Guys,
This is a last patch for that series. It is a new patch, as Allan asked, so you can apply it in an already patched branch.
The description on the patch itself is self explanatory. This is just to justify the new patch without poluting its description.
Any sugestions or criticisms are always welcome.
-- Denis Falqueto
The --reload command was refactored to allow a more flexible management. There are two sets of keys that will be added, one that will be removed and one that will be kept.
The set of keys to be kept are configured in pacman.conf, with the option HoldKeys, with the same meaning of HoldPkgs. It can be repeated and several values can be put in the same entry.
The new behavior allows a key to be marked for removal, but the user can decide if that key must be kept. For example, if a developer has a public repository, signed with his own key, that key must be added to the HoldKeys option. If the key is marked for removal from pacman's keyring, it will not be removed for the users that have configured HoldKeys correctly.
There are other minor fixes, mainly in the handling of --add command when there is no aditional parameter. In that case, pacman-key will behave just like gpg, adding the contents of stdin into pacman's keyring.
Signed-off-by: Denis A. Altoé Falqueto denisfalqueto@gmail.com --- scripts/pacman-key.sh.in | 152 +++++++++++++++++++++++++++++++++------------- 1 files changed, 110 insertions(+), 42 deletions(-)
diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 7b5fb29..08f99a4 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -85,45 +85,131 @@ This is free software; see the source for copying conditions.\n\ There is NO WARRANTY, to the extent permitted by law.\n")" }
+find_config() { + # Prints on stdin the values of all the options from the configuration file that + # are associated with the first parameter of this function. + # The option names are stripped + if (( $# == 0 )); then + error "find_config: missing parameter" + exit 1 + fi + grep -e "^[[:blank:]]*$1[[:blank:]]*=.*" "$CONFIG" | cut -d= -f 2- +} + reload_keyring() { local PACMAN_SHARE_DIR='@prefix@/share/pacman' local GPG_NOKEYRING="gpg --batch --quiet --ignore-time-conflict --no-options --no-default-keyring --homedir ${PACMAN_KEYRING_DIR}"
- # Read-only keyring with keys to be added to the keyring + # Variable used for iterating on keyrings + local key + local key_id + + # Keyring with keys to be added to the keyring local ADDED_KEYS="${PACMAN_SHARE_DIR}/addedkeys.gpg"
- # Read-only list of keys removed from the keyring. + # Keyring with keys that were deprecated and will eventually be deleted + local DEPRECATED_KEYS="${PACMAN_SHARE_DIR}/deprecatedkeys.gpg" + + # List of keys removed from the keyring. This file is not a keyring, unlike the others. + # It is a textual list of values that gpg recogniezes as identifiers for keys. local REMOVED_KEYS="${PACMAN_SHARE_DIR}/removedkeys"
- # Add keys from the current set of keys from pacman-keyring package. The web of trust will - # be updated automatically. + # Verify signatures of related files, if they exist if [[ -r "${ADDED_KEYS}" ]]; then msg "$(gettext "Verifying official keys file signature...")" - if ! ${GPG_PACMAN} --quiet --verify "${ADDED_KEYS}.sig" 1>/dev/null; then + if ! ${GPG_PACMAN} --quiet --batch --verify "${ADDED_KEYS}.sig" 1>/dev/null; then error "$(gettext "The signature of file %s is not valid.")" "${ADDED_KEYS}" exit 1 fi + fi
- msg "$(gettext "Appending official keys...")" - local add_keys=$(${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5) - for key in ${add_keys}; do - msg "$(gettext " key id: %s")" "$key" - ${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --export "${key}" | ${GPG_PACMAN} --import - done + if [[ -r "${DEPRECATED_KEYS}" ]]; then + msg "$(gettext "Verifying deprecated keys file signature...")" + if ! ${GPG_PACMAN} --quiet --batch --verify "${DEPRECATED_KEYS}.sig" 1>/dev/null; then + error "$(gettext "The signature of file %s is not valid.")" "${DEPRECATED_KEYS}" + exit 1 + fi fi
