scripts/pacman-key.sh.in

   1 #!/bin/bash -e
   2 #
   3 #   pacman-key - manages pacman's keyring
   4 #                Based on apt-key, from Debian
   5 #   @configure_input@
   6 #
   7 #   Copyright (c) 2010-2011 Pacman Development Team <pacman-dev@archlinux.org>
   8 #
   9 #   This program is free software; you can redistribute it and/or modify
  10 #   it under the terms of the GNU General Public License as published by
  11 #   the Free Software Foundation; either version 2 of the License, or
  12 #   (at your option) any later version.
  13 #
  14 #   This program is distributed in the hope that it will be useful,
  15 #   but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 #   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17 #   GNU General Public License for more details.
  18 #
  19 #   You should have received a copy of the GNU General Public License
  20 #   along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 #
  22
  23 # gettext initialization
  24 export TEXTDOMAIN='pacman-scripts'
  25 export TEXTDOMAINDIR='@localedir@'
  26
  27 myver="@PACKAGE_VERSION@"
  28
  29 # Options
  30 ADD=0
  31 DELETE=0
  32 EDITKEY=0
  33 EXPORT=0
  34 FINGER=0
  35 IMPORT=0
  36 IMPORT_TRUSTDB=0
  37 INIT=0
  38 KEYSERVER=''
  39 LISTKEYS=0
  40 LISTSIGS=0
  41 LSIGNKEY=0
  42 POPULATE=0
  43 RECEIVE=0
  44 REFRESH=0
  45 UPDATEDB=0
  46 VERIFY=0
  47
  48 DEFAULT_KEYSERVER='hkp://keys.gnupg.net'
  49
  50 m4_include(library/output_format.sh)
  51
  52 m4_include(library/parse_options.sh)
  53
  54 usage() {
  55         printf "pacman-key (pacman) %s\n" ${myver}
  56         echo
  57         printf "$(gettext "Usage: %s [options]")\n" $(basename $0)
  58         echo
  59         printf "$(gettext "Manage pacman\'s list of trusted keys")\n"
  60         echo
  61         echo "$(gettext "Options:")"
  62         echo "$(gettext "  -a, --add [file(s)]       Add the specified keys (empty for stdin)")"
  63         echo "$(gettext "  -d, --delete <keyid(s)>   Remove the specified keyids")"
  64         echo "$(gettext "  -e, --export [keyid(s)]   Export the specified or all keyids")"
  65         echo "$(gettext "  -f, --finger [keyid(s)]   List fingerprint for specified or all keyids")"
  66         echo "$(gettext "  -h, --help                Show this help message and exit")"
  67         echo "$(gettext "  -l, --list-keys [keyid(s)] List the specified or all keys")"
  68         echo "$(gettext "  -r, --recv-keys <keyid(s)> Fetch the specified keyids")"
  69         echo "$(gettext "  -u, --updatedb            Update the trustdb of pacman")"
  70         echo "$(gettext "  -v, --verify <signature>  Verify the file specified by the signature")"
  71         echo "$(gettext "  -V, --version             Show program version")"
  72         printf "$(gettext "  --config <file>           Use an alternate config file (instead of\n\
  73                             '%s')")\n" "@sysconfdir@/pacman.conf"
  74         echo "$(gettext "  --edit-key <keyid(s)>     Present a menu for key management task on keyids")"
  75         printf "$(gettext "  --gpgdir <dir>            Set an alternate directory for GnuPG (instead\n\
  76                             of '%s')")\n" "@sysconfdir@/pacman.d/gnupg"
  77         echo "$(gettext "  --import <dir(s)>         Imports pubring.gpg and trustdb.gpg from dir(s)")"
  78         echo "$(gettext "  --import-trustdb <dir(s)> Imports ownertrust values from trustdb.gpg in dir(s)")"
  79         echo "$(gettext "  --init                    Ensure the keyring is properly initialized")"
  80         echo "$(gettext "  --keyserver               Specify a keyserver to use if necessary")"
  81         echo "$(gettext "  --list-sigs [keyid(s)]    List keys and their signatures")"
  82         echo "$(gettext "  --lsign-key <keyid>       Locally sign the specified keyid")"
  83         printf "$(gettext "  --populate [keyring(s)] Reload the default keys from the (given) keyrings\n\
  84                             in '%s'")\n" "@pkgdatadir@/keyrings"
  85         echo "$(gettext "  --refresh-keys [keyid(s)] Update specified or all keys from a keyserver")"
  86 }
  87
  88 version() {
  89         printf "pacman-key (pacman) %s\n" "${myver}"
  90         printf "$(gettext "\
  91 Copyright (c) 2010-2011 Pacman Development Team <pacman-dev@archlinux.org>.\n\
  92 This is free software; see the source for copying conditions.\n\
  93 There is NO WARRANTY, to the extent permitted by law.\n")"
  94 }
  95
  96 # read the config file "$1" which has key=value pairs, and return the key which
  97 # matches "$2". the equals sign between pairs may be surrounded by any amount
  98 # of whitespace.
  99 get_from() {
 100         while IFS='=' read -r key value; do
 101                 [[ -z $key || ${key:0:1} = '#' ]] && continue
 102
 103                 if [[ ${key%% *} = "$2" && -n ${value##* } ]]; then
 104                         echo "${value##* }"
 105                         return 0
 106                 fi
 107         done < "$1"
 108         return 1
 109 }
 110
 111 generate_master_key() {
 112         # Generate the master key, which will be in both pubring and secring
 113         "${GPG_PACMAN[@]}" --gen-key --batch <<EOF
 114 %echo Generating pacman keychain master key...
 115 Key-Type: RSA
 116 Key-Length: 2048
 117 Key-Usage: sign
 118 Name-Real: Pacman Keychain Master Key
 119 Name-Email: pacman@localhost
 120 Expire-Date: 0
 121 %commit
 122 %echo Done
 123 EOF
 124 }
 125
 126 secret_keys_available() {
 127         "${GPG_PACMAN[@]}" -K --with-colons | wc -l
 128 }
 129
 130 # Adds the given gpg.conf option if it is not present in the file.
 131 # Note that if we find it commented out, we won't add the option.
 132 # args: $1 conffile, $2 option-name, $3 (optional) option-value
 133 add_gpg_conf_option() {
 134         local confline
 135         # looking for the option 'bare', only leading spaces or # chars allowed,
 136         # followed by at least one space and any other text or the end of line.
 137         if ! grep -q "^[[:space:]#]*$2\([[:space:]].*\)*$" "$1" &>/dev/null; then
 138                 confline="$2"
 139                 [[ -n $3 ]] && confline="$2 $3"
 140                 echo "$confline" >> "$1"
 141         fi
 142 }
 143
 144 initialize() {
 145         local conffile keyserv
 146         # Check for simple existence rather than for a directory as someone
 147         # may want to use a symlink here
 148         [[ -e ${PACMAN_KEYRING_DIR} ]] || mkdir -p -m 755 "${PACMAN_KEYRING_DIR}"
 149
 150         # keyring files
 151         [[ -f ${PACMAN_KEYRING_DIR}/pubring.gpg ]] || touch ${PACMAN_KEYRING_DIR}/pubring.gpg
 152         [[ -f ${PACMAN_KEYRING_DIR}/secring.gpg ]] || touch ${PACMAN_KEYRING_DIR}/secring.gpg
 153         [[ -f ${PACMAN_KEYRING_DIR}/trustdb.gpg ]] || "${GPG_PACMAN[@]}" --update-trustdb
 154         chmod 644 ${PACMAN_KEYRING_DIR}/{pubring,trustdb}.gpg
 155         chmod 600 ${PACMAN_KEYRING_DIR}/secring.gpg
 156
 157         # gpg.conf
 158         conffile="${PACMAN_KEYRING_DIR}/gpg.conf"
 159         [[ -f $conffile ]] || touch "$conffile"
 160         chmod 644 "$conffile"
 161         add_gpg_conf_option "$conffile" 'no-greeting'
 162         add_gpg_conf_option "$conffile" 'no-permission-warning'
 163         add_gpg_conf_option "$conffile" 'lock-never'
 164         keyserv=${KEYSERVER:-$DEFAULT_KEYSERVER}
 165         add_gpg_conf_option "$conffile" 'keyserver' "$keyserv"
 166
 167         # set up a private signing key (if none available)
 168         if [[ $(secret_keys_available) -lt 1 ]]; then
 169                 generate_master_key
 170                 UPDATEDB=1
 171         fi
 172 }
 173
 174 check_keyring() {
 175         if [[ ! -r ${PACMAN_KEYRING_DIR}/pubring.gpg || \
 176                         ! -r ${PACMAN_KEYRING_DIR}/trustdb.gpg ]]; then
 177                 error "$(gettext "You do not have sufficient permissions to read the %s keyring...")" "pacman"
 178                 msg "$(gettext "Use '%s' to correct the keyring permissions.")" "pacman-key --init"
 179                 exit 1
 180         fi
 181
 182         if (( (EXPORT || FINGER || LIST || VERIFY) && EUID != 0 )); then
 183                 if ! grep -q "^[[:space:]]*lock-never[[:space:]]*$" ${PACMAN_KEYRING_DIR}/gpg.conf &>/dev/null; then
 184                         error "$(gettext "You do not have sufficient permissions to run this command...")"
