cmdline/apt-key.in

   1 #!/bin/sh
   2
   3 set -e
   4 unset GREP_OPTIONS
   5 export IFS="$(printf "\n\b")"
   6
   7 MASTER_KEYRING='&keyring-master-filename;'
   8 eval "$(apt-config shell MASTER_KEYRING APT::Key::MasterKeyring)"
   9 ARCHIVE_KEYRING='&keyring-filename;'
  10 eval "$(apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring)"
  11 REMOVED_KEYS='&keyring-removed-filename;'
  12 eval "$(apt-config shell REMOVED_KEYS APT::Key::RemovedKeys)"
  13 ARCHIVE_KEYRING_URI='&keyring-uri;'
  14 eval "$(apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI)"
  15
  16 aptkey_echo() { echo "$@"; }
  17
  18 requires_root() {
  19         if [ "$(id -u)" -ne 0 ]; then
  20                 echo >&2 "ERROR: This command can only be used by root."
  21                 exit 1
  22         fi
  23 }
  24
  25 command_available() {
  26     if [ -x "$1" ]; then return 0; fi
  27     # command -v "$1" >/dev/null 2>&1 # not required by policy, see #747320
  28     # which "$1" >/dev/null 2>&1 # is in debianutils (essential) but not on non-debian systems
  29     local OLDIFS="$IFS"
  30     IFS=:
  31     for p in $PATH; do
  32         if [ -x "${p}/${1}" ]; then
  33             IFS="$OLDIFS"
  34             return 0
  35         fi
  36     done
  37     IFS="$OLDIFS"
  38     return 1
  39 }
  40
  41 escape_shell() {
  42     echo "$@" | sed -e "s#'#'\"'\"'#g"
  43 }
  44
  45 get_fingerprints_of_keyring() {
  46     aptkey_execute "$GPG_SH" --keyring "$1" --with-colons --fingerprint | while read publine; do
  47         # search for a public key
  48         if [ "${publine%%:*}" != 'pub' ]; then continue; fi
  49         # search for the associated fingerprint (should be the very next line)
  50         while read fprline; do
  51            if [ "${fprline%%:*}" = 'sub' ]; then break; # should never happen
  52            elif [ "${fprline%%:*}" != 'fpr' ]; then continue; fi
  53            echo "$fprline" | cut -d':' -f 10
  54         done
  55         # order in the keyring shouldn't be important
  56     done | sort
  57 }
  58
  59 add_keys_with_verify_against_master_keyring() {
  60     ADD_KEYRING="$1"
  61     MASTER="$2"
  62
  63     if [ ! -f "$ADD_KEYRING" ]; then
  64         echo >&2 "ERROR: '$ADD_KEYRING' not found"
  65         return
  66     fi
  67     if [ ! -f "$MASTER" ]; then
  68         echo >&2 "ERROR: '$MASTER' not found"
  69         return
  70     fi
  71
  72     # when adding new keys, make sure that the archive-master-keyring
  73     # is honored. so:
  74     #   all keys that are exported must have a valid signature
  75     #   from a key in the $distro-master-keyring
  76     add_keys="$(get_fingerprints_of_keyring "$ADD_KEYRING")"
  77     all_add_keys="$(aptkey_execute "$GPG_SH" --keyring "$ADD_KEYRING" --with-colons --list-keys | grep ^[ps]ub | cut -d: -f5)"
  78     master_keys="$(aptkey_execute "$GPG_SH" --keyring "$MASTER" --with-colons --list-keys | grep ^pub | cut -d: -f5)"
  79
  80     # ensure there are no colisions LP: #857472
  81     for all_add_key in $all_add_keys; do
  82         for master_key in $master_keys; do
  83             if [ "$all_add_key" = "$master_key" ]; then
  84                 echo >&2 "Keyid collision for '$all_add_key' detected, operation aborted"
  85                 return 1
  86             fi
  87         done
  88     done
  89
  90     for add_key in $add_keys; do
  91         # export the add keyring one-by-one
  92         local TMP_KEYRING="${GPGHOMEDIR}/tmp-keyring.gpg"
  93         aptkey_execute "$GPG_SH" --batch --yes --keyring "$ADD_KEYRING" --output "$TMP_KEYRING" --export "$add_key"
  94         if ! aptkey_execute "$GPG_SH" --batch --yes --keyring "$TMP_KEYRING" --import "$MASTER" > "${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
  95             cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
  96             false
  97         fi
  98         # check if signed with the master key and only add in this case
  99         ADDED=0
 100         for master_key in $master_keys; do
 101             if aptkey_execute "$GPG_SH" --keyring "$TMP_KEYRING" --check-sigs --with-colons "$add_key" \
 102                | grep '^sig:!:' | cut -d: -f5 | grep -q "$master_key"; then
