scripts/pacman-key.sh.in

   1 #!@BASH_SHELL@ -e
   2 #
   3 #   pacman-key - manages pacman's keyring
   4 #                Based on apt-key, from Debian
   5 #   @configure_input@
   6 #
   7 #   Copyright (c) 2010-2011 Pacman Development Team <pacman-dev@archlinux.org>
   8 #
   9 #   This program is free software; you can redistribute it and/or modify
  10 #   it under the terms of the GNU General Public License as published by
  11 #   the Free Software Foundation; either version 2 of the License, or
  12 #   (at your option) any later version.
  13 #
  14 #   This program is distributed in the hope that it will be useful,
  15 #   but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 #   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17 #   GNU General Public License for more details.
  18 #
  19 #   You should have received a copy of the GNU General Public License
  20 #   along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 #
  22
  23 # gettext initialization
  24 export TEXTDOMAIN='pacman'
  25 export TEXTDOMAINDIR='@localedir@'
  26
  27 myver="@PACKAGE_VERSION@"
  28
  29 m4_include(library/output_format.sh)
  30
  31 usage() {
  32         printf "pacman-key (pacman) %s\n" ${myver}
  33         echo
  34         printf "$(gettext "Usage: %s [options] <command> [arguments]")\n" $(basename $0)
  35         echo
  36         echo "$(gettext "Manage pacman's list of trusted keys")"
  37         echo
  38         echo "$(gettext "Options must be placed before commands. The available options are:")"
  39         printf "$(gettext "  --config <file>  Use an alternate config file (instead of '%s')")\n" "$CONFIG"
  40         printf "$(gettext "  --gpgdir         Set an alternate directory for gnupg (instead of '%s')")\n" "$PACMAN_KEYRING_DIR"
  41         echo
  42         echo "$(gettext "The available commands are:")"
  43         echo "$(gettext "  -a, --add [<file(s)>]     Add the specified keys (empty for stdin)")"
  44         echo "$(gettext "  -d, --del <keyid(s)>      Remove the specified keyids")"
  45         echo "$(gettext "  -e, --export <keyid(s)>   Export the specified keyids")"
  46         echo "$(gettext "  -f, --finger [<keyid(s)>] List fingerprint for specified or all keyids")"
  47         echo "$(gettext "  -h, --help                Show this help message and exit")"
  48         echo "$(gettext "  -l, --list                List keys")"
  49         echo "$(gettext "  -r, --receive <keyserver> <keyid(s)> Fetch the specified keyids")"
  50         echo "$(gettext "  -t, --trust <keyid(s)>    Set the trust level of the given keyids")"
  51         echo "$(gettext "  -u, --updatedb            Update the trustdb of pacman")"
  52         echo "$(gettext "  -V, --version             Show program version")"
  53         echo "$(gettext "  --adv <params>            Use pacman's keyring with advanced gpg commands")"
  54         printf "$(gettext "  --reload                  Reload the default keys")"
  55         echo
  56 }
  57
  58 version() {
  59         printf "pacman-key (pacman) %s\n" "${myver}"
  60         printf "$(gettext "\
  61 Copyright (c) 2010-2011 Pacman Development Team <pacman-dev@archlinux.org>.\n\
  62 This is free software; see the source for copying conditions.\n\
  63 There is NO WARRANTY, to the extent permitted by law.\n")"
  64 }
  65
  66 # Read provided file and search for values matching the given key
  67 # The contents of the file are expected to be in this format: key = value
  68 # 'key', 'equal sign' and 'value' can be surrounded by random whitespace
  69 # Usage: get_from "$file" "$key" # returns the value for the first matching key in the file
  70 get_from() {
  71         while read key _ value; do
  72                 if [[ $key = $2 ]]; then
  73                         echo "$value"
  74                         break
  75                 fi
  76         done < "$1"
  77 }
  78
  79 reload_keyring() {
  80         local PACMAN_SHARE_DIR='@prefix@/share/pacman'
  81         local GPG_NOKEYRING="gpg --batch --quiet --ignore-time-conflict --no-options --no-default-keyring --homedir ${PACMAN_KEYRING_DIR}"
  82
  83         # Variable used for iterating on keyrings
  84         local key
  85         local key_id
  86
  87         # Keyring with keys to be added to the keyring
  88         local ADDED_KEYS="${PACMAN_SHARE_DIR}/addedkeys.gpg"
  89
  90         # Keyring with keys that were deprecated and will eventually be deleted
  91         local DEPRECATED_KEYS="${PACMAN_SHARE_DIR}/deprecatedkeys.gpg"
  92
  93         # List of keys removed from the keyring. This file is not a keyring, unlike the others.
  94         # It is a textual list of values that gpg recogniezes as identifiers for keys.
  95         local REMOVED_KEYS="${PACMAN_SHARE_DIR}/removedkeys"
  96
  97         # Verify signatures of related files, if they exist
  98         if [[ -r "${ADDED_KEYS}" ]]; then
  99                 msg "$(gettext "Verifying official keys file signature...")"
 100                 if ! ${GPG_PACMAN} --quiet --batch --verify "${ADDED_KEYS}.sig" 1>/dev/null; then
 101                         error "$(gettext "The signature of file %s is not valid.")" "${ADDED_KEYS}"
 102                         exit 1
 103                 fi
 104         fi
 105
 106         if [[ -r "${DEPRECATED_KEYS}" ]]; then
 107                 msg "$(gettext "Verifying deprecated keys file signature...")"
 108                 if ! ${GPG_PACMAN} --quiet --batch --verify "${DEPRECATED_KEYS}.sig" 1>/dev/null; then
 109                         error "$(gettext "The signature of file %s is not valid.")" "${DEPRECATED_KEYS}"
 110                         exit 1
 111                 fi
 112         fi
 113
 114         if [[ -r "${REMOVED_KEYS}" ]]; then
 115                 msg "$(gettext "Verifying deleted keys file signature...")"
 116                 if ! ${GPG_PACMAN} --quiet --batch --verify "${REMOVED_KEYS}.sig"; then
 117                         error "$(gettext "The signature of file %s is not valid.")" "${REMOVED_KEYS}"
 118                         exit 1
 119                 fi
 120         fi
 121
 122         # Read the key ids to an array. The conversion from whatever is inside the file
 123         # to key ids is important, because key ids are the only guarantee of identification
 124         # for the keys.
 125         local -A removed_ids
 126         if [[ -r "${REMOVED_KEYS}" ]]; then
 127                 while read key; do
 128                         local key_values name
 129                         key_values=$(${GPG_PACMAN} --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5,10 --output-delimiter=' ')
 130                         if [[ -n $key_values ]]; then
 131                                 # The first word is the key_id
 132                                 key_id=${key_values%% *}
 133                                 # the rest if the name of the owner
 134                                 name=${key_values#* }
 135                                 if [[ -n ${key_id} ]]; then
 136                                         # Mark this key to be deleted
 137                                         removed_ids[$key_id]="$name"
 138                                 fi
 139                         fi
 140                 done < "${REMOVED_KEYS}"
 141         fi
 142
 143         # List of keys that must be kept installed, even if in the list of keys to be removed
 144         local HOLD_KEYS=$(get_from "$CONFIG" "HoldKeys")
 145
 146         # Remove the keys that must be kept from the set of keys that should be removed
 147         if [[ -n ${HOLD_KEYS} ]]; then
 148                 for key in ${HOLD_KEYS}; do
 149                         key_id=$(${GPG_PACMAN} --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5)
 150                         if [[ -n "${removed_ids[$key_id]}" ]]; then
 151                                 unset removed_ids[$key_id]
 152                         fi
 153                 done
 154         fi
 155
 156         # Add keys from the current set of keys from pacman-keyring package. The web of trust will
 157         # be updated automatically.
 158         if [[ -r "${ADDED_KEYS}" ]]; then
 159                 msg "$(gettext "Appending official keys...")"
 160                 local add_keys=$(${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5)
 161                 for key_id in ${add_keys}; do
 162                         # There is no point in adding a key that will be deleted right after
 163                         if [[ -z "${removed_ids[$key_id]}" ]]; then
 164                                 ${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --export "${key_id}" | ${GPG_PACMAN} --import
 165                         fi
 166                 done
 167         fi
 168
 169         if [[ -r "${DEPRECATED_KEYS}" ]]; then
 170                 msg "$(gettext "Appending deprecated keys...")"
 171                 local add_keys=$(${GPG_NOKEYRING} --keyring "${DEPRECATED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5)
 172                 for key_id in ${add_keys}; do
 173                         # There is no point in adding a key that will be deleted right after
 174                         if [[ -z "${removed_ids[$key_id]}" ]]; then
 175                                 ${GPG_NOKEYRING} --keyring "${DEPRECATED_KEYS}" --export "${key_id}" | ${GPG_PACMAN} --import
 176                         fi
 177                 done
 178         fi
 179
 180         # Remove the keys not marked to keep
 181         if (( ${#removed_ids[@]} > 0 )); then
 182                 msg "$(gettext "Removing deleted keys from keyring...")"
 183                 for key_id in "${!removed_ids[@]}"; do
 184                         echo "  removing key $key_id - ${removed_ids[$key_id]}"
 185                         ${GPG_PACMAN} --quiet --batch --yes --delete-key "${key_id}"
 186                 done
 187         fi
 188
 189         # Update trustdb, just to be sure
 190         msg "$(gettext "Updating trust database...")"
 191         ${GPG_PACMAN} --batch --check-trustdb
 192 }
 193
 194 # PROGRAM START
 195 if ! type gettext &>/dev/null; then
 196         gettext() {
 197                 echo "$@"
 198         }
 199 fi
 200
 201 if [[ $1 != "--version" && $1 != "-V" && $1 != "--help" && $1 != "-h" && $1 != "" ]]; then
 202         if type -p gpg >/dev/null 2>&1 = 1; then
 203                 error "$(gettext "gnupg does not seem to be installed.")"
 204                 msg2 "$(gettext "pacman-key requires gnupg for most operations.")"
 205                 exit 1
 206         elif (( EUID != 0 )); then
 207                 error "$(gettext "pacman-key needs to be run as root.")"
 208                 exit 1
 209         fi
 210 fi
 211
 212 # Parse global options
 213 CONFIG="@sysconfdir@/pacman.conf"
 214 PACMAN_KEYRING_DIR="@sysconfdir@/pacman.d/gnupg"
 215 while [[ $1 =~ ^--(config|gpgdir)$ ]]; do
 216         case "$1" in
 217                 --config) shift; CONFIG="$1" ;;
 218                 --gpgdir) shift; PACMAN_KEYRING_DIR="$1" ;;
 219         esac
 220         shift
 221 done
 222
 223 if [[ ! -r "${CONFIG}" ]]; then
 224         error "$(gettext "%s not found.")" "$CONFIG"
 225         exit 1
 226 fi
 227
 228 # Read GPGDIR from $CONFIG.
 229 if [[ GPGDIR=$(get_from "$CONFIG" "GPGDir") == 0 ]]; then
 230         PACMAN_KEYRING_DIR="${GPGDIR}"
 231 fi
 232 GPG_PACMAN="gpg --homedir ${PACMAN_KEYRING_DIR} --no-permission-warning"
 233
 234 # Try to create $PACMAN_KEYRING_DIR if non-existent
 235 # Check for simple existence rather than for a directory as someone may want
 236 # to use a symlink here
 237 [[ -e ${PACMAN_KEYRING_DIR} ]] || mkdir -p -m 755 "${PACMAN_KEYRING_DIR}"
 238
 239 # Parse and execute command
 240 command="$1"
 241 if [[ -z "${command}" ]]; then
 242         usage
 243         exit 1
 244 fi
 245 shift
 246
 247 case "${command}" in
 248         -a|--add)
 249                 # If there is no extra parameter, gpg will read stdin
 250                 ${GPG_PACMAN} --quiet --batch --import "$@"
 251                 ;;
 252         -d|--del)
 253                 if (( $# == 0 )); then
 254                         error "$(gettext "You need to specify at least one key identifier")"
 255                         exit 1
 256                 fi
 257                 ${GPG_PACMAN} --quiet --batch --delete-key --yes "$@"
 258                 ;;
 259         -u|--updatedb)
 260                 ${GPG_PACMAN} --batch --check-trustdb
 261                 ;;
 262         --reload)
 263                 reload_keyring
 264                 ;;
 265         -l|--list)
 266                 ${GPG_PACMAN} --batch --list-sigs "$@"
 267                 ;;
 268         -f|--finger)
 269                 ${GPG_PACMAN} --batch --fingerprint "$@"
 270                 ;;
 271         -e|--export)
 272                 ${GPG_PACMAN} --armor --export "$@"
 273                 ;;
 274         -r|--receive)
 275                 if (( $# < 2 )); then
 276                         error "$(gettext "You need to specify the keyserver and at least one key identifier")"
 277                         exit 1
 278                 fi
 279                 keyserver="$1"
 280                 shift
 281                 ${GPG_PACMAN} --keyserver "${keyserver}" --recv-keys "$@"
 282                 ;;
 283         -t|--trust)
 284                 if (( $# == 0 )); then
 285                         error "$(gettext "You need to specify at least one key identifier")"
 286                         exit 1
 287                 fi
 288                 while (( $# > 0 )); do
 289                         # Verify if the key exists in pacman's keyring
 290                         if ${GPG_PACMAN} --list-keys "$1" > /dev/null 2>&1; then
 291                                 ${GPG_PACMAN} --edit-key "$1"
 292                         else
 293                                 error "$(gettext "The key identified by %s doesn't exist")" "$1"
 294                                 exit 1
 295                         fi
 296                         shift
 297                 done
 298                 ;;
 299         --adv)
 300                 msg "$(gettext "Executing: %s ")$*" "${GPG_PACMAN}"
 301                 ${GPG_PACMAN} "$@" || ret=$?
 302                 exit $ret
 303                 ;;
 304         -h|--help)
 305                 usage; exit 0 ;;
 306         -V|--version)
 307                 version; exit 0 ;;
 308         *)
 309                 error "$(gettext "Unknown command:") $command"
 310                 usage; exit 1 ;;
 311 esac
 312
 313 # vim: set ts=2 sw=2 noet: