cmdline/apt-key.in

   1 #!/bin/sh
   2
   3 set -e
   4 unset GREP_OPTIONS
   5 export IFS="$(printf "\n\b")"
   6
   7 MASTER_KEYRING='&keyring-master-filename;'
   8 eval "$(apt-config shell MASTER_KEYRING APT::Key::MasterKeyring)"
   9 ARCHIVE_KEYRING='&keyring-filename;'
  10 eval "$(apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring)"
  11 REMOVED_KEYS='&keyring-removed-filename;'
  12 eval "$(apt-config shell REMOVED_KEYS APT::Key::RemovedKeys)"
  13 ARCHIVE_KEYRING_URI='&keyring-uri;'
  14 eval "$(apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI)"
  15
  16 aptkey_echo() { echo "$@"; }
  17
  18 requires_root() {
  19         if [ "$(id -u)" -ne 0 ]; then
  20                 apt_error "This command can only be used by root."
  21                 exit 1
  22         fi
  23 }
  24
  25 command_available() {
  26     if [ -x "$1" ]; then return 0; fi
  27     # command -v "$1" >/dev/null 2>&1 # not required by policy, see #747320
  28     # which "$1" >/dev/null 2>&1 # is in debianutils (essential) but not on non-debian systems
  29     local OLDIFS="$IFS"
  30     IFS=:
  31     for p in $PATH; do
  32         if [ -x "${p}/${1}" ]; then
  33             IFS="$OLDIFS"
  34             return 0
  35         fi
  36     done
  37     IFS="$OLDIFS"
  38     return 1
  39 }
  40
  41 escape_shell() {
  42     echo "$@" | sed -e "s#'#'\"'\"'#g"
  43 }
  44
  45 get_fingerprints_of_keyring() {
  46     aptkey_execute "$GPG_SH" --keyring "$1" --with-colons --fingerprint | while read publine; do
  47         # search for a public key
  48         if [ "${publine%%:*}" != 'pub' ]; then continue; fi
  49         # search for the associated fingerprint (should be the very next line)
  50         while read fprline; do
  51            if [ "${fprline%%:*}" = 'sub' ]; then break; # should never happen
  52            elif [ "${fprline%%:*}" != 'fpr' ]; then continue; fi
  53            echo "$fprline" | cut -d':' -f 10
  54         done
  55         # order in the keyring shouldn't be important
  56     done | sort
  57 }
  58
  59 add_keys_with_verify_against_master_keyring() {
  60     ADD_KEYRING="$1"
  61     MASTER="$2"
  62
  63     if [ ! -f "$ADD_KEYRING" ]; then
  64         apt_error "Keyring '$ADD_KEYRING' to be added not found"
  65         return
  66     fi
  67     if [ ! -f "$MASTER" ]; then
  68         apt_error "Master-Keyring '$MASTER' not found"
  69         return
  70     fi
  71
  72     # when adding new keys, make sure that the archive-master-keyring
  73     # is honored. so:
  74     #   all keys that are exported must have a valid signature
  75     #   from a key in the $distro-master-keyring
  76     add_keys="$(get_fingerprints_of_keyring "$ADD_KEYRING")"
  77     all_add_keys="$(aptkey_execute "$GPG_SH" --keyring "$ADD_KEYRING" --with-colons --list-keys | grep ^[ps]ub | cut -d: -f5)"
  78     master_keys="$(aptkey_execute "$GPG_SH" --keyring "$MASTER" --with-colons --list-keys | grep ^pub | cut -d: -f5)"
  79
  80     # ensure there are no colisions LP: #857472
  81     for all_add_key in $all_add_keys; do
  82         for master_key in $master_keys; do
  83             if [ "$all_add_key" = "$master_key" ]; then
  84                 echo >&2 "Keyid collision for '$all_add_key' detected, operation aborted"
  85                 return 1
  86             fi
  87         done
  88     done
  89
  90     for add_key in $add_keys; do
  91         # export the add keyring one-by-one