 185                         msg "$(gettext "Use '%s' to correct the keyring permissions.")" "pacman-key --init"
 186                         exit 1
 187                 fi
 188         fi
 189
 190         if (( LSIGNKEY )); then
 191                 if [[ $(secret_keys_available) -lt 1 ]]; then
 192                         error "$(gettext "There is no secret key available to sign with.")"
 193                         msg "$(gettext "Use '%s' to generate a default secret key.")" "pacman-key --init"
 194                         exit 1
 195                 fi
 196         fi
 197 }
 198
 199 verify_keyring_input() {
 200         local ret=0;
 201         local KEYRING_IMPORT_DIR='@pkgdatadir@/keyrings'
 202
 203         # Verify signatures of keyring files and association revocation files if they exist
 204         msg "$(gettext "Verifying keyring file signatures...")"
 205         local keyring
 206         for keyring in ${KEYRINGIDS[@]}; do
 207                 if ! "${GPG_PACMAN[@]}" --verify "${KEYRING_IMPORT_DIR}/${keyring}.gpg.sig" &>/dev/null; then
 208                         error "$(gettext "The signature of file %s is not valid.")" "${ADDED_KEYS}"
 209                         ret=1
 210                 fi
 211
 212                 if [[ -f "${KEYRING_IMPORT_DIR}/${keyring}-revoked" ]]; then
 213                         if ! "${GPG_PACMAN[@]}" --verify "${KEYRING_IMPORT_DIR}/${keyring}-revoked.sig" &>/dev/null; then
 214                                 error "$(gettext "The signature of file %s is not valid.")" "${KEYRING_IMPORT_DIR}/${keyring}-revoked"
 215                                 ret=1
 216                         fi
 217                 fi
 218         done
 219
 220         return $ret
 221 }
 222
 223 populate_keyring() {
 224         local KEYRING_IMPORT_DIR='@pkgdatadir@/keyrings'
 225         local GPG_NOKEYRING=(gpg --batch --quiet --ignore-time-conflict --no-options --no-default-keyring --homedir ${PACMAN_KEYRING_DIR} --no-permission-warning)
 226
 227         local keyring
 228         local ret=0
 229         if [[ -z ${KEYRINGIDS[@]} ]]; then
 230                 # get list of all available keyrings
 231                 shopt -s nullglob
 232                 KEYRINGIDS=("$KEYRING_IMPORT_DIR"/*.gpg)
 233                 shopt -u nullglob
 234                 KEYRINGIDS=("${KEYRINGIDS[@]##*/}")
 235                 KEYRINGIDS=("${KEYRINGIDS[@]%.gpg}")
 236                 if [[ -z ${KEYRINGIDS[@]} ]]; then
 237                         error "$(gettext "No keyring files exist in %s.")" "$KEYRING_IMPORT_DIR"
 238                         ret=1
 239                 fi
 240         else
 241                 # verify listed keyrings exist
 242                 for keyring in ${KEYRINGIDS[@]}; do
 243                         if [[ ! -f "$KEYRING_IMPORT_DIR/$keyring.gpg" ]]; then
 244                                 error "$(gettext "The keyring file %s does not exist.")" "$KEYRING_IMPORT_DIR/$keyring.gpg"
 245                                 ret=1
 246                         fi
 247                 done
 248         fi
 249
 250         if (( ret )); then
 251                 exit 1