- # Remove the keys from REMOVED_KEYS keyring if [[ -r "${REMOVED_KEYS}" ]]; then msg "$(gettext "Verifying deleted keys file signature...")" - if ! ${GPG_PACMAN} --quiet --verify "${REMOVED_KEYS}.sig"; then + if ! ${GPG_PACMAN} --quiet --batch --verify "${REMOVED_KEYS}.sig"; then error "$(gettext "The signature of file %s is not valid.")" "${REMOVED_KEYS}" exit 1 fi + fi + + # Read the key ids to an array. The conversion from whatever is inside the file + # to key ids is important, because key ids are the only guarantee of identification + # for the keys. + local -A removed_ids + if [[ -r "${REMOVED_KEYS}" ]]; then + while read key; do + local key_values name + key_values=$(${GPG_PACMAN} --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5,10 --output-delimiter=' ') + if [[ -z $key_values ]]; then + # The key is not in pacman's keyring, so search it on the added and deprecated keys + key_values=$(${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --with-colons --list-key "${key}" | grep ^pub | \ + cut -d: -f5,10 --output-delimiter=' ') + if [[ -z $key_values ]]; then + key_values=$(${GPG_NOKEYRING} --keyring "${DEPRECATED_KEYS}" --with-colons --list-key "${key}" | \ + grep ^pub | cut -d: -f5,10 --output-delimiter=' ') + fi + fi + # The first word is the key_id + key_id=${key_values%% *} + # the rest if the name of the owner + name=${key_values#* } + if [[ -n ${key_id} ]]; then + # Mark this key to be deleted + removed_ids[$key_id]="$name" + fi + done < "${REMOVED_KEYS}" + fi
+ # List of keys that must be kept installed, even if in the list of keys to be removed + local HOLD_KEYS=$(find_config "HoldKeys") + + # Remove the keys that must be kept from the set of keys that should be removed + if [[ -n ${HOLD_KEYS} ]]; then + for key in ${HOLD_KEYS}; do + key_id=$(${GPG_PACMAN} --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5) + if [[ -n "${removed_ids[$key_id]}" ]]; then + unset removed_ids[$key_id] + fi + done + fi + + # Add keys from the current set of keys from pacman-keyring package. The web of trust will + # be updated automatically. + if [[ -r "${ADDED_KEYS}" ]]; then + msg "$(gettext "Appending official keys...")" + local add_keys=$(${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5) + for key_id in ${add_keys}; do + # There is no point in adding a key that will be deleted right after + if [[ -z "${removed_ids[$key_id]}" ]]; then + ${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --export "${key_id}" | ${GPG_PACMAN} --import + fi + done + fi + + if [[ -r "${DEPRECATED_KEYS}" ]]; then + msg "$(gettext "Appending deprecated keys...")" + local add_keys=$(${GPG_NOKEYRING} --keyring "${DEPRECATED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5) + for key_id in ${add_keys}; do + # There is no point in adding a key that will be deleted right after + if [[ -z "${removed_ids[$key_id]}" ]]; then + ${GPG_NOKEYRING} --keyring "${DEPRECATED_KEYS}" --export "${key_id}" | ${GPG_PACMAN} --import + fi + done + fi + + # Remove the keys not marked to keep + if (( ${#removed_ids[@]} > 0 )); then msg "$(gettext "Removing deleted keys from keyring...")" - cat "${REMOVED_KEYS}" | while read key; do - msg "$(gettext " key id: %s")" "$key" - ${GPG_PACMAN} --quiet --batch --yes --delete-key "${key}" + for key_id in "${!removed_ids[@]}"; do + echo " removing key ${removed_ids[$key_id]}" + ${GPG_PACMAN} --quiet --batch --yes --delete-key "${key_id}" done fi
@@ -169,8 +255,7 @@ fi # Read GPGDIR from $CONFIG. # The pattern is: any spaces or tabs, GPGDir, any spaces or tabs, equal sign # and the rest of the line. The string is splitted after the first occurrence of = -if [[ GPGDIR=$(grep -e '^[[:blank:]]*GPGDir[[:blank:]]*=.*' "$CONFIG") == 0 ]]; then - GPGDIR=${GPGDIR#*=} +if [[ GPGDIR=$(find_config "GPGDir") == 0 ]]; then PACMAN_KEYRING_DIR="${GPGDIR}" fi GPG_PACMAN="gpg --homedir ${PACMAN_KEYRING_DIR}" @@ -185,15 +270,8 @@ shift
case "${command}" in -a|--add) - if (( $# == 0 )); then - error "$(gettext "You need to specify at least one key identifier")" - usage - exit 1 - fi - while (( $# > 0 )); do - ${GPG_PACMAN} --quiet --batch --import "$1" - shift - done + # If there is no extra parameter, gpg will read stdin + ${GPG_PACMAN} --quiet --batch --import "$@" ;; -d|--del) if (( $# == 0 )); then @@ -201,10 +279,7 @@ case "${command}" in usage exit 1 fi - while (( $# > 0 )); do - ${GPG_PACMAN} --quiet --batch --delete-key --yes "$1" - shift - done + ${GPG_PACMAN} --quiet --batch --delete-key --yes "$@" ;; -u|--updatedb) ${GPG_PACMAN} --batch --check-trustdb @@ -213,20 +288,13 @@ case "${command}" in reload_keyring ;; -l|--list) - ${GPG_PACMAN} --batch --list-sigs + ${GPG_PACMAN} --batch --list-sigs "$@" ;; -f|--finger) ${GPG_PACMAN} --batch --fingerprint $* ;; -e|--export) - if (( $# == 0 )); then - ${GPG_PACMAN} --armor --export - else - while (( $# > 0 )); do - ${GPG_PACMAN} --armor --export "$1" - shift - done - fi + ${GPG_PACMAN} --armor --export "$@" ;; -r|--receive) if (( $# < 2 )); then @@ -236,7 +304,7 @@ case "${command}" in fi keyserver="$1" shift - ${GPG_PACMAN} --keyserver "${keyserver}" --recv-keys $* + ${GPG_PACMAN} --keyserver "${keyserver}" --recv-keys "$@" ;; -t|--trust) if (( $# == 0 )); then @@ -257,7 +325,7 @@ case "${command}" in ;; --adv) msg "$(gettext "Executing: %s ")$*" "${GPG_PACMAN}" - ${GPG_PACMAN} $* || ret=$? + ${GPG_PACMAN} "$@" || ret=$? exit $ret ;; --help)
On 06/10/10 12:26, Denis A. Altoé Falqueto wrote:
The --reload command was refactored to allow a more flexible management. There are two sets of keys that will be added, one that will be removed and one that will be kept.
<snip>
Signed-off-by: Denis A. Altoé Falquetodenisfalqueto@gmail.com
scripts/pacman-key.sh.in | 152 +++++++++++++++++++++++++++++++++------------- 1 files changed, 110 insertions(+), 42 deletions(-)
Looks file to me overall. A couple of comments/queries below:
<snip>
+find_config() {
- # Prints on stdin the values of all the options from the configuration file that
- # are associated with the first parameter of this function.
- # The option names are stripped
- if (( $# == 0 )); then
error "find_config: missing parameter"exit 1- fi
Given this is only being called from within the script, I really do not think we need the error check there.
- grep -e "^[[:blank:]]*$1[[:blank:]]*=.*" "$CONFIG" | cut -d= -f 2-
+}
<snip>
- # Read the key ids to an array. The conversion from whatever is inside the file
- # to key ids is important, because key ids are the only guarantee of identification
- # for the keys.
- local -A removed_ids
- if [[ -r "${REMOVED_KEYS}" ]]; then
while read key; dolocal key_values namekey_values=$(${GPG_PACMAN} --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5,10 --output-delimiter=' ')if [[ -z $key_values ]]; then# The key is not in pacman's keyring, so search it on the added and deprecated keys
This I do not understand. Surely if a key is in the remove list then it is not in the added or deprecated list. I'd assume that if a key is to be removed and is not in the keyring already, then we have to do nothing.
Either that or if it could be added via the added and deprecated lists, deal with those first and just remove them all at the end. I know it is a waste to add the key only to remove it later in that weird situation, but it would simplify this section of the code a lot.
Allan
On Thu, Oct 7, 2010 at 1:34 AM, Allan McRae allan@archlinux.org wrote:
- # Read the key ids to an array. The conversion from whatever is
inside the file
- # to key ids is important, because key ids are the only guarantee
of identification
- # for the keys.
- local -A removed_ids
- if [[ -r "${REMOVED_KEYS}" ]]; then
- while read key; do
- local key_values name
- key_values=$(${GPG_PACMAN} --quiet --with-colons
--list-key "${key}" | grep ^pub | cut -d: -f5,10 --output-delimiter=' ')
- if [[ -z $key_values ]]; then
- # The key is not in pacman's keyring, so
search it on the added and deprecated keys
This I do not understand. Surely if a key is in the remove list then it is not in the added or deprecated list. I'd assume that if a key is to be removed and is not in the keyring already, then we have to do nothing.
Either that or if it could be added via the added and deprecated lists, deal with those first and just remove them all at the end. I know it is a waste to add the key only to remove it later in that weird situation, but it would simplify this section of the code a lot.
Yes, you're right. I was overcomplicating because on my tests I created a too convoluted situation that would not really happen in real life.
Do you want me to resend the patch or will you adapt it before including in your repository?
On 08/10/10 00:46, Denis A. Altoé Falqueto wrote:
On Thu, Oct 7, 2010 at 1:34 AM, Allan McRaeallan@archlinux.org wrote:
# Read the key ids to an array. The conversion from whatever isinside the file
# to key ids is important, because key ids are the only guaranteeof identification
# for the keys.local -A removed_idsif [[ -r "${REMOVED_KEYS}" ]]; thenwhile read key; dolocal key_values namekey_values=$(${GPG_PACMAN} --quiet --with-colons--list-key "${key}" | grep ^pub | cut -d: -f5,10 --output-delimiter=' ')
if [[ -z $key_values ]]; then# The key is not in pacman's keyring, sosearch it on the added and deprecated keys
This I do not understand. Surely if a key is in the remove list then it is not in the added or deprecated list. I'd assume that if a key is to be removed and is not in the keyring already, then we have to do nothing.
Either that or if it could be added via the added and deprecated lists, deal with those first and just remove them all at the end. I know it is a waste to add the key only to remove it later in that weird situation, but it would simplify this section of the code a lot.
Yes, you're right. I was overcomplicating because on my tests I created a too convoluted situation that would not really happen in real life.
Do you want me to resend the patch or will you adapt it before including in your repository?
That adjustment is big enough that resending the patch would be helpful. Otherwise it might take some time for me to get it adjusted...
Allan
The --reload command was refactored to allow a more flexible management. There are two sets of keys that will be added, one that will be removed and one that will be kept.
The set of keys to be kept are configured in pacman.conf, with the option HoldKeys, with the same meaning of HoldPkgs. It can be repeated and several values can be put in the same entry.
The new behavior allows a key to be marked for removal, but the user can decide if that key must be kept. For example, if a developer has a public repository, signed with his own key, that key must be added to the HoldKeys option. If the key is marked for removal from pacman's keyring, it will not be removed for the users that have configured HoldKeys correctly.
There are other minor fixes, mainly in the handling of --add command when there is no aditional parameter. In that case, pacman-key will behave just like gpg, adding the contents of stdin into pacman's keyring.
Signed-off-by: Denis A. Altoé Falqueto denisfalqueto@gmail.com --- scripts/pacman-key.sh.in | 143 ++++++++++++++++++++++++++++++++-------------- 1 files changed, 100 insertions(+), 43 deletions(-)
diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 7b5fb29..38bbd32 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -85,45 +85,120 @@ This is free software; see the source for copying conditions.\n\ There is NO WARRANTY, to the extent permitted by law.\n")" }
+find_config() { + # Prints on stdin the values of all the options from the configuration file that + # are associated with the first parameter of this function. + # The option names are stripped + grep -e "^[[:blank:]]*$1[[:blank:]]*=.*" "$CONFIG" | cut -d= -f 2- +} + reload_keyring() { local PACMAN_SHARE_DIR='@prefix@/share/pacman' - local GPG_NOKEYRING="gpg --batch --quiet --ignore-time-conflict --no-options --no-default-keyring --homedir ${PACMAN_KEYRING_DIR}" + local GPG_NOKEYRING="gpg --batch --quiet --ignore-time-conflict --no-options --no-default-keyring" + + # Variable used for iterating on keyrings + local key + local key_id
- # Read-only keyring with keys to be added to the keyring + # Keyring with keys to be added to the keyring local ADDED_KEYS="${PACMAN_SHARE_DIR}/addedkeys.gpg"
- # Read-only list of keys removed from the keyring. + # Keyring with keys that were deprecated and will eventually be deleted + local DEPRECATED_KEYS="${PACMAN_SHARE_DIR}/deprecatedkeys.gpg" + + # List of keys removed from the keyring. This file is not a keyring, unlike the others. + # It is a textual list of values that gpg recogniezes as identifiers for keys. local REMOVED_KEYS="${PACMAN_SHARE_DIR}/removedkeys"
- # Add keys from the current set of keys from pacman-keyring package. The web of trust will - # be updated automatically. + # Verify signatures of related files, if they exist if [[ -r "${ADDED_KEYS}" ]]; then msg "$(gettext "Verifying official keys file signature...")" - if ! ${GPG_PACMAN} --quiet --verify "${ADDED_KEYS}.sig" 1>/dev/null; then + if ! ${GPG_PACMAN} --quiet --batch --verify "${ADDED_KEYS}.sig" 1>/dev/null; then error "$(gettext "The signature of file %s is not valid.")" "${ADDED_KEYS}" exit 1 fi + fi
- msg "$(gettext "Appending official keys...")" - local add_keys=$(${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5) - for key in ${add_keys}; do - msg "$(gettext " key id: %s")" "$key" - ${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --export "${key}" | ${GPG_PACMAN} --import - done + if [[ -r "${DEPRECATED_KEYS}" ]]; then + msg "$(gettext "Verifying deprecated keys file signature...")" + if ! ${GPG_PACMAN} --quiet --batch --verify "${DEPRECATED_KEYS}.sig" 1>/dev/null; then + error "$(gettext "The signature of file %s is not valid.")" "${DEPRECATED_KEYS}" + exit 1 + fi fi
- # Remove the keys from REMOVED_KEYS keyring if [[ -r "${REMOVED_KEYS}" ]]; then msg "$(gettext "Verifying deleted keys file signature...")" - if ! ${GPG_PACMAN} --quiet --verify "${REMOVED_KEYS}.sig"; then + if ! ${GPG_PACMAN} --quiet --batch --verify "${REMOVED_KEYS}.sig"; then error "$(gettext "The signature of file %s is not valid.")" "${REMOVED_KEYS}" exit 1 fi + fi + + # Read the key ids to an array. The conversion from whatever is inside the file + # to key ids is important, because key ids are the only guarantee of identification + # for the keys. + local -A removed_ids + if [[ -r "${REMOVED_KEYS}" ]]; then + while read key; do + local key_values name + key_values=$(${GPG_PACMAN} --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5,10 --output-delimiter=' ') + if [[ -n $key_values ]]; then + # The first word is the key_id + key_id=${key_values%% *} + # the rest if the name of the owner + name=${key_values#* } + if [[ -n ${key_id} ]]; then + # Mark this key to be deleted + removed_ids[$key_id]="$name" + fi + fi + done < "${REMOVED_KEYS}" + fi + + # List of keys that must be kept installed, even if in the list of keys to be removed + local HOLD_KEYS=$(find_config "HoldKeys") + + # Remove the keys that must be kept from the set of keys that should be removed + if [[ -n ${HOLD_KEYS} ]]; then + for key in ${HOLD_KEYS}; do + key_id=$(${GPG_PACMAN} --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5) + if [[ -n "${removed_ids[$key_id]}" ]]; then + unset removed_ids[$key_id] + fi + done + fi + + # Add keys from the current set of keys from pacman-keyring package. The web of trust will + # be updated automatically. + if [[ -r "${ADDED_KEYS}" ]]; then + msg "$(gettext "Appending official keys...")" + local add_keys=$(${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5) + for key_id in ${add_keys}; do + # There is no point in adding a key that will be deleted right after + if [[ -z "${removed_ids[$key_id]}" ]]; then + ${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --export "${key_id}" | ${GPG_PACMAN} --import + fi + done + fi + + if [[ -r "${DEPRECATED_KEYS}" ]]; then + msg "$(gettext "Appending deprecated keys...")" + local add_keys=$(${GPG_NOKEYRING} --keyring "${DEPRECATED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5) + for key_id in ${add_keys}; do + # There is no point in adding a key that will be deleted right after + if [[ -z "${removed_ids[$key_id]}" ]]; then + ${GPG_NOKEYRING} --keyring "${DEPRECATED_KEYS}" --export "${key_id}" | ${GPG_PACMAN} --import + fi + done + fi
+ # Remove the keys not marked to keep + if (( ${#removed_ids[@]} > 0 )); then msg "$(gettext "Removing deleted keys from keyring...")" - cat "${REMOVED_KEYS}" | while read key; do - msg "$(gettext " key id: %s")" "$key" - ${GPG_PACMAN} --quiet --batch --yes --delete-key "${key}" + for key_id in "${!removed_ids[@]}"; do + echo " removing key $key_id - ${removed_ids[$key_id]}" + ${GPG_PACMAN} --quiet --batch --yes --delete-key "${key_id}" done fi
