On Mon, Jul 26, 2010 at 3:26 PM, Denis A. Altoé Falqueto denisfalqueto@gmail.com wrote:

The script pacman-key will manage pacman's keyring. It imports, exports, fetches from keyservers, helps in the process of trusting and updates the trust database.

Signed-off-by: Denis A. Altoé Falqueto denisfalqueto@gmail.com

scripts/.gitignore       |    1 +  scripts/Makefile.am      |    3 +  scripts/pacman-key.sh.in |  296 ++++++++++++++++++++++++++++++++++++++++++++++  3 files changed, 300 insertions(+), 0 deletions(-)  create mode 100644 scripts/pacman-key.sh.in

diff --git a/scripts/.gitignore b/scripts/.gitignore index eafc493..1c662de 100644 --- a/scripts/.gitignore +++ b/scripts/.gitignore @@ -4,3 +4,4 @@ rankmirrors  repo-add  repo-remove  pkgdelta +pacman-key diff --git a/scripts/Makefile.am b/scripts/Makefile.am index 31e8fb5..c81f703 100644 --- a/scripts/Makefile.am +++ b/scripts/Makefile.am @@ -7,6 +7,7 @@ bin_SCRIPTS = \

OURSCRIPTS = \        makepkg \

• pacman-key \

pacman-optimize \        pkgdelta \        rankmirrors \ @@ -14,6 +15,7 @@ OURSCRIPTS = \

EXTRA_DIST = \        makepkg.sh.in \

• pacman-key.sh.in \

pacman-optimize.sh.in \        pkgdelta.sh.in \        rankmirrors.sh.in \ @@ -60,6 +62,7 @@ $(OURSCRIPTS): Makefile        @mv $@.tmp $@

makepkg: $(srcdir)/makepkg.sh.in +pacman-key: ${srcdir}/pacman-key.sh.in  pacman-optimize: $(srcdir)/pacman-optimize.sh.in  pkgdelta: $(srcdir)/pkgdelta.sh.in  rankmirrors: $(srcdir)/rankmirrors.sh.in diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in new file mode 100644 index 0000000..5cb4066 --- /dev/null +++ b/scripts/pacman-key.sh.in @@ -0,0 +1,296 @@ +#!/bin/bash -e +# +#   pacman-key - manages pacman's keyring +#   @configure_input@ +# +#   Copyright (c) 2010 - Denis A. Altoé Falqueto denisfalqueto@gmail.com +# +#   This program is free software; you can redistribute it and/or modify +#   it under the terms of the GNU General Public License as published by +#   the Free Software Foundation; either version 2 of the License, or +#   (at your option) any later version. +# +#   This program is distributed in the hope that it will be useful, +#   but WITHOUT ANY WARRANTY; without even the implied warranty of +#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the +#   GNU General Public License for more details. +# +#   You should have received a copy of the GNU General Public License +#   along with this program.  If not, see http://www.gnu.org/licenses/. +#

+# gettext initialization +export TEXTDOMAIN='pacman' +export TEXTDOMAINDIR='@localedir@'

You don't end up actually using gettext anywhere. A script like this actually should.

+# Based on apt-key, from Debian +# Author: Denis A. Altoé Falqueto <denisfalqueto at gmail dot com>

These quickly become outdated- I'm fine with the copyright, but if you want this you also need to fix every single problem that comes up with the script. git does a perfectly fine job at telling you who the original author is.

+PACMAN_KEY_VERSION="@PACKAGE_VERSION@"

+# According to apt-key, gpg doesn't like to be called without a secret keyring. +# We will not really need one, because pacman will not sign packages, just verify +# their integrities. +PACMAN_SHARE_DIR="/usr/share/pacman"

This needs to be autoconf-ed. See doc/Makefile.am and pkgdatadir and use that like @sysconfdir@ in makepkg.sh.in.

+# Default parameters for the command gpg. Some more will be added when needed +GPG="gpg" +GPG_NOKEYRING="${GPG} --ignore-time-conflict --no-options --no-default-keyring" +SIG_EXT=".sig"

Would we ever change this? I'd rather have .sig hardcoded just like we killed other things that will never really change because they are convention outside of just this package.

+# Read-only keyring with keys to be added to the keyring +ADDED_KEYS="${PACMAN_SHARE_DIR}/addedkeys.gpg"

+# Read-only keyring with keys removed from the keyring. They need to be removed before +# the keys from the added keyring be really imported +REMOVED_KEYS="${PACMAN_SHARE_DIR}/removedkeys.gpg"

+usage() {

• echo "pacman-key - Pacman's keyring management utility"
• echo "Usage: $(basename $0) [options] command [arguments]"
• echo
• echo "Manage pacman's list of trusted keys"
• echo
• echo "Options must be placed before commands. The abailable options are:"
• echo " --config    - set an alternative configuraton file to use. "
• echo "               Default is @sysconfdir@/pacman.conf"
• echo " --gpgdir    - set an alternativ home directory for gnupg. "
• echo "               Default is @sysconfdir@/pacman.d/gnupg"
• echo
• echo "The available commands are:"
• echo "  pacman-key add <file> ...                  - add the key contained in <file> ('-' for stdin)"
• echo "  pacman-key del <keyid> ...                 - remove the key <keyid>"
• echo "  pacman-key export <keyid> ...              - output the key <keyid>"
• echo "  pacman-key exportall                       - output all trusted keys"
• echo "  pacman-key receive <keyserver> <keyid> ... - fetch the keyids from the specified keyserver URL"
• echo "  pacman-key trust <keyid> ...               - set the truslevel of the given key"
• echo "  pacman-key updatedb                        - update the trustdb of pacman"
• echo "  pacman-key reload                          - reloads the keys from the keyring package"
• echo "  pacman-key list                            - list keys"
• echo "  pacman-key finger <keyid> ...              - list fingerprints"
• echo "  pacman-key adv <params>                    - pass advanced options to gpg"
• echo "  pacman-key help                            - displays this message"
• echo "  pacman-key version                         - displays the current version"

