[pacman-dev] [PATCH 1/5] pacman-key: keyring management tool
Guillaume ALAUX
guillaume at archlinux.org
Thu Sep 16 03:37:14 EDT 2010
On 16 September 2010 05:40, Denis A. Altoé Falqueto
<denisfalqueto at gmail.com> wrote:
> The script pacman-key will manage pacman's keyring. It imports, exports,
> fetches from keyservers, helps in the process of trusting and updates
> the trust database.
>
> Signed-off-by: Denis A. Altoé Falqueto <denisfalqueto at gmail.com>
> ---
> scripts/.gitignore | 1 +
> scripts/Makefile.am | 3 +
> scripts/pacman-key.sh.in | 275 ++++++++++++++++++++++++++++++++++++++++++++++
> 3 files changed, 279 insertions(+), 0 deletions(-)
> create mode 100644 scripts/pacman-key.sh.in
>
> diff --git a/scripts/.gitignore b/scripts/.gitignore
> index eafc493..1c662de 100644
> --- a/scripts/.gitignore
> +++ b/scripts/.gitignore
> @@ -4,3 +4,4 @@ rankmirrors
> repo-add
> repo-remove
> pkgdelta
> +pacman-key
> diff --git a/scripts/Makefile.am b/scripts/Makefile.am
> index 31e8fb5..c81f703 100644
> --- a/scripts/Makefile.am
> +++ b/scripts/Makefile.am
> @@ -7,6 +7,7 @@ bin_SCRIPTS = \
>
> OURSCRIPTS = \
> makepkg \
> + pacman-key \
> pacman-optimize \
> pkgdelta \
> rankmirrors \
> @@ -14,6 +15,7 @@ OURSCRIPTS = \
>
> EXTRA_DIST = \
> makepkg.sh.in \
> + pacman-key.sh.in \
> pacman-optimize.sh.in \
> pkgdelta.sh.in \
> rankmirrors.sh.in \
> @@ -60,6 +62,7 @@ $(OURSCRIPTS): Makefile
> @mv $@.tmp $@
>
> makepkg: $(srcdir)/makepkg.sh.in
> +pacman-key: ${srcdir}/pacman-key.sh.in
> pacman-optimize: $(srcdir)/pacman-optimize.sh.in
> pkgdelta: $(srcdir)/pkgdelta.sh.in
> rankmirrors: $(srcdir)/rankmirrors.sh.in
> diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in
> new file mode 100644
> index 0000000..7b5fb29
> --- /dev/null
> +++ b/scripts/pacman-key.sh.in
> @@ -0,0 +1,275 @@
> +#!/bin/bash -e
> +#
> +# pacman-key - manages pacman's keyring
> +# Based on apt-key, from Debian
> +# @configure_input@
> +#
> +# Copyright (c) 2010 - Pacman Development Team <pacman-dev at archlinux.org>
> +#
> +# This program is free software; you can redistribute it and/or modify
> +# it under the terms of the GNU General Public License as published by
> +# the Free Software Foundation; either version 2 of the License, or
> +# (at your option) any later version.
> +#
> +# This program is distributed in the hope that it will be useful,
> +# but WITHOUT ANY WARRANTY; without even the implied warranty of
> +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
> +# GNU General Public License for more details.
> +#
> +# You should have received a copy of the GNU General Public License
> +# along with this program. If not, see <http://www.gnu.org/licenses/>.
> +#
> +
> +# gettext initialization
> +export TEXTDOMAIN='pacman'
> +export TEXTDOMAINDIR='@localedir@'
> +
> +myver="@PACKAGE_VERSION@"
> +
> +msg() {
> + local mesg=$1; shift
> + printf "==> ${mesg}\n" "$@" >&1
> +}
> +
> +msg2() {
> + (( QUIET )) && return
> + local mesg=$1; shift
> + printf " -> ${mesg}\n" "$@" >&1
> +}
> +
> +warning() {
> + local mesg=$1; shift
> + printf "==> $(gettext "WARNING:") ${mesg}\n" "$@" >&2
> +}
> +
> +error() {
> + local mesg=$1; shift
> + printf "==> $(gettext "ERROR:") ${mesg}\n" "$@" >&2
> +}
> +
> +usage() {
> + printf "pacman-key (pacman) %s\n" ${myver}
> + echo
> + printf "$(gettext "Usage: %s [options] command [arguments]")\n" $(basename $0)
> + echo
> + echo "$(gettext "Manage pacman's list of trusted keys")"
> + echo
> + echo "$(gettext "Options must be placed before commands. The available options are:")"
> + echo "$(gettext " --config - set an alternative configuration file to use. ")"
> + printf "$(gettext " Default is %s")\n" "@sysconfdir@/pacman.conf"
> + echo "$(gettext " --gpgdir - set an alternative home directory for gnupg. ")"
> + printf "$(gettext " Default is set in %s")\n" "@sysconfdir@/pacman.conf"
> + echo
> + echo "$(gettext "The available commands are:")"
> + echo "$(gettext " pacman-key -a | --add [<file>] ... - add the key contained ")"
> + echo "$(gettext " in <file> (empty for stdin)")"
> + echo "$(gettext " pacman-key -d | --del <keyid> ... - remove the key <keyid>")"
> + echo "$(gettext " pacman-key -e | --export <keyid> ... - output the key <keyid>")"
> + echo "$(gettext " pacman-key -r | --receive <keyserver> <keyid> ... - fetch the keyids from")"
> + echo "$(gettext " the specified keyserver URL")"
> + echo "$(gettext " pacman-key -t | --trust <keyid> ... - set the trust level of the given key")"
> + echo "$(gettext " pacman-key -u | --updatedb - update the trustdb of pacman")"
> + echo "$(gettext " pacman-key --reload - reloads the keys from the keyring package")"
> + echo "$(gettext " pacman-key -l | --list - list keys")"
> + echo "$(gettext " pacman-key -f | --finger [<keyid]> ... - list fingerprint for specified keyids (or for all, if none is specified)")"
> + echo "$(gettext " pacman-key --adv <params> - use pacman's keyring as target for advanced commands")"
> + echo "$(gettext " pacman-key -h | --help - displays this message")"
> + echo "$(gettext " pacman-key -v | --version - displays the current version")"
> +}
> +
> +version() {
> + printf "pacman-key (pacman) %s\n" "${myver}"
> + printf "$(gettext "\
> +Copyright (c) 2010 Pacman Development Team <pacman-dev at archlinux.org>.\n\
> +This is free software; see the source for copying conditions.\n\
> +There is NO WARRANTY, to the extent permitted by law.\n")"
> +}
> +
> +reload_keyring() {
> + local PACMAN_SHARE_DIR='@prefix@/share/pacman'
> + local GPG_NOKEYRING="gpg --batch --quiet --ignore-time-conflict --no-options --no-default-keyring --homedir ${PACMAN_KEYRING_DIR}"
> +
> + # Read-only keyring with keys to be added to the keyring
> + local ADDED_KEYS="${PACMAN_SHARE_DIR}/addedkeys.gpg"
> +
> + # Read-only list of keys removed from the keyring.
> + local REMOVED_KEYS="${PACMAN_SHARE_DIR}/removedkeys"
> +
> + # Add keys from the current set of keys from pacman-keyring package. The web of trust will
> + # be updated automatically.
> + if [[ -r "${ADDED_KEYS}" ]]; then
> + msg "$(gettext "Verifying official keys file signature...")"
> + if ! ${GPG_PACMAN} --quiet --verify "${ADDED_KEYS}.sig" 1>/dev/null; then
> + error "$(gettext "The signature of file %s is not valid.")" "${ADDED_KEYS}"
> + exit 1
> + fi
> +
> + msg "$(gettext "Appending official keys...")"
> + local add_keys=$(${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5)
> + for key in ${add_keys}; do
> + msg "$(gettext " key id: %s")" "$key"
> + ${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --export "${key}" | ${GPG_PACMAN} --import
> + done
> + fi
> +
> + # Remove the keys from REMOVED_KEYS keyring
> + if [[ -r "${REMOVED_KEYS}" ]]; then
> + msg "$(gettext "Verifying deleted keys file signature...")"
> + if ! ${GPG_PACMAN} --quiet --verify "${REMOVED_KEYS}.sig"; then
> + error "$(gettext "The signature of file %s is not valid.")" "${REMOVED_KEYS}"
> + exit 1
> + fi
> +
> + msg "$(gettext "Removing deleted keys from keyring...")"
> + cat "${REMOVED_KEYS}" | while read key; do
> + msg "$(gettext " key id: %s")" "$key"
> + ${GPG_PACMAN} --quiet --batch --yes --delete-key "${key}"
> + done
> + fi
> +
> + # Update trustdb, just to be sure
> + msg "$(gettext "Updating trust database...")"
> + ${GPG_PACMAN} --batch --check-trustdb
> +}
> +
> +# PROGRAM START
> +if ! type gettext &>/dev/null; then
> + gettext() {
> + echo "$@"
> + }
> +fi
> +
> +if [[ $1 != "--version" && $1 != "-v" && $1 != "--help" && $1 != "-h" ]]; then
> + if type -p gpg >/dev/null 2>&1 = 1; then
> + error "$(gettext "gnupg does not seem to be installed.")"
> + msg2 "$(gettext "pacman-key requires gnupg for most operations.")"
> + exit 1
> + elif (( EUID != 0 )); then
> + error "$(gettext "pacman-key needs to be run as root.")"
> + exit 1
> + fi
> +fi
> +
> +# Parse global options
> +CONFIG="@sysconfdir@/pacman.conf"
> +PACMAN_KEYRING_DIR="@sysconfdir@/pacman.d/gnupg"
> +while [[ $1 =~ ^--(config|gpgdir)$ ]]; do
> + case "$1" in
> + --config) shift; CONFIG="$1" ;;
> + --gpgdir) shift; PACMAN_KEYRING_DIR="$1" ;;
> + esac
> + shift
> +done
> +
> +if [[ ! -r "${CONFIG}" ]]; then
> + error "$(gettext "It is not possible to read %s")" "${CONFIG}"
> + exit 1
> +fi
> +
> +# Read GPGDIR from $CONFIG.
> +# The pattern is: any spaces or tabs, GPGDir, any spaces or tabs, equal sign
> +# and the rest of the line. The string is splitted after the first occurrence of =
> +if [[ GPGDIR=$(grep -e '^[[:blank:]]*GPGDir[[:blank:]]*=.*' "$CONFIG") == 0 ]]; then
> + GPGDIR=${GPGDIR#*=}
> + PACMAN_KEYRING_DIR="${GPGDIR}"
> +fi
> +GPG_PACMAN="gpg --homedir ${PACMAN_KEYRING_DIR}"
> +
> +# Parse and execute command
> +command="$1"
> +if [[ -z "${command}" ]]; then
> + usage
> + exit 1
> +fi
> +shift
> +
> +case "${command}" in
> + -a|--add)
> + if (( $# == 0 )); then
> + error "$(gettext "You need to specify at least one key identifier")"
> + usage
> + exit 1
> + fi
> + while (( $# > 0 )); do
> + ${GPG_PACMAN} --quiet --batch --import "$1"
> + shift
> + done
> + ;;
> + -d|--del)
> + if (( $# == 0 )); then
> + error "$(gettext "You need to specify at least one key identifier")"
> + usage
> + exit 1
> + fi
> + while (( $# > 0 )); do
> + ${GPG_PACMAN} --quiet --batch --delete-key --yes "$1"
> + shift
> + done
> + ;;
> + -u|--updatedb)
> + ${GPG_PACMAN} --batch --check-trustdb
> + ;;
> + --reload)
> + reload_keyring
> + ;;
> + -l|--list)
> + ${GPG_PACMAN} --batch --list-sigs
> + ;;
> + -f|--finger)
> + ${GPG_PACMAN} --batch --fingerprint $*
> + ;;
> + -e|--export)
> + if (( $# == 0 )); then
> + ${GPG_PACMAN} --armor --export
> + else
> + while (( $# > 0 )); do
> + ${GPG_PACMAN} --armor --export "$1"
> + shift
> + done
> + fi
> + ;;
> + -r|--receive)
> + if (( $# < 2 )); then
> + error "$(gettext "You need to specify the keyserver and at least one key identifier")"
> + usage
> + exit 1
> + fi
> + keyserver="$1"
> + shift
> + ${GPG_PACMAN} --keyserver "${keyserver}" --recv-keys $*
> + ;;
> + -t|--trust)
> + if (( $# == 0 )); then
> + error "$(gettext "You need to specify at least one key identifier")"
> + usage
> + exit 1
> + fi
> + while (( $# > 0 )); do
> + # Verify if the key exists in pacman's keyring
> + if ${GPG_PACMAN} --list-keys "$1" > /dev/null 2>&1; then
> + ${GPG_PACMAN} --edit-key "$1"
> + else
> + error "$(gettext "The key identified by %s doesn't exist")" "$1"
> + exit 1
> + fi
> + shift
> + done
> + ;;
> + --adv)
> + msg "$(gettext "Executing: %s ")$*" "${GPG_PACMAN}"
> + ${GPG_PACMAN} $* || ret=$?
> + exit $ret
> + ;;
> + --help)
> + usage
> + ;;
> + --version)
> + version
> + exit 0
> + ;;
> + *)
> + usage
> + exit 1
> + ;;
> +esac
> +
> --
> 1.7.2.3
>
>
>
Hi Denis, Hi everyone,
I'm really pleased to see you're back on track.
> If any of the collaborators want to help, this is the time
I would be glad to.
I see you need help to write the man right? Is this the number one
task? Because I could also help with some more technical things if
needed.
Just let me know.
--
Guillaume
More information about the pacman-dev
mailing list