cmdline/apt-key.in

   1 #!/bin/sh
   2
   3 set -e
   4 unset GREP_OPTIONS
   5
   6 APT_DIR="/"
   7 eval $(apt-config shell APT_DIR Dir)
   8
   9 MASTER_KEYRING='&keyring-master-filename;'
  10 eval $(apt-config shell MASTER_KEYRING APT::Key::MasterKeyring)
  11 ARCHIVE_KEYRING='&keyring-filename;'
  12 eval $(apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring)
  13 REMOVED_KEYS='&keyring-removed-filename;'
  14 eval $(apt-config shell REMOVED_KEYS APT::Key::RemovedKeys)
  15 ARCHIVE_KEYRING_URI='&keyring-uri;'
  16 eval $(apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI)
  17 TMP_KEYRING=${APT_DIR}/var/lib/apt/keyrings/maybe-import-keyring.gpg
  18
  19 aptkey_echo() { echo "$@"; }
  20
  21 requires_root() {
  22         if [ "$(id -u)" -ne 0 ]; then
  23                 echo >&2 "ERROR: This command can only be used by root."
  24                 exit 1
  25         fi
  26 }
  27
  28 add_keys_with_verify_against_master_keyring() {
  29     ADD_KEYRING=$1
  30     MASTER=$2
  31
  32     if [ ! -f "$ADD_KEYRING" ]; then
  33         echo >&2 "ERROR: '$ADD_KEYRING' not found"
  34         return
  35     fi
  36     if [ ! -f "$MASTER" ]; then
  37         echo >&2 "ERROR: '$MASTER' not found"
  38         return
  39     fi
  40
  41     # when adding new keys, make sure that the archive-master-keyring
  42     # is honored. so:
  43     #   all keys that are exported must have a valid signature
  44     #   from a key in the $distro-master-keyring
  45     add_keys=`$GPG_CMD --keyring $ADD_KEYRING --with-colons --list-keys | grep ^pub | cut -d: -f5`
  46     all_add_keys=`$GPG_CMD --keyring $ADD_KEYRING --with-colons --list-keys | grep ^[ps]ub | cut -d: -f5`
  47     master_keys=`$GPG_CMD --keyring $MASTER --with-colons --list-keys | grep ^pub | cut -d: -f5`
  48
  49     # ensure there are no colisions LP: #857472
  50     for all_add_key in $all_add_keys; do
  51         for master_key in $master_keys; do
  52             if [ "$all_add_key" = "$master_key" ]; then
  53                 echo >&2 "Keyid collision for '$all_add_key' detected, operation aborted"
  54                 return 1
  55             fi
  56         done
  57     done
  58
  59     for add_key in $add_keys; do
  60         # export the add keyring one-by-one
  61         rm -f $TMP_KEYRING
  62         $GPG_CMD --keyring $ADD_KEYRING --output $TMP_KEYRING --export $add_key
  63         # check if signed with the master key and only add in this case
  64         ADDED=0
  65         for master_key in $master_keys; do
  66             if $GPG_CMD --keyring $MASTER --keyring $TMP_KEYRING --check-sigs --with-colons $add_key | grep '^sig:!:' | cut -d: -f5 | grep -q $master_key; then
  67                 $GPG --import $TMP_KEYRING
  68                 ADDED=1
  69             fi
  70         done
  71         if [ $ADDED = 0 ]; then
  72             echo >&2 "Key '$add_key' not added. It is not signed with a master key"
  73         fi
  74     done
  75     rm -f $TMP_KEYRING
  76 }
  77
  78 # update the current archive signing keyring from a network URI
  79 # the archive-keyring keys needs to be signed with the master key
  80 # (otherwise it does not make sense from a security POV)
  81 net_update() {
  82     # Disabled for now as code is insecure (LP: #1013639 (and 857472, 1013128))
  83     APT_KEY_NET_UPDATE_ENABLED=""
  84     eval $(apt-config shell APT_KEY_NET_UPDATE_ENABLED APT::Key::Net-Update-Enabled)
  85     if [ -z "$APT_KEY_NET_UPDATE_ENABLED" ]; then
  86         exit 1
  87     fi
  88
  89     if [ -z "$ARCHIVE_KEYRING_URI" ]; then
  90         echo >&2 "ERROR: Your distribution is not supported in net-update as no uri for the archive-keyring is set"
  91         exit 1
  92     fi
  93     # in theory we would need to depend on wget for this, but this feature
  94     # isn't useable in debian anyway as we have no keyring uri nor a master key
  95     if ! which wget >/dev/null 2>&1; then
  96         echo >&2 "ERROR: an installed wget is required for a network-based update"
  97         exit 1
  98     fi
  99     if [ ! -d ${APT_DIR}/var/lib/apt/keyrings ]; then
 100         mkdir -p ${APT_DIR}/var/lib/apt/keyrings
 101     fi
 102     keyring=${APT_DIR}/var/lib/apt/keyrings/$(basename $ARCHIVE_KEYRING_URI)
 103     old_mtime=0
 104     if [ -e $keyring ]; then
 105         old_mtime=$(stat -c %Y $keyring)
 106     fi
 107     (cd  ${APT_DIR}/var/lib/apt/keyrings; wget --timeout=90 -q -N $ARCHIVE_KEYRING_URI)
 108     if [ ! -e $keyring ]; then
 109         return
 110     fi
 111     new_mtime=$(stat -c %Y $keyring)
 112     if [ $new_mtime -ne $old_mtime ]; then
 113         aptkey_echo "Checking for new archive signing keys now"
 114         add_keys_with_verify_against_master_keyring $keyring $MASTER_KEYRING
 115     fi
 116 }
 117
 118 update() {
 119     if [ ! -f $ARCHIVE_KEYRING ]; then
 120         echo >&2 "ERROR: Can't find the archive-keyring"
 121         echo >&2 "Is the &keyring-package; package installed?"
 122         exit 1
 123     fi
 124
 125     # add new keys from the package;
 126
 127     # we do not use add_keys_with_verify_against_master_keyring here,
 128     # because "update" is run on regular package updates.  A
 129     # attacker might as well replace the master-archive-keyring file
 130     # in the package and add his own keys. so this check wouldn't
 131     # add any security. we *need* this check on net-update though
 132     $GPG_CMD --quiet --batch --keyring $ARCHIVE_KEYRING --export | $GPG --import
 133
 134     if [ -r "$REMOVED_KEYS" ]; then
 135         # remove no-longer supported/used keys
 136         $GPG_CMD --keyring $REMOVED_KEYS --with-colons --list-keys | grep ^pub | cut -d: -f5 | while read key; do
 137             foreach_keyring_do 'remove_key_from_keyring' "$key"
 138         done
 139     else
 140         echo >&2 "Warning: removed keys keyring  $REMOVED_KEYS missing or not readable"
 141     fi
 142 }
 143
 144 remove_key_from_keyring() {
 145     local KEYRINGFILE="$1"
 146     shift
 147     # non-existent keyrings have by definition no keys
 148     if [ ! -e "$KEYRINGFILE" ]; then
 149        return
 150     fi
 151
 152     local GPG="$GPG_CMD --keyring $KEYRINGFILE"
 153     while [ -n "$1" ]; do
 154        local KEY="$1"
 155        shift
 156         # check if the key is in this keyring: the key id is in the 5 column at the end
 157         if ! $GPG --with-colons --list-keys 2>&1 | grep -q "^pub:[^:]*:[^:]*:[^:]*:[0-9A-F]*${KEY}:"; then
 158             continue
 159         fi
 160         if [ ! -w "$KEYRINGFILE" ]; then
 161             echo >&2 "Key ${KEY} is in keyring ${KEYRINGFILE}, but can't be removed as it is read only."
 162             continue
 163         fi
 164         # check if it is the only key in the keyring and if so remove the keyring altogether
 165         if [ '1' = "$($GPG --with-colons --list-keys | grep "^pub:[^:]*:[^:]*:[^:]*:[0-9A-F]\+:" | wc -l)" ]; then
 166             mv -f "$KEYRINGFILE" "${KEYRINGFILE}~" # behave like gpg
 167             return
 168         fi
 169         # we can't just modify pointed to files as these might be in /usr or something
 170         local REALTARGET
 171         if [ -L "$KEYRINGFILE" ]; then
 172             REALTARGET="$(readlink -f "$KEYRINGFILE")"
 173             mv -f "$KEYRINGFILE" "${KEYRINGFILE}.dpkg-tmp"
 174             cp -a "$REALTARGET" "$KEYRINGFILE"
 175         fi
 176         # delete the key from the keyring
 177         $GPG --batch --delete-key --yes "$KEY"
 178         if [ -n "$REALTARGET" ]; then
 179             # the real backup is the old link, not the copy we made
 180             mv -f "${KEYRINGFILE}.dpkg-tmp" "${KEYRINGFILE}~"
 181         fi
 182     done
 183 }
 184
 185 foreach_keyring_do() {
 186    local ACTION="$1"
 187    shift
 188    # if a --keyring was given, just remove from there
 189    if [ -n "$FORCED_KEYRING" ]; then
 190         $ACTION "$FORCED_KEYRING" "$@"
 191    else
 192         # otherwise all known keyrings are up for inspection
 193         if [ -s "$TRUSTEDFILE" ]; then
 194             $ACTION "$TRUSTEDFILE" "$@"
 195         fi
 196         local TRUSTEDPARTS="/etc/apt/trusted.gpg.d"
 197         eval $(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d)
 198         if [ -d "$TRUSTEDPARTS" ]; then
 199             # strip / suffix as gpg will double-slash in that case (#665411)
 200             local STRIPPED_TRUSTEDPARTS="${TRUSTEDPARTS%/}"
 201             if [ "${STRIPPED_TRUSTEDPARTS}/" = "$TRUSTEDPARTS" ]; then
 202                 TRUSTEDPARTS="$STRIPPED_TRUSTEDPARTS"
 203             fi
 204             for trusted in $(run-parts --list "$TRUSTEDPARTS" --regex '^.*\.gpg$'); do
 205                 if [ -s "$trusted" ]; then
 206                     $ACTION "$trusted" "$@"
 207                 fi
 208             done
 209         fi
 210    fi
 211 }
 212
 213 list_keys_from_keyring() {
 214     local KEYRINGFILE="$1"
 215     shift
 216     # don't show the error message if this keyring doesn't include the key
 217     $GPG_CMD --keyring "$KEYRINGFILE" --batch --list-keys "$@" 2>/dev/null || true
 218 }
 219
 220 fingerprint_keys_from_keyring() {
 221     local KEYRINGFILE="$1"
 222     shift
 223     # don't show the error message if this keyring doesn't include the fingerprint
 224     $GPG_CMD --keyring "$KEYRINGFILE" --batch --fingerprint "$@" 2>/dev/null || true
 225 }
 226
 227 import_keys_from_keyring() {
 228     local IMPORT="$1"
 229     local KEYRINGFILE="$2"
 230     $GPG_CMD --keyring "$KEYRINGFILE" --batch --import "$IMPORT" >/dev/null 2>&1
 231 }
 232
 233 setup_merged_keyring() {
 234     if [ -z "$FORCED_KEYRING" ]; then
 235         local TRUSTEDFILE_BAK="$TRUSTEDFILE"
 236         TRUSTEDFILE='/dev/null'
 237         foreach_keyring_do 'import_keys_from_keyring' "${GPGHOMEDIR}/pubring.gpg"
 238         TRUSTEDFILE="$TRUSTEDFILE_BAK"
 239         # mark it as non-writeable so users get errors if gnupg tries to modify it
 240         if [ -s "${GPGHOMEDIR}/pubring.gpg" ]; then
 241             chmod -w "${GPGHOMEDIR}/pubring.gpg"
 242             GPG="$GPG --keyring ${GPGHOMEDIR}/pubring.gpg"
 243         fi
 244     fi
 245     if [ -r "$TRUSTEDFILE" ]; then
 246         GPG="$GPG --keyring $TRUSTEDFILE --primary-keyring $TRUSTEDFILE"
 247     fi
 248 }
 249
 250
 251 usage() {
 252     echo "Usage: apt-key [--keyring file] [command] [arguments]"
 253     echo
 254     echo "Manage apt's list of trusted keys"
 255     echo
 256     echo "  apt-key add <file>          - add the key contained in <file> ('-' for stdin)"
 257     echo "  apt-key del <keyid>         - remove the key <keyid>"
 258     echo "  apt-key export <keyid>      - output the key <keyid>"
 259     echo "  apt-key exportall           - output all trusted keys"
 260     echo "  apt-key update              - update keys using the keyring package"
 261     echo "  apt-key net-update          - update keys using the network"
 262     echo "  apt-key list                - list keys"
 263     echo "  apt-key finger              - list fingerprints"
 264     echo "  apt-key adv                 - pass advanced options to gpg (download key)"
 265     echo
 266     echo "If no specific keyring file is given the command applies to all keyring files."
 267 }
 268
 269 while [ -n "$1" ]; do
 270    case "$1" in
 271       --keyring)
 272          shift
 273          TRUSTEDFILE="$1"
 274          FORCED_KEYRING="$1"
 275          shift
 276          ;;
 277       --fakeroot)
 278          requires_root() { true; }
 279          shift
 280          ;;
 281       --quiet)
 282          aptkey_echo() { true; }
 283          shift
 284          ;;
 285       --*)
 286          echo >&2 "Unknown option: $1"
 287          usage
 288          exit 1;;
 289       *)
 290          break;;
 291    esac
 292 done
 293
 294 if [ -z "$TRUSTEDFILE" ]; then
 295    TRUSTEDFILE="/etc/apt/trusted.gpg"
 296    eval $(apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring)
 297    eval $(apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f)
 298 fi
 299
 300 command="$1"
 301 if [ -z "$command" ]; then
 302     usage
 303     exit 1
 304 fi
 305 shift
 306
 307 if [ "$command" != "help" ]; then
 308     eval $(apt-config shell GPG_EXE Apt::Key::gpgcommand)
 309
 310     if [ -n "$GPG_EXE" ] && which "$GPG_EXE" >/dev/null 2>&1; then
 311         true
 312     elif which gpg >/dev/null 2>&1; then
 313         GPG_EXE="gpg"
 314     elif which gpg2 >/dev/null 2>&1; then
 315         GPG_EXE="gpg2"
 316     else
 317         echo >&2 "Error: gnupg or gnupg2 do not seem to be installed,"
 318         echo >&2 "Error: but apt-key requires gnupg or gnupg2 for operation."
 319         echo >&2
 320         exit 255
 321     fi
 322
 323     GPG_CMD="$GPG_EXE --ignore-time-conflict --no-options --no-default-keyring"
 324
 325     # gpg needs (in different versions more or less) files to function correctly,
 326     # so we give it its own homedir and generate some valid content for it
 327     GPGHOMEDIR="$(mktemp -d)"
 328     CURRENTTRAP="${CURRENTTRAP} rm -rf '${GPGHOMEDIR}';"
 329     trap "${CURRENTTRAP}" 0 HUP INT QUIT ILL ABRT FPE SEGV PIPE TERM
 330     chmod 700 "$GPGHOMEDIR"
 331     # We don't use a secret keyring, of course, but gpg panics and
 332     # implodes if there isn't one available - and writeable for imports
 333     SECRETKEYRING="${GPGHOMEDIR}/secring.gpg"
 334     touch $SECRETKEYRING
 335     GPG_CMD="$GPG_CMD --homedir $GPGHOMEDIR"
 336     # create the trustdb with an (empty) dummy keyring
 337     # older gpgs required it, newer gpgs even warn that it isn't needed,
 338     # but require it nonetheless for some commands, so we just play safe
 339     # here for the foreseeable future and create a dummy one
 340     $GPG_CMD --quiet --check-trustdb --keyring $SECRETKEYRING >/dev/null 2>&1
 341     # tell gpg that it shouldn't try to maintain a trustdb file
 342     GPG_CMD="$GPG_CMD --no-auto-check-trustdb --trust-model always"
 343     GPG="$GPG_CMD"
 344
 345     # gpg defaults to mode 0600 for new keyrings. Create one with 0644 instead.
 346     if ! [ -e "$TRUSTEDFILE" ]; then
 347         if [ -w "$(dirname "$TRUSTEDFILE")" ]; then
 348            touch -- "$TRUSTEDFILE"
 349            chmod 0644 -- "$TRUSTEDFILE"
 350         fi
 351     fi
 352 fi
 353
 354 case "$command" in
 355     add)
 356         requires_root
 357         setup_merged_keyring
 358         $GPG --quiet --batch --import "$@"
 359         aptkey_echo "OK"
 360         ;;
 361     del|rm|remove)
 362         requires_root
 363         foreach_keyring_do 'remove_key_from_keyring' "$@"
 364         aptkey_echo "OK"
 365         ;;
 366     update)
 367         requires_root
 368         setup_merged_keyring
 369         update
 370         ;;
 371     net-update)
 372         requires_root
 373         setup_merged_keyring
 374         net_update
 375         ;;
 376     list)
 377         foreach_keyring_do 'list_keys_from_keyring' "$@"
 378         ;;
 379     finger*)
 380         foreach_keyring_do 'fingerprint_keys_from_keyring' "$@"
 381         ;;
 382     export|exportall)
 383         foreach_keyring_do 'import_keys_from_keyring' "${GPGHOMEDIR}/trusted.gpg"
 384         $GPG_CMD --keyring "${GPGHOMEDIR}/trusted.gpg" --armor --export "$@"
 385         ;;
 386     adv*)
 387         setup_merged_keyring
 388         aptkey_echo "Executing: $GPG $*"
 389         $GPG "$@"
 390         ;;
 391     help)
 392         usage
 393         ;;
 394     *)
 395         usage
 396         exit 1
 397         ;;
 398 esac