+}

I forgot we did this in makepkg; I don't really like it there. This stuff seems like it belongs in a manpage with a shorter usage() such as the one in repo-add. Anyone else have thoughts?

Either way, for a essential tool, we will need a manpage.

+prepare_homedir() {

• if [[ ! -d ${PACMAN_KEYRING_DIR} ]] ; then
• mkdir -p "${PACMAN_KEYRING_DIR}"
• [[ ! -f "${PACMAN_KEYRING_DIR}/secring.gpg" ]] && touch "${PACMAN_KEYRING_DIR}/secring.gpg"
• [[ ! -f "${PACMAN_KEYRING_DIR}/pubring.gpg" ]] && touch "${PACMAN_KEYRING_DIR}/pubring.gpg"

If the dir didn't exist, why this -f check?

• chmod 700 "${PACMAN_KEYRING_DIR}"
• chmod 600 "${PACMAN_KEYRING_DIR}"/*

Why the glob? Can't we just explicitly list the two files previously touched? Minor nitpick but seems more sensible to me.

• fi

+}

+add_key() {

• ${GPG_PACMAN} --quiet --batch --import "$1"

+}

+remove_key() {

• ${GPG_PACMAN} --quiet --batch --delete-key --yes "$1"

+}

+update_trustdb() {

• ${GPG_PACMAN} --batch --check-trustdb

+}

+list_sigs() {

• ${GPG_PACMAN} --batch --list-sigs

+}

+list_fingerprints() {

• ${GPG_PACMAN} --batch --fingerprint $*

+}

+export_key() {

• ${GPG_PACMAN} --armor --export "$1"

+}

+export_all() {

• ${GPG_PACMAN} --armor --export

+}

If these are all one-liners, it would seem to make more sense to inline them if they are only called from one place. Ignore me if they are not.

+trust_key() {

• # Verify if the key exists in pacman's keyring
• if ${GPG_PACMAN} --list-key "$1" > /dev/null 2>&1 ; then
• ${GPG_PACMAN} --edit-key "$1"
• else
• echo >&2 "The key identified by $1 doesn't exist"

I'd rather find a way to reuse msg/msg2/warning/error from repo-add then do this. We might want to move those into a sourced common utilities file.

• exit 1
• fi

+}

+reload_keyring() {

• # Verify the signature of removed keys file
• if [[ -f ${REMOVED_KEYS} ]] && ! ${GPG_PACMAN} --quiet --verify ${REMOVED_KEYS}${SIG_EXT} ; then

You quoted paths elsewhere but then didn't quote here or many of the following places.

• echo >&2 "The signature of file ${REMOVED_KEYS} is not valid."
• exit 1
• fi
• # Verify the signature of the added keys file
• if [[ -f ${ADDED_KEYS} ]] && ! ${GPG_PACMAN} --quiet --verify ${ADDED_KEYS}${SIG_EXT} ; then
• echo >&2 "The signature of file ${ADDED_KEYS} is not valid."
• exit 1
• fi
• # Remove the keys from REMOVED_KEYS keyring
• [[ -r ${REMOVED_KEYS} ]] && cat "${REMOVED_KEYS}" | while read key ; do
• ${GPG_PACMAN} --quiet --batch --yes --delete-keys ${key}
• done
• # Add keys from the current set of keys from pacman-keyring package. The web of trust will
• # be updated automatically.
• if [[ -r ${ADDED_KEYS} ]] ; then
• add_keys=$(${GPG_NOKEYRING} --keyring ${ADDED_KEYS} --with-colons --list-keys | grep ^pub | cut -d: -f5)
• for add_key in $add_keys; do
• ${GPG_NOKEYRING} --quiet --batch --keyring $ADDED_KEYS --export $add_key | ${GPG_PACMAN} --import
• done
• fi
• # Update trustdb, just to be sure
• update_trustdb

+}

+receive() {

• keyserver="$1"
• shift
• ${GPG_PACMAN} --keyserver ${keyserver} $*

+}

+# PROGRAM START

+if ! type gettext &>/dev/null; then

• gettext() {
• echo "$@"
• }

+fi

+if [[ "$command" != "version" && "$command" != "help" ]] && ! which "${GPG}" >/dev/null 2>&1; then

• echo >&2 "Warning: gnupg does not seem to be installed."
• echo >&2 "Warning: pacman-key requires gnupg for most operations."
• echo >&2
• exit 1

+fi

+# Parse global options +CONFIG="@sysconfdir@/pacman.conf" +PACMAN_KEYRING_DIR="@sysconfdir@/pacman.d/gnupg" +while [[ $1 =~ ^- ]] ; do

• case "$1" in
• --config) shift; CONFIG="$1" ;;
• --gpgdir) shift; PACMAN_KEYRING_DIR="$1" ;;
• esac
• shift

+done

+if [[ ! -r "$CONFIG" ]] ; then

• echo >&2 "It is not possible to read $CONFIG."
• exit 1

+fi +# Read GPGDIR from $CONFIG +GPGDIR=$(grep "^ *GPGDir *=" "$CONFIG" | cut -d= -f2) +if [[ "$GPGDIR" ]] ; then

• PACMAN_KEYRING_DIR="$GPGDIR"

+fi

Hmm, this is kinda ugly but not sure what to suggest just yet.

+GPG_PACMAN="${GPG} --homedir ${PACMAN_KEYRING_DIR}"

+prepare_homedir

+# Parse and execute command +command="$1" +if [[ -z "$command" ]]; then

• usage
• exit 1

+fi +shift

+case "$command" in

• add)
• if (( $# == 0 )) ; then
• echo >&2 "You need to specify at least one key identifier"
• usage
• exit 1
• fi
• while (( $# > 0 )) ; do
• add_key $1
• shift
• done
• ;;
• del|rm|remove)
• if (( $# == 0 )) ; then
• echo >&2 "You need to specify at least one key identifier"
• usage
• exit 1
• fi
• while (( $# > 0 )) ; do
• remove_key $1
• shift
• done
• ;;
• updatedb)
• update_trustdb
• ;;
• reload)
• reload_keyring
• ;;
• list)
• list_sigs
• ;;
• finger*)
• if (( $# == 0 )) ; then
• echo >&2 "You need to specify at least one key identifier"
• usage
• exit 1
• fi
• list_fingerprints $*
• ;;
• export)
• if (( $# == 0 )) ; then
• echo >&2 "You need to specify at least one key identifier"
• usage
• exit 1
• fi
• while (( $# > 0 )) ; do
• export_key $1
• shift
• done
• ;;
• exportall)
• export_all
• ;;
• receive)
• if (( $# < 2 )) ; then
• echo >&2 "You need to specify the keyserver and at least one key identifier"
• usage
• exit 1
• fi
• receive $*
• ;;
• trust)
• if (( $# == 0 )) ; then
• echo >&2 "You need to specify at least one key identifier"
• usage
• exit 1
• fi
• while (( $# > 0 )) ; do
• trust_key $1
• shift
• done
• ;;
• adv*)
• echo "Executing: ${GPG_PACMAN} $*"
• ${GPG_PACMAN} $* || ret=$?
• exit $ret
• ;;
• --help)
• usage
• ;;
• --version)
• echo "pacman-key v${PACMAN_KEY_VERSION}"
• echo " This program can be freely distributed under the GPL v2"
• ;;

Please use a similar version() function to makepkg/repo-add.

You also have help/version above, and --help/--version here.

• *)
• usage
• exit 1
• ;;

+esac

1.7.1.1

General thoughts: 1. We don't use the non-dashed option type commands in any other utility. I'm not necessarily against it but thought it was worth pointing out. 2. A lot of times our style in shell scripts has tended towards omitting braces, e.g. ${foobar} would be just $foobar if possible. 3. This was a static code analysis, I need to actually run this and give it a shot. 4. Don't get discouraged at my review here, I'm just trying to make sure when we introduce something new we don't have to spend the next few iterations making it a solid core piece of code. I'd rather get it right the first time.

-Dan

-Dan

The script pacman-key will manage pacman's keyring. It imports, exports, fetches from keyservers, helps in the process of trusting and updates the trust database.

Signed-off-by: Denis A. Altoé Falqueto denisfalqueto@gmail.com --- scripts/.gitignore | 1 + scripts/Makefile.am | 3 + scripts/pacman-key.sh.in | 280 ++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 284 insertions(+), 0 deletions(-) create mode 100644 scripts/pacman-key.sh.in

diff --git a/scripts/.gitignore b/scripts/.gitignore index eafc493..1c662de 100644 --- a/scripts/.gitignore +++ b/scripts/.gitignore @@ -4,3 +4,4 @@ rankmirrors repo-add repo-remove pkgdelta +pacman-key diff --git a/scripts/Makefile.am b/scripts/Makefile.am index 31e8fb5..c81f703 100644 --- a/scripts/Makefile.am +++ b/scripts/Makefile.am @@ -7,6 +7,7 @@ bin_SCRIPTS = \

OURSCRIPTS = \ makepkg \ + pacman-key \ pacman-optimize \ pkgdelta \ rankmirrors \ @@ -14,6 +15,7 @@ OURSCRIPTS = \

EXTRA_DIST = \ makepkg.sh.in \ + pacman-key.sh.in \ pacman-optimize.sh.in \ pkgdelta.sh.in \ rankmirrors.sh.in \ @@ -60,6 +62,7 @@ $(OURSCRIPTS): Makefile @mv $@.tmp $@

