cmdline/apt-key.in

   1 #!/bin/sh
   2
   3 set -e
   4 unset GREP_OPTIONS
   5 export IFS="$(printf "\n\b")"
   6
   7 APT_DIR="/"
   8 eval $(apt-config shell APT_DIR Dir)
   9
  10 MASTER_KEYRING='&keyring-master-filename;'
  11 eval $(apt-config shell MASTER_KEYRING APT::Key::MasterKeyring)
  12 ARCHIVE_KEYRING='&keyring-filename;'
  13 eval $(apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring)
  14 REMOVED_KEYS='&keyring-removed-filename;'
  15 eval $(apt-config shell REMOVED_KEYS APT::Key::RemovedKeys)
  16 ARCHIVE_KEYRING_URI='&keyring-uri;'
  17 eval $(apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI)
  18
  19 aptkey_echo() { echo "$@"; }
  20
  21 requires_root() {
  22         if [ "$(id -u)" -ne 0 ]; then
  23                 echo >&2 "ERROR: This command can only be used by root."
  24                 exit 1
  25         fi
  26 }
  27
  28 command_available() {
  29     # command -v "$1" >/dev/null 2>&1 # not required by policy, see #747320
  30     # which "$1" >/dev/null 2>&1 # is in debianutils (essential) but not on non-debian systems
  31     local OLDIFS="$IFS"
  32     IFS=:
  33     for p in $PATH; do
  34         if [ -x "${p}/${1}" ]; then
  35             IFS="$OLDIFS"
  36             return 0
  37         fi
  38     done
  39     IFS="$OLDIFS"
  40     return 1
  41 }
  42
  43 get_fingerprints_of_keyring() {
  44     aptkey_execute "$GPG_SH" --keyring "$1" --with-colons --fingerprint | while read publine; do
  45         # search for a public key
  46         if [ "${publine%%:*}" != 'pub' ]; then continue; fi
  47         # search for the associated fingerprint (should be the very next line)
  48         while read fprline; do
  49            if [ "${fprline%%:*}" = 'sub' ]; then break; # should never happen
  50            elif [ "${fprline%%:*}" != 'fpr' ]; then continue; fi
  51            echo "$fprline" | cut -d':' -f 10
  52         done
  53         # order in the keyring shouldn't be important
  54     done | sort
  55 }
  56
  57 add_keys_with_verify_against_master_keyring() {
  58     ADD_KEYRING=$1
  59     MASTER=$2
  60
  61     if [ ! -f "$ADD_KEYRING" ]; then
  62         echo >&2 "ERROR: '$ADD_KEYRING' not found"
  63         return
  64     fi
  65     if [ ! -f "$MASTER" ]; then
  66         echo >&2 "ERROR: '$MASTER' not found"
  67         return
  68     fi
  69
  70     # when adding new keys, make sure that the archive-master-keyring
  71     # is honored. so:
  72     #   all keys that are exported must have a valid signature
  73     #   from a key in the $distro-master-keyring
  74     add_keys="$(get_fingerprints_of_keyring "$ADD_KEYRING")"
  75     all_add_keys=`aptkey_execute "$GPG_SH" --keyring "$ADD_KEYRING" --with-colons --list-keys | grep ^[ps]ub | cut -d: -f5`
  76     master_keys=`aptkey_execute "$GPG_SH" --keyring "$MASTER" --with-colons --list-keys | grep ^pub | cut -d: -f5`
  77
  78     # ensure there are no colisions LP: #857472
  79     for all_add_key in $all_add_keys; do
  80         for master_key in $master_keys; do
  81             if [ "$all_add_key" = "$master_key" ]; then
  82                 echo >&2 "Keyid collision for '$all_add_key' detected, operation aborted"
  83                 return 1
  84             fi
  85         done
  86     done
  87
  88     for add_key in $add_keys; do
