[pacman-dev] [PATCH] pacman-key: ignores keys already lsigned during populate

[Matthew Sexton]

WORK IN PROGRESS. I'm only emailing this patch to get some
feedback. I added a function that checks whether a key
being imported has already been signed, and if it has been,
skip lsigning it.

I'm not 100% sure this line is entirely necessary:
	if (( LSIGNKEY || POPULATE )); then

I wanted to ensure that there -was- a signing key to check
against. It might be a superfluous check, but I couldn't
find where --populate implies having run --init. I may've
missed it.

Otherwise, just looking for feedback before I move on to
step 2 which is not disabling already disabled keys. Let
me know if there are any glaring errors you see, or if
there is a more elegant way of doing what I did.

Signed-off-by: Matthew Sexton <wsdmatty at gmail.com>
---
 scripts/pacman-key.sh.in | 27 ++++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in
index 3627a805..796375a5 100644
--- a/scripts/pacman-key.sh.in
+++ b/scripts/pacman-key.sh.in
@@ -247,7 +247,7 @@ check_keyring() {
 		fi
 	fi
 
-	if (( LSIGNKEY )); then
+	if (( LSIGNKEY || POPULATE )); then
 		if [[ $(secret_keys_available) -lt 1 ]]; then
 			error "$(gettext "There is no secret key available to sign with.")"
 			msg "$(gettext "Use '%s' to generate a default secret key.")" "pacman-key --init"
@@ -447,6 +447,25 @@ list_sigs() {
 		exit 1
 	fi
 }
+lsigned_already() {
+	# Determines whether a key has already been signed locally by getting the
+	# local pacman secret key and comparing it against signatures on the key
+	# returns 1 if key is not signed, 0 if signed
+	secret_key=$("${GPG_PACMAN[@]}" --with-colons --list-secret-key | head -n1 | awk -F : '{print $5}')
+	NEEDS_SIGNED=1
+	while read line; do
+        while IFS=: read -r _ valid _ _ signkey _; do
+                if [ "$valid" != "!" ]; then
+                    continue
+                fi
+                if [[ "$signkey" == "$secret_key" ]]; then
+                        NEEDS_SIGNED=0
+                        break
+                fi
+        done
+	done < <("${GPG_PACMAN[@]}" --with-colons --check-signatures "$1")
+
+}
 
 lsign_keys() {
 	check_keyids_exist
@@ -454,6 +473,10 @@ lsign_keys() {
 	local ret=0
 	local key_count=0
 	for key_id in "$@"; do
+		lsigned_already "$key_id"
+		if [[ "$NEEDS_SIGNED" == 0 ]]; then
+			continue
+		fi
 		if (( VERBOSE )); then
 			msg2 "$(gettext "Locally signing key %s...")" "${key_id}"
 		fi
@@ -469,7 +492,9 @@ lsign_keys() {
 	if (( ret )); then
 		exit 1
 	fi
+	if (( key_count )); then
 	msg2 "$(gettext "Locally signed %s keys.")" "${key_count}"
+	fi
 }
 
 receive_keys() {
-- 
2.23.0