makepkg: $(srcdir)/makepkg.sh.in +pacman-key: ${srcdir}/pacman-key.sh.in pacman-optimize: $(srcdir)/pacman-optimize.sh.in pkgdelta: $(srcdir)/pkgdelta.sh.in rankmirrors: $(srcdir)/rankmirrors.sh.in diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in new file mode 100644 index 0000000..05745a9 --- /dev/null +++ b/scripts/pacman-key.sh.in @@ -0,0 +1,280 @@ +#!/bin/bash -e +# +# pacman-key - manages pacman's keyring +# @configure_input@ +# +# Copyright (c) 2010 - Pacman Development Team pacman-dev@archlinux.org +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# + +# gettext initialization +export TEXTDOMAIN='pacman' +export TEXTDOMAINDIR='@localedir@' + +# Based on apt-key, from Debian +myver="@PACKAGE_VERSION@" + +# According to apt-key, gpg doesn't like to be called without a secret keyring. +# We will not really need one, because pacman will not sign packages, just verify +# their integrities. +PACMAN_SHARE_DIR="@pkgdatadir@" + +# Default parameters for the command gpg. Some more will be added when needed +GPG="gpg" +GPG_NOKEYRING="${GPG} --ignore-time-conflict --no-options --no-default-keyring" +SIG_EXT=".sig" + +# Read-only keyring with keys to be added to the keyring +ADDED_KEYS="${PACMAN_SHARE_DIR}/addedkeys.gpg" + +# Read-only keyring with keys removed from the keyring. They need to be removed before +# the keys from the added keyring be really imported +REMOVED_KEYS="${PACMAN_SHARE_DIR}/removedkeys.gpg" + +usage() { + printf "pacman-key (pacman) %s\n" ${myver} + echo + printf $(gettext "Usage: %s [options] command [arguments]") $(basename $0) + echo + echo $(gettext "Manage pacman's list of trusted keys") + echo + echo $(gettext "Options must be placed before commands. The abailable options are:") + echo $(gettext " --config - set an alternative configuraton file to use. ") + echo $(gettext " Default is @sysconfdir@/pacman.conf") + echo $(gettext " --gpgdir - set an alternativ home directory for gnupg. ") + echo $(gettext " Default is @sysconfdir@/pacman.d/gnupg") + echo + echo $(gettext "The available commands are:") + echo $(gettext " pacman-key -a | --add <file> ... - add the key contained ") + echo $(gettext " in <file> ('-' for stdin)") + echo $(gettext " pacman-key -d | --del <keyid> ... - remove the key <keyid>") + echo $(gettext " pacman-key -e | --export <keyid> ... - output the key <keyid>") + echo $(gettext " pacman-key -x | --exportall - output all trusted keys") + echo $(gettext " pacman-key -r | --receive <keyserver> <keyid> ... - fetch the keyids from") + echo $(gettext " the specified keyserver URL") + echo $(gettext " pacman-key -t | --trust <keyid> ... - set the truslevel of the given key") + echo $(gettext " pacman-key -u | --updatedb - update the trustdb of pacman") + echo $(gettext " pacman-key --reload - reloads the keys from the keyring package") + echo $(gettext " pacman-key -l | --list - list keys") + echo $(gettext " pacman-key -f | --finger <keyid> ... - list fingerprints") + echo $(gettext " pacman-key --adv <params> - pass advanced options to gpg") + echo $(gettext " pacman-key -h | --help - displays this message") + echo $(gettext " pacman-key -v | --version - displays the current version") +} + +version() { + printf "pacman-key (pacman) %s\n" "${myver}" + printf "$(gettext "\ +Copyright (c) 2010 Pacman Development Team pacman-dev@archlinux.org.\n\ +This is free software; see the source for copying conditions.\n\ +There is NO WARRANTY, to the extent permitted by law.\n")" +} + +prepare_homedir() { + if [[ ! -d "${PACMAN_KEYRING_DIR}" ]] ; then + mkdir -p "${PACMAN_KEYRING_DIR}" + touch "${PACMAN_KEYRING_DIR}/secring.gpg" + touch "${PACMAN_KEYRING_DIR}/pubring.gpg" + chmod 700 "${PACMAN_KEYRING_DIR}" + chmod 600 "${PACMAN_KEYRING_DIR}"/{sec,pub}ring.gpg + fi +} + +update_trustdb() { + ${GPG_PACMAN} --batch --check-trustdb +} + +reload_keyring() { + # Verify the signature of removed keys file + if [[ -f "${REMOVED_KEYS}" ]] && ! ${GPG_PACMAN} --quiet --verify "${REMOVED_KEYS}${SIG_EXT}" ; then + echo >&2 $(gettext "The signature of file ${REMOVED_KEYS} is not valid.") + exit 1 + fi + + # Verify the signature of the added keys file + if [[ -f "${ADDED_KEYS}" ]] && ! ${GPG_PACMAN} --quiet --verify "${ADDED_KEYS}${SIG_EXT}" ; then + echo >&2 $(gettext "The signature of file ${ADDED_KEYS} is not valid.") + exit 1 + fi + + # Remove the keys from REMOVED_KEYS keyring + [[ -r "${REMOVED_KEYS}" ]] && cat "${REMOVED_KEYS}" | while read key ; do + ${GPG_PACMAN} --quiet --batch --yes --delete-keys "${key}" + done + + # Add keys from the current set of keys from pacman-keyring package. The web of trust will + # be updated automatically. + if [[ -r "${ADDED_KEYS}" ]] ; then + add_keys=$(${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5) + for key in ${add_keys}; do + ${GPG_NOKEYRING} --quiet --batch --keyring "${ADDED_KEYS}" --export "${key}" | ${GPG_PACMAN} --import + done + fi + + # Update trustdb, just to be sure + update_trustdb +} + +receive() { + keyserver="$1" + shift + ${GPG_PACMAN} --keyserver "${keyserver}" $* +} + +# PROGRAM START + +if ! type gettext &>/dev/null; then + gettext() { + echo "$@" + } +fi + +if [[ "$command" != "version" && "$command" != "help" ]] && ! which "${GPG}" >/dev/null 2>&1; then + echo >&2 $(gettext "Warning: gnupg does not seem to be installed.") + echo >&2 $(gettext "Warning: pacman-key requires gnupg for most operations.") + exit 1 +fi + +# Parse global options +CONFIG="@sysconfdir@/pacman.conf" +PACMAN_KEYRING_DIR="@sysconfdir@/pacman.d/gnupg" +while [[ $1 =~ ^--(config|gpgdir)$ ]] ; do + case "$1" in + --config) shift; CONFIG="$1" ;; + --gpgdir) shift; PACMAN_KEYRING_DIR="$1" ;; + esac + shift +done + +if [[ ! -r "${CONFIG}" ]] ; then + echo >&2 $(gettext "It is not possible to read ${CONFIG}.") + exit 1 +fi + +# Read GPGDIR from $CONFIG. +# The pattern is: any spaces or tabs, GPGDir, any spaces or tabs, equal sign +# and the rest of the line. The string is splitted after the first occurrence of = +GPGDIR=$(cat ${CONFIG} | awk '/^(\t| )*GPGDir(\t| )*=.*/ { print substr($0,index($0, "=")+1) }') +if [[ "${GPGDIR}" ]] ; then + PACMAN_KEYRING_DIR="${GPGDIR}" +fi +GPG_PACMAN="${GPG} --homedir ${PACMAN_KEYRING_DIR}" + +prepare_homedir + +# Parse and execute command +command="$1" +if [[ -z "${command}" ]]; then + usage + exit 1 +fi +shift + +case "${command}" in + -a|--add) + if (( $# == 0 )) ; then + echo >&2 $(gettext "You need to specify at least one key identifier") + usage + exit 1 + fi + while (( $# > 0 )) ; do + ${GPG_PACMAN} --quiet --batch --import "$1" + shift + done + ;; + -d|--del) + if (( $# == 0 )) ; then + echo >&2 $(gettext "You need to specify at least one key identifier") + usage + exit 1 + fi + while (( $# > 0 )) ; do + ${GPG_PACMAN} --quiet --batch --delete-key --yes "$1" + shift + done + ;; + -u|--updatedb) + update_trustdb + ;; + --reload) + reload_keyring + ;; + -l|-list) + ${GPG_PACMAN} --batch --list-sigs + ;; + -f|--finger) + if (( $# == 0 )) ; then + echo >&2 $(gettext "You need to specify at least one key identifier") + usage + exit 1 + fi + ${GPG_PACMAN} --batch --fingerprint $* + ;; + -e|--export) + if (( $# == 0 )) ; then + echo >&2 $(gettext "You need to specify at least one key identifier") + usage + exit 1 + fi + while (( $# > 0 )) ; do + ${GPG_PACMAN} --armor --export "$1" + shift + done + ;; + -x|--exportall) + ${GPG_PACMAN} --armor --export + ;; + -r|--receive) + if (( $# < 2 )) ; then + echo >&2 $(gettext "You need to specify the keyserver and at least one key identifier") + usage + exit 1 + fi + receive $* + ;; + -t|--trust) + if (( $# == 0 )) ; then + echo >&2 $(gettext "You need to specify at least one key identifier") + usage + exit 1 + fi + while (( $# > 0 )) ; do + # Verify if the key exists in pacman's keyring + if ${GPG_PACMAN} --list-key "$1" > /dev/null 2>&1 ; then + ${GPG_PACMAN} --edit-key "$1" + else + echo >&2 $(gettext "The key identified by $1 doesn't exist") + exit 1 + fi + shift + done + ;; + --adv) + echo $(gettext "Executing: ${GPG_PACMAN} $*") + ${GPG_PACMAN} $* || ret=$? + exit $ret + ;; + --help) + usage + ;; + --version) + version + exit 0 + ;; + *) + usage + exit 1 + ;; +esac