  92         local TMP_KEYRING="${GPGHOMEDIR}/tmp-keyring.gpg"
  93         aptkey_execute "$GPG_SH" --batch --yes --keyring "$ADD_KEYRING" --output "$TMP_KEYRING" --export "$add_key"
  94         if ! aptkey_execute "$GPG_SH" --batch --yes --keyring "$TMP_KEYRING" --import "$MASTER" > "${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
  95             cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
  96             false
  97         fi
  98         # check if signed with the master key and only add in this case
  99         ADDED=0
 100         for master_key in $master_keys; do
 101             if aptkey_execute "$GPG_SH" --keyring "$TMP_KEYRING" --check-sigs --with-colons "$add_key" \
 102                | grep '^sig:!:' | cut -d: -f5 | grep -q "$master_key"; then
 103                 aptkey_execute "$GPG_SH" --batch --yes --keyring "$ADD_KEYRING" --export "$add_key" \
 104                    | aptkey_execute "$GPG" --batch --yes --import
 105                 ADDED=1
 106             fi
 107         done
 108         if [ $ADDED = 0 ]; then
 109             echo >&2 "Key '$add_key' not added. It is not signed with a master key"
 110         fi
 111         rm -f "${TMP_KEYRING}"
 112     done
 113 }
 114
 115 # update the current archive signing keyring from a network URI
 116 # the archive-keyring keys needs to be signed with the master key
 117 # (otherwise it does not make sense from a security POV)
 118 net_update() {
 119     local APT_DIR='/'
 120     eval $(apt-config shell APT_DIR Dir)
 121
 122     # Disabled for now as code is insecure (LP: #1013639 (and 857472, 1013128))
 123     APT_KEY_NET_UPDATE_ENABLED=""
 124     eval $(apt-config shell APT_KEY_NET_UPDATE_ENABLED APT::Key::Net-Update-Enabled)
 125     if [ -z "$APT_KEY_NET_UPDATE_ENABLED" ]; then
 126         exit 1
 127     fi
 128
 129     if [ -z "$ARCHIVE_KEYRING_URI" ]; then
 130         apt_error 'Your distribution is not supported in net-update as no uri for the archive-keyring is set'
 131         exit 1
 132     fi
 133     # in theory we would need to depend on wget for this, but this feature
 134     # isn't useable in debian anyway as we have no keyring uri nor a master key
 135     if ! command_available 'wget'; then
 136         apt_error 'wget is required for a network-based update, but it is not installed'
 137         exit 1
 138     fi
 139     if [ ! -d "${APT_DIR}/var/lib/apt/keyrings" ]; then
 140         mkdir -p "${APT_DIR}/var/lib/apt/keyrings"
 141     fi
 142     keyring="${APT_DIR}/var/lib/apt/keyrings/$(basename "$ARCHIVE_KEYRING_URI")"
 143     old_mtime=0
 144     if [ -e $keyring ]; then
 145         old_mtime=$(stat -c %Y "$keyring")
 146     fi
 147     (cd  "${APT_DIR}/var/lib/apt/keyrings"; wget --timeout=90 -q -N "$ARCHIVE_KEYRING_URI")
 148     if [ ! -e "$keyring" ]; then
 149         return
 150     fi
 151     new_mtime=$(stat -c %Y "$keyring")
 152     if [ $new_mtime -ne $old_mtime ]; then
 153         aptkey_echo "Checking for new archive signing keys now"
 154         add_keys_with_verify_against_master_keyring "$keyring" "$MASTER_KEYRING"
 155     fi
 156 }
 157
 158 update() {
 159     if [ -z "$APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE" ]; then
 160         echo >&2 "Warning: 'apt-key update' is deprecated and should not be used anymore!"
 161         if [ -z "$ARCHIVE_KEYRING" ]; then
 162             echo >&2 "Note: In your distribution this command is a no-op and can therefore be removed safely."
 163             exit 0
 164         fi
 165     fi
 166     if [ ! -f "$ARCHIVE_KEYRING" ]; then
 167         apt_error "Can't find the archive-keyring (Is the &keyring-package; package installed?)"
 168         exit 1
 169     fi
 170
 171     # add new keys from the package;
 172
 173     # we do not use add_keys_with_verify_against_master_keyring here,
 174     # because "update" is run on regular package updates.  A
 175     # attacker might as well replace the master-archive-keyring file
 176     # in the package and add his own keys. so this check wouldn't
 177     # add any security. we *need* this check on net-update though
 178     import_keyring_into_keyring "$ARCHIVE_KEYRING" '' && cat "${GPGHOMEDIR}/gpgoutput.log"
 179
 180     if [ -r "$REMOVED_KEYS" ]; then
 181         # remove no-longer supported/used keys
 182         get_fingerprints_of_keyring "$REMOVED_KEYS" | while read key; do
 183             foreach_keyring_do 'remove_key_from_keyring' "$key"
 184         done
 185     else
 186         apt_warn "Removed keys keyring '$REMOVED_KEYS' missing or not readable"
 187     fi
 188 }
 189
 190 remove_key_from_keyring() {
 191     local KEYRINGFILE="$1"
 192     shift
 193     # non-existent keyrings have by definition no keys
 194     if [ ! -e "$KEYRINGFILE" ]; then
 195        return
 196     fi
 197
 198     for KEY in "$@"; do
 199         local FINGERPRINTS="${GPGHOMEDIR}/keyringfile.keylst"
 200         get_fingerprints_of_keyring "$KEYRINGFILE" > "$FINGERPRINTS"
 201
 202         # strip leading 0x, if present:
 203         KEY="$(echo "${KEY#0x}" | tr -d ' ')"
 204
 205         # check if the key is in this keyring
 206         if ! grep -iq "^[0-9A-F]*${KEY}$" "$FINGERPRINTS"; then
 207             continue
 208         fi
 209         if [ ! -w "$KEYRINGFILE" ]; then
 210             echo >&2 "Key ${KEY} is in keyring ${KEYRINGFILE}, but can't be removed as it is read only."
 211             continue
 212         fi
 213         # check if it is the only key in the keyring and if so remove the keyring altogether
 214         if [ '1' = "$(uniq "$FINGERPRINTS" | wc -l)" ]; then
 215             mv -f "$KEYRINGFILE" "${KEYRINGFILE}~" # behave like gpg
 216             return
 217         fi
 218         # we can't just modify pointed to files as these might be in /usr or something
 219         local REALTARGET
 220         if [ -L "$KEYRINGFILE" ]; then
 221             REALTARGET="$(readlink -f "$KEYRINGFILE")"
 222             mv -f "$KEYRINGFILE" "${KEYRINGFILE}.dpkg-tmp"
 223             cp -a "$REALTARGET" "$KEYRINGFILE"
 224         fi
 225         # delete the key from the keyring
 226         aptkey_execute "$GPG_SH" --keyring "$KEYRINGFILE" --batch --delete-keys --yes "$KEY"
 227         if [ -n "$REALTARGET" ]; then
 228             # the real backup is the old link, not the copy we made
 229             mv -f "${KEYRINGFILE}.dpkg-tmp" "${KEYRINGFILE}~"
 230         fi
 231     done
 232 }
 233
 234 accessible_file_exists() {
 235    if ! test -s "$1"; then
 236       return 1
 237    fi
 238    if test -r "$1"; then
 239       return 0
 240    fi
 241    apt_warn "The key(s) in the keyring $1 are ignored as the file is not readable by user '$USER' executing apt-key."
 242    return 1
 243 }
 244
 245 foreach_keyring_do() {
 246    local ACTION="$1"
 247    shift
 248    # if a --keyring was given, just work on this one
 249    if [ -n "$FORCED_KEYRING" ]; then
 250         $ACTION "$FORCED_KEYRING" "$@"
 251    else
 252         # otherwise all known keyrings are up for inspection
 253         if accessible_file_exists "$TRUSTEDFILE"; then
 254             $ACTION "$TRUSTEDFILE" "$@"
 255         fi
 256         local TRUSTEDPARTS="/etc/apt/trusted.gpg.d"
 257         eval "$(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d)"
 258         if [ -d "$TRUSTEDPARTS" ]; then
 259             TRUSTEDPARTS="$(readlink -f "$TRUSTEDPARTS")"
 260             local TRUSTEDPARTSLIST="$(cd /; find "$TRUSTEDPARTS" -mindepth 1 -maxdepth 1 -name '*.gpg')"
 261             for trusted in $(echo "$TRUSTEDPARTSLIST" | sort); do
 262                 if accessible_file_exists "$trusted"; then
 263                     $ACTION "$trusted" "$@"
 264                 fi
 265             done
 266         fi
 267    fi
 268 }
 269
 270 run_cmd_on_keyring() {
 271     local KEYRINGFILE="$1"
 272     shift
 273     # fingerprint and co will fail if key isn't in this keyring
 274     aptkey_execute "$GPG_SH" --keyring "$KEYRINGFILE" --batch "$@" 2>/dev/null || true
 275 }
 276
 277 import_keyring_into_keyring() {
 278     local FROM="${1:-${GPGHOMEDIR}/pubring.gpg}"
 279     local TO="${2:-${GPGHOMEDIR}/pubring.gpg}"
 280     shift 2
 281     rm -f "${GPGHOMEDIR}/gpgoutput.log"
 282     # the idea is simple: We take keys from one keyring and copy it to another
 283     # we do this with so many checks in between to ensure that WE control the
 284     # creation, so we know that the (potentially) created $TO keyring is a
 285     # simple keyring rather than a keybox as gpg2 would create it which in turn
 286     # can't be read by gpgv.
 287     # BEWARE: This is designed more in the way to work with the current
 288     # callers, than to have a well defined it would be easy to add new callers to.
 289     if [ ! -s "$TO" ]; then
 290         if [ -s "$FROM" ]; then
 291             if [ -z "$2" ]; then
 292                 if ! aptkey_execute "$GPG_SH" --keyring "$FROM" --export ${1:+"$1"} > "$TO" 2> "${GPGHOMEDIR}/gpgoutput.log"; then
 293                     cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
 294                     false
 295                 else
 296                     chmod 0644 -- "$TO"
 297                 fi
 298             else
 299                 create_new_keyring "$TO"
 300             fi
 301         else
 302             create_new_keyring "$TO"
 303         fi
 304     elif [ -s "$FROM" ]; then
 305         local EXPORTLIMIT="$1"
 306         if [ -n "$1$2" ]; then shift; fi
 307         if ! aptkey_execute "$GPG_SH" --keyring "$FROM" --export ${EXPORTLIMIT:+"$EXPORTLIMIT"} \
 308            | aptkey_execute "$GPG_SH" --keyring "$TO" --batch --import "$@" > "${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
 309             cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
 310             false
 311         fi
 312     fi
 313 }
 314
 315 catfile() {
 316    cat "$1" >> "$2"
 317 }
 318
 319 merge_all_trusted_keyrings_into_pubring() {
 320     # does the same as:
 321     # foreach_keyring_do 'import_keys_from_keyring' "${GPGHOMEDIR}/pubring.gpg"
 322     # but without using gpg, just cat and find
 323     local PUBRING="$(readlink -f "${GPGHOMEDIR}")/pubring.gpg"
 324     rm -f "$PUBRING"
 325     touch "$PUBRING"
 326     foreach_keyring_do 'catfile' "$PUBRING"
 327 }
 328
 329 import_keys_from_keyring() {
 330     import_keyring_into_keyring "$1" "$2"
 331 }
 332
 333 merge_keys_into_keyrings() {
 334     import_keyring_into_keyring "$2" "$1" '' --import-options 'merge-only'
 335 }
 336
 337 merge_back_changes() {
 338     if [ -n "$FORCED_KEYRING" ]; then
 339         # if the keyring was forced merge is already done
 340         return
 341     fi
 342     if [ -s "${GPGHOMEDIR}/pubring.gpg" ]; then
 343         # merge all updated keys
 344         foreach_keyring_do 'merge_keys_into_keyrings' "${GPGHOMEDIR}/pubring.gpg"
 345     fi
 346     # look for keys which were added or removed
 347     get_fingerprints_of_keyring "${GPGHOMEDIR}/pubring.orig.gpg" > "${GPGHOMEDIR}/pubring.orig.keylst"
 348     get_fingerprints_of_keyring "${GPGHOMEDIR}/pubring.gpg" > "${GPGHOMEDIR}/pubring.keylst"
 349     comm -3 "${GPGHOMEDIR}/pubring.keylst" "${GPGHOMEDIR}/pubring.orig.keylst" > "${GPGHOMEDIR}/pubring.diff"
 350     # key isn't part of new keyring, so remove
 351     cut -f 2 "${GPGHOMEDIR}/pubring.diff" | while read key; do
 352         if [ -z "$key" ]; then continue; fi
 353         foreach_keyring_do 'remove_key_from_keyring' "$key"
 354     done
 355     # key is only part of new keyring, so we need to import it
 356     cut -f 1 "${GPGHOMEDIR}/pubring.diff" | while read key; do
 357         if [ -z "$key" ]; then continue; fi
 358         import_keyring_into_keyring '' "$TRUSTEDFILE" "$key"
 359     done
 360 }
 361
 362 setup_merged_keyring() {
 363     if [ -n "$FORCED_KEYID" ]; then
 364         merge_all_trusted_keyrings_into_pubring
 365         FORCED_KEYRING="${GPGHOMEDIR}/forcedkeyid.gpg"
 366         TRUSTEDFILE="${FORCED_KEYRING}"
 367         echo "#!/bin/sh
 368 exec sh '($(escape_shell "${GPG}")' --keyring '$(escape_shell "${TRUSTEDFILE}")' \"\$@\"" > "${GPGHOMEDIR}/gpg.1.sh"
 369         GPG="${GPGHOMEDIR}/gpg.1.sh"
 370         # ignore error as this "just" means we haven't found the forced keyid and the keyring will be empty
 371         import_keyring_into_keyring '' "$TRUSTEDFILE" "$FORCED_KEYID" || true
 372     elif [ -z "$FORCED_KEYRING" ]; then
 373         merge_all_trusted_keyrings_into_pubring
 374         if [ -r "${GPGHOMEDIR}/pubring.gpg" ]; then
 375             cp -a "${GPGHOMEDIR}/pubring.gpg" "${GPGHOMEDIR}/pubring.orig.gpg"
 376         else
 377            touch "${GPGHOMEDIR}/pubring.gpg" "${GPGHOMEDIR}/pubring.orig.gpg"
 378         fi
 379         echo "#!/bin/sh
 380 exec sh '$(escape_shell "${GPG}")' --keyring '$(escape_shell "${GPGHOMEDIR}/pubring.gpg")' \"\$@\"" > "${GPGHOMEDIR}/gpg.1.sh"
 381         GPG="${GPGHOMEDIR}/gpg.1.sh"
 382     else
 383         create_new_keyring "$TRUSTEDFILE"
 384         echo "#!/bin/sh
 385 exec sh '$(escape_shell "${GPG}")' --keyring '$(escape_shell "${TRUSTEDFILE}")' \"\$@\"" > "${GPGHOMEDIR}/gpg.1.sh"
 386         GPG="${GPGHOMEDIR}/gpg.1.sh"
 387     fi
 388 }
 389
 390 create_new_keyring() {
 391     # gpg defaults to mode 0600 for new keