]> git.saurik.com Git - apt.git/blame - cmdline/apt-key.in
deal with spaces in path, command and filepaths in apt-key
[apt.git] / cmdline / apt-key.in
CommitLineData
b3d44315
MV
1#!/bin/sh
2
3set -e
dac074b0 4unset GREP_OPTIONS
fecfbf2e 5export IFS="$(printf "\n\b")"
b3d44315 6
5acf154d
MV
7APT_DIR="/"
8eval $(apt-config shell APT_DIR Dir)
9
5b2c6ddc 10MASTER_KEYRING='&keyring-master-filename;'
80f3aeb0 11eval $(apt-config shell MASTER_KEYRING APT::Key::MasterKeyring)
5b2c6ddc 12ARCHIVE_KEYRING='&keyring-filename;'
80f3aeb0 13eval $(apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring)
5b2c6ddc 14REMOVED_KEYS='&keyring-removed-filename;'
80f3aeb0 15eval $(apt-config shell REMOVED_KEYS APT::Key::RemovedKeys)
5b2c6ddc 16ARCHIVE_KEYRING_URI='&keyring-uri;'
f87338d2 17eval $(apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI)
4a242c5b 18
3d0def05
DK
19aptkey_echo() { echo "$@"; }
20
00c6e1a3
MV
21requires_root() {
22 if [ "$(id -u)" -ne 0 ]; then
84b286f6 23 echo >&2 "ERROR: This command can only be used by root."
00c6e1a3
MV
24 exit 1
25 fi
26}
27
ba72845c 28get_fingerprints_of_keyring() {
fecfbf2e 29 aptkey_execute "$GPG_SH" --keyring "$1" --with-colons --fingerprint | while read publine; do
ba72845c
DK
30 # search for a public key
31 if [ "${publine%%:*}" != 'pub' ]; then continue; fi
32 # search for the associated fingerprint (should be the very next line)
33 while read fprline; do
34 if [ "${fprline%%:*}" = 'sub' ]; then break; # should never happen
35 elif [ "${fprline%%:*}" != 'fpr' ]; then continue; fi
36 echo "$fprline" | cut -d':' -f 10
37 done
25f27319
DK
38 # order in the keyring shouldn't be important
39 done | sort
ba72845c
DK
40}
41
7fbe42c0 42add_keys_with_verify_against_master_keyring() {
8c56b1e0
MV
43 ADD_KEYRING=$1
44 MASTER=$2
f87338d2 45
8c56b1e0 46 if [ ! -f "$ADD_KEYRING" ]; then
84b286f6 47 echo >&2 "ERROR: '$ADD_KEYRING' not found"
8c56b1e0 48 return
84b286f6 49 fi
8c56b1e0 50 if [ ! -f "$MASTER" ]; then
84b286f6 51 echo >&2 "ERROR: '$MASTER' not found"
8c56b1e0
MV
52 return
53 fi
54
55 # when adding new keys, make sure that the archive-master-keyring
56 # is honored. so:
3a341a1d
MV
57 # all keys that are exported must have a valid signature
58 # from a key in the $distro-master-keyring
ba72845c 59 add_keys="$(get_fingerprints_of_keyring "$ADD_KEYRING")"
fecfbf2e
DK
60 all_add_keys=`aptkey_execute "$GPG_SH" --keyring "$ADD_KEYRING" --with-colons --list-keys | grep ^[ps]ub | cut -d: -f5`
61 master_keys=`aptkey_execute "$GPG_SH" --keyring "$MASTER" --with-colons --list-keys | grep ^pub | cut -d: -f5`
f87338d2
DK
62
63 # ensure there are no colisions LP: #857472
64 for all_add_key in $all_add_keys; do
65 for master_key in $master_keys; do
66 if [ "$all_add_key" = "$master_key" ]; then
67 echo >&2 "Keyid collision for '$all_add_key' detected, operation aborted"
68 return 1
69 fi
70 done
71 done
0dae96a2 72
8c56b1e0 73 for add_key in $add_keys; do
f87338d2 74 # export the add keyring one-by-one
0dae96a2 75 local TMP_KEYRING="${GPGHOMEDIR}/tmp-keyring.gpg"
fecfbf2e
DK
76 aptkey_execute "$GPG_SH" --batch --yes --keyring "$ADD_KEYRING" --output "$TMP_KEYRING" --export "$add_key"
77 if ! aptkey_execute "$GPG_SH" --batch --yes --keyring "$TMP_KEYRING" --import "$MASTER" > "${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
c1642be5 78 cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
0dae96a2
DK
79 false
80 fi
81 # check if signed with the master key and only add in this case
82 ADDED=0
8c56b1e0 83 for master_key in $master_keys; do
fecfbf2e
DK
84 if aptkey_execute "$GPG_SH" --keyring "$TMP_KEYRING" --check-sigs --with-colons "$add_key" \
85 | grep '^sig:!:' | cut -d: -f5 | grep -q "$master_key"; then
86 aptkey_execute "$GPG_SH" --batch --yes --keyring "$ADD_KEYRING" --export "$add_key" \
87 | aptkey_execute "$GPG" --batch --yes --import
c9bb37c7 88 ADDED=1
8c56b1e0 89 fi
7fbe42c0 90 done
c9bb37c7
MV
91 if [ $ADDED = 0 ]; then
92 echo >&2 "Key '$add_key' not added. It is not signed with a master key"
93 fi
0dae96a2 94 rm -f "${TMP_KEYRING}"
8c56b1e0 95 done
7fbe42c0 96}
4a242c5b 97
848ecfa4
MV
98# update the current archive signing keyring from a network URI
99# the archive-keyring keys needs to be signed with the master key
100# (otherwise it does not make sense from a security POV)
101net_update() {
f87338d2 102 # Disabled for now as code is insecure (LP: #1013639 (and 857472, 1013128))
5acf154d
MV
103 APT_KEY_NET_UPDATE_ENABLED=""
104 eval $(apt-config shell APT_KEY_NET_UPDATE_ENABLED APT::Key::Net-Update-Enabled)
105 if [ -z "$APT_KEY_NET_UPDATE_ENABLED" ]; then
106 exit 1
107 fi
f87338d2 108
848ecfa4 109 if [ -z "$ARCHIVE_KEYRING_URI" ]; then
00c6e1a3 110 echo >&2 "ERROR: Your distribution is not supported in net-update as no uri for the archive-keyring is set"
46e39c8e
MV
111 exit 1
112 fi
113 # in theory we would need to depend on wget for this, but this feature
114 # isn't useable in debian anyway as we have no keyring uri nor a master key
115 if ! which wget >/dev/null 2>&1; then
00c6e1a3 116 echo >&2 "ERROR: an installed wget is required for a network-based update"
46e39c8e 117 exit 1
848ecfa4 118 fi
fecfbf2e
DK
119 if [ ! -d "${APT_DIR}/var/lib/apt/keyrings" ]; then
120 mkdir -p "${APT_DIR}/var/lib/apt/keyrings"
848ecfa4 121 fi
fecfbf2e 122 keyring="${APT_DIR}/var/lib/apt/keyrings/$(basename "$ARCHIVE_KEYRING_URI")"
93886541
MV
123 old_mtime=0
124 if [ -e $keyring ]; then
20ba2505 125 old_mtime=$(stat -c %Y $keyring)
93886541 126 fi
fecfbf2e
DK
127 (cd "${APT_DIR}/var/lib/apt/keyrings"; wget --timeout=90 -q -N "$ARCHIVE_KEYRING_URI")
128 if [ ! -e "$keyring" ]; then
93886541
MV
129 return
130 fi
fecfbf2e 131 new_mtime=$(stat -c %Y "$keyring")
93886541 132 if [ $new_mtime -ne $old_mtime ]; then
3d0def05 133 aptkey_echo "Checking for new archive signing keys now"
fecfbf2e 134 add_keys_with_verify_against_master_keyring "$keyring" "$MASTER_KEYRING"
93886541 135 fi
848ecfa4
MV
136}
137
4a242c5b 138update() {
fecfbf2e 139 if [ ! -f "$ARCHIVE_KEYRING" ]; then
4a242c5b 140 echo >&2 "ERROR: Can't find the archive-keyring"
5b2c6ddc 141 echo >&2 "Is the &keyring-package; package installed?"
4a242c5b
MV
142 exit 1
143 fi
144
3a341a1d
MV
145 # add new keys from the package;
146
147 # we do not use add_keys_with_verify_against_master_keyring here,
1171258a 148 # because "update" is run on regular package updates. A
3a341a1d
MV
149 # attacker might as well replace the master-archive-keyring file
150 # in the package and add his own keys. so this check wouldn't
151 # add any security. we *need* this check on net-update though
f14cde2c 152 import_keyring_into_keyring "$ARCHIVE_KEYRING" '' && cat "${GPGHOMEDIR}/gpgoutput.log"
4a242c5b 153
364af2ef
MV
154 if [ -r "$REMOVED_KEYS" ]; then
155 # remove no-longer supported/used keys
ba72845c 156 get_fingerprints_of_keyring "$REMOVED_KEYS" | while read key; do
5beb682d 157 foreach_keyring_do 'remove_key_from_keyring' "$key"
364af2ef
MV
158 done
159 else
84b286f6 160 echo >&2 "Warning: removed keys keyring $REMOVED_KEYS missing or not readable"
364af2ef 161 fi
4a242c5b
MV
162}
163
04937adc 164remove_key_from_keyring() {
4b30c1dc
DK
165 local KEYRINGFILE="$1"
166 shift
5beb682d
DK
167 # non-existent keyrings have by definition no keys
168 if [ ! -e "$KEYRINGFILE" ]; then
169 return
170 fi
171
0b94a7bc 172 for KEY in "$@"; do
25f27319
DK
173 local FINGERPRINTS="${GPGHOMEDIR}/keyringfile.keylst"
174 get_fingerprints_of_keyring "$KEYRINGFILE" > "$FINGERPRINTS"
175 # check if the key is in this keyring
176 if ! grep -iq "^[0-9A-F]*${KEY}$" "$FINGERPRINTS"; then
4b30c1dc
DK
177 continue
178 fi
179 if [ ! -w "$KEYRINGFILE" ]; then
180 echo >&2 "Key ${KEY} is in keyring ${KEYRINGFILE}, but can't be removed as it is read only."
181 continue
182 fi
183 # check if it is the only key in the keyring and if so remove the keyring altogether
25f27319 184 if [ '1' = "$(uniq "$FINGERPRINTS" | wc -l)" ]; then
4b30c1dc
DK
185 mv -f "$KEYRINGFILE" "${KEYRINGFILE}~" # behave like gpg
186 return
187 fi
188 # we can't just modify pointed to files as these might be in /usr or something
189 local REALTARGET
190 if [ -L "$KEYRINGFILE" ]; then
191 REALTARGET="$(readlink -f "$KEYRINGFILE")"
192 mv -f "$KEYRINGFILE" "${KEYRINGFILE}.dpkg-tmp"
193 cp -a "$REALTARGET" "$KEYRINGFILE"
194 fi
195 # delete the key from the keyring
fecfbf2e 196 aptkey_execute "$GPG_SH" --keyring "$KEYRINGFILE" --batch --delete-keys --yes "$KEY"
4b30c1dc
DK
197 if [ -n "$REALTARGET" ]; then
198 # the real backup is the old link, not the copy we made
199 mv -f "${KEYRINGFILE}.dpkg-tmp" "${KEYRINGFILE}~"
200 fi
201 done
04937adc
DK
202}
203
4b30c1dc
DK
204foreach_keyring_do() {
205 local ACTION="$1"
206 shift
b0d40854 207 # if a --keyring was given, just work on this one
4b30c1dc
DK
208 if [ -n "$FORCED_KEYRING" ]; then
209 $ACTION "$FORCED_KEYRING" "$@"
210 else
211 # otherwise all known keyrings are up for inspection
5beb682d
DK
212 if [ -s "$TRUSTEDFILE" ]; then
213 $ACTION "$TRUSTEDFILE" "$@"
214 fi
4b30c1dc
DK
215 local TRUSTEDPARTS="/etc/apt/trusted.gpg.d"
216 eval $(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d)
217 if [ -d "$TRUSTEDPARTS" ]; then
5beb682d
DK
218 # strip / suffix as gpg will double-slash in that case (#665411)
219 local STRIPPED_TRUSTEDPARTS="${TRUSTEDPARTS%/}"
220 if [ "${STRIPPED_TRUSTEDPARTS}/" = "$TRUSTEDPARTS" ]; then
221 TRUSTEDPARTS="$STRIPPED_TRUSTEDPARTS"
222 fi
4b30c1dc 223 for trusted in $(run-parts --list "$TRUSTEDPARTS" --regex '^.*\.gpg$'); do
5beb682d
DK
224 if [ -s "$trusted" ]; then
225 $ACTION "$trusted" "$@"
226 fi
4b30c1dc 227 done
04937adc 228 fi
4b30c1dc 229 fi
04937adc
DK
230}
231
0b94a7bc 232run_cmd_on_keyring() {
5beb682d
DK
233 local KEYRINGFILE="$1"
234 shift
0b94a7bc 235 # fingerprint and co will fail if key isn't in this keyring
fecfbf2e 236 aptkey_execute "$GPG_SH" --keyring "$KEYRINGFILE" --batch "$@" 2>/dev/null || true
5beb682d
DK
237}
238
f14cde2c
DK
239import_keyring_into_keyring() {
240 local FROM="${1:-${GPGHOMEDIR}/pubring.gpg}"
241 local TO="${2:-${GPGHOMEDIR}/pubring.gpg}"
242 shift 2
243 rm -f "${GPGHOMEDIR}/gpgoutput.log"
244 # the idea is simple: We take keys from one keyring and copy it to another
3a8776a3 245 # we do this with so many checks in between to ensure that WE control the
f14cde2c
DK
246 # creation, so we know that the (potentially) created $TO keyring is a
247 # simple keyring rather than a keybox as gpg2 would create it which in turn
248 # can't be read by gpgv.
249 # BEWARE: This is designed more in the way to work with the current
250 # callers, than to have a well defined it would be easy to add new callers to.
251 if [ ! -s "$TO" ]; then
252 if [ -s "$FROM" ]; then
253 if [ -z "$2" ]; then
fecfbf2e 254 if ! aptkey_execute "$GPG_SH" --keyring "$FROM" --export ${1:+"$1"} > "$TO" 2> "${GPGHOMEDIR}/gpgoutput.log"; then
f14cde2c
DK
255 cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
256 false
257 else
258 chmod 0644 -- "$TO"
259 fi
260 else
261 create_new_keyring "$TO"
262 fi
263 else
264 create_new_keyring "$TO"
265 fi
266 elif [ -s "$FROM" ]; then
267 local EXPORTLIMIT="$1"
268 if [ -n "$1$2" ]; then shift; fi
fecfbf2e
DK
269 if ! aptkey_execute "$GPG_SH" --keyring "$FROM" --export ${EXPORTLIMIT:+"$EXPORTLIMIT"} \
270 | aptkey_execute "$GPG_SH" --keyring "$TO" --batch --import "$@" > "${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
f14cde2c
DK
271 cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
272 false
273 fi
0dae96a2
DK
274 fi
275}
276
25f27319
DK
277merge_all_trusted_keyrings_into_pubring() {
278 # does the same as:
279 # foreach_keyring_do 'import_keys_from_keyring' "${GPGHOMEDIR}/pubring.gpg"
280 # but without using gpg, just cat and find
281 local PUBRING="${GPGHOMEDIR}/pubring.gpg"
282 # if a --keyring was given, just use this one
283 if [ -n "$FORCED_KEYRING" ]; then
284 if [ -s "$FORCED_KEYRING" ]; then
285 cp --dereference "$FORCED_KEYRING" "$PUBRING"
286 fi
287 else
288 # otherwise all known keyrings are merged
289 local TRUSTEDPARTS="/etc/apt/trusted.gpg.d"
290 eval $(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d)
291 if [ -d "$TRUSTEDPARTS" ]; then
292 # ignore errors mostly for non-existing $TRUSTEDFILE
fecfbf2e
DK
293 {
294 cat "$TRUSTEDFILE" || true
295 for parts in $(find -L "$TRUSTEDPARTS" -type f -name '*.gpg'); do
296 cat "$parts" || true
297 done
298 } > "$PUBRING" 2>/dev/null
25f27319
DK
299 elif [ -s "$TRUSTEDFILE" ]; then
300 cp --dereference "$TRUSTEDFILE" "$PUBRING"
301 fi
302 fi
303
304 if [ ! -s "$PUBRING" ]; then
305 touch "$PUBRING"
306 fi
307}
308
f14cde2c
DK
309import_keys_from_keyring() {
310 import_keyring_into_keyring "$1" "$2"
311}
312
0dae96a2 313merge_keys_into_keyrings() {
f14cde2c 314 import_keyring_into_keyring "$2" "$1" '' --import-options 'merge-only'
0dae96a2
DK
315}
316
317merge_back_changes() {
318 if [ -n "$FORCED_KEYRING" ]; then
319 # if the keyring was forced merge is already done
320 return
321 fi
322 if [ -s "${GPGHOMEDIR}/pubring.gpg" ]; then
323 # merge all updated keys
324 foreach_keyring_do 'merge_keys_into_keyrings' "${GPGHOMEDIR}/pubring.gpg"
325 fi
0b94a7bc 326 # look for keys which were added or removed
0dae96a2
DK
327 get_fingerprints_of_keyring "${GPGHOMEDIR}/pubring.orig.gpg" > "${GPGHOMEDIR}/pubring.orig.keylst"
328 get_fingerprints_of_keyring "${GPGHOMEDIR}/pubring.gpg" > "${GPGHOMEDIR}/pubring.keylst"
25f27319
DK
329 comm -3 "${GPGHOMEDIR}/pubring.keylst" "${GPGHOMEDIR}/pubring.orig.keylst" > "${GPGHOMEDIR}/pubring.diff"
330 # key isn't part of new keyring, so remove
331 cut -f 2 "${GPGHOMEDIR}/pubring.diff" | while read key; do
332 if [ -z "$key" ]; then continue; fi
333 foreach_keyring_do 'remove_key_from_keyring' "$key"
334 done
335 # key is only part of new keyring, so we need to import it
336 cut -f 1 "${GPGHOMEDIR}/pubring.diff" | while read key; do
337 if [ -z "$key" ]; then continue; fi
338 import_keyring_into_keyring '' "$TRUSTEDFILE" "$key"
0dae96a2 339 done
5beb682d
DK
340}
341
342setup_merged_keyring() {
b0d40854 343 if [ -n "$FORCED_KEYID" ]; then
25f27319 344 merge_all_trusted_keyrings_into_pubring
b0d40854
DK
345 FORCED_KEYRING="${GPGHOMEDIR}/forcedkeyid.gpg"
346 TRUSTEDFILE="${FORCED_KEYRING}"
fecfbf2e
DK
347 echo "#!/bin/sh
348exec sh \"${GPG}\" --keyring \"${TRUSTEDFILE}\" \"\$@\"" > "${GPGHOMEDIR}/gpg.1.sh"
349 GPG="${GPGHOMEDIR}/gpg.1.sh"
b0d40854 350 # ignore error as this "just" means we haven't found the forced keyid and the keyring will be empty
f14cde2c 351 import_keyring_into_keyring '' "$TRUSTEDFILE" "$FORCED_KEYID" || true
b0d40854 352 elif [ -z "$FORCED_KEYRING" ]; then
25f27319 353 merge_all_trusted_keyrings_into_pubring
0dae96a2
DK
354 if [ -r "${GPGHOMEDIR}/pubring.gpg" ]; then
355 cp -a "${GPGHOMEDIR}/pubring.gpg" "${GPGHOMEDIR}/pubring.orig.gpg"
356 else
357 touch "${GPGHOMEDIR}/pubring.gpg" "${GPGHOMEDIR}/pubring.orig.gpg"
0740a310 358 fi
fecfbf2e
DK
359 echo "#!/bin/sh
360exec sh \"${GPG}\" --keyring \"${GPGHOMEDIR}/pubring.gpg\" \"\$@\"" > "${GPGHOMEDIR}/gpg.1.sh"
361 GPG="${GPGHOMEDIR}/gpg.1.sh"
0dae96a2 362 else
0dae96a2 363 create_new_keyring "$TRUSTEDFILE"
fecfbf2e
DK
364 echo "#!/bin/sh
365exec sh \"${GPG}\" --keyring \"${TRUSTEDFILE}\" \"\$@\"" > "${GPGHOMEDIR}/gpg.1.sh"
366 GPG="${GPGHOMEDIR}/gpg.1.sh"
5beb682d
DK
367 fi
368}
369
0dae96a2
DK
370create_new_keyring() {
371 # gpg defaults to mode 0600 for new keyrings. Create one with 0644 instead.
372 if ! [ -e "$TRUSTEDFILE" ]; then
373 if [ -w "$(dirname "$TRUSTEDFILE")" ]; then
374 touch -- "$TRUSTEDFILE"
375 chmod 0644 -- "$TRUSTEDFILE"
376 fi
377 fi
378}
5beb682d 379
fecfbf2e
DK
380aptkey_execute() { sh "$@"; }
381
b3d44315 382usage() {
46e39c8e 383 echo "Usage: apt-key [--keyring file] [command] [arguments]"
b3d44315
MV
384 echo
385 echo "Manage apt's list of trusted keys"
386 echo
387 echo " apt-key add <file> - add the key contained in <file> ('-' for stdin)"
388 echo " apt-key del <keyid> - remove the key <keyid>"
bf6d5b42
OS
389 echo " apt-key export <keyid> - output the key <keyid>"
390 echo " apt-key exportall - output all trusted keys"
4a242c5b 391 echo " apt-key update - update keys using the keyring package"
848ecfa4 392 echo " apt-key net-update - update keys using the network"
b3d44315 393 echo " apt-key list - list keys"
a8cabc8f
LB
394 echo " apt-key finger - list fingerprints"
395 echo " apt-key adv - pass advanced options to gpg (download key)"
b3d44315 396 echo
46e39c8e 397 echo "If no specific keyring file is given the command applies to all keyring files."
b3d44315
MV
398}
399
3dc55197
DK
400while [ -n "$1" ]; do
401 case "$1" in
402 --keyring)
403 shift
404 TRUSTEDFILE="$1"
04937adc 405 FORCED_KEYRING="$1"
3dc55197 406 ;;
b0d40854
DK
407 --keyid)
408 shift
409 FORCED_KEYID="$1"
410 ;;
bd7fb5aa
DK
411 --secret-keyring)
412 shift
413 FORCED_SECRET_KEYRING="$1"
33a22672
DK
414 ;;
415 --readonly)
416 merge_back_changes() { true; }
fecfbf2e 417 create_new_keyring() { if [ ! -r "$FORCED_KEYRING" ]; then TRUSTEDFILE='/dev/null'; FORCED_KEYRING="$TRUSTEDFILE"; fi; }
bd7fb5aa 418 ;;
3dc55197
DK
419 --fakeroot)
420 requires_root() { true; }
3dc55197 421 ;;
3d0def05
DK
422 --quiet)
423 aptkey_echo() { true; }
3d0def05 424 ;;
c1642be5
DK
425 --debug1)
426 # some cmds like finger redirect stderr to /dev/null …
fecfbf2e 427 aptkey_execute() { echo 'EXEC:' "$@"; sh "$@"; }
c1642be5
DK
428 ;;
429 --debug2)
430 # … other more complicated ones pipe gpg into gpg.
fecfbf2e 431 aptkey_execute() { echo >&2 'EXEC:' "$@"; sh "$@"; }
c1642be5 432 ;;
3dc55197
DK
433 --*)
434 echo >&2 "Unknown option: $1"
435 usage
436 exit 1;;
437 *)
438 break;;
439 esac
33a22672 440 shift
3dc55197
DK
441done
442
443if [ -z "$TRUSTEDFILE" ]; then
444 TRUSTEDFILE="/etc/apt/trusted.gpg"
445 eval $(apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring)
446 eval $(apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f)
46e39c8e 447fi
46e39c8e 448
b3d44315
MV
449command="$1"
450if [ -z "$command" ]; then
451 usage
452 exit 1
453fi
454shift
455
25f27319
DK
456create_gpg_home() {
457 # gpg needs (in different versions more or less) files to function correctly,
458 # so we give it its own homedir and generate some valid content for it later on
459 if [ -n "$TMPDIR" ]; then
460 # tmpdir is a directory and current user has rwx access to it
461 # same tests as in apt-pkg/contrib/fileutl.cc GetTempDir()
462 if [ ! -d "$TMPDIR" ] || [ ! -r "$TMPDIR" ] || [ ! -w "$TMPDIR" ] || [ ! -x "$TMPDIR" ]; then
463 unset TMPDIR
464 fi
465 fi
466 GPGHOMEDIR="$(mktemp -d)"
467 CURRENTTRAP="${CURRENTTRAP} rm -rf '${GPGHOMEDIR}';"
468 trap "${CURRENTTRAP}" 0 HUP INT QUIT ILL ABRT FPE SEGV PIPE TERM
469 chmod 700 "$GPGHOMEDIR"
470}
471
472prepare_gpg_home() {
93d0d08c
DK
473 eval $(apt-config shell GPG_EXE Apt::Key::gpgcommand)
474
475 if [ -n "$GPG_EXE" ] && which "$GPG_EXE" >/dev/null 2>&1; then
476 true
477 elif which gpg >/dev/null 2>&1; then
478 GPG_EXE="gpg"
479 elif which gpg2 >/dev/null 2>&1; then
480 GPG_EXE="gpg2"
481 else
482 echo >&2 "Error: gnupg or gnupg2 do not seem to be installed,"
25f27319 483 echo >&2 "Error: but apt-key requires gnupg or gnupg2 for this operation."
9fda3be1 484 echo >&2
93d0d08c 485 exit 255
9fda3be1
DK
486 fi
487
25f27319
DK
488 create_gpg_home
489
05991180
DK
490 # We don't use a secret keyring, of course, but gpg panics and
491 # implodes if there isn't one available - and writeable for imports
492 SECRETKEYRING="${GPGHOMEDIR}/secring.gpg"
fecfbf2e
DK
493 touch "$SECRETKEYRING"
494
05991180
DK
495 # create the trustdb with an (empty) dummy keyring
496 # older gpgs required it, newer gpgs even warn that it isn't needed,
497 # but require it nonetheless for some commands, so we just play safe
498 # here for the foreseeable future and create a dummy one
fecfbf2e
DK
499 if ! "$GPG_EXE" --ignore-time-conflict --no-options --no-default-keyring \
500 --homedir "$GPGHOMEDIR" --quiet --check-trustdb --keyring "$SECRETKEYRING" >"${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
501 cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
502 false
503 fi
05991180 504 # tell gpg that it shouldn't try to maintain a trustdb file
fecfbf2e
DK
505 echo "#!/bin/sh
506exec \"${GPG_EXE}\" --ignore-time-conflict --no-options --no-default-keyring \\
507 --homedir \"${GPGHOMEDIR}\" --no-auto-check-trustdb --trust-model always \"\$@\"" > "${GPGHOMEDIR}/gpg.0.sh"
508 GPG_SH="${GPGHOMEDIR}/gpg.0.sh"
509 GPG="$GPG_SH"
05991180 510
bd7fb5aa
DK
511 # for advanced operations, we might really need a secret keyring after all
512 if [ -n "$FORCED_SECRET_KEYRING" ] && [ -r "$FORCED_SECRET_KEYRING" ]; then
513 rm -f "$SECRETKEYRING"
514 cp -a "$FORCED_SECRET_KEYRING" "$SECRETKEYRING"
515 fi
f14cde2c
DK
516
517 # older gpg versions need a secring file, but newer versions take it as
518 # a hint to start a migration from earlier versions. The file is empty
519 # anyhow, so nothing actually happens, but its three lines of output
520 # nobody expects to see in apt-key context, so trigger it in silence
fecfbf2e 521 echo -n | aptkey_execute "$GPG" --batch --import >/dev/null 2>&1 || true
25f27319
DK
522}
523
524if [ "$command" != 'help' ] && [ "$command" != 'verify' ]; then
525 prepare_gpg_home
b3d44315
MV
526fi
527
b3d44315
MV
528case "$command" in
529 add)
5beb682d
DK
530 requires_root
531 setup_merged_keyring
fecfbf2e 532 aptkey_execute "$GPG" --quiet --batch --import "$@"
0dae96a2 533 merge_back_changes
5beb682d 534 aptkey_echo "OK"
b3d44315
MV
535 ;;
536 del|rm|remove)
5beb682d
DK
537 requires_root
538 foreach_keyring_do 'remove_key_from_keyring' "$@"
539 aptkey_echo "OK"
b3d44315 540 ;;
4a242c5b 541 update)
5beb682d
DK
542 requires_root
543 setup_merged_keyring
4a242c5b 544 update
0dae96a2 545 merge_back_changes
4a242c5b 546 ;;
848ecfa4 547 net-update)
5beb682d
DK
548 requires_root
549 setup_merged_keyring
848ecfa4 550 net_update
0dae96a2 551 merge_back_changes
848ecfa4 552 ;;
b3d44315 553 list)
0b94a7bc 554 foreach_keyring_do 'run_cmd_on_keyring' --list-keys "$@"
5beb682d 555 ;;
b3d44315 556 finger*)
0b94a7bc 557 foreach_keyring_do 'run_cmd_on_keyring' --fingerprint "$@"
5beb682d 558 ;;
4f51a496 559 export|exportall)
25f27319 560 merge_all_trusted_keyrings_into_pubring
fecfbf2e 561 aptkey_execute "$GPG_SH" --keyring "${GPGHOMEDIR}/pubring.gpg" --armor --export "$@"
5beb682d 562 ;;
b3d44315 563 adv*)
5beb682d
DK
564 setup_merged_keyring
565 aptkey_echo "Executing: $GPG $*"
fecfbf2e 566 aptkey_execute "$GPG" "$@"
0dae96a2 567 merge_back_changes
5beb682d 568 ;;
c46a36ad 569 verify)
f14cde2c
DK
570 GPGV=''
571 eval $(apt-config shell GPGV Apt::Key::gpgvcommand)
25f27319 572 if [ -n "$GPGV" ] && which "$GPGV" >/dev/null 2>&1; then true;
f14cde2c
DK
573 elif which gpgv >/dev/null 2>&1; then GPGV='gpgv';
574 elif which gpgv2 >/dev/null 2>&1; then GPGV='gpgv2';
25f27319
DK
575 else
576 echo >&2 'ERROR: gpgv or gpgv2 required for verification'
577 exit 29
f14cde2c 578 fi
25f27319
DK
579 # for a forced keyid we need gpg --export, so full wrapping required
580 if [ -n "$FORCED_KEYID" ]; then
581 prepare_gpg_home
582 else
583 create_gpg_home
584 fi
585 setup_merged_keyring
586 if [ -n "$FORCED_KEYRING" ]; then
fecfbf2e 587 "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "${FORCED_KEYRING}" --ignore-time-conflict "$@"
c46a36ad 588 else
fecfbf2e 589 "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "${GPGHOMEDIR}/pubring.gpg" --ignore-time-conflict "$@"
c46a36ad
DK
590 fi
591 ;;
b3d44315
MV
592 help)
593 usage
594 ;;
595 *)
596 usage
597 exit 1
598 ;;
599esac