 103                 aptkey_execute "$GPG_SH" --batch --yes --keyring "$ADD_KEYRING" --export "$add_key" \
 104                    | aptkey_execute "$GPG" --batch --yes --import
 105                 ADDED=1
 106             fi
 107         done
 108         if [ $ADDED = 0 ]; then
 109             echo >&2 "Key '$add_key' not added. It is not signed with a master key"
 110         fi
 111         rm -f "${TMP_KEYRING}"
 112     done
 113 }
 114
 115 # update the current archive signing keyring from a network URI
 116 # the archive-keyring keys needs to be signed with the master key
 117 # (otherwise it does not make sense from a security POV)
 118 net_update() {
 119     local APT_DIR='/'
 120     eval $(apt-config shell APT_DIR Dir)
 121
 122     # Disabled for now as code is insecure (LP: #1013639 (and 857472, 1013128))
 123     APT_KEY_NET_UPDATE_ENABLED=""
 124     eval $(apt-config shell APT_KEY_NET_UPDATE_ENABLED APT::Key::Net-Update-Enabled)
 125     if [ -z "$APT_KEY_NET_UPDATE_ENABLED" ]; then
 126         exit 1
 127     fi
 128
 129     if [ -z "$ARCHIVE_KEYRING_URI" ]; then
 130         echo >&2 "ERROR: Your distribution is not supported in net-update as no uri for the archive-keyring is set"
 131         exit 1
 132     fi
 133     # in theory we would need to depend on wget for this, but this feature
 134     # isn't useable in debian anyway as we have no keyring uri nor a master key
 135     if ! command_available 'wget'; then
 136         echo >&2 "ERROR: an installed wget is required for a network-based update"
 137         exit 1
 138     fi
 139     if [ ! -d "${APT_DIR}/var/lib/apt/keyrings" ]; then
 140         mkdir -p "${APT_DIR}/var/lib/apt/keyrings"
 141     fi
 142     keyring="${APT_DIR}/var/lib/apt/keyrings/$(basename "$ARCHIVE_KEYRING_URI")"
 143     old_mtime=0
 144     if [ -e $keyring ]; then
 145         old_mtime=$(stat -c %Y "$keyring")
 146     fi
 147     (cd  "${APT_DIR}/var/lib/apt/keyrings"; wget --timeout=90 -q -N "$ARCHIVE_KEYRING_URI")
 148     if [ ! -e "$keyring" ]; then
 149         return
 150     fi
 151     new_mtime=$(stat -c %Y "$keyring")
 152     if [ $new_mtime -ne $old_mtime ]; then
 153         aptkey_echo "Checking for new archive signing keys now"
 154         add_keys_with_verify_against_master_keyring "$keyring" "$MASTER_KEYRING"
 155     fi
 156 }
 157
 158 update() {
 159     if [ ! -f "$ARCHIVE_KEYRING" ]; then
 160         echo >&2 "ERROR: Can't find the archive-keyring"
 161         echo >&2 "Is the &keyring-package; package installed?"
 162         exit 1
 163     fi
 164
 165     # add new keys from the package;
 166
 167     # we do not use add_keys_with_verify_against_master_keyring here,
 168     # because "update" is run on regular package updates.  A
 169     # attacker might as well replace the master-archive-keyring file
 170     # in the package and add his own keys. so this check wouldn't
 171     # add any security. we *need* this check on net-update though
 172     import_keyring_into_keyring "$ARCHIVE_KEYRING" '' && cat "${GPGHOMEDIR}/gpgoutput.log"
 173
 174     if [ -r "$REMOVED_KEYS" ]; then
 175         # remove no-longer supported/used keys
 176         get_fingerprints_of_keyring "$REMOVED_KEYS" | while read key; do
 177             foreach_keyring_do 'remove_key_from_keyring' "$key"
 178         done
 179     else
 180         echo >&2 "Warning: removed keys keyring  $REMOVED_KEYS missing or not readable"
 181     fi
 182 }
 183
 184 remove_key_from_keyring() {
 185     local KEYRINGFILE="$1"
 186     shift
 187     # non-existent keyrings have by definition no keys
 188     if [ ! -e "$KEYRINGFILE" ]; then
 189        return
 190     fi
 191
 192     for KEY in "$@"; do
 193         local FINGERPRINTS="${GPGHOMEDIR}/keyringfile.keylst"
 194         get_fingerprints_of_keyring "$KEYRINGFILE" > "$FINGERPRINTS"
 195
 196         # strip leading 0x, if present:
 197         KEY="${KEY#0x}"
 198
 199         # check if the key is in this keyring
 200         if ! grep -iq "^[0-9A-F]*${KEY}$" "$FINGERPRINTS"; then
 201             continue
 202         fi
 203         if [ ! -w "$KEYRINGFILE" ]; then
 204             echo >&2 "Key ${KEY} is in keyring ${KEYRINGFILE}, but can't be removed as it is read only."