 252         fi
 253
 254         verify_keyring_input || exit 1
 255
 256         # Variable used for iterating on keyrings
 257         local key
 258         local key_id
 259
 260         # Add keys from requested keyrings
 261         for keyring in ${KEYRINGIDS[@]}; do
 262                 msg "$(gettext "Appending keys from %s.gpg...")" "$keyring"
 263                 local add_keys="$("${GPG_NOKEYRING[@]}" --keyring "${KEYRING_IMPORT_DIR}/${keyring}.gpg" --with-colons --list-keys | grep ^pub | cut -d: -f5)"
 264                 for key_id in ${add_keys}; do
 265                         "${GPG_NOKEYRING[@]}" --keyring "${KEYRING_IMPORT_DIR}/${keyring}.gpg" --export "${key_id}" | "${GPG_PACMAN[@]}" --import
 266                 done
 267         done
 268
 269         # Read the revoked key IDs to an array. The conversion from whatever is inside the file
 270         # to key ids is important, because key ids are the only guarantee of identification
 271         # for the keys.
 272         local -A removed_ids
 273         for keyring in ${KEYRINGIDS[@]}; do
 274                 if [[ -f "${KEYRING_IMPORT_DIR}/${keyring}-revoked" ]]; then
 275                         while read key; do
 276                                 local key_values name
 277                                 # extract key ID (field 5) and the name of owner (field 10)
 278                                 key_values="$("${GPG_PACMAN[@]}" --quiet --with-colons --list-key "${key}" 2>/dev/null | grep ^pub | cut -d: -f5,10 --output-delimiter=' ')"
 279                                 if [[ -n $key_values ]]; then
 280                                         # The first word is the key_id
 281                                         key_id="${key_values%% *}"
 282                                         # the rest is the name of the owner
 283                                         name="${key_values#* }"
 284                                         if [[ -n ${key_id} ]]; then
 285                                                 # Mark this key to be deleted
 286                                                 removed_ids[$key_id]="$name"
 287                                         fi
 288                                 fi
 289                         done < "${KEYRING_IMPORT_DIR}/${keyring}-revoked"
 290                 fi
 291         done
 292
 293         # Read list of keys that must be kept installed and remove them from the list
 294         # of keys to be removed
 295         if [[ -f "${PACMAN_KEYRING_DIR}/holdkeys" ]]; then
 296                 while read key; do
 297                         key_id="$("${GPG_PACMAN[@]}" --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5)"
 298                         if [[ -n "${removed_ids[$key_id]}" ]]; then
 299                                 unset removed_ids[$key_id]
 300                         fi
 301                 done < "${PACMAN_KEYRING_DIR}/holdkeys"
 302         fi
 303
 304         # Remove the keys not marked to keep
 305         if (( ${#removed_ids[@]} > 0 )); then
 306                 msg "$(gettext "Removing revoked keys from keyring...")"
 307                 for key_id in "${!removed_ids[@]}"; do
 308                         echo "  removing key $key_id - ${removed_ids[$key_id]}"
 309                         "${GPG_PACMAN[@]}" --quiet --batch --yes --delete-key "${key_id}"
 310                 done
 311         fi
 312 }
 313
 314 edit_keys() {
 315         local errors=0;
 316         for key in ${KEYIDS[@]}; do
 317                 # Verify if the key exists in pacman's keyring
 318                 if ! "${GPG_PACMAN[@]}" --list-keys "$key" &>/dev/null; then
 319                         error "$(gettext "The key identified by %s does not exist")" "$key"
 320                         errors=1;
 321                 fi
 322         done
 323         (( errors )) && exit 1;
 324
 325         for key in ${KEYIDS[@]}; do
 326                 "${GPG_PACMAN[@]}" --edit-key "$key"
 327         done
 328 }
 329
 330 import_trustdb() {
 331         local importdir
 332         local trustdb=$(mktemp)
 333         "${GPG_PACMAN[@]}" --export-ownertrust > ${trustdb}
 334
 335         for importdir in "${IMPORT_DIRS[@]}"; do
 336                 if [[ -f "${importdir}/trustdb.gpg" ]]; then
 337                         gpg --homedir "${importdir}" --export-ownertrust >> ${trustdb}
 338                 fi
 339         done
 340
 341         "${GPG_PACMAN[@]}" --import-ownertrust ${trustdb}
 342         rm -f ${trustdb}
 343 }
 344
 345 import() {
 346         local importdir
 347
 348         # Imports public keys, then import trustdbs
 349         for importdir in "${IMPORT_DIRS[@]}"; do
 350                 if [[ -f "${importdir}/pubring.gpg" ]]; then
 351                         "${GPG_PACMAN[@]}" --quiet --batch --import "${importdir}/pubring.gpg"
 352                 fi
 353         done
 354
 355         import_trustdb
 356 }
 357
 358 # PROGRAM START
 359 if ! type gettext &>/dev/null; then
 360         gettext() {
 361                 echo "$@"
 362         }
 363 fi
 364
 365 OPT_SHORT="a::d:e:f::hl::r:uv:V"
 366 OPT_LONG="add::,config:,delete:,edit-key:,export::,finger::,gpgdir:"
 367 OPT_LONG+=",help,import:,import-trustdb:,init,keyserver:,list-keys::,list-sigs::"
 368 OPT_LONG+=",lsign-key:,populate::,recv-keys:,refresh-keys::,updatedb"
 369 OPT_LONG+=",verify:,version"
 370 if ! OPT_TEMP="$(parse_options $OPT_SHORT $OPT_LONG "$@")"; then
 371         echo; usage; exit 1 # E_INVALID_OPTION;
 372 fi
 373 eval set -- "$OPT_TEMP"
 374 unset OPT_SHORT OPT_LONG OPT_TEMP
 375
 376 if [[ $1 == "--" ]]; then
 377         usage;
 378         exit 0;
 379 fi
 380
 381 while true; do
 382         case "$1" in
 383                 -a|--add)         ADD=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYFILES=($1); UPDATEDB=1 ;;
 384                 --config)         shift; CONFIG=$1 ;;
 385                 -d|--delete)      DELETE=1; shift; KEYIDS=($1); UPDATEDB=1 ;;
 386                 --edit-key)       EDITKEY=1; shift; KEYIDS=($1); UPDATEDB=1 ;;
 387                 -e|--export)      EXPORT=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
 388                 -f|--finger)      FINGER=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
 389                 --gpgdir)         shift; PACMAN_KEYRING_DIR=$1 ;;
 390                 --import)         IMPORT=1; shift; IMPORT_DIRS=($1); UPDATEDB=1 ;;
 391                 --import-trustdb) IMPORT_TRUSTDB=1; shift; IMPORT_DIRS=($1); UPDATEDB=1 ;;
 392                 --init)           INIT=1 ;;
 393                 --keyserver)      shift; KEYSERVER=$1 ;;
 394                 -l|--list-keys)   LISTKEYS=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
 395                 --list-sigs)      LISTSIGS=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
 396                 --lsign-key)      LSIGNKEY=1; shift; KEYIDS=($1); UPDATEDB=1 ;;
 397                 --populate)       POPULATE=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYRINGIDS=($1); UPDATEDB=1 ;;
 398                 -r|--recv-keys)   RECEIVE=1; shift; KEYIDS=($1); UPDATEDB=1 ;;
 399                 --refresh-keys)   REFRESH=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
 400                 -u|--updatedb)    UPDATEDB=1 ;;
 401                 -v|--verify)      VERIFY=1; shift; SIGNATURE=$1 ;;
 402
 403                 -h|--help)        usage; exit 0 ;;
 404                 -V|--version)     version; exit 0 ;;
 405
 406                 --)               OPT_IND=0; shift; break;;
 407                 *)                usage; exit 1 ;;
 408         esac
 409         shift
 410 done
 411
 412
 413 if ! type -p gpg >/dev/null; then
 414     error "$(gettext "Cannot find the %s binary required for all %s operations.")" "gpg" "pacman-key"
 415         exit 1
 416 fi
 417
 418 if (( (ADD || DELETE || EDITKEY || IMPORT || IMPORT_TRUSTDB || INIT || LSIGNKEY || POPULATE || RECEIVE || REFRESH || UPDATEDB) && EUID != 0 )); then
 419         error "$(gettext "%s needs to be run as root for this operation.")" "pacman-key"
 420         exit 1
 421 fi
 422
 423 CONFIG=${CONFIG:-@sysconfdir@/pacman.conf}
 424 if [[ ! -r "${CONFIG}" ]]; then
 425         error "$(gettext "%s configuration file '%s' not found.")" "pacman" "$CONFIG"
 426         exit 1
 427 fi
 428
 429 # if PACMAN_KEYRING_DIR isn't assigned, try to get it from the config
 430 # file, falling back on a hard default
 431 PACMAN_KEYRING_DIR=${PACMAN_KEYRING_DIR:-$(get_from "$CONFIG" "GPGDir" || echo "@sysconfdir@/pacman.d/gnupg")}
 432
 433 GPG_PACMAN=(gpg --homedir ${PACMAN_KEYRING_DIR} --no-permission-warning)
 434 if [[ -n ${KEYSERVER} ]]; then
 435         GPG_PACMAN+=(--keyserver ${KEYSERVER})
 436 fi
 437
 438 # check only a single operation has been given
 439 # don't include UPDATEDB in here as other opts can induce it
 440 numopt=$(( ADD + DELETE + EDITKEY + EXPORT + FINGER + IMPORT + IMPORT_TRUSTDB +
 441                 INIT + LISTKEYS + LISTSIGS + LSIGNKEY + POPULATE + RECEIVE + REFRESH + VERIFY ))
 442
 443 case $numopt in
 444         0)
 445                 if (( ! UPDATEDB )); then
 446                         error "$(gettext "no operation specified (use -h for help)")"
 447                         exit 1
 448                 fi
 449                 ;;
 450         [!1])
 451                 error "$(gettext "Multiple operations specified")"
 452                 printf "$(gettext "Please run %s with each operation separately\n")" "pacman-key"
 453                 exit 1
 454                 ;;
 455 esac
 456
 457 (( ! INIT )) && check_keyring
 458
 459 (( ADD )) && "${GPG_PACMAN[@]}" --quiet --batch --import "${KEYFILES[@]}"
 460 (( DELETE )) && "${GPG_PACMAN[@]}" --quiet --batch --delete-key --yes "${KEYIDS[@]}"
 461 (( EDITKEY )) && edit_keys
 462 (( EXPORT )) && "${GPG_PACMAN[@]}" --armor --export "${KEYIDS[@]}"
 463 (( FINGER )) && "${GPG_PACMAN[@]}" --batch --fingerprint "${KEYIDS[@]}"
 464 (( IMPORT )) && import
 465 (( IMPORT_TRUSTDB)) && import_trustdb
 466 (( INIT )) && initialize
 467 (( LISTKEYS )) && "${GPG_PACMAN[@]}" --batch --list-keys "${KEYIDS[@]}"
 468 (( LISTSIGS )) && "${GPG_PACMAN[@]}" --batch --list-sigs "${KEYIDS[@]}"
 469 # TODO: we can't do --batch on lsign until we figure out --command-fd
 470 (( LSIGNKEY )) && "${GPG_PACMAN[@]}" --lsign-key "${KEYIDS[@]}"
 471 (( POPULATE )) && populate_keyring
 472 (( RECEIVE )) && "${GPG_PACMAN[@]}" --recv-keys "${KEYIDS[@]}"
 473 (( REFRESH )) && "${GPG_PACMAN[@]}" --refresh-keys "${KEYIDS[@]}"
 474 (( VERIFY )) && "${GPG_PACMAN[@]}" --verify $SIGNATURE
 475
 476 if (( UPDATEDB )); then
 477         msg "$(gettext "Updating trust database...")"
 478         "${GPG_PACMAN[@]}" --batch --check-trustdb
 479 fi
 480
 481 # vim: set ts=2 sw=2 noet: