#!@BASH_SHELL@ -e # # pacman-key - manages pacman's keyring # Based on apt-key, from Debian # @configure_input@ # # Copyright (c) 2010 - Pacman Development Team <pacman-dev@archlinux.org> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # # gettext initialization export TEXTDOMAIN='pacman' export TEXTDOMAINDIR='@localedir@' myver="@PACKAGE_VERSION@" msg() { local mesg=$1; shift printf "==> ${mesg}\n" "$@" >&1 } msg2() { (( QUIET )) && return local mesg=$1; shift printf " -> ${mesg}\n" "$@" >&1 } warning() { local mesg=$1; shift printf "==> $(gettext "WARNING:") ${mesg}\n" "$@" >&2 } error() { local mesg=$1; shift printf "==> $(gettext "ERROR:") ${mesg}\n" "$@" >&2 } usage() { printf "pacman-key (pacman) %s\n" ${myver} echo printf "$(gettext "Usage: %s [options] <command> [arguments]")\n" $(basename $0) echo echo "$(gettext "Manage pacman's list of trusted keys")" echo echo "$(gettext "Options must be placed before commands. The available options are:")" printf "$(gettext " --config <file> Use an alternate config file (instead of '%s')")\n" "$CONFIG" echo "$(gettext " --gpgdir Set an alternate directory for gnupg")" echo echo "$(gettext "The available commands are:")" echo "$(gettext " -a, --add [<file(s)>] Add the specified keys (empty for stdin)")" echo "$(gettext " -d, --del <keyid(s)> Remove the specified keyids")" echo "$(gettext " -e, --export <keyid(s)> Export the specified keyids")" echo "$(gettext " -f, --finger [<keyid(s)>] List fingerprint for specified or all keyids")" echo "$(gettext " -h, --help Show this help message and exit")" echo "$(gettext " -l, --list List keys")" echo "$(gettext " -r, --receive <keyserver> <keyid(s)> Fetch the specified keyids")" echo "$(gettext " -t, --trust <keyid(s)> Set the trust level of the given keyids")" echo "$(gettext " -u, --updatedb Update the trustdb of pacman")" echo "$(gettext " -V, --version Show program version")" echo "$(gettext " --adv <params> Use pacman's keyring with advanced gpg commands")" printf "$(gettext " --reload Reload the default keys")" echo } version() { printf "pacman-key (pacman) %s\n" "${myver}" printf "$(gettext "\ Copyright (c) 2010-2011 Pacman Development Team <pacman-dev@archlinux.org>.\n\ This is free software; see the source for copying conditions.\n\ There is NO WARRANTY, to the extent permitted by law.\n")" } # Read provided file and search for values matching the given key # The contents of the file are expected to be in this format: key = value # 'key', 'equal sign' and 'value' can be surrounded by random whitespace # Usage: get_from "$file" "$key" # returns the value for the first matching key in the file get_from() { while read key _ value; do if [[ $key = $2 ]]; then echo "$value" break fi done < "$1" } reload_keyring() { local PACMAN_SHARE_DIR='@prefix@/share/pacman' local GPG_NOKEYRING="gpg --batch --quiet --ignore-time-conflict --no-options --no-default-keyring --homedir ${PACMAN_KEYRING_DIR}" # Variable used for iterating on keyrings local key local key_id # Keyring with keys to be added to the keyring local ADDED_KEYS="${PACMAN_SHARE_DIR}/addedkeys.gpg" # Keyring with keys that were deprecated and will eventually be deleted local DEPRECATED_KEYS="${PACMAN_SHARE_DIR}/deprecatedkeys.gpg" # List of keys removed from the keyring. This file is not a keyring, unlike the others. # It is a textual list of values that gpg recogniezes as identifiers for keys. local REMOVED_KEYS="${PACMAN_SHARE_DIR}/removedkeys" # Verify signatures of related files, if they exist if [[ -r "${ADDED_KEYS}" ]]; then msg "$(gettext "Verifying official keys file signature...")" if ! ${GPG_PACMAN} --quiet --batch --verify "${ADDED_KEYS}.sig" 1>/dev/null; then error "$(gettext "The signature of file %s is not valid.")" "${ADDED_KEYS}" exit 1 fi fi if [[ -r "${DEPRECATED_KEYS}" ]]; then msg "$(gettext "Verifying deprecated keys file signature...")" if ! ${GPG_PACMAN} --quiet --batch --verify "${DEPRECATED_KEYS}.sig" 1>/dev/null; then error "$(gettext "The signature of file %s is not valid.")" "${DEPRECATED_KEYS}" exit 1 fi fi if [[ -r "${REMOVED_KEYS}" ]]; then msg "$(gettext "Verifying deleted keys file signature...")" if ! ${GPG_PACMAN} --quiet --batch --verify "${REMOVED_KEYS}.sig"; then error "$(gettext "The signature of file %s is not valid.")" "${REMOVED_KEYS}" exit 1 fi fi # Read the key ids to an array. The conversion from whatever is inside the file # to key ids is important, because key ids are the only guarantee of identification # for the keys. local -A removed_ids if [[ -r "${REMOVED_KEYS}" ]]; then while read key; do local key_values name key_values=$(${GPG_PACMAN} --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5,10 --output-delimiter=' ') if [[ -n $key_values ]]; then # The first word is the key_id key_id=${key_values%% *} # the rest if the name of the owner name=${key_values#* } if [[ -n ${key_id} ]]; then # Mark this key to be deleted removed_ids[$key_id]="$name" fi fi done < "${REMOVED_KEYS}" fi # List of keys that must be kept installed, even if in the list of keys to be removed local HOLD_KEYS=$(get_from "$CONFIG" "HoldKeys") # Remove the keys that must be kept from the set of keys that should be removed if [[ -n ${HOLD_KEYS} ]]; then for key in ${HOLD_KEYS}; do key_id=$(${GPG_PACMAN} --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5) if [[ -n "${removed_ids[$key_id]}" ]]; then unset removed_ids[$key_id] fi done fi # Add keys from the current set of keys from pacman-keyring package. The web of trust will # be updated automatically. if [[ -r "${ADDED_KEYS}" ]]; then msg "$(gettext "Appending official keys...")" local add_keys=$(${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5) for key_id in ${add_keys}; do # There is no point in adding a key that will be deleted right after if [[ -z "${removed_ids[$key_id]}" ]]; then ${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --export "${key_id}" | ${GPG_PACMAN} --import fi done fi if [[ -r "${DEPRECATED_KEYS}" ]]; then msg "$(gettext "Appending deprecated keys...")" local add_keys=$(${GPG_NOKEYRING} --keyring "${DEPRECATED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5) for key_id in ${add_keys}; do # There is no point in adding a key that will be deleted right after if [[ -z "${removed_ids[$key_id]}" ]]; then ${GPG_NOKEYRING} --keyring "${DEPRECATED_KEYS}" --export "${key_id}" | ${GPG_PACMAN} --import fi done fi # Remove the keys not marked to keep if (( ${#removed_ids[@]} > 0 )); then msg "$(gettext "Removing deleted keys from keyring...")" for key_id in "${!removed_ids[@]}"; do echo " removing key $key_id - ${removed_ids[$key_id]}" ${GPG_PACMAN} --quiet --batch --yes --delete-key "${key_id}" done fi # Update trustdb, just to be sure msg "$(gettext "Updating trust database...")" ${GPG_PACMAN} --batch --check-trustdb } # PROGRAM START if ! type gettext &>/dev/null; then gettext() { echo "$@" } fi if [[ $1 != "--version" && $1 != "-V" && $1 != "--help" && $1 != "-h" && $1 != "" ]]; then if type -p gpg >/dev/null 2>&1 = 1; then error "$(gettext "gnupg does not seem to be installed.")" msg2 "$(gettext "pacman-key requires gnupg for most operations.")" exit 1 elif (( EUID != 0 )); then error "$(gettext "pacman-key needs to be run as root.")" exit 1 fi fi # Parse global options CONFIG="@sysconfdir@/pacman.conf" PACMAN_KEYRING_DIR="@sysconfdir@/pacman.d/gnupg" while [[ $1 =~ ^--(config|gpgdir)$ ]]; do case "$1" in --config) shift; CONFIG="$1" ;; --gpgdir) shift; PACMAN_KEYRING_DIR="$1" ;; esac shift done if [[ ! -r "${CONFIG}" ]]; then error "$(gettext "%s not found.")" "$CONFIG" exit 1 fi # Read GPGDIR from $CONFIG. if [[ GPGDIR=$(get_from "$CONFIG" "GPGDir") == 0 ]]; then PACMAN_KEYRING_DIR="${GPGDIR}" fi GPG_PACMAN="gpg --homedir ${PACMAN_KEYRING_DIR} --no-permission-warning" # Try to create $PACMAN_KEYRING_DIR if non-existent # Check for simple existence rather than for a directory as someone may want # to use a symlink here [[ -e ${PACMAN_KEYRING_DIR} ]] || mkdir -p -m 755 "${PACMAN_KEYRING_DIR}" # Parse and execute command command="$1" if [[ -z "${command}" ]]; then usage exit 1 fi shift case "${command}" in -a|--add) # If there is no extra parameter, gpg will read stdin ${GPG_PACMAN} --quiet --batch --import "$@" ;; -d|--del) if (( $# == 0 )); then error "$(gettext "You need to specify at least one key identifier")" exit 1 fi ${GPG_PACMAN} --quiet --batch --delete-key --yes "$@" ;; -u|--updatedb) ${GPG_PACMAN} --batch --check-trustdb ;; --reload) reload_keyring ;; -l|--list) ${GPG_PACMAN} --batch --list-sigs "$@" ;; -f|--finger) ${GPG_PACMAN} --batch --fingerprint "$@" ;; -e|--export) ${GPG_PACMAN} --armor --export "$@" ;; -r|--receive) if (( $# < 2 )); then error "$(gettext "You need to specify the keyserver and at least one key identifier")" exit 1 fi keyserver="$1" shift ${GPG_PACMAN} --keyserver "${keyserver}" --recv-keys "$@" ;; -t|--trust) if (( $# == 0 )); then error "$(gettext "You need to specify at least one key identifier")" exit 1 fi while (( $# > 0 )); do # Verify if the key exists in pacman's keyring if ${GPG_PACMAN} --list-keys "$1" > /dev/null 2>&1; then ${GPG_PACMAN} --edit-key "$1" else error "$(gettext "The key identified by %s doesn't exist")" "$1" exit 1 fi shift done ;; --adv) msg "$(gettext "Executing: %s ")$*" "${GPG_PACMAN}" ${GPG_PACMAN} "$@" || ret=$? exit $ret ;; -h|--help) usage; exit 0 ;; -V|--version) version; exit 0 ;; *) error "$(gettext "Unknown command:") $command" usage; exit 1 ;; esac