 205             continue
 206         fi
 207         # check if it is the only key in the keyring and if so remove the keyring altogether
 208         if [ '1' = "$(uniq "$FINGERPRINTS" | wc -l)" ]; then
 209             mv -f "$KEYRINGFILE" "${KEYRINGFILE}~" # behave like gpg
 210             return
 211         fi
 212         # we can't just modify pointed to files as these might be in /usr or something
 213         local REALTARGET
 214         if [ -L "$KEYRINGFILE" ]; then
 215             REALTARGET="$(readlink -f "$KEYRINGFILE")"
 216             mv -f "$KEYRINGFILE" "${KEYRINGFILE}.dpkg-tmp"
 217             cp -a "$REALTARGET" "$KEYRINGFILE"
 218         fi
 219         # delete the key from the keyring
 220         aptkey_execute "$GPG_SH" --keyring "$KEYRINGFILE" --batch --delete-keys --yes "$KEY"
 221         if [ -n "$REALTARGET" ]; then
 222             # the real backup is the old link, not the copy we made
 223             mv -f "${KEYRINGFILE}.dpkg-tmp" "${KEYRINGFILE}~"
 224         fi
 225     done
 226 }
 227
 228 foreach_keyring_do() {
 229    local ACTION="$1"
 230    shift
 231    # if a --keyring was given, just work on this one
 232    if [ -n "$FORCED_KEYRING" ]; then
 233         $ACTION "$FORCED_KEYRING" "$@"
 234    else
 235         # otherwise all known keyrings are up for inspection
 236         if [ -s "$TRUSTEDFILE" ]; then
 237             $ACTION "$TRUSTEDFILE" "$@"
 238         fi
 239         local TRUSTEDPARTS="/etc/apt/trusted.gpg.d"
 240         eval "$(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d)"
 241         if [ -d "$TRUSTEDPARTS" ]; then
 242             TRUSTEDPARTS="$(readlink -f "$TRUSTEDPARTS")"
 243             local TRUSTEDPARTSLIST="$(cd /; find "$TRUSTEDPARTS" -mindepth 1 -maxdepth 1 -name '*.gpg')"
 244             for trusted in $(echo "$TRUSTEDPARTSLIST" | sort); do
 245                 if [ -s "$trusted" ]; then
 246                     $ACTION "$trusted" "$@"
 247                 fi
 248             done
 249         fi
 250    fi
 251 }
 252
 253 run_cmd_on_keyring() {
 254     local KEYRINGFILE="$1"
 255     shift
 256     # fingerprint and co will fail if key isn't in this keyring
 257     aptkey_execute "$GPG_SH" --keyring "$KEYRINGFILE" --batch "$@" 2>/dev/null || true
 258 }
 259
 260 import_keyring_into_keyring() {
 261     local FROM="${1:-${GPGHOMEDIR}/pubring.gpg}"
 262     local TO="${2:-${GPGHOMEDIR}/pubring.gpg}"
 263     shift 2
 264     rm -f "${GPGHOMEDIR}/gpgoutput.log"
 265     # the idea is simple: We take keys from one keyring and copy it to another
 266     # we do this with so many checks in between to ensure that WE control the
 267     # creation, so we know that the (potentially) created $TO keyring is a
 268     # simple keyring rather than a keybox as gpg2 would create it which in turn
 269     # can't be read by gpgv.
 270     # BEWARE: This is designed more in the way to work with the current
 271     # callers, than to have a well defined it would be easy to add new callers to.
 272     if [ ! -s "$TO" ]; then
 273         if [ -s "$FROM" ]; then
 274             if [ -z "$2" ]; then
 275                 if ! aptkey_execute "$GPG_SH" --keyring "$FROM" --export ${1:+"$1"} > "$TO" 2> "${GPGHOMEDIR}/gpgoutput.log"; then
 276                     cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
 277                     false
 278                 else
 279                     chmod 0644 -- "$TO"
 280                 fi
 281             else
 282                 create_new_keyring "$TO"
 283             fi
 284         else
 285             create_new_keyring "$TO"
 286         fi
 287     elif [ -s "$FROM" ]; then
 288         local EXPORTLIMIT="$1"
 289         if [ -n "$1$2" ]; then shift; fi
 290         if ! aptkey_execute "$GPG_SH" --keyring "$FROM" --export ${EXPORTLIMIT:+"$EXPORTLIMIT"} \
 291            | aptkey_execute "$GPG_SH" --keyring "$TO" --batch --import "$@" > "${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
 292             cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
 293             false
 294         fi
 295     fi
 296 }
 297
 298 merge_all_trusted_keyrings_into_pubring() {
 299     # does the same as:
 300     # foreach_keyring_do 'import_keys_from_keyring' "${GPGHOMEDIR}/pubring.gpg"
 301     # but without using gpg, just cat and find
 302     local PUBRING="$(readlink -f "${GPGHOMEDIR}/pubring.gpg")"
 303     # if a --keyring was given, just use this one
 304     if [ -n "$FORCED_KEYRING" ]; then
 305         if [ -s "$FORCED_KEYRING" ]; then
 306             cp --dereference "$FORCED_KEYRING" "$PUBRING"
 307         fi
 308     else
 309         # otherwise all known keyrings are merged
 310         local TRUSTEDPARTS="/etc/apt/trusted.gpg.d"
 311         eval $(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d)
 312         if [ -d "$TRUSTEDPARTS" ]; then
 313             rm -f "$PUBRING"
 314             if [ -s "$TRUSTEDFILE" ]; then
 315                 cat "$TRUSTEDFILE" > "$PUBRING"
 316             fi
 317             TRUSTEDPARTS="$(readlink -f "$TRUSTEDPARTS")"
 318             (cd /; find "$TRUSTEDPARTS" -mindepth 1 -maxdepth 1 -name '*.gpg' -exec cat {} + >> "$PUBRING";)
 319         elif [ -s "$TRUSTEDFILE" ]; then
 320             cp --dereference "$TRUSTEDFILE" "$PUBRING"
 321         fi
 322     fi
 323
 324     if [ ! -s "$PUBRING" ]; then
 325         touch "$PUBRING"
 326     fi
 327 }
 328
 329 import_keys_from_keyring() {
 330     import_keyring_into_keyring "$1" "$2"
 331 }
 332
 333 merge_keys_into_keyrings() {
 334     import_keyring_into_keyring "$2" "$1" '' --import-options 'merge-only'
 335 }
 336
 337 merge_back_changes() {
 338     if [ -n "$FORCED_KEYRING" ]; then
 339         # if the keyring was forced merge is already done
 340         return
 341     fi
 342     if [ -s "${GPGHOMEDIR}/pubring.gpg" ]; then
 343         # merge all updated keys
 344         foreach_keyring_do 'merge_keys_into_keyrings' "${GPGHOMEDIR}/pubring.gpg"
 345     fi
 346     # look for keys which were added or removed
 347     get_fingerprints_of_keyring "${GPGHOMEDIR}/pubring.orig.gpg" > "${GPGHOMEDIR}/pubring.orig.keylst"
 348     get_fingerprints_of_keyring "${GPGHOMEDIR}/pubring.gpg" > "${GPGHOMEDIR}/pubring.keylst"
 349     comm -3 "${GPGHOMEDIR}/pubring.keylst" "${GPGHOMEDIR}/pubring.orig.keylst" > "${GPGHOMEDIR}/pubring.diff"
 350     # key isn't part of new keyring, so remove
 351     cut -f 2 "${GPGHOMEDIR}/pubring.diff" | while read key; do
 352         if [ -z "$key" ]; then continue; fi
 353         foreach_keyring_do 'remove_key_from_keyring' "$key"
 354     done
 355     # key is only part of new keyring, so we need to import it
 356     cut -f 1 "${GPGHOMEDIR}/pubring.diff" | while read key; do
 357         if [ -z "$key" ]; then continue; fi
 358         import_keyring_into_keyring '' "$TRUSTEDFILE" "$key"
 359     done
 360 }
 361
 362 setup_merged_keyring() {
 363     if [ -n "$FORCED_KEYID" ]; then
 364         merge_all_trusted_keyrings_into_pubring
 365         FORCED_KEYRING="${GPGHOMEDIR}/forcedkeyid.gpg"
 366         TRUSTEDFILE="${FORCED_KEYRING}"
 367         echo "#!/bin/sh
 368 exec sh '($(escape_shell "${GPG}")' --keyring '$(escape_shell "${TRUSTEDFILE}")' \"\$@\"" > "${GPGHOMEDIR}/gpg.1.sh"
 369         GPG="${GPGHOMEDIR}/gpg.1.sh"
 370         # ignore error as this "just" means we haven't found the forced keyid and the keyring will be empty
 371         import_keyring_into_keyring '' "$TRUSTEDFILE" "$FORCED_KEYID" || true
 372     elif [ -z "$FORCED_KEYRING" ]; then
 373         merge_all_trusted_keyrings_into_pubring
 374         if [ -r "${GPGHOMEDIR}/pubring.gpg" ]; then
 375             cp -a "${GPGHOMEDIR}/pubring.gpg" "${GPGHOMEDIR}/pubring.orig.gpg"
 376         else
 377            touch "${GPGHOMEDIR}/pubring.gpg" "${GPGHOMEDIR}/pubring.orig.gpg"
 378         fi
 379         echo "#!/bin/sh
 380 exec sh '$(escape_shell "${GPG}")' --keyring '$(escape_shell "${GPGHOMEDIR}/pubring.gpg")' \"\$@\"" > "${GPGHOMEDIR}/gpg.1.sh"
 381         GPG="${GPGHOMEDIR}/gpg.1.sh"
 382     else
 383         create_new_keyring "$TRUSTEDFILE"
 384         echo "#!/bin/sh
 385 exec sh '$(escape_shell "${GPG}")' --keyring '$(escape_shell "${TRUSTEDFILE}")' \"\$@\"" > "${GPGHOMEDIR}/gpg.1.sh"
 386         GPG="${GPGHOMEDIR}/gpg.1.sh"
 387     fi
 388 }
 389
 390 create_new_keyring() {
 391     # gpg defaults to mode 0600 for new keyrings. Create one with 0644 instead.
 392     if ! [ -e "$TRUSTEDFILE" ]; then
 393         if [ -w "$(dirname "$TRUSTEDFILE")" ]; then
 394             touch -- "$TRUSTEDFILE"
 395             chmod 0644 -- "$TRUSTEDFILE"
 396         fi
 397     fi
 398 }
 399
 400 aptkey_execute() { sh "$@"; }
 401
 402 usage() {
 403     echo "Usage: apt-key [--keyring file] [command] [arguments]"
 404     echo
 405     echo "Manage apt's list of trusted keys"
 406     echo
 407     echo "  apt-key add <file>          - add the key contained in <file> ('-' for stdin)"
 408     echo "  apt-key del <keyid>         - remove the key <keyid>"
 409     echo "  apt-key export <keyid>      - output the key <keyid>"
 410     echo "  apt-key exportall           - output all trusted keys"
 411     echo "  apt-key update              - update keys using the keyring package"
 412     echo "  apt-key net-update          - update keys using the network"
 413     echo "  apt-key list                - list keys"
 414     echo "  apt-key finger              - list fingerprints"
 415     echo "  apt-key adv                 - pass advanced options to gpg (download key)"
 416     echo
 417     echo "If no specific keyring file is given the command applies to all keyring files."
 418 }
 419
 420 while [ -n "$1" ]; do
 421    case "$1" in
 422       --keyring)
 423          shift
 424          TRUSTEDFILE="$1"
 425          FORCED_KEYRING="$1"
 426          ;;
 427       --keyid)
 428          shift
 429          FORCED_KEYID="$1"
 430          ;;
 431       --secret-keyring)
 432          shift
 433          FORCED_SECRET_KEYRING="$1"
 434          ;;
 435       --readonly)
 436          merge_back_changes() { true; }
 437          create_new_keyring() { if [ ! -r "$FORCED_KEYRING" ]; then TRUSTEDFILE='/dev/null'; FORCED_KEYRING="$TRUSTEDFILE"; fi; }
 438          ;;
 439       --fakeroot)
 440          requires_root() { true; }
 441          ;;
 442       --quiet)
 443          aptkey_echo() { true; }
 444          ;;
 445       --debug1)
 446          # some cmds like finger redirect stderr to /dev/null …
 447         aptkey_execute() { echo 'EXEC:' "$@"; sh "$@"; }
 448         ;;
 449       --debug2)
 450          # … other more complicated ones pipe gpg into gpg.
 451         aptkey_execute() { echo >&2 'EXEC:' "$@"; sh "$@"; }
 452         ;;
 453       --*)
 454          echo >&2 "Unknown option: $1"
 455          usage
 456          exit 1;;
 457       *)
 458          break;;
 459    esac
 460    shift
 461 done
 462
 463 if [ -z "$TRUSTEDFILE" ]; then
 464    TRUSTEDFILE="/etc/apt/trusted.gpg"
 465    eval $(apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring)
 466    eval $(apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f)
 467 fi
 468
 469 command="$1"
 470 if [ -z "$command" ]; then
 471     usage
 472     exit 1
 473 fi
 474 shift
 475
 476 create_gpg_home() {
 477     # gpg needs (in different versions more or less) files to function correctly,
 478     # so we give it its own homedir and generate some valid content for it later on
 479     if [ -n "$TMPDIR" ]; then
 480         # tmpdir is a directory and current user has rwx access to it
 481         # same tests as in apt-pkg/contrib/fileutl.cc GetTempDir()
 482         if [ ! -d "$TMPDIR" ] || [ ! -r "$TMPDIR" ] || [ ! -w "$TMPDIR" ] || [ ! -x "$TMPDIR" ]; then
 483             unset TMPDIR
 484         fi
 485     fi
 486     GPGHOMEDIR="$(mktemp -d)"
 487     CURRENTTRAP="${CURRENTTRAP} rm -rf '$(escape_shell "${GPGHOMEDIR}")';"
 488     trap "${CURRENTTRAP}" 0 HUP INT QUIT ILL ABRT FPE SEGV PIPE TERM
 489     chmod 700 "$GPGHOMEDIR"
 490 }
 491
 492 prepare_gpg_home() {
 493     # crude detection if we are called from a maintainerscript where the
 494     # package depends on gnupg or not. We accept recommends here as
 495     # well as the script hopefully uses apt-key optionally then like e.g.
 496     # debian-archive-keyring for (upgrade) cleanup did
 497     if [ -n "$DPKG_MAINTSCRIPT_PACKAGE" ]; then
 498         if ! dpkg-query --show --showformat '${Pre-Depends}${Depends}${Recommends}\n' "$DPKG_MAINTSCRIPT_PACKAGE" 2>/dev/null | grep -q gnupg; then
 499             cat >&2 <<EOF
 500 Warning: The $DPKG_MAINTSCRIPT_NAME maintainerscript of the package $DPKG_MAINTSCRIPT_PACKAGE
 501 Warning: seems to use apt-key (provided by apt) without depending on gnupg or gnupg2.
 502 Warning: This will BREAK in the future and should be fixed by the package maintainer(s).
 503 Note: Check first if apt-key functionality is needed at all - it probably isn't!
 504 EOF
 505         fi
 506     fi
 507     eval "$(apt-config shell GPG_EXE Apt::Key::gpgcommand)"
 508     if [ -n "$GPG_EXE" ] && command_available "$GPG_EXE"; then
 509         true
 510     elif command_available 'gpg'; then
 511         GPG_EXE="gpg"
 512     elif command_available 'gpg2'; then
 513         GPG_EXE="gpg2"
 514     else
 515         echo >&2 "Error: gnupg or gnupg2 do not seem to be installed,"
 516         echo >&2 "Error: but apt-key requires gnupg or gnupg2 for this operation."
 517         echo >&2
 518         exit 255
 519     fi
 520
 521     create_gpg_home
 522
 523     # create the trustdb with an (empty) dummy keyring
 524     # older gpgs required it, newer gpgs even warn that it isn't needed,
 525     # but require it nonetheless for some commands, so we just play safe
 526     # here for the foreseeable future and create a dummy one
 527     touch "${GPGHOMEDIR}/empty.gpg"
 528     if ! "$GPG_EXE" --ignore-time-conflict --no-options --no-default-keyring \
 529        --homedir "$GPGHOMEDIR" --quiet --check-trustdb --keyring "${GPGHOMEDIR}/empty.gpg" >"${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
 530        cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
 531        false
 532     fi
 533
 534     # now tell gpg that it shouldn't try to maintain this trustdb file
 535     echo "#!/bin/sh
 536 exec '$(escape_shell "${GPG_EXE}")' --ignore-time-conflict --no-options --no-default-keyring \\
 537 --homedir '$(escape_shell "${GPGHOMEDIR}")' --no-auto-check-trustdb --trust-model always \"\$@\"" > "${GPGHOMEDIR}/gpg.0.sh"
 538     GPG_SH="${GPGHOMEDIR}/gpg.0.sh"
 539     GPG="$GPG_SH"
 540
 541     # We don't usually need a secret keyring, of course, but
 542     # for advanced operations, we might really need a secret keyring after all
 543     if [ -n "$FORCED_SECRET_KEYRING" ] && [ -r "$FORCED_SECRET_KEYRING" ]; then
 544         if ! aptkey_execute "$GPG" -v --batch --import "$FORCED_SECRET_KEYRING" >"${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
 545             cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
 546             false
 547         fi
 548     else
 549        # and then, there are older versions of gpg which panic and implode
 550        # if there isn't one available - and writeable for imports
 551        # and even if not output is littered with the creation of a secring,
 552        # so lets call import once to have it create what it wants in silence
 553        echo -n | aptkey_execute "$GPG" --batch --import >/dev/null 2>&1 || true
 554     fi
 555 }
 556
 557 if [ "$command" != 'help' ] && [ "$command" != 'verify' ]; then
 558     prepare_gpg_home
 559 fi
 560
 561 case "$command" in
 562     add)
 563         requires_root
 564         setup_merged_keyring
 565         aptkey_execute "$GPG" --quiet --batch --import "$@"
 566         merge_back_changes
 567         aptkey_echo "OK"
 568         ;;
 569     del|rm|remove)
 570         requires_root
 571         foreach_keyring_do 'remove_key_from_keyring' "$@"
 572         aptkey_echo "OK"
 573         ;;
 574     update)
 575         requires_root
 576         setup_merged_keyring
 577         update
 578         merge_back_changes
 579         ;;
 580     net-update)
 581         requires_root
 582         setup_merged_keyring
 583         net_update
 584         merge_back_changes
 585         ;;
 586     list)
 587         foreach_keyring_do 'run_cmd_on_keyring' --list-keys "$@"
 588         ;;
 589     finger*)
 590         foreach_keyring_do 'run_cmd_on_keyring' --fingerprint "$@"
 591         ;;
 592     export|exportall)
 593         merge_all_trusted_keyrings_into_pubring
 594         aptkey_execute "$GPG_SH" --keyring "${GPGHOMEDIR}/pubring.gpg" --armor --export "$@"
 595         ;;
 596     adv*)
 597         setup_merged_keyring
 598         aptkey_echo "Executing: $GPG $*"
 599         aptkey_execute "$GPG" "$@"
 600         merge_back_changes
 601         ;;
 602     verify)
 603         GPGV=''
 604         eval $(apt-config shell GPGV Apt::Key::gpgvcommand)
 605         if [ -n "$GPGV" ] && command_available "$GPGV"; then true;
 606         elif command_available 'gpgv'; then GPGV='gpgv';
 607         elif command_available 'gpgv2'; then GPGV='gpgv2';
 608         else
 609            echo >&2 'ERROR: gpgv or gpgv2 required for verification'
 610            exit 29
 611         fi
 612         # for a forced keyid we need gpg --export, so full wrapping required
 613         if [ -n "$FORCED_KEYID" ]; then
 614             prepare_gpg_home
 615         else
 616             create_gpg_home
 617         fi
 618         setup_merged_keyring
 619         if [ -n "$FORCED_KEYRING" ]; then
 620             "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "${FORCED_KEYRING}" --ignore-time-conflict "$@"
 621         else
 622             "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "${GPGHOMEDIR}/pubring.gpg" --ignore-time-conflict "$@"
 623         fi
 624         ;;
 625     help)
 626         usage
 627         ;;
 628     *)
 629         usage
 630         exit 1
 631         ;;
 632 esac