pacman-key: print default gpgdir in usage
[pacman-ng.git] / scripts / pacman-key.sh.in
blobe795aada323181cbca6485285e54a0daf6ddd678
1 #!@BASH_SHELL@ -e
3 # pacman-key - manages pacman's keyring
4 # Based on apt-key, from Debian
5 # @configure_input@
7 # Copyright (c) 2010 - Pacman Development Team <pacman-dev@archlinux.org>
9 # This program is free software; you can redistribute it and/or modify
10 # it under the terms of the GNU General Public License as published by
11 # the Free Software Foundation; either version 2 of the License, or
12 # (at your option) any later version.
14 # This program is distributed in the hope that it will be useful,
15 # but WITHOUT ANY WARRANTY; without even the implied warranty of
16 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 # GNU General Public License for more details.
19 # You should have received a copy of the GNU General Public License
20 # along with this program. If not, see <http://www.gnu.org/licenses/>.
23 # gettext initialization
24 export TEXTDOMAIN='pacman'
25 export TEXTDOMAINDIR='@localedir@'
27 myver="@PACKAGE_VERSION@"
29 msg() {
30 local mesg=$1; shift
31 printf "==> ${mesg}\n" "$@" >&1
34 msg2() {
35 (( QUIET )) && return
36 local mesg=$1; shift
37 printf " -> ${mesg}\n" "$@" >&1
40 warning() {
41 local mesg=$1; shift
42 printf "==> $(gettext "WARNING:") ${mesg}\n" "$@" >&2
45 error() {
46 local mesg=$1; shift
47 printf "==> $(gettext "ERROR:") ${mesg}\n" "$@" >&2
50 usage() {
51 printf "pacman-key (pacman) %s\n" ${myver}
52 echo
53 printf "$(gettext "Usage: %s [options] <command> [arguments]")\n" $(basename $0)
54 echo
55 echo "$(gettext "Manage pacman's list of trusted keys")"
56 echo
57 echo "$(gettext "Options must be placed before commands. The available options are:")"
58 printf "$(gettext " --config <file> Use an alternate config file (instead of '%s')")\n" "$CONFIG"
59 printf "$(gettext " --gpgdir Set an alternate directory for gnupg (instead of '%s')")\n" "$PACMAN_KEYRING_DIR"
60 echo
61 echo "$(gettext "The available commands are:")"
62 echo "$(gettext " -a, --add [<file(s)>] Add the specified keys (empty for stdin)")"
63 echo "$(gettext " -d, --del <keyid(s)> Remove the specified keyids")"
64 echo "$(gettext " -e, --export <keyid(s)> Export the specified keyids")"
65 echo "$(gettext " -f, --finger [<keyid(s)>] List fingerprint for specified or all keyids")"
66 echo "$(gettext " -h, --help Show this help message and exit")"
67 echo "$(gettext " -l, --list List keys")"
68 echo "$(gettext " -r, --receive <keyserver> <keyid(s)> Fetch the specified keyids")"
69 echo "$(gettext " -t, --trust <keyid(s)> Set the trust level of the given keyids")"
70 echo "$(gettext " -u, --updatedb Update the trustdb of pacman")"
71 echo "$(gettext " -V, --version Show program version")"
72 echo "$(gettext " --adv <params> Use pacman's keyring with advanced gpg commands")"
73 printf "$(gettext " --reload Reload the default keys")"
74 echo
77 version() {
78 printf "pacman-key (pacman) %s\n" "${myver}"
79 printf "$(gettext "\
80 Copyright (c) 2010-2011 Pacman Development Team <pacman-dev@archlinux.org>.\n\
81 This is free software; see the source for copying conditions.\n\
82 There is NO WARRANTY, to the extent permitted by law.\n")"
85 # Read provided file and search for values matching the given key
86 # The contents of the file are expected to be in this format: key = value
87 # 'key', 'equal sign' and 'value' can be surrounded by random whitespace
88 # Usage: get_from "$file" "$key" # returns the value for the first matching key in the file
89 get_from() {
90 while read key _ value; do
91 if [[ $key = $2 ]]; then
92 echo "$value"
93 break
95 done < "$1"
98 reload_keyring() {
99 local PACMAN_SHARE_DIR='@prefix@/share/pacman'
100 local GPG_NOKEYRING="gpg --batch --quiet --ignore-time-conflict --no-options --no-default-keyring --homedir ${PACMAN_KEYRING_DIR}"
102 # Variable used for iterating on keyrings
103 local key
104 local key_id
106 # Keyring with keys to be added to the keyring
107 local ADDED_KEYS="${PACMAN_SHARE_DIR}/addedkeys.gpg"
109 # Keyring with keys that were deprecated and will eventually be deleted
110 local DEPRECATED_KEYS="${PACMAN_SHARE_DIR}/deprecatedkeys.gpg"
112 # List of keys removed from the keyring. This file is not a keyring, unlike the others.
113 # It is a textual list of values that gpg recogniezes as identifiers for keys.
114 local REMOVED_KEYS="${PACMAN_SHARE_DIR}/removedkeys"
116 # Verify signatures of related files, if they exist
117 if [[ -r "${ADDED_KEYS}" ]]; then
118 msg "$(gettext "Verifying official keys file signature...")"
119 if ! ${GPG_PACMAN} --quiet --batch --verify "${ADDED_KEYS}.sig" 1>/dev/null; then
120 error "$(gettext "The signature of file %s is not valid.")" "${ADDED_KEYS}"
121 exit 1
125 if [[ -r "${DEPRECATED_KEYS}" ]]; then
126 msg "$(gettext "Verifying deprecated keys file signature...")"
127 if ! ${GPG_PACMAN} --quiet --batch --verify "${DEPRECATED_KEYS}.sig" 1>/dev/null; then
128 error "$(gettext "The signature of file %s is not valid.")" "${DEPRECATED_KEYS}"
129 exit 1
133 if [[ -r "${REMOVED_KEYS}" ]]; then
134 msg "$(gettext "Verifying deleted keys file signature...")"
135 if ! ${GPG_PACMAN} --quiet --batch --verify "${REMOVED_KEYS}.sig"; then
136 error "$(gettext "The signature of file %s is not valid.")" "${REMOVED_KEYS}"
137 exit 1
141 # Read the key ids to an array. The conversion from whatever is inside the file
142 # to key ids is important, because key ids are the only guarantee of identification
143 # for the keys.
144 local -A removed_ids
145 if [[ -r "${REMOVED_KEYS}" ]]; then
146 while read key; do
147 local key_values name
148 key_values=$(${GPG_PACMAN} --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5,10 --output-delimiter=' ')
149 if [[ -n $key_values ]]; then
150 # The first word is the key_id
151 key_id=${key_values%% *}
152 # the rest if the name of the owner
153 name=${key_values#* }
154 if [[ -n ${key_id} ]]; then
155 # Mark this key to be deleted
156 removed_ids[$key_id]="$name"
159 done < "${REMOVED_KEYS}"
162 # List of keys that must be kept installed, even if in the list of keys to be removed
163 local HOLD_KEYS=$(get_from "$CONFIG" "HoldKeys")
165 # Remove the keys that must be kept from the set of keys that should be removed
166 if [[ -n ${HOLD_KEYS} ]]; then
167 for key in ${HOLD_KEYS}; do
168 key_id=$(${GPG_PACMAN} --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5)
169 if [[ -n "${removed_ids[$key_id]}" ]]; then
170 unset removed_ids[$key_id]
172 done
175 # Add keys from the current set of keys from pacman-keyring package. The web of trust will
176 # be updated automatically.
177 if [[ -r "${ADDED_KEYS}" ]]; then
178 msg "$(gettext "Appending official keys...")"
179 local add_keys=$(${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5)
180 for key_id in ${add_keys}; do
181 # There is no point in adding a key that will be deleted right after
182 if [[ -z "${removed_ids[$key_id]}" ]]; then
183 ${GPG_NOKEYRING} --keyring "${ADDED_KEYS}" --export "${key_id}" | ${GPG_PACMAN} --import
185 done
188 if [[ -r "${DEPRECATED_KEYS}" ]]; then
189 msg "$(gettext "Appending deprecated keys...")"
190 local add_keys=$(${GPG_NOKEYRING} --keyring "${DEPRECATED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5)
191 for key_id in ${add_keys}; do
192 # There is no point in adding a key that will be deleted right after
193 if [[ -z "${removed_ids[$key_id]}" ]]; then
194 ${GPG_NOKEYRING} --keyring "${DEPRECATED_KEYS}" --export "${key_id}" | ${GPG_PACMAN} --import
196 done
199 # Remove the keys not marked to keep
200 if (( ${#removed_ids[@]} > 0 )); then
201 msg "$(gettext "Removing deleted keys from keyring...")"
202 for key_id in "${!removed_ids[@]}"; do
203 echo " removing key $key_id - ${removed_ids[$key_id]}"
204 ${GPG_PACMAN} --quiet --batch --yes --delete-key "${key_id}"
205 done
208 # Update trustdb, just to be sure
209 msg "$(gettext "Updating trust database...")"
210 ${GPG_PACMAN} --batch --check-trustdb
213 # PROGRAM START
214 if ! type gettext &>/dev/null; then
215 gettext() {
216 echo "$@"
220 if [[ $1 != "--version" && $1 != "-V" && $1 != "--help" && $1 != "-h" && $1 != "" ]]; then
221 if type -p gpg >/dev/null 2>&1 = 1; then
222 error "$(gettext "gnupg does not seem to be installed.")"
223 msg2 "$(gettext "pacman-key requires gnupg for most operations.")"
224 exit 1
225 elif (( EUID != 0 )); then
226 error "$(gettext "pacman-key needs to be run as root.")"
227 exit 1
231 # Parse global options
232 CONFIG="@sysconfdir@/pacman.conf"
233 PACMAN_KEYRING_DIR="@sysconfdir@/pacman.d/gnupg"
234 while [[ $1 =~ ^--(config|gpgdir)$ ]]; do
235 case "$1" in
236 --config) shift; CONFIG="$1" ;;
237 --gpgdir) shift; PACMAN_KEYRING_DIR="$1" ;;
238 esac
239 shift
240 done
242 if [[ ! -r "${CONFIG}" ]]; then
243 error "$(gettext "%s not found.")" "$CONFIG"
244 exit 1
247 # Read GPGDIR from $CONFIG.
248 if [[ GPGDIR=$(get_from "$CONFIG" "GPGDir") == 0 ]]; then
249 PACMAN_KEYRING_DIR="${GPGDIR}"
251 GPG_PACMAN="gpg --homedir ${PACMAN_KEYRING_DIR} --no-permission-warning"
253 # Try to create $PACMAN_KEYRING_DIR if non-existent
254 # Check for simple existence rather than for a directory as someone may want
255 # to use a symlink here
256 [[ -e ${PACMAN_KEYRING_DIR} ]] || mkdir -p -m 755 "${PACMAN_KEYRING_DIR}"
258 # Parse and execute command
259 command="$1"
260 if [[ -z "${command}" ]]; then
261 usage
262 exit 1
264 shift
266 case "${command}" in
267 -a|--add)
268 # If there is no extra parameter, gpg will read stdin
269 ${GPG_PACMAN} --quiet --batch --import "$@"
271 -d|--del)
272 if (( $# == 0 )); then
273 error "$(gettext "You need to specify at least one key identifier")"
274 exit 1
276 ${GPG_PACMAN} --quiet --batch --delete-key --yes "$@"
278 -u|--updatedb)
279 ${GPG_PACMAN} --batch --check-trustdb
281 --reload)
282 reload_keyring
284 -l|--list)
285 ${GPG_PACMAN} --batch --list-sigs "$@"
287 -f|--finger)
288 ${GPG_PACMAN} --batch --fingerprint "$@"
290 -e|--export)
291 ${GPG_PACMAN} --armor --export "$@"
293 -r|--receive)
294 if (( $# < 2 )); then
295 error "$(gettext "You need to specify the keyserver and at least one key identifier")"
296 exit 1
298 keyserver="$1"
299 shift
300 ${GPG_PACMAN} --keyserver "${keyserver}" --recv-keys "$@"
302 -t|--trust)
303 if (( $# == 0 )); then
304 error "$(gettext "You need to specify at least one key identifier")"
305 exit 1
307 while (( $# > 0 )); do
308 # Verify if the key exists in pacman's keyring
309 if ${GPG_PACMAN} --list-keys "$1" > /dev/null 2>&1; then
310 ${GPG_PACMAN} --edit-key "$1"
311 else
312 error "$(gettext "The key identified by %s doesn't exist")" "$1"
313 exit 1
315 shift
316 done
318 --adv)
319 msg "$(gettext "Executing: %s ")$*" "${GPG_PACMAN}"
320 ${GPG_PACMAN} "$@" || ret=$?
321 exit $ret
323 -h|--help)
324 usage; exit 0 ;;
325 -V|--version)
326 version; exit 0 ;;
328 error "$(gettext "Unknown command:") $command"
329 usage; exit 1 ;;
330 esac