scripts/pacman-key.sh.in

   1 #!@BASH_SHELL@ -e
   2 #
   3 #   pacman-key - manages pacman's keyring
   4 #                Based on apt-key, from Debian
   5 #   @configure_input@
   6 #
   7 #   Copyright (c) 2010 - Pacman Development Team <pacman-dev@archlinux.org>
   8 #
   9 #   This program is free software; you can redistribute it and/or modify
  10 #   it under the terms of the GNU General Public License as published by
  11 #   the Free Software Foundation; either version 2 of the License, or
  12 #   (at your option) any later version.
  13 #
  14 #   This program is distributed in the hope that it will be useful,
  15 #   but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 #   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17 #   GNU General Public License for more details.
  18 #
  19 #   You should have received a copy of the GNU General Public License
  20 #   along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 #
  22
  23 # gettext initialization
  24 export TEXTDOMAIN='pacman'
  25 export TEXTDOMAINDIR='@localedir@'
  26
  27 myver="@PACKAGE_VERSION@"
  28
  29 msg() {
  30         local mesg=$1; shift
  31         printf "==> ${mesg}\n" "$@" >&1
  32 }
  33
  34 msg2() {
  35         (( QUIET )) && return
  36         local mesg=$1; shift
  37         printf "  -> ${mesg}\n" "$@" >&1
  38 }
  39
  40 warning() {
  41         local mesg=$1; shift
  42         printf "==> $(gettext "WARNING:") ${mesg}\n" "$@" >&2
  43 }
  44
  45 error() {
  46         local mesg=$1; shift
  47         printf "==> $(gettext "ERROR:") ${mesg}\n" "$@" >&2
  48 }
  49
  50 usage() {
  51         printf "pacman-key (pacman) %s\n" ${myver}
  52         echo
  53         printf "$(gettext "Usage: %s [options] <command> [arguments]")\n" $(basename $0)
  54         echo
  55         echo "$(gettext "Manage pacman's list of trusted keys")"
  56         echo
  57         echo "$(gettext "Options must be placed before commands. The available options are:")"
  58         printf "$(gettext "  --config <file>  Use an alternate config file (instead of '%s')")\n" "$CONFIG"
  59         echo "$(gettext "  --gpgdir         Set an alternate directory for gnupg")"
  60         echo
  61         echo "$(gettext "The available commands are:")"
  62         echo "$(gettext "  -a, --add [<file(s)>]     Add the specified keys (empty for stdin)")"
  63         echo "$(gettext "  -d, --del <keyid(s)>      Remove the specified keyids")"
  64         echo "$(gettext "  -e, --export <keyid(s)>   Export the specified keyids")"
  65         echo "$(gettext "  -f, --finger [<keyid(s)>] List fingerprint for specified or all keyids")"
  66         echo "$(gettext "  -h, --help                Show this help message and exit")"
  67         echo "$(gettext "  -l, --list                List keys")"
  68         echo "$(gettext "  -r, --receive <keyserver> <keyid(s)> Fetch the specified keyids")"
  69         echo "$(gettext "  -t, --trust <keyid(s)>    Set the trust level of the given keyids")"
  70         echo "$(gettext "  -u, --updatedb            Update the trustdb of pacman")"
  71         echo "$(gettext "  -V, --version             Show program version")"
  72         echo "$(gettext "  --adv <params>            Use pacman's keyring with advanced gpg commands")"
  73         printf "$(gettext "  --reload                  Reload the default keys")"
  74         echo
  75 }
  76
  77 version() {
  78         printf "pacman-key (pacman) %s\n" "${myver}"
  79         printf "$(gettext "\
  80 Copyright (c) 2010-2011 Pacman Development Team <pacman-dev@archlinux.org>.\n\
  81 This is free software; see the source for copying conditions.\n\
  82 There is NO WARRANTY, to the extent permitted by law.\n")"
  83 }
  84
  85 # Read provided file and search for values matching the given key
  86 # The contents of the file are expected to be in this format: key = value
  87 # 'key', 'equal sign' and 'value' can be surrounded by random whitespace
  88 # Usage: get_from "$file" "$key" # returns the value for the first matching key in the file
  89 get_from() {
  90     while read key _ value; do
  91         if [[ $key = $2 ]]; then
  92             echo "$value"
  93             break
  94         fi
  95     done < "$1"
  96 }
  97
  98 reload_keyring() {
  99         local PACMAN_SHARE_DIR='@prefix@/share/pacman'
 100         local GPG_NOKEYRING="gpg --batch --quiet --ignore-time-conflict --no-options --no-default-keyring --homedir ${PACMAN_KEYRING_DIR}"
 101
 102         # Variable used for iterating on keyrings
 103         local key
 104         local key_id
 105
 106         # Keyring with keys to be added to the keyring
 107         local ADDED_KEYS="${PACMAN_SHARE_DIR}/addedkeys.gpg"
 108
 109         # Keyring with keys that were deprecated and will eventually be deleted
 110         local DEPRECATED_KEYS="${PACMAN_SHARE_DIR}/deprecatedkeys.gpg"
 111
 112         # List of keys removed from the keyring. This file is not a keyring, unlike the others.
 113         # It is a textual list of values that gpg recogniezes as identifiers for keys.
 114         local REMOVED_KEYS="${PACMAN_SHARE_DIR}/removedkeys"
 115
 116         # Verify signatures of related files, if they exist
 117         if [[ -r "${ADDED_KEYS}" ]]; then
 118                 msg "$(gettext "Verifying official keys file signature...")"
 119                 if ! ${GPG_PACMAN} --quiet --batch --verify "${ADDED_KEYS}.sig" 1>/dev/null; then
 120                         error "$(gettext "The signature of file %s is not valid.")" "${ADDED_KEYS}"
 121                         exit 1
 122                 fi
 123         fi
 124
 125         if [[ -r "${DEPRECATED_KEYS}" ]]; then
 126                 msg "$(gettext "Verifying deprecated keys file signature...")"
 127                 if ! ${GPG_PACMAN} --quiet --batch --verify "${DEPRECATED_KEYS}.sig" 1>/dev/null; then
 128                         error "$(gettext "The signature of file %s is not valid.")" "${DEPRECATED_KEYS}"
 129                         exit 1
 130                 fi
 131         fi
 132
 133         if [[ -r "${REMOVED_KEYS}" ]]; then
 134                 msg "$(gettext "Verifying deleted keys file signature...")"
 135                 if ! ${GPG_PACMAN} --quiet --batch --verify "${REMOVED_KEYS}.sig"; then
 136                         error "$(gettext "The signature of file %s is not valid.")" "${REMOVED_KEYS}"
 137                         exit 1
 138                 fi
 139         fi
 140
 141         # Read the key ids to an array. The conversion from whatever is inside the file
 142         # to key ids is important, because key ids are the only guarantee of identification
 143         # for the keys.
 144         local -A removed_ids
 145         if [[ -r "${REMOVED_KEYS}" ]]; then
 146                 while read key; do
 147                         local key_values name
 148                         key_values=$(${GPG_PACMAN} --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5,10 --output-delimiter=' ')
 149                         if [[ -n $key_values ]]; then
 150                                 # The first word is the key_id
 151                                 key_id=${key_values%% *}
 152                                 # the rest if the name of the owner
 153                                 name=${key_values#* }
 154                                 if [[ -n ${key_id} ]]; then
 155                                         # Mark this key to be deleted
 156                                         removed_ids[$key_id]="$name"
 157                                 fi
 158                         fi
 159                 done < "${REMOVED_KEYS}"
 160         fi
 161
 162         # List of keys that must be kept installed, even if in the list of keys to be removed
 163         local HOLD_KEYS=$(get_from "$CONFIG" "HoldKeys")
 164
 165         # Remove the keys that must be kept from the set of keys that should be removed
 166         if [[ -n ${HOLD_KEYS} ]]; then
 167                 for key in ${HOLD_KEYS}; do
 168                         key_id=$(${GPG_PACMAN} --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5)
 169                         if [[ -n "${removed_ids[$key_id]}" ]]; then
 170                                 unset removed_ids[$key_id]
 171                         fi
 172                 done
 173         fi
 174
 175         # Add keys from the current set of keys from pacman-keyring package. The web of trust will
 176         # be updated automatically.
 177         if [[ -r "${ADDED_KEYS}" ]]; then
 178                 msg "$(gettext "Appending official keys...")"
 179                 local add_keys=$(${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5)
 180                 for key_id in ${add_keys}; do
 181                         # There is no point in adding a key that will be deleted right after
 182                         if [[ -z "${removed_ids[$key_id]}" ]]; then
 183                                 ${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --export "${key_id}" | ${GPG_PACMAN} --import
 184                         fi
 185                 done
 186         fi
 187
 188         if [[ -r "${DEPRECATED_KEYS}" ]]; then
 189                 msg "$(gettext "Appending deprecated keys...")"
 190                 local add_keys=$(${GPG_NOKEYRING} --keyring "${DEPRECATED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5)
 191                 for key_id in ${add_keys}; do
 192                         # There is no point in adding a key that will be deleted right after
 193                         if [[ -z "${removed_ids[$key_id]}" ]]; then
 194                                 ${GPG_NOKEYRING} --keyring "${DEPRECATED_KEYS}" --export "${key_id}" | ${GPG_PACMAN} --import
 195                         fi
 196                 done
 197         fi
 198
 199         # Remove the keys not marked to keep
 200         if (( ${#removed_ids[@]} > 0 )); then
 201                 msg "$(gettext "Removing deleted keys from keyring...")"
 202                 for key_id in "${!removed_ids[@]}"; do
 203                         echo "  removing key $key_id - ${removed_ids[$key_id]}"
 204                         ${GPG_PACMAN} --quiet --batch --yes --delete-key "${key_id}"
 205                 done
 206         fi
 207
 208         # Update trustdb, just to be sure
 209         msg "$(gettext "Updating trust database...")"
 210         ${GPG_PACMAN} --batch --check-trustdb
 211 }
 212
 213 # PROGRAM START
 214 if ! type gettext &>/dev/null; then
 215         gettext() {
 216                 echo "$@"
 217         }
 218 fi
 219
 220 if [[ $1 != "--version" && $1 != "-V" && $1 != "--help" && $1 != "-h" && $1 != "" ]]; then
 221         if type -p gpg >/dev/null 2>&1 = 1; then
 222                 error "$(gettext "gnupg does not seem to be installed.")"
 223                 msg2 "$(gettext "pacman-key requires gnupg for most operations.")"
 224                 exit 1
 225         elif (( EUID != 0 )); then
 226                 error "$(gettext "pacman-key needs to be run as root.")"
 227                 exit 1
 228         fi
 229 fi
 230
 231 # Parse global options
 232 CONFIG="@sysconfdir@/pacman.conf"
 233 PACMAN_KEYRING_DIR="@sysconfdir@/pacman.d/gnupg"
 234 while [[ $1 =~ ^--(config|gpgdir)$ ]]; do
 235         case "$1" in
 236                 --config) shift; CONFIG="$1" ;;
 237                 --gpgdir) shift; PACMAN_KEYRING_DIR="$1" ;;
 238         esac
 239         shift
 240 done
 241
 242 if [[ ! -r "${CONFIG}" ]]; then
 243         error "$(gettext "%s not found.")" "$CONFIG"
 244         exit 1
 245 fi
 246
 247 # Read GPGDIR from $CONFIG.
 248 if [[ GPGDIR=$(get_from "$CONFIG" "GPGDir") == 0 ]]; then
 249         PACMAN_KEYRING_DIR="${GPGDIR}"
 250 fi
 251 GPG_PACMAN="gpg --homedir ${PACMAN_KEYRING_DIR} --no-permission-warning"
 252
 253 # Try to create $PACMAN_KEYRING_DIR if non-existent
 254 # Check for simple existence rather than for a directory as someone may want
 255 # to use a symlink here
 256 [[ -e ${PACMAN_KEYRING_DIR} ]] || mkdir -p -m 755 "${PACMAN_KEYRING_DIR}"
 257
 258 # Parse and execute command
 259 command="$1"
 260 if [[ -z "${command}" ]]; then
 261         usage
 262         exit 1
 263 fi
 264 shift
 265
 266 case "${command}" in
 267         -a|--add)
 268                 # If there is no extra parameter, gpg will read stdin
 269                 ${GPG_PACMAN} --quiet --batch --import "$@"
 270                 ;;
 271         -d|--del)
 272                 if (( $# == 0 )); then
 273                         error "$(gettext "You need to specify at least one key identifier")"
 274                         exit 1
 275                 fi
 276                 ${GPG_PACMAN} --quiet --batch --delete-key --yes "$@"
 277                 ;;
 278         -u|--updatedb)
 279                 ${GPG_PACMAN} --batch --check-trustdb
 280                 ;;
 281         --reload)
 282                 reload_keyring
 283                 ;;
 284         -l|--list)
 285                 ${GPG_PACMAN} --batch --list-sigs "$@"
 286                 ;;
 287         -f|--finger)
 288                 ${GPG_PACMAN} --batch --fingerprint "$@"
 289                 ;;
 290         -e|--export)
 291                 ${GPG_PACMAN} --armor --export "$@"
 292                 ;;
 293         -r|--receive)
 294                 if (( $# < 2 )); then
 295                         error "$(gettext "You need to specify the keyserver and at least one key identifier")"
 296                         exit 1
 297                 fi
 298                 keyserver="$1"
 299                 shift
 300                 ${GPG_PACMAN} --keyserver "${keyserver}" --recv-keys "$@"
 301                 ;;
 302         -t|--trust)
 303                 if (( $# == 0 )); then
 304                         error "$(gettext "You need to specify at least one key identifier")"
 305                         exit 1
 306                 fi
 307                 while (( $# > 0 )); do
 308                         # Verify if the key exists in pacman's keyring
 309                         if ${GPG_PACMAN} --list-keys "$1" > /dev/null 2>&1; then
 310                                 ${GPG_PACMAN} --edit-key "$1"
 311                         else
 312                                 error "$(gettext "The key identified by %s doesn't exist")" "$1"
 313                                 exit 1
 314                         fi
 315                         shift
 316                 done
 317                 ;;
 318         --adv)
 319                 msg "$(gettext "Executing: %s ")$*" "${GPG_PACMAN}"
 320                 ${GPG_PACMAN} "$@" || ret=$?
 321                 exit $ret
 322                 ;;
 323         -h|--help)
 324                 usage; exit 0 ;;
 325         -V|--version)
 326                 version; exit 0 ;;
 327         *)
 328                 error "$(gettext "Unknown command:") $command"
 329                 usage; exit 1 ;;
 330 esac