On 16 September 2010 05:40, Denis A. Altoé Falqueto denisfalqueto@gmail.com wrote:

The script pacman-key will manage pacman's keyring. It imports, exports, fetches from keyservers, helps in the process of trusting and updates the trust database.

Signed-off-by: Denis A. Altoé Falqueto denisfalqueto@gmail.com

scripts/.gitignore       |    1 +  scripts/Makefile.am      |    3 +  scripts/pacman-key.sh.in |  275 ++++++++++++++++++++++++++++++++++++++++++++++  3 files changed, 279 insertions(+), 0 deletions(-)  create mode 100644 scripts/pacman-key.sh.in

diff --git a/scripts/.gitignore b/scripts/.gitignore index eafc493..1c662de 100644 --- a/scripts/.gitignore +++ b/scripts/.gitignore @@ -4,3 +4,4 @@ rankmirrors  repo-add  repo-remove  pkgdelta +pacman-key diff --git a/scripts/Makefile.am b/scripts/Makefile.am index 31e8fb5..c81f703 100644 --- a/scripts/Makefile.am +++ b/scripts/Makefile.am @@ -7,6 +7,7 @@ bin_SCRIPTS = \

OURSCRIPTS = \        makepkg \

• pacman-key \

pacman-optimize \        pkgdelta \        rankmirrors \ @@ -14,6 +15,7 @@ OURSCRIPTS = \

EXTRA_DIST = \        makepkg.sh.in \

• pacman-key.sh.in \

pacman-optimize.sh.in \        pkgdelta.sh.in \        rankmirrors.sh.in \ @@ -60,6 +62,7 @@ $(OURSCRIPTS): Makefile        @mv $@.tmp $@

makepkg: $(srcdir)/makepkg.sh.in +pacman-key: ${srcdir}/pacman-key.sh.in  pacman-optimize: $(srcdir)/pacman-optimize.sh.in  pkgdelta: $(srcdir)/pkgdelta.sh.in  rankmirrors: $(srcdir)/rankmirrors.sh.in diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in new file mode 100644 index 0000000..7b5fb29 --- /dev/null +++ b/scripts/pacman-key.sh.in @@ -0,0 +1,275 @@ +#!/bin/bash -e +# +#   pacman-key - manages pacman's keyring +#                Based on apt-key, from Debian +#   @configure_input@ +# +#   Copyright (c) 2010 - Pacman Development Team pacman-dev@archlinux.org +# +#   This program is free software; you can redistribute it and/or modify +#   it under the terms of the GNU General Public License as published by +#   the Free Software Foundation; either version 2 of the License, or +#   (at your option) any later version. +# +#   This program is distributed in the hope that it will be useful, +#   but WITHOUT ANY WARRANTY; without even the implied warranty of +#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the +#   GNU General Public License for more details. +# +#   You should have received a copy of the GNU General Public License +#   along with this program.  If not, see http://www.gnu.org/licenses/. +#

+# gettext initialization +export TEXTDOMAIN='pacman' +export TEXTDOMAINDIR='@localedir@'

+myver="@PACKAGE_VERSION@"

+msg() {

• local mesg=$1; shift
• printf "==> ${mesg}\n" "$@" >&1

+}

+msg2() {

• (( QUIET )) && return
• local mesg=$1; shift
• printf "  -> ${mesg}\n" "$@" >&1

+}

+warning() {

• local mesg=$1; shift
• printf "==> $(gettext "WARNING:") ${mesg}\n" "$@" >&2

+}

+error() {

• local mesg=$1; shift
• printf "==> $(gettext "ERROR:") ${mesg}\n" "$@" >&2

+}

+usage() {

• printf "pacman-key (pacman) %s\n" ${myver}
• echo
• printf "$(gettext "Usage: %s [options] command [arguments]")\n" $(basename $0)
• echo
• echo "$(gettext "Manage pacman's list of trusted keys")"
• echo
• echo "$(gettext "Options must be placed before commands. The available options are:")"
• echo "$(gettext " --config    - set an alternative configuration file to use. ")"
• printf "$(gettext "               Default is %s")\n" "@sysconfdir@/pacman.conf"
• echo "$(gettext " --gpgdir    - set an alternative home directory for gnupg. ")"
• printf "$(gettext "               Default is set in %s")\n" "@sysconfdir@/pacman.conf"
• echo
• echo "$(gettext "The available commands are:")"
• echo "$(gettext "  pacman-key -a | --add [<file>] ...                - add the key contained ")"
• echo "$(gettext "                                                      in <file> (empty for stdin)")"
• echo "$(gettext "  pacman-key -d | --del <keyid> ...                 - remove the key <keyid>")"
• echo "$(gettext "  pacman-key -e | --export <keyid> ...              - output the key <keyid>")"
• echo "$(gettext "  pacman-key -r | --receive <keyserver> <keyid> ... - fetch the keyids from")"
• echo "$(gettext "                                                      the specified keyserver URL")"
• echo "$(gettext "  pacman-key -t | --trust <keyid> ...               - set the trust level of the given key")"
• echo "$(gettext "  pacman-key -u | --updatedb                        - update the trustdb of pacman")"
• echo "$(gettext "  pacman-key --reload                               - reloads the keys from the keyring package")"
• echo "$(gettext "  pacman-key -l | --list                            - list keys")"
• echo "$(gettext "  pacman-key -f | --finger [<keyid]> ...            - list fingerprint for specified keyids (or for all, if none is specified)")"
• echo "$(gettext "  pacman-key --adv <params>                         - use pacman's keyring as target for advanced commands")"
• echo "$(gettext "  pacman-key -h | --help                            - displays this message")"
• echo "$(gettext "  pacman-key -v | --version                         - displays the current version")"

+}

+version() {

• printf "pacman-key (pacman) %s\n" "${myver}"
• printf "$(gettext "\

+Copyright (c) 2010 Pacman Development Team pacman-dev@archlinux.org.\n\ +This is free software; see the source for copying conditions.\n\ +There is NO WARRANTY, to the extent permitted by law.\n")" +}

+reload_keyring() {

• local PACMAN_SHARE_DIR='@prefix@/share/pacman'
• local GPG_NOKEYRING="gpg --batch --quiet --ignore-time-conflict --no-options --no-default-keyring --homedir ${PACMAN_KEYRING_DIR}"
• # Read-only keyring with keys to be added to the keyring
• local ADDED_KEYS="${PACMAN_SHARE_DIR}/addedkeys.gpg"
• # Read-only list of keys removed from the keyring.
• local REMOVED_KEYS="${PACMAN_SHARE_DIR}/removedkeys"
• # Add keys from the current set of keys from pacman-keyring package. The web of trust will
• # be updated automatically.
• if [[ -r "${ADDED_KEYS}" ]]; then
• msg "$(gettext "Verifying official keys file signature...")"
• if ! ${GPG_PACMAN} --quiet --verify "${ADDED_KEYS}.sig" 1>/dev/null; then
• error "$(gettext "The signature of file %s is not valid.")" "${ADDED_KEYS}"
• exit 1
• fi
• msg "$(gettext "Appending official keys...")"
• local add_keys=$(${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5)
• for key in ${add_keys}; do
• msg "$(gettext "  key id: %s")" "$key"
• ${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --export "${key}" | ${GPG_PACMAN} --import
• done
• fi
• # Remove the keys from REMOVED_KEYS keyring
• if [[ -r "${REMOVED_KEYS}" ]]; then
• msg "$(gettext "Verifying deleted keys file signature...")"
• if ! ${GPG_PACMAN} --quiet --verify "${REMOVED_KEYS}.sig"; then
• error "$(gettext "The signature of file %s is not valid.")" "${REMOVED_KEYS}"
• exit 1
• fi
• msg "$(gettext "Removing deleted keys from keyring...")"
• cat "${REMOVED_KEYS}" | while read key; do
• msg "$(gettext "  key id: %s")" "$key"
• ${GPG_PACMAN} --quiet --batch --yes --delete-key "${key}"
• done
• fi
• # Update trustdb, just to be sure
• msg "$(gettext "Updating trust database...")"
• ${GPG_PACMAN} --batch --check-trustdb

+}

+# PROGRAM START +if ! type gettext &>/dev/null; then

• gettext() {
• echo "$@"
• }

+fi

+if [[ $1 != "--version" && $1 != "-v" && $1 != "--help" && $1 != "-h" ]]; then

• if type -p gpg >/dev/null 2>&1 = 1; then
• error "$(gettext "gnupg does not seem to be installed.")"
• msg2 "$(gettext "pacman-key requires gnupg for most operations.")"
• exit 1
• elif (( EUID != 0 )); then
• error "$(gettext "pacman-key needs to be run as root.")"
• exit 1
• fi

+fi

+# Parse global options +CONFIG="@sysconfdir@/pacman.conf" +PACMAN_KEYRING_DIR="@sysconfdir@/pacman.d/gnupg" +while [[ $1 =~ ^--(config|gpgdir)$ ]]; do

• case "$1" in
• --config) shift; CONFIG="$1" ;;
• --gpgdir) shift; PACMAN_KEYRING_DIR="$1" ;;
• esac
• shift

+done

+if [[ ! -r "${CONFIG}" ]]; then

• error "$(gettext "It is not possible to read %s")" "${CONFIG}"
• exit 1

+fi

+# Read GPGDIR from $CONFIG. +# The pattern is: any spaces or tabs, GPGDir, any spaces or tabs, equal sign +# and the rest of the line. The string is splitted after the first occurrence of = +if [[ GPGDIR=$(grep -e '^[[:blank:]]*GPGDir[[:blank:]]*=.*' "$CONFIG") == 0 ]]; then

• GPGDIR=${GPGDIR#*=}
• PACMAN_KEYRING_DIR="${GPGDIR}"

+fi +GPG_PACMAN="gpg --homedir ${PACMAN_KEYRING_DIR}"

+# Parse and execute command +command="$1" +if [[ -z "${command}" ]]; then

• usage
• exit 1

+fi +shift

+case "${command}" in

• -a|--add)
• if (( $# == 0 )); then
• error "$(gettext "You need to specify at least one key identifier")"
• usage
• exit 1
• fi
• while (( $# > 0 )); do
• ${GPG_PACMAN} --quiet --batch --import "$1"
• shift
• done
• ;;
• -d|--del)
• if (( $# == 0 )); then
• error "$(gettext "You need to specify at least one key identifier")"
• usage
• exit 1
• fi
• while (( $# > 0 )); do
• ${GPG_PACMAN} --quiet --batch --delete-key --yes "$1"
• shift
• done
• ;;
• -u|--updatedb)
• ${GPG_PACMAN} --batch --check-trustdb
• ;;
• --reload)
• reload_keyring
• ;;
• -l|--list)
• ${GPG_PACMAN} --batch --list-sigs
• ;;
• -f|--finger)
• ${GPG_PACMAN} --batch --fingerprint $*
• ;;
• -e|--export)
• if (( $# == 0 )); then
• ${GPG_PACMAN} --armor --export
• else
• while (( $# > 0 )); do
• ${GPG_PACMAN} --armor --export "$1"
• shift
• done
• fi
• ;;
• -r|--receive)
• if (( $# < 2 )); then
• error "$(gettext "You need to specify the keyserver and at least one key identifier")"
• usage
• exit 1
• fi
• keyserver="$1"
• shift
• ${GPG_PACMAN} --keyserver "${keyserver}" --recv-keys $*
• ;;
• -t|--trust)
• if (( $# == 0 )); then
• error "$(gettext "You need to specify at least one key identifier")"
• usage
• exit 1
• fi
• while (( $# > 0 )); do
• # Verify if the key exists in pacman's keyring
• if ${GPG_PACMAN} --list-keys "$1" > /dev/null 2>&1; then
• ${GPG_PACMAN} --edit-key "$1"
• else
• error "$(gettext "The key identified by %s doesn't exist")" "$1"
• exit 1
• fi
• shift
• done
• ;;
• --adv)
• msg "$(gettext "Executing: %s ")$*" "${GPG_PACMAN}"
• ${GPG_PACMAN} $* || ret=$?
• exit $ret
• ;;
• --help)
• usage
• ;;
• --version)
• version
• exit 0
• ;;
• *)
• usage
• exit 1
• ;;

+esac

-- 1.7.2.3

Hi Denis, Hi everyone,

I'm really pleased to see you're back on track.

If any of the collaborators want to help, this is the time

I would be glad to. I see you need help to write the man right? Is this the number one task? Because I could also help with some more technical things if needed.

Just let me know.

-- Guillaume

On 27/07/10 06:26, Denis A. Altoé Falqueto wrote:

There is a possibility of another key being used, instead of the user's default. For exemple, the pacman-keyring package will be signed by a master key, because it needs to be trusted explicitly by the user before the installation of that package. So, the parameter --signwithkey will be used to supply an id of a key that will be used to sign a database or package.

Signed-off-by: Denis A. Altoé Falquetodenisfalqueto@gmail.com

scripts/makepkg.sh.in | 38 ++++++++++++++++++++-------- scripts/repo-add.sh.in | 63 +++++++++++++++++++++++++++++++++++------------- 2 files changed, 73 insertions(+), 28 deletions(-)

I would prefer this patch to be split into makepkg and repo-add parts and have the documentation patch similarly split and then the changes and documentation merged together.

diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 080e530..f6f9dfe 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -28,7 +28,7 @@ # makepkg uses quite a few external programs during its execution. You # need to have at least the following installed for makepkg to function: # bsdtar (libarchive), bzip2, coreutils, fakeroot, find (findutils), -# gettext, grep, gzip, openssl, sed, tput (ncurses), xz +# gettext, grep, gzip, openssl, sed, tput (ncurses), xz, gpg

Try keeping this alphabetical.

# gettext initialization export TEXTDOMAIN='pacman' @@ -43,6 +43,8 @@ BUILDSCRIPT='@BUILDSCRIPT@' startdir="$PWD" srcdir="$startdir/src" pkgdir="$startdir/pkg" +GPG="gpg2"

Why change to gpg2? In fact, I would prefer a separate patch that changes the "gpg" references to $GPG (=gpg by default) but allows the value to be overridden by environmental variables. So if someone wants to use gpg2 they would do something like "GPG=gpg2 makepkg".

+SIG_EXT=".sig"

We consider ".sig" hard-coded in pacman. We should do the same here.

<snip> otherwise makepkg changes are fine.

diff --git a/scripts/repo-add.sh.in b/scripts/repo-add.sh.in index 4ee63d8..ac734aa 100644 --- a/scripts/repo-add.sh.in +++ b/scripts/repo-add.sh.in @@ -26,6 +26,8 @@ export TEXTDOMAINDIR='@localedir@'

myver='@PACKAGE_VERSION@' confdir='@sysconfdir@' +GPG="gpg2" +SIG_EXT=".sig"

Same comments as applied to makepkg.

QUIET=0 SIGN=0 @@ -62,8 +64,8 @@ error() { # print usage instructions usage() { printf "repo-add, repo-remove (pacman) %s\n\n" "$myver"

• printf "$(gettext "Usage: repo-add [-q] [-s] [-v]<path-to-db> <package|delta> ...\n")"
• printf "$(gettext "Usage: repo-remove [-q]<path-to-db> <packagename|delta> ...\n\n")"

• printf "$(gettext "Usage: repo-add [-q] [-s [-k|--signwithkey key]] [-v]<path-to-db> <package|delta> ...\n")"
• printf "$(gettext "Usage: repo-remove [-q] [-s [-k|--signwithkey key]]<path-to-db> <packagename|delta> ...\n\n")"

Just list the short option here as is done with all other options.

<snip>

@@ -492,10 +505,24 @@ trap 'trap_exit "$(gettext "An unknown error has occured. Exiting...")"' ERR

success=0 # parse arguments -for arg in "$@"; do +while [[ $#> 0 ]] ; do

• arg="$1" case "$arg" in -q|--quiet) QUIET=1;;

• -s|--sign) SIGN=1;;
  

• -s|--sign)
  

• 	SIGN=1
  

• 	# The signature will be made, even if there are no operations
  

• 	success=1
  

• 	;;
  

• -k|--signwithkey)
  

• 	shift
  

• 	SIGNKEY="$1"
  

• 	# Check if key really exists
  

We have not done any checks for the gpg binary at this stage...

• 	if ! ${GPG} --list-key ${SIGNKEY} 1>  /dev/null 2>&1; then
  

• 		error "$(gettext "Cannot find key $SIGNKEY.")"
  

• 		exit 1
  

• 	fi
  

• 	;;
  

  -v|--verify) VERIFY=1;; *) if [[ -z $REPO_DB_FILE ]]; then

@@ -510,6 +537,7 @@ for arg in "$@"; do fi ;; esac

• shift done

  # if at least one operation was a success, re-zip database

@@ -529,18 +557,19 @@ if (( success )); then cd "$tmpdir" if [[ -n $(ls) ]]; then bsdtar -c${TAR_OPT}f "$filename" *

• create_signature "$filename"
  

  else # we have no packages remaining? zip up some emptyness warning "$(gettext "No packages remain, creating empty database.")" bsdtar -c${TAR_OPT}f "$filename" -T /dev/null fi

• # The signature must be dealt with in both cases, empty repo or not.
• create_signature "$filename"

Good catch