]> git.saurik.com Git - apt.git/blame - cmdline/apt-key
* cmdline/apt-get.cc:
[apt.git] / cmdline / apt-key
CommitLineData
b3d44315
MV
1#!/bin/sh
2
3set -e
dac074b0 4unset GREP_OPTIONS
b3d44315 5
4a242c5b
MV
6# We don't use a secret keyring, of course, but gpg panics and
7# implodes if there isn't one available
248ec5ab
DK
8GPG_CMD='gpg --ignore-time-conflict --no-options --no-default-keyring --secret-keyring /etc/apt/secring.gpg'
9
d4e80f1f 10if [ "$(id -u)" -eq 0 ]; then
248ec5ab
DK
11 GPG_CMD="$GPG_CMD --trustdb-name /etc/apt/trustdb.gpg"
12fi
13
46e39c8e 14GPG="$GPG_CMD"
4a242c5b 15
7fbe42c0 16MASTER_KEYRING=""
848ecfa4 17ARCHIVE_KEYRING_URI=""
7fbe42c0 18#MASTER_KEYRING=/usr/share/keyrings/debian-master-keyring.gpg
848ecfa4
MV
19#ARCHIVE_KEYRING_URI=http://ftp.debian.org/debian/debian-archive-keyring.gpg
20
7ef96224
MV
21ARCHIVE_KEYRING=/usr/share/keyrings/debian-archive-keyring.gpg
22REMOVED_KEYS=/usr/share/keyrings/debian-archive-removed-keys.gpg
4a242c5b 23
7851d583
DK
24requires_root() {
25 if [ "$(id -u)" -ne 0 ]; then
26 echo >&1 "ERROR: This command can only be used by root."
27 exit 1
28 fi
29}
30
7fbe42c0 31add_keys_with_verify_against_master_keyring() {
8c56b1e0
MV
32 ADD_KEYRING=$1
33 MASTER=$2
34
35 if [ ! -f "$ADD_KEYRING" ]; then
36 echo "ERROR: '$ADD_KEYRING' not found"
37 return
38 fi
39 if [ ! -f "$MASTER" ]; then
40 echo "ERROR: '$MASTER' not found"
41 return
42 fi
43
44 # when adding new keys, make sure that the archive-master-keyring
45 # is honored. so:
3a341a1d
MV
46 # all keys that are exported must have a valid signature
47 # from a key in the $distro-master-keyring
8c56b1e0
MV
48 add_keys=`$GPG_CMD --keyring $ADD_KEYRING --with-colons --list-keys | grep ^pub | cut -d: -f5`
49 master_keys=`$GPG_CMD --keyring $MASTER --with-colons --list-keys | grep ^pub | cut -d: -f5`
50 for add_key in $add_keys; do
c9bb37c7 51 ADDED=0
8c56b1e0 52 for master_key in $master_keys; do
c9bb37c7 53 if $GPG_CMD --keyring $ADD_KEYRING --list-sigs --with-colons $add_key | grep ^sig | cut -d: -f5 | grep -q $master_key; then
3916f941 54 $GPG_CMD --quiet --batch --keyring $ADD_KEYRING --export $add_key | $GPG --import
c9bb37c7 55 ADDED=1
8c56b1e0 56 fi
7fbe42c0 57 done
c9bb37c7
MV
58 if [ $ADDED = 0 ]; then
59 echo >&2 "Key '$add_key' not added. It is not signed with a master key"
60 fi
8c56b1e0 61 done
7fbe42c0 62}
4a242c5b 63
848ecfa4
MV
64# update the current archive signing keyring from a network URI
65# the archive-keyring keys needs to be signed with the master key
66# (otherwise it does not make sense from a security POV)
67net_update() {
68 if [ -z "$ARCHIVE_KEYRING_URI" ]; then
49434e94 69 echo >&2 "ERROR: Your distribution is not supported in net-update as no uri for the archive-keyring is set"
46e39c8e
MV
70 exit 1
71 fi
7851d583 72 requires_root
46e39c8e
MV
73 # in theory we would need to depend on wget for this, but this feature
74 # isn't useable in debian anyway as we have no keyring uri nor a master key
75 if ! which wget >/dev/null 2>&1; then
49434e94 76 echo >&2 "ERROR: an installed wget is required for a network-based update"
46e39c8e 77 exit 1
848ecfa4
MV
78 fi
79 if [ ! -d /var/lib/apt/keyrings ]; then
80 mkdir -p /var/lib/apt/keyrings
81 fi
20ba2505 82 keyring=/var/lib/apt/keyrings/$(basename $ARCHIVE_KEYRING)
93886541
MV
83 old_mtime=0
84 if [ -e $keyring ]; then
20ba2505 85 old_mtime=$(stat -c %Y $keyring)
93886541 86 fi
848ecfa4 87 (cd /var/lib/apt/keyrings; wget -q -N $ARCHIVE_KEYRING_URI)
93886541
MV
88 if [ ! -e $keyring ]; then
89 return
90 fi
20ba2505 91 new_mtime=$(stat -c %Y $keyring)
93886541 92 if [ $new_mtime -ne $old_mtime ]; then
8dd0686e 93 echo "Checking for new archive signing keys now"
93886541
MV
94 add_keys_with_verify_against_master_keyring $keyring $MASTER_KEYRING
95 fi
848ecfa4
MV
96}
97
4a242c5b
MV
98update() {
99 if [ ! -f $ARCHIVE_KEYRING ]; then
100 echo >&2 "ERROR: Can't find the archive-keyring"
5fdd72f2 101 echo >&2 "Is the debian-archive-keyring package installed?"
4a242c5b
MV
102 exit 1
103 fi
7851d583 104 requires_root
4a242c5b 105
3a341a1d
MV
106 # add new keys from the package;
107
108 # we do not use add_keys_with_verify_against_master_keyring here,
1171258a 109 # because "update" is run on regular package updates. A
3a341a1d
MV
110 # attacker might as well replace the master-archive-keyring file
111 # in the package and add his own keys. so this check wouldn't
112 # add any security. we *need* this check on net-update though
113 $GPG_CMD --quiet --batch --keyring $ARCHIVE_KEYRING --export | $GPG --import
4a242c5b 114
364af2ef
MV
115 if [ -r "$REMOVED_KEYS" ]; then
116 # remove no-longer supported/used keys
117 keys=`$GPG_CMD --keyring $REMOVED_KEYS --with-colons --list-keys | grep ^pub | cut -d: -f5`
118 for key in $keys; do
119 if $GPG --list-keys --with-colons | grep ^pub | cut -d: -f5 | grep -q $key; then
120 $GPG --quiet --batch --delete-key --yes ${key}
121 fi
122 done
123 else
124 echo "Warning: removed keys keyring $REMOVED_KEYS missing or not readable" >&2
125 fi
4a242c5b
MV
126}
127
7fbe42c0 128
b3d44315 129usage() {
46e39c8e 130 echo "Usage: apt-key [--keyring file] [command] [arguments]"
b3d44315
MV
131 echo
132 echo "Manage apt's list of trusted keys"
133 echo
134 echo " apt-key add <file> - add the key contained in <file> ('-' for stdin)"
135 echo " apt-key del <keyid> - remove the key <keyid>"
bf6d5b42
OS
136 echo " apt-key export <keyid> - output the key <keyid>"
137 echo " apt-key exportall - output all trusted keys"
4a242c5b 138 echo " apt-key update - update keys using the keyring package"
848ecfa4 139 echo " apt-key net-update - update keys using the network"
b3d44315 140 echo " apt-key list - list keys"
a8cabc8f
LB
141 echo " apt-key finger - list fingerprints"
142 echo " apt-key adv - pass advanced options to gpg (download key)"
b3d44315 143 echo
46e39c8e 144 echo "If no specific keyring file is given the command applies to all keyring files."
b3d44315
MV
145}
146
46e39c8e
MV
147# Determine on which keyring we want to work
148if [ "$1" = "--keyring" ]; then
149 #echo "keyfile given"
150 shift
151 TRUSTEDFILE="$1"
152 if [ -r "$TRUSTEDFILE" ]; then
153 GPG="$GPG --keyring $TRUSTEDFILE --primary-keyring $TRUSTEDFILE"
154 else
155 echo >&2 "Error: The specified keyring »$TRUSTEDFILE« is missing or not readable"
156 exit 1
157 fi
158 shift
159# otherwise use the default
160else
161 #echo "generate list"
162 TRUSTEDFILE="/etc/apt/trusted.gpg"
6520109c 163 eval $(apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring)
1f8b2599 164 eval $(apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f)
46e39c8e
MV
165 if [ -r "$TRUSTEDFILE" ]; then
166 GPG="$GPG --keyring $TRUSTEDFILE"
167 fi
168 GPG="$GPG --primary-keyring $TRUSTEDFILE"
169 TRUSTEDPARTS="/etc/apt/trusted.gpg.d"
1f8b2599 170 eval $(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d)
46e39c8e
MV
171 if [ -d "$TRUSTEDPARTS" ]; then
172 #echo "parts active"
173 for trusted in $(run-parts --list $TRUSTEDPARTS --regex '^.*\.gpg$'); do
174 #echo "part -> $trusted"
175 GPG="$GPG --keyring $trusted"
176 done
177 fi
178fi
179#echo "COMMAND: $GPG"
180
b3d44315
MV
181command="$1"
182if [ -z "$command" ]; then
183 usage
184 exit 1
185fi
186shift
187
188if [ "$command" != "help" ] && ! which gpg >/dev/null 2>&1; then
189 echo >&2 "Warning: gnupg does not seem to be installed."
190 echo >&2 "Warning: apt-key requires gnupg for most operations."
191 echo >&2
192fi
193
b3d44315
MV
194case "$command" in
195 add)
7851d583 196 requires_root
b3d44315
MV
197 $GPG --quiet --batch --import "$1"
198 echo "OK"
199 ;;
200 del|rm|remove)
7851d583 201 requires_root
b3d44315
MV
202 $GPG --quiet --batch --delete-key --yes "$1"
203 echo "OK"
204 ;;
4a242c5b
MV
205 update)
206 update
207 ;;
848ecfa4
MV
208 net-update)
209 net_update
210 ;;
b3d44315
MV
211 list)
212 $GPG --batch --list-keys
213 ;;
214 finger*)
215 $GPG --batch --fingerprint
216 ;;
bf6d5b42
OS
217 export)
218 $GPG --armor --export "$1"
219 ;;
220 exportall)
221 $GPG --armor --export
222 ;;
b3d44315
MV
223 adv*)
224 echo "Executing: $GPG $*"
225 $GPG $*
226 ;;
227 help)
228 usage
229 ;;
230 *)
231 usage
232 exit 1
233 ;;
234esac