  89         # export the add keyring one-by-one
  90         local TMP_KEYRING="${GPGHOMEDIR}/tmp-keyring.gpg"
  91         aptkey_execute "$GPG_SH" --batch --yes --keyring "$ADD_KEYRING" --output "$TMP_KEYRING" --export "$add_key"
  92         if ! aptkey_execute "$GPG_SH" --batch --yes --keyring "$TMP_KEYRING" --import "$MASTER" > "${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
  93             cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
  94             false
  95         fi
  96         # check if signed with the master key and only add in this case
  97         ADDED=0
  98         for master_key in $master_keys; do
  99             if aptkey_execute "$GPG_SH" --keyring "$TMP_KEYRING" --check-sigs --with-colons "$add_key" \
 100                | grep '^sig:!:' | cut -d: -f5 | grep -q "$master_key"; then
 101                 aptkey_execute "$GPG_SH" --batch --yes --keyring "$ADD_KEYRING" --export "$add_key" \
 102                    | aptkey_execute "$GPG" --batch --yes --import
 103                 ADDED=1
 104             fi
 105         done
 106         if [ $ADDED = 0 ]; then
 107             echo >&2 "Key '$add_key' not added. It is not signed with a master key"
 108         fi
 109         rm -f "${TMP_KEYRING}"
 110     done
 111 }
 112
 113 # update the current archive signing keyring from a network URI
 114 # the archive-keyring keys needs to be signed with the master key
 115 # (otherwise it does not make sense from a security POV)
 116 net_update() {
 117     # Disabled for now as code is insecure (LP: #1013639 (and 857472, 1013128))
 118     APT_KEY_NET_UPDATE_ENABLED=""
 119     eval $(apt-config shell APT_KEY_NET_UPDATE_ENABLED APT::Key::Net-Update-Enabled)
 120     if [ -z "$APT_KEY_NET_UPDATE_ENABLED" ]; then
 121         exit 1
 122     fi
 123
 124     if [ -z "$ARCHIVE_KEYRING_URI" ]; then
 125         echo >&2 "ERROR: Your distribution is not supported in net-update as no uri for the archive-keyring is set"
 126         exit 1
 127     fi
 128     # in theory we would need to depend on wget for this, but this feature
 129     # isn't useable in debian anyway as we have no keyring uri nor a master key
 130     if ! command_available 'wget'; then
 131         echo >&2 "ERROR: an installed wget is required for a network-based update"
 132         exit 1
 133     fi
 134     if [ ! -d "${APT_DIR}/var/lib/apt/keyrings" ]; then
 135         mkdir -p "${APT_DIR}/var/lib/apt/keyrings"
 136     fi
 137     keyring="${APT_DIR}/var/lib/apt/keyrings/$(basename "$ARCHIVE_KEYRING_URI")"
 138     old_mtime=0
 139     if [ -e $keyring ]; then
 140         old_mtime=$(stat -c %Y $keyring)
 141     fi
 142     (cd  "${APT_DIR}/var/lib/apt/keyrings"; wget --timeout=90 -q -N "$ARCHIVE_KEYRING_URI")
 143     if [ ! -e "$keyring" ]; then
 144         return
 145     fi
 146     new_mtime=$(stat -c %Y "$keyring")
 147     if [ $new_mtime -ne $old_mtime ]; then
 148         aptkey_echo "Checking for new archive signing keys now"
 149         add_keys_with_verify_against_master_keyring "$keyring" "$MASTER_KEYRING"
 150     fi
 151 }
 152
 153 update() {
 154     if [ ! -f "$ARCHIVE_KEYRING" ]; then
 155         echo >&2 "ERROR: Can't find the archive-keyring"
 156         echo >&2 "Is the &keyring-package; package installed?"
 157         exit 1
 158     fi
 159
 160     # add new keys from the package;
 161
 162     # we do not use add_keys_with_verify_against_master_keyring here,
 163     # because "update" is run on regular package updates.  A
 164     # attacker might as well replace the master-archive-keyring file
 165     # in the package and add his own keys. so this check wouldn't
 166     # add any security. we *need* this check on net-update though
 167     import_keyring_into_keyring "$ARCHIVE_KEYRING" '' && cat "${GPGHOMEDIR}/gpgoutput.log"
 168
 169     if [ -r "$REMOVED_KEYS" ]; then
 170         # remove no-longer supported/used keys
 171         get_fingerprints_of_keyring "$REMOVED_KEYS" | while read key; do
 172             foreach_keyring_do 'remove_key_from_keyring' "$key"
 173         done
 174     else
 175         echo >&2 "Warning: removed keys keyring  $REMOVED_KEYS missing or not readable"
 176     fi
 177 }
 178
 179 remove_key_from_keyring() {
 180     local KEYRINGFILE="$1"
 181     shift
 182     # non-existent keyrings have by definition no keys
 183     if [ ! -e "$KEYRINGFILE" ]; then
 184        return
 185     fi
 186
 187     for KEY in "$@"; do
 188         local FINGERPRINTS="${GPGHOMEDIR}/keyringfile.keylst"
 189         get_fingerprints_of_keyring "$KEYRINGFILE" > "$FINGERPRINTS"
 190         # check if the key is in this keyring
 191         if ! grep -iq "^[0-9A-F]*${KEY}$" "$FINGERPRINTS"; then
 192             continue
 193         fi
 194         if [ ! -w "$KEYRINGFILE" ]; then
 195             echo >&2 "Key ${KEY} is in keyring ${KEYRINGFILE}, but can't be removed as it is read only."
 196             continue
 197         fi
 198         # check if it is the only key in the keyring and if so remove the keyring altogether
 199         if [ '1' = "$(uniq "$FINGERPRINTS" | wc -l)" ]; then
 200             mv -f "$KEYRINGFILE" "${KEYRINGFILE}~" # behave like gpg
 201             return
 202         fi
 203         # we can't just modify pointed to files as these might be in /usr or something
 204         local REALTARGET
 205         if [ -L "$KEYRINGFILE" ]; then
 206             REALTARGET="$(readlink -f "$KEYRINGFILE")"
 207             mv -f "$KEYRINGFILE" "${KEYRINGFILE}.dpkg-tmp"
 208             cp -a "$REALTARGET" "$KEYRINGFILE"
 209         fi
 210         # delete the key from the keyring
 211         aptkey_execute "$GPG_SH" --keyring "$KEYRINGFILE" --batch --delete-keys --yes "$KEY"
 212         if [ -n "$REALTARGET" ]; then
 213             # the real backup is the old link, not the copy we made
 214             mv -f "${KEYRINGFILE}.dpkg-tmp" "${KEYRINGFILE}~"
 215         fi
 216     done
 217 }
 218
 219 foreach_keyring_do() {
 220    local ACTION="$1"
 221    shift
 222    # if a --keyring was given, just work on this one
 223    if [ -n "$FORCED_KEYRING" ]; then
 224         $ACTION "$FORCED_KEYRING" "$@"
 225    else
 226         # otherwise all known keyrings are up for inspection
 227         if [ -s "$TRUSTEDFILE" ]; then
 228             $ACTION "$TRUSTEDFILE" "$@"
 229         fi
 230         local TRUSTEDPARTS="/etc/apt/trusted.gpg.d"
 231         eval $(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d)
 232         if [ -d "$TRUSTEDPARTS" ]; then
 233             # strip / suffix as gpg will double-slash in that case (#665411)
 234             local STRIPPED_TRUSTEDPARTS="${TRUSTEDPARTS%/}"
 235             if [ "${STRIPPED_TRUSTEDPARTS}/" = "$TRUSTEDPARTS" ]; then
 236                 TRUSTEDPARTS="$STRIPPED_TRUSTEDPARTS"
 237             fi
 238             for trusted in $(find "$TRUSTEDPARTS" -mindepth 1 -maxdepth 1 -regex '^.*\.gpg$' | sort); do
 239                 if [ -s "$trusted" ]; then
 240                     $ACTION "$trusted" "$@"
 241                 fi
 242             done
 243         fi
 244    fi
 245 }
 246
 247 run_cmd_on_keyring() {
 248     local KEYRINGFILE="$1"
 249     shift
 250     # fingerprint and co will fail if key isn't in this keyring
 251     aptkey_execute "$GPG_SH" --keyring "$KEYRINGFILE" --batch "$@" 2>/dev/null || true
 252 }
 253
 254 import_keyring_into_keyring() {
 255     local FROM="${1:-${GPGHOMEDIR}/pubring.gpg}"
 256     local TO="${2:-${GPGHOMEDIR}/pubring.gpg}"
 257     shift 2
 258     rm -f "${GPGHOMEDIR}/gpgoutput.log"
 259     # the idea is simple: We take keys from one keyring and copy it to another
 260     # we do this with so many checks in between to ensure that WE control the
 261     # creation, so we know that the (potentially) created $TO keyring is a
 262     # simple keyring rather than a keybox as gpg2 would create it which in turn
 263     # can't be read by gpgv.
 264     # BEWARE: This is designed more in the way to work with the current
 265     # callers, than to have a well defined it would be easy to add new callers to.
 266     if [ ! -s "$TO" ]; then
 267         if [ -s "$FROM" ]; then
 268             if [ -z "$2" ]; then
 269                 if ! aptkey_execute "$GPG_SH" --keyring "$FROM" --export ${1:+"$1"} > "$TO" 2> "${GPGHOMEDIR}/gpgoutput.log"; then
 270                     cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
 271                     false
 272                 else
 273                     chmod 0644 -- "$TO"
 274                 fi
 275             else
 276                 create_new_keyring "$TO"
 277             fi
 278         else
 279             create_new_keyring "$TO"
 280         fi
 281     elif [ -s "$FROM" ]; then
 282         local EXPORTLIMIT="$1"
 283         if [ -n "$1$2" ]; then shift; fi
 284         if ! aptkey_execute "$GPG_SH" --keyring "$FROM" --export ${EXPORTLIMIT:+"$EXPORTLIMIT"} \
 285            | aptkey_execute "$GPG_SH" --keyring "$TO" --batch --import "$@" > "${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
 286             cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
 287             false
 288         fi
 289     fi
 290 }
 291
 292 merge_all_trusted_keyrings_into_pubring() {
 293     # does the same as:
 294     # foreach_keyring_do 'import_keys_from_keyring' "${GPGHOMEDIR}/pubring.gpg"
 295     # but without using gpg, just cat and find
 296     local PUBRING="${GPGHOMEDIR}/pubring.gpg"
 297     # if a --keyring was given, just use this one
 298     if [ -n "$FORCED_KEYRING" ]; then
 299         if [ -s "$FORCED_KEYRING" ]; then
 300             cp --dereference "$FORCED_KEYRING" "$PUBRING"
 301         fi
 302     else
 303         # otherwise all known keyrings are merged
 304         local TRUSTEDPARTS="/etc/apt/trusted.gpg.d"
 305         eval $(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d)
 306         if [ -d "$TRUSTEDPARTS" ]; then
 307             # ignore errors mostly for non-existing $TRUSTEDFILE
 308             {
 309                cat "$TRUSTEDFILE" || true
 310                for parts in $(find -L "$TRUSTEDPARTS" -type f -name '*.gpg'); do
 311                   cat "$parts" || true
 312                done
 313             } > "$PUBRING" 2>/dev/null
 314         elif [ -s "$TRUSTEDFILE" ]; then
 315             cp --dereference "$TRUSTEDFILE" "$PUBRING"
 316         fi
 317     fi
 318
 319     if [ ! -s "$PUBRING" ]; then
 320         touch "$PUBRING"
 321     fi
 322 }
 323
 324 import_keys_from_keyring() {
 325     import_keyring_into_keyring "$1" "$2"
 326 }
 327
 328 merge_keys_into_keyrings() {
 329     import_keyring_into_keyring "$2" "$1" '' --import-options 'merge-only'
 330 }
 331
 332 merge_back_changes() {
 333     if [ -n "$FORCED_KEYRING" ]; then
 334         # if the keyring was forced merge is already done
 335         return
 336     fi
 337     if [ -s "${GPGHOMEDIR}/pubring.gpg" ]; then
 338         # merge all updated keys
 339         foreach_keyring_do 'merge_keys_into_keyrings' "${GPGHOMEDIR}/pubring.gpg"
 340     fi
 341     # look for keys which were added or removed
 342     get_fingerprints_of_keyring "${GPGHOMEDIR}/pubring.orig.gpg" > "${GPGHOMEDIR}/pubring.orig.keylst"
 343     get_fingerprints_of_keyring "${GPGHOMEDIR}/pubring.gpg" > "${GPGHOMEDIR}/pubring.keylst"
 344     comm -3 "${GPGHOMEDIR}/pubring.keylst" "${GPGHOMEDIR}/pubring.orig.keylst" > "${GPGHOMEDIR}/pubring.diff"
 345     # key isn't part of new keyring, so remove
 346     cut -f 2 "${GPGHOMEDIR}/pubring.diff" | while read key; do
 347         if [ -z "$key" ]; then continue; fi
 348         foreach_keyring_do 'remove_key_from_keyring' "$key"
 349     done
 350     # key is only part of new keyring, so we need to import it
 351     cut -f 1 "${GPGHOMEDIR}/pubring.diff" | while read key; do
 352         if [ -z "$key" ]; then continue; fi
 353         import_keyring_into_keyring '' "$TRUSTEDFILE" "$key"
 354     done
 355 }
 356
 357 setup_merged_keyring() {
 358     if [ -n "$FORCED_KEYID" ]; then
 359         merge_all_trusted_keyrings_into_pubring
 360         FORCED_KEYRING="${GPGHOMEDIR}/forcedkeyid.gpg"
 361         TRUSTEDFILE="${FORCED_KEYRING}"
 362         echo "#!/bin/sh
 363 exec sh \"${GPG}\" --keyring \"${TRUSTEDFILE}\" \"\$@\"" > "${GPGHOMEDIR}/gpg.1.sh"
 364         GPG="${GPGHOMEDIR}/gpg.1.sh"
 365         # ignore error as this "just" means we haven't found the forced keyid and the keyring will be empty
 366         import_keyring_into_keyring '' "$TRUSTEDFILE" "$FORCED_KEYID" || true
 367     elif [ -z "$FORCED_KEYRING" ]; then
 368         merge_all_trusted_keyrings_into_pubring
 369         if [ -r "${GPGHOMEDIR}/pubring.gpg" ]; then
 370             cp -a "${GPGHOMEDIR}/pubring.gpg" "${GPGHOMEDIR}/pubring.orig.gpg"
 371         else
 372            touch "${GPGHOMEDIR}/pubring.gpg" "${GPGHOMEDIR}/pubring.orig.gpg"
 373         fi
 374         echo "#!/bin/sh
 375 exec sh \"${GPG}\" --keyring \"${GPGHOMEDIR}/pubring.gpg\" \"\$@\"" > "${GPGHOMEDIR}/gpg.1.sh"
 376         GPG="${GPGHOMEDIR}/gpg.1.sh"
 377     else
 378         create_new_keyring "$TRUSTEDFILE"
 379         echo "#!/bin/sh
 380 exec sh \"${GPG}\" --keyring \"${TRUSTEDFILE}\" \"\$@\"" > "${GPGHOMEDIR}/gpg.1.sh"
 381         GPG="${GPGHOMEDIR}/gpg.1.sh"
 382     fi
 383 }
 384
 385 create_new_keyring() {
 386     # gpg defaults to mode 0600 for new keyrings. Create one with 0644 instead.
 387     if ! [ -e "$TRUSTEDFILE" ]; then
 388         if [ -w "$(dirname "$TRUSTEDFILE")" ]; then
 389             touch -- "$TRUSTEDFILE"
 390             chmod 0644 -- "$TRUSTEDFILE"
 391         fi
 392     fi
 393 }
 394
 395 aptkey_execute() { sh "$@"; }
 396
 397 usage() {
 398     echo "Usage: apt-key [--keyring file] [command] [arguments]"
 399     echo
 400     echo "Manage apt's list of trusted keys"
 401     echo
 402     echo "  apt-key add <file>          - add the key contained in <file> ('-' for stdin)"
 403     echo "  apt-key del <keyid>         - remove the key <keyid>"
 404     echo "  apt-key export <keyid>      - output the key <keyid>"
 405     echo "  apt-key exportall           - output all trusted keys"
 406     echo "  apt-key update              - update keys using the keyring package"
 407     echo "  apt-key net-update          - update keys using the network"
 408     echo "  apt-key list                - list keys"
 409     echo "  apt-key finger              - list fingerprints"
 410     echo "  apt-key adv                 - pass advanced options to gpg (download key)"
 411     echo
 412     echo "If no specific keyring file is given the command applies to all keyring files."
 413 }
 414
 415 while [ -n "$1" ]; do
 416    case "$1" in
 417       --keyring)
 418          shift
 419          TRUSTEDFILE="$1"
 420          FORCED_KEYRING="$1"
 421          ;;
 422       --keyid)
 423          shift
 424          FORCED_KEYID="$1"
 425          ;;
 426       --secret-keyring)
 427          shift
 428          FORCED_SECRET_KEYRING="$1"
 429          ;;
 430       --readonly)
 431          merge_back_changes() { true; }
 432          create_new_keyring() { if [ ! -r "$FORCED_KEYRING" ]; then TRUSTEDFILE='/dev/null'; FORCED_KEYRING="$TRUSTEDFILE"; fi; }
 433          ;;
 434       --fakeroot)
 435          requires_root() { true; }
 436          ;;
 437       --quiet)
 438          aptkey_echo() { true; }
 439          ;;
 440       --debug1)
 441          # some cmds like finger redirect stderr to /dev/null …
 442         aptkey_execute() { echo 'EXEC:' "$@"; sh "$@"; }
 443         ;;
 444       --debug2)
 445          # … other more complicated ones pipe gpg into gpg.
 446         aptkey_execute() { echo >&2 'EXEC:' "$@"; sh "$@"; }
 447         ;;
 448       --*)
 449          echo >&2 "Unknown option: $1"
 450          usage
 451          exit 1;;
 452       *)
 453          break;;
 454    esac
 455    shift
 456 done
 457
 458 if [ -z "$TRUSTEDFILE" ]; then
 459    TRUSTEDFILE="/etc/apt/trusted.gpg"
 460    eval $(apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring)
 461    eval $(apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f)
 462 fi
 463
 464 command="$1"
 465 if [ -z "$command" ]; then
 466     usage
 467     exit 1
 468 fi
 469 shift
 470
 471 create_gpg_home() {
 472     # gpg needs (in different versions more or less) files to function correctly,
 473     # so we give it its own homedir and generate some valid content for it later on
 474     if [ -n "$TMPDIR" ]; then
 475         # tmpdir is a directory and current user has rwx access to it
 476         # same tests as in apt-pkg/contrib/fileutl.cc GetTempDir()
 477         if [ ! -d "$TMPDIR" ] || [ ! -r "$TMPDIR" ] || [ ! -w "$TMPDIR" ] || [ ! -x "$TMPDIR" ]; then
 478             unset TMPDIR
 479         fi
 480     fi
 481     GPGHOMEDIR="$(mktemp -d)"
 482     CURRENTTRAP="${CURRENTTRAP} rm -rf '${GPGHOMEDIR}';"
 483     trap "${CURRENTTRAP}" 0 HUP INT QUIT ILL ABRT FPE SEGV PIPE TERM
 484     chmod 700 "$GPGHOMEDIR"
 485 }
 486
 487 prepare_gpg_home() {
 488     eval $(apt-config shell GPG_EXE Apt::Key::gpgcommand)
 489
 490     if [ -n "$GPG_EXE" ] && command_available "$GPG_EXE"; then
 491         true
 492     elif command_available 'gpg'; then
 493         GPG_EXE="gpg"
 494     elif command_available 'gpg2'; then
 495         GPG_EXE="gpg2"
 496     else
 497         echo >&2 "Error: gnupg or gnupg2 do not seem to be installed,"
 498         echo >&2 "Error: but apt-key requires gnupg or gnupg2 for this operation."
 499         echo >&2
 500         exit 255
 501     fi
 502
 503     create_gpg_home
 504
 505     # We don't use a secret keyring, of course, but gpg panics and
 506     # implodes if there isn't one available - and writeable for imports
 507     SECRETKEYRING="${GPGHOMEDIR}/secring.gpg"
 508     touch "$SECRETKEYRING"
 509
 510     # create the trustdb with an (empty) dummy keyring
 511     # older gpgs required it, newer gpgs even warn that it isn't needed,
 512     # but require it nonetheless for some commands, so we just play safe
 513     # here for the foreseeable future and create a dummy one
 514     if ! "$GPG_EXE" --ignore-time-conflict --no-options --no-default-keyring \
 515        --homedir "$GPGHOMEDIR" --quiet --check-trustdb --keyring "$SECRETKEYRING" >"${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
 516        cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
 517        false
 518     fi
 519     # tell gpg that it shouldn't try to maintain a trustdb file
 520     echo "#!/bin/sh
 521 exec \"${GPG_EXE}\" --ignore-time-conflict --no-options --no-default-keyring \\
 522    --homedir \"${GPGHOMEDIR}\" --no-auto-check-trustdb --trust-model always \"\$@\"" > "${GPGHOMEDIR}/gpg.0.sh"
 523     GPG_SH="${GPGHOMEDIR}/gpg.0.sh"
 524     GPG="$GPG_SH"
 525
 526     # for advanced operations, we might really need a secret keyring after all
 527     if [ -n "$FORCED_SECRET_KEYRING" ] && [ -r "$FORCED_SECRET_KEYRING" ]; then
 528         rm -f "$SECRETKEYRING"
 529         cp -a "$FORCED_SECRET_KEYRING" "$SECRETKEYRING"
 530     fi
 531
 532     # older gpg versions need a secring file, but newer versions take it as
 533     # a hint to start a migration from earlier versions. The file is empty
 534     # anyhow, so nothing actually happens, but its three lines of output
 535     # nobody expects to see in apt-key context, so trigger it in silence
 536     echo -n | aptkey_execute "$GPG" --batch --import >/dev/null 2>&1 || true
 537 }
 538
 539 if [ "$command" != 'help' ] && [ "$command" != 'verify' ]; then
 540     prepare_gpg_home
 541 fi
 542
 543 case "$command" in
 544     add)
 545         requires_root
 546         setup_merged_keyring
 547         aptkey_execute "$GPG" --quiet --batch --import "$@"
 548         merge_back_changes
 549         aptkey_echo "OK"
 550         ;;
 551     del|rm|remove)
 552         requires_root
 553         foreach_keyring_do 'remove_key_from_keyring' "$@"
 554         aptkey_echo "OK"
 555         ;;
 556     update)
 557         requires_root
 558         setup_merged_keyring
 559         update
 560         merge_back_changes
 561         ;;
 562     net-update)
 563         requires_root
 564         setup_merged_keyring
 565         net_update
 566         merge_back_changes
 567         ;;
 568     list)
 569         foreach_keyring_do 'run_cmd_on_keyring' --list-keys "$@"
 570         ;;
 571     finger*)
 572         foreach_keyring_do 'run_cmd_on_keyring' --fingerprint "$@"
 573         ;;
 574     export|exportall)
 575         merge_all_trusted_keyrings_into_pubring
 576         aptkey_execute "$GPG_SH" --keyring "${GPGHOMEDIR}/pubring.gpg" --armor --export "$@"
 577         ;;
 578     adv*)
 579         setup_merged_keyring
 580         aptkey_echo "Executing: $GPG $*"
 581         aptkey_execute "$GPG" "$@"
 582         merge_back_changes
 583         ;;
 584     verify)
 585         GPGV=''
 586         eval $(apt-config shell GPGV Apt::Key::gpgvcommand)
 587         if [ -n "$GPGV" ] && command_available "$GPGV"; then true;
 588         elif command_available 'gpgv'; then GPGV='gpgv';
 589         elif command_available 'gpgv2'; then GPGV='gpgv2';
 590         else
 591            echo >&2 'ERROR: gpgv or gpgv2 required for verification'
 592            exit 29
 593         fi
 594         # for a forced keyid we need gpg --export, so full wrapping required
 595         if [ -n "$FORCED_KEYID" ]; then
 596             prepare_gpg_home
 597         else
 598             create_gpg_home
 599         fi
 600         setup_merged_keyring
 601         if [ -n "$FORCED_KEYRING" ]; then
 602             "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "${FORCED_KEYRING}" --ignore-time-conflict "$@"
 603         else
 604             "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "${GPGHOMEDIR}/pubring.gpg" --ignore-time-conflict "$@"
 605         fi
 606         ;;
 607     help)
 608         usage
 609         ;;
 610     *)
 611         usage
 612         exit 1
 613         ;;
 614 esac