[pacman-dev] [PATCH 1/5] pacman-key: keyring management tool
Denis A. Altoé Falqueto
denisfalqueto at gmail.com
Tue Jul 27 23:50:18 EDT 2010
The script pacman-key will manage pacman's keyring. It imports, exports,
fetches from keyservers, helps in the process of trusting and updates
the trust database.
Signed-off-by: Denis A. Altoé Falqueto <denisfalqueto at gmail.com>
---
scripts/.gitignore | 1 +
scripts/Makefile.am | 3 +
scripts/pacman-key.sh.in | 280 ++++++++++++++++++++++++++++++++++++++++++++++
3 files changed, 284 insertions(+), 0 deletions(-)
create mode 100644 scripts/pacman-key.sh.in
diff --git a/scripts/.gitignore b/scripts/.gitignore
index eafc493..1c662de 100644
--- a/scripts/.gitignore
+++ b/scripts/.gitignore
@@ -4,3 +4,4 @@ rankmirrors
repo-add
repo-remove
pkgdelta
+pacman-key
diff --git a/scripts/Makefile.am b/scripts/Makefile.am
index 31e8fb5..c81f703 100644
--- a/scripts/Makefile.am
+++ b/scripts/Makefile.am
@@ -7,6 +7,7 @@ bin_SCRIPTS = \
OURSCRIPTS = \
makepkg \
+ pacman-key \
pacman-optimize \
pkgdelta \
rankmirrors \
@@ -14,6 +15,7 @@ OURSCRIPTS = \
EXTRA_DIST = \
makepkg.sh.in \
+ pacman-key.sh.in \
pacman-optimize.sh.in \
pkgdelta.sh.in \
rankmirrors.sh.in \
@@ -60,6 +62,7 @@ $(OURSCRIPTS): Makefile
@mv $@.tmp $@
makepkg: $(srcdir)/makepkg.sh.in
+pacman-key: ${srcdir}/pacman-key.sh.in
pacman-optimize: $(srcdir)/pacman-optimize.sh.in
pkgdelta: $(srcdir)/pkgdelta.sh.in
rankmirrors: $(srcdir)/rankmirrors.sh.in
diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in
new file mode 100644
index 0000000..05745a9
--- /dev/null
+++ b/scripts/pacman-key.sh.in
@@ -0,0 +1,280 @@
+#!/bin/bash -e
+#
+# pacman-key - manages pacman's keyring
+# @configure_input@
+#
+# Copyright (c) 2010 - Pacman Development Team <pacman-dev at archlinux.org>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+
+# gettext initialization
+export TEXTDOMAIN='pacman'
+export TEXTDOMAINDIR='@localedir@'
+
+# Based on apt-key, from Debian
+myver="@PACKAGE_VERSION@"
+
+# According to apt-key, gpg doesn't like to be called without a secret keyring.
+# We will not really need one, because pacman will not sign packages, just verify
+# their integrities.
+PACMAN_SHARE_DIR="@pkgdatadir@"
+
+# Default parameters for the command gpg. Some more will be added when needed
+GPG="gpg"
+GPG_NOKEYRING="${GPG} --ignore-time-conflict --no-options --no-default-keyring"
+SIG_EXT=".sig"
+
+# Read-only keyring with keys to be added to the keyring
+ADDED_KEYS="${PACMAN_SHARE_DIR}/addedkeys.gpg"
+
+# Read-only keyring with keys removed from the keyring. They need to be removed before
+# the keys from the added keyring be really imported
+REMOVED_KEYS="${PACMAN_SHARE_DIR}/removedkeys.gpg"
+
+usage() {
+ printf "pacman-key (pacman) %s\n" ${myver}
+ echo
+ printf $(gettext "Usage: %s [options] command [arguments]") $(basename $0)
+ echo
+ echo $(gettext "Manage pacman's list of trusted keys")
+ echo
+ echo $(gettext "Options must be placed before commands. The abailable options are:")
+ echo $(gettext " --config - set an alternative configuraton file to use. ")
+ echo $(gettext " Default is @sysconfdir@/pacman.conf")
+ echo $(gettext " --gpgdir - set an alternativ home directory for gnupg. ")
+ echo $(gettext " Default is @sysconfdir@/pacman.d/gnupg")
+ echo
+ echo $(gettext "The available commands are:")
+ echo $(gettext " pacman-key -a | --add <file> ... - add the key contained ")
+ echo $(gettext " in <file> ('-' for stdin)")
+ echo $(gettext " pacman-key -d | --del <keyid> ... - remove the key <keyid>")
+ echo $(gettext " pacman-key -e | --export <keyid> ... - output the key <keyid>")
+ echo $(gettext " pacman-key -x | --exportall - output all trusted keys")
+ echo $(gettext " pacman-key -r | --receive <keyserver> <keyid> ... - fetch the keyids from")
+ echo $(gettext " the specified keyserver URL")
+ echo $(gettext " pacman-key -t | --trust <keyid> ... - set the truslevel of the given key")
+ echo $(gettext " pacman-key -u | --updatedb - update the trustdb of pacman")
+ echo $(gettext " pacman-key --reload - reloads the keys from the keyring package")
+ echo $(gettext " pacman-key -l | --list - list keys")
+ echo $(gettext " pacman-key -f | --finger <keyid> ... - list fingerprints")
+ echo $(gettext " pacman-key --adv <params> - pass advanced options to gpg")
+ echo $(gettext " pacman-key -h | --help - displays this message")
+ echo $(gettext " pacman-key -v | --version - displays the current version")
+}
+
+version() {
+ printf "pacman-key (pacman) %s\n" "${myver}"
+ printf "$(gettext "\
+Copyright (c) 2010 Pacman Development Team <pacman-dev at archlinux.org>.\n\
+This is free software; see the source for copying conditions.\n\
+There is NO WARRANTY, to the extent permitted by law.\n")"
+}
+
+prepare_homedir() {
+ if [[ ! -d "${PACMAN_KEYRING_DIR}" ]] ; then
+ mkdir -p "${PACMAN_KEYRING_DIR}"
+ touch "${PACMAN_KEYRING_DIR}/secring.gpg"
+ touch "${PACMAN_KEYRING_DIR}/pubring.gpg"
+ chmod 700 "${PACMAN_KEYRING_DIR}"
+ chmod 600 "${PACMAN_KEYRING_DIR}"/{sec,pub}ring.gpg
+ fi
+}
+
+update_trustdb() {
+ ${GPG_PACMAN} --batch --check-trustdb
+}
+
+reload_keyring() {
+ # Verify the signature of removed keys file
+ if [[ -f "${REMOVED_KEYS}" ]] && ! ${GPG_PACMAN} --quiet --verify "${REMOVED_KEYS}${SIG_EXT}" ; then
+ echo >&2 $(gettext "The signature of file ${REMOVED_KEYS} is not valid.")
+ exit 1
+ fi
+
+ # Verify the signature of the added keys file
+ if [[ -f "${ADDED_KEYS}" ]] && ! ${GPG_PACMAN} --quiet --verify "${ADDED_KEYS}${SIG_EXT}" ; then
+ echo >&2 $(gettext "The signature of file ${ADDED_KEYS} is not valid.")
+ exit 1
+ fi
+
+ # Remove the keys from REMOVED_KEYS keyring
+ [[ -r "${REMOVED_KEYS}" ]] && cat "${REMOVED_KEYS}" | while read key ; do
+ ${GPG_PACMAN} --quiet --batch --yes --delete-keys "${key}"
+ done
+
+ # Add keys from the current set of keys from pacman-keyring package. The web of trust will
+ # be updated automatically.
+ if [[ -r "${ADDED_KEYS}" ]] ; then
+ add_keys=$(${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5)
+ for key in ${add_keys}; do
+ ${GPG_NOKEYRING} --quiet --batch --keyring "${ADDED_KEYS}" --export "${key}" | ${GPG_PACMAN} --import
+ done
+ fi
+
+ # Update trustdb, just to be sure
+ update_trustdb
+}
+
+receive() {
+ keyserver="$1"
+ shift
+ ${GPG_PACMAN} --keyserver "${keyserver}" $*
+}
+
+# PROGRAM START
+
+if ! type gettext &>/dev/null; then
+ gettext() {
+ echo "$@"
+ }
+fi
+
+if [[ "$command" != "version" && "$command" != "help" ]] && ! which "${GPG}" >/dev/null 2>&1; then
+ echo >&2 $(gettext "Warning: gnupg does not seem to be installed.")
+ echo >&2 $(gettext "Warning: pacman-key requires gnupg for most operations.")
+ exit 1
+fi
+
+# Parse global options
+CONFIG="@sysconfdir@/pacman.conf"
+PACMAN_KEYRING_DIR="@sysconfdir@/pacman.d/gnupg"
+while [[ $1 =~ ^--(config|gpgdir)$ ]] ; do
+ case "$1" in
+ --config) shift; CONFIG="$1" ;;
+ --gpgdir) shift; PACMAN_KEYRING_DIR="$1" ;;
+ esac
+ shift
+done
+
+if [[ ! -r "${CONFIG}" ]] ; then
+ echo >&2 $(gettext "It is not possible to read ${CONFIG}.")
+ exit 1
+fi
+
+# Read GPGDIR from $CONFIG.
+# The pattern is: any spaces or tabs, GPGDir, any spaces or tabs, equal sign
+# and the rest of the line. The string is splitted after the first occurrence of =
+GPGDIR=$(cat ${CONFIG} | awk '/^(\t| )*GPGDir(\t| )*=.*/ { print substr($0,index($0, "=")+1) }')
+if [[ "${GPGDIR}" ]] ; then
+ PACMAN_KEYRING_DIR="${GPGDIR}"
+fi
+GPG_PACMAN="${GPG} --homedir ${PACMAN_KEYRING_DIR}"
+
+prepare_homedir
+
+# Parse and execute command
+command="$1"
+if [[ -z "${command}" ]]; then
+ usage
+ exit 1
+fi
+shift
+
+case "${command}" in
+ -a|--add)
+ if (( $# == 0 )) ; then
+ echo >&2 $(gettext "You need to specify at least one key identifier")
+ usage
+ exit 1
+ fi
+ while (( $# > 0 )) ; do
+ ${GPG_PACMAN} --quiet --batch --import "$1"
+ shift
+ done
+ ;;
+ -d|--del)
+ if (( $# == 0 )) ; then
+ echo >&2 $(gettext "You need to specify at least one key identifier")
+ usage
+ exit 1
+ fi
+ while (( $# > 0 )) ; do
+ ${GPG_PACMAN} --quiet --batch --delete-key --yes "$1"
+ shift
+ done
+ ;;
+ -u|--updatedb)
+ update_trustdb
+ ;;
+ --reload)
+ reload_keyring
+ ;;
+ -l|-list)
+ ${GPG_PACMAN} --batch --list-sigs
+ ;;
+ -f|--finger)
+ if (( $# == 0 )) ; then
+ echo >&2 $(gettext "You need to specify at least one key identifier")
+ usage
+ exit 1
+ fi
+ ${GPG_PACMAN} --batch --fingerprint $*
+ ;;
+ -e|--export)
+ if (( $# == 0 )) ; then
+ echo >&2 $(gettext "You need to specify at least one key identifier")
+ usage
+ exit 1
+ fi
+ while (( $# > 0 )) ; do
+ ${GPG_PACMAN} --armor --export "$1"
+ shift
+ done
+ ;;
+ -x|--exportall)
+ ${GPG_PACMAN} --armor --export
+ ;;
+ -r|--receive)
+ if (( $# < 2 )) ; then
+ echo >&2 $(gettext "You need to specify the keyserver and at least one key identifier")
+ usage
+ exit 1
+ fi
+ receive $*
+ ;;
+ -t|--trust)
+ if (( $# == 0 )) ; then
+ echo >&2 $(gettext "You need to specify at least one key identifier")
+ usage
+ exit 1
+ fi
+ while (( $# > 0 )) ; do
+ # Verify if the key exists in pacman's keyring
+ if ${GPG_PACMAN} --list-key "$1" > /dev/null 2>&1 ; then
+ ${GPG_PACMAN} --edit-key "$1"
+ else
+ echo >&2 $(gettext "The key identified by $1 doesn't exist")
+ exit 1
+ fi
+ shift
+ done
+ ;;
+ --adv)
+ echo $(gettext "Executing: ${GPG_PACMAN} $*")
+ ${GPG_PACMAN} $* || ret=$?
+ exit $ret
+ ;;
+ --help)
+ usage
+ ;;
+ --version)
+ version
+ exit 0
+ ;;
+ *)
+ usage
+ exit 1
+ ;;
+esac
--
1.7.2
More information about the pacman-dev
mailing list