@@ -169,8 +244,7 @@ fi # Read GPGDIR from $CONFIG. # The pattern is: any spaces or tabs, GPGDir, any spaces or tabs, equal sign # and the rest of the line. The string is splitted after the first occurrence of = -if [[ GPGDIR=$(grep -e '^[[:blank:]]*GPGDir[[:blank:]]*=.*' "$CONFIG") == 0 ]]; then - GPGDIR=${GPGDIR#*=} +if [[ GPGDIR=$(find_config "GPGDir") == 0 ]]; then PACMAN_KEYRING_DIR="${GPGDIR}" fi GPG_PACMAN="gpg --homedir ${PACMAN_KEYRING_DIR}" @@ -185,15 +259,8 @@ shift
case "${command}" in -a|--add) - if (( $# == 0 )); then - error "$(gettext "You need to specify at least one key identifier")" - usage - exit 1 - fi - while (( $# > 0 )); do - ${GPG_PACMAN} --quiet --batch --import "$1" - shift - done + # If there is no extra parameter, gpg will read stdin + ${GPG_PACMAN} --quiet --batch --import "$@" ;; -d|--del) if (( $# == 0 )); then @@ -201,10 +268,7 @@ case "${command}" in usage exit 1 fi - while (( $# > 0 )); do - ${GPG_PACMAN} --quiet --batch --delete-key --yes "$1" - shift - done + ${GPG_PACMAN} --quiet --batch --delete-key --yes "$@" ;; -u|--updatedb) ${GPG_PACMAN} --batch --check-trustdb @@ -213,20 +277,13 @@ case "${command}" in reload_keyring ;; -l|--list) - ${GPG_PACMAN} --batch --list-sigs + ${GPG_PACMAN} --batch --list-sigs "$@" ;; -f|--finger) ${GPG_PACMAN} --batch --fingerprint $* ;; -e|--export) - if (( $# == 0 )); then - ${GPG_PACMAN} --armor --export - else - while (( $# > 0 )); do - ${GPG_PACMAN} --armor --export "$1" - shift - done - fi + ${GPG_PACMAN} --armor --export "$@" ;; -r|--receive) if (( $# < 2 )); then @@ -236,7 +293,7 @@ case "${command}" in fi keyserver="$1" shift - ${GPG_PACMAN} --keyserver "${keyserver}" --recv-keys $* + ${GPG_PACMAN} --keyserver "${keyserver}" --recv-keys "$@" ;; -t|--trust) if (( $# == 0 )); then @@ -257,7 +314,7 @@ case "${command}" in ;; --adv) msg "$(gettext "Executing: %s ")$*" "${GPG_PACMAN}" - ${GPG_PACMAN} $* || ret=$? + ${GPG_PACMAN} "$@" || ret=$? exit $ret ;; --help)
On Thu, Oct 7, 2010 at 9:03 PM, Denis A. Altoé Falqueto denisfalqueto@gmail.com wrote:
.....
Sorry, ignore this patch, please. I forgot the --homedir option. Without it, there'll be a nasty message about missing /root/.gpg, bla bla bla...
I'll send the right one very soon.
The --reload command was refactored to allow a more flexible management. There are two sets of keys that will be added, one that will be removed and one that will be kept.
The set of keys to be kept are configured in pacman.conf, with the option HoldKeys, with the same meaning of HoldPkgs. It can be repeated and several values can be put in the same entry.
The new behavior allows a key to be marked for removal, but the user can decide if that key must be kept. For example, if a developer has a public repository, signed with his own key, that key must be added to the HoldKeys option. If the key is marked for removal from pacman's keyring, it will not be removed for the users that have configured HoldKeys correctly.
There are other minor fixes, mainly in the handling of --add command when there is no aditional parameter. In that case, pacman-key will behave just like gpg, adding the contents of stdin into pacman's keyring.
Signed-off-by: Denis A. Altoé Falqueto denisfalqueto@gmail.com --- scripts/pacman-key.sh.in | 141 ++++++++++++++++++++++++++++++++-------------- 1 files changed, 99 insertions(+), 42 deletions(-)
diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 7b5fb29..777146a 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -85,45 +85,120 @@ This is free software; see the source for copying conditions.\n\ There is NO WARRANTY, to the extent permitted by law.\n")" }
+find_config() { + # Prints on stdin the values of all the options from the configuration file that + # are associated with the first parameter of this function. + # The option names are stripped + grep -e "^[[:blank:]]*$1[[:blank:]]*=.*" "$CONFIG" | cut -d= -f 2- +} + reload_keyring() { local PACMAN_SHARE_DIR='@prefix@/share/pacman' local GPG_NOKEYRING="gpg --batch --quiet --ignore-time-conflict --no-options --no-default-keyring --homedir ${PACMAN_KEYRING_DIR}"
- # Read-only keyring with keys to be added to the keyring + # Variable used for iterating on keyrings + local key + local key_id + + # Keyring with keys to be added to the keyring local ADDED_KEYS="${PACMAN_SHARE_DIR}/addedkeys.gpg"
- # Read-only list of keys removed from the keyring. + # Keyring with keys that were deprecated and will eventually be deleted + local DEPRECATED_KEYS="${PACMAN_SHARE_DIR}/deprecatedkeys.gpg" + + # List of keys removed from the keyring. This file is not a keyring, unlike the others. + # It is a textual list of values that gpg recogniezes as identifiers for keys. local REMOVED_KEYS="${PACMAN_SHARE_DIR}/removedkeys"
- # Add keys from the current set of keys from pacman-keyring package. The web of trust will - # be updated automatically. + # Verify signatures of related files, if they exist if [[ -r "${ADDED_KEYS}" ]]; then msg "$(gettext "Verifying official keys file signature...")" - if ! ${GPG_PACMAN} --quiet --verify "${ADDED_KEYS}.sig" 1>/dev/null; then + if ! ${GPG_PACMAN} --quiet --batch --verify "${ADDED_KEYS}.sig" 1>/dev/null; then error "$(gettext "The signature of file %s is not valid.")" "${ADDED_KEYS}" exit 1 fi + fi
- msg "$(gettext "Appending official keys...")" - local add_keys=$(${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5) - for key in ${add_keys}; do - msg "$(gettext " key id: %s")" "$key" - ${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --export "${key}" | ${GPG_PACMAN} --import - done + if [[ -r "${DEPRECATED_KEYS}" ]]; then + msg "$(gettext "Verifying deprecated keys file signature...")" + if ! ${GPG_PACMAN} --quiet --batch --verify "${DEPRECATED_KEYS}.sig" 1>/dev/null; then + error "$(gettext "The signature of file %s is not valid.")" "${DEPRECATED_KEYS}" + exit 1 + fi fi
- # Remove the keys from REMOVED_KEYS keyring if [[ -r "${REMOVED_KEYS}" ]]; then msg "$(gettext "Verifying deleted keys file signature...")" - if ! ${GPG_PACMAN} --quiet --verify "${REMOVED_KEYS}.sig"; then + if ! ${GPG_PACMAN} --quiet --batch --verify "${REMOVED_KEYS}.sig"; then error "$(gettext "The signature of file %s is not valid.")" "${REMOVED_KEYS}" exit 1 fi + fi + + # Read the key ids to an array. The conversion from whatever is inside the file + # to key ids is important, because key ids are the only guarantee of identification + # for the keys. + local -A removed_ids + if [[ -r "${REMOVED_KEYS}" ]]; then + while read key; do + local key_values name + key_values=$(${GPG_PACMAN} --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5,10 --output-delimiter=' ') + if [[ -n $key_values ]]; then + # The first word is the key_id + key_id=${key_values%% *} + # the rest if the name of the owner + name=${key_values#* } + if [[ -n ${key_id} ]]; then + # Mark this key to be deleted + removed_ids[$key_id]="$name" + fi + fi + done < "${REMOVED_KEYS}" + fi + + # List of keys that must be kept installed, even if in the list of keys to be removed + local HOLD_KEYS=$(find_config "HoldKeys") + + # Remove the keys that must be kept from the set of keys that should be removed + if [[ -n ${HOLD_KEYS} ]]; then + for key in ${HOLD_KEYS}; do + key_id=$(${GPG_PACMAN} --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5) + if [[ -n "${removed_ids[$key_id]}" ]]; then + unset removed_ids[$key_id] + fi + done + fi + + # Add keys from the current set of keys from pacman-keyring package. The web of trust will + # be updated automatically. + if [[ -r "${ADDED_KEYS}" ]]; then + msg "$(gettext "Appending official keys...")" + local add_keys=$(${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5) + for key_id in ${add_keys}; do + # There is no point in adding a key that will be deleted right after + if [[ -z "${removed_ids[$key_id]}" ]]; then + ${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --export "${key_id}" | ${GPG_PACMAN} --import + fi + done + fi + + if [[ -r "${DEPRECATED_KEYS}" ]]; then + msg "$(gettext "Appending deprecated keys...")" + local add_keys=$(${GPG_NOKEYRING} --keyring "${DEPRECATED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5) + for key_id in ${add_keys}; do + # There is no point in adding a key that will be deleted right after + if [[ -z "${removed_ids[$key_id]}" ]]; then + ${GPG_NOKEYRING} --keyring "${DEPRECATED_KEYS}" --export "${key_id}" | ${GPG_PACMAN} --import + fi + done + fi
+ # Remove the keys not marked to keep + if (( ${#removed_ids[@]} > 0 )); then msg "$(gettext "Removing deleted keys from keyring...")" - cat "${REMOVED_KEYS}" | while read key; do - msg "$(gettext " key id: %s")" "$key" - ${GPG_PACMAN} --quiet --batch --yes --delete-key "${key}" + for key_id in "${!removed_ids[@]}"; do + echo " removing key $key_id - ${removed_ids[$key_id]}" + ${GPG_PACMAN} --quiet --batch --yes --delete-key "${key_id}" done fi
@@ -169,8 +244,7 @@ fi # Read GPGDIR from $CONFIG. # The pattern is: any spaces or tabs, GPGDir, any spaces or tabs, equal sign # and the rest of the line. The string is splitted after the first occurrence of = -if [[ GPGDIR=$(grep -e '^[[:blank:]]*GPGDir[[:blank:]]*=.*' "$CONFIG") == 0 ]]; then - GPGDIR=${GPGDIR#*=} +if [[ GPGDIR=$(find_config "GPGDir") == 0 ]]; then PACMAN_KEYRING_DIR="${GPGDIR}" fi GPG_PACMAN="gpg --homedir ${PACMAN_KEYRING_DIR}" @@ -185,15 +259,8 @@ shift
case "${command}" in -a|--add) - if (( $# == 0 )); then - error "$(gettext "You need to specify at least one key identifier")" - usage - exit 1 - fi - while (( $# > 0 )); do - ${GPG_PACMAN} --quiet --batch --import "$1" - shift - done + # If there is no extra parameter, gpg will read stdin + ${GPG_PACMAN} --quiet --batch --import "$@" ;; -d|--del) if (( $# == 0 )); then @@ -201,10 +268,7 @@ case "${command}" in usage exit 1 fi - while (( $# > 0 )); do - ${GPG_PACMAN} --quiet --batch --delete-key --yes "$1" - shift - done + ${GPG_PACMAN} --quiet --batch --delete-key --yes "$@" ;; -u|--updatedb) ${GPG_PACMAN} --batch --check-trustdb @@ -213,20 +277,13 @@ case "${command}" in reload_keyring ;; -l|--list) - ${GPG_PACMAN} --batch --list-sigs + ${GPG_PACMAN} --batch --list-sigs "$@" ;; -f|--finger) ${GPG_PACMAN} --batch --fingerprint $* ;; -e|--export) - if (( $# == 0 )); then - ${GPG_PACMAN} --armor --export - else - while (( $# > 0 )); do - ${GPG_PACMAN} --armor --export "$1" - shift - done - fi + ${GPG_PACMAN} --armor --export "$@" ;; -r|--receive) if (( $# < 2 )); then @@ -236,7 +293,7 @@ case "${command}" in fi keyserver="$1" shift - ${GPG_PACMAN} --keyserver "${keyserver}" --recv-keys $* + ${GPG_PACMAN} --keyserver "${keyserver}" --recv-keys "$@" ;; -t|--trust) if (( $# == 0 )); then @@ -257,7 +314,7 @@ case "${command}" in ;; --adv) msg "$(gettext "Executing: %s ")$*" "${GPG_PACMAN}" - ${GPG_PACMAN} $* || ret=$? + ${GPG_PACMAN} "$@" || ret=$? exit $ret ;; --help)
On 08/10/10 10:13, Denis A. Altoé Falqueto wrote:
The --reload command was refactored to allow a more flexible management. There are two sets of keys that will be added, one that will be removed and one that will be kept.
The set of keys to be kept are configured in pacman.conf, with the option HoldKeys, with the same meaning of HoldPkgs. It can be repeated and several values can be put in the same entry.
The new behavior allows a key to be marked for removal, but the user can decide if that key must be kept. For example, if a developer has a public repository, signed with his own key, that key must be added to the HoldKeys option. If the key is marked for removal from pacman's keyring, it will not be removed for the users that have configured HoldKeys correctly.
There are other minor fixes, mainly in the handling of --add command when there is no aditional parameter. In that case, pacman-key will behave just like gpg, adding the contents of stdin into pacman's keyring.
Signed-off-by: Denis A. Altoé Falquetodenisfalqueto@gmail.com
scripts/pacman-key.sh.in | 141 ++++++++++++++++++++++++++++++++-------------- 1 files changed, 99 insertions(+), 42 deletions(-)
Finally got to the re-review of this... it looks like all my original comments were addressed.
Pulled onto my newly rebased gpg branch.
Allan
On 06/10/10 12:26, Denis A. Altoé Falqueto wrote:
Guys,
This is a last patch for that series. It is a new patch, as Allan asked, so you can apply it in an already patched branch.
The description on the patch itself is self explanatory. This is just to justify the new patch without poluting its description.
Any sugestions or criticisms are always welcome.
Thanks,
I will look at this in the coming days and rebase it into the previous keyring patch as necessary.
I am also part way through reviewing the next patch in the series so expect a reply to that in the next few days.
Cheers, Allan
pacman-dev@lists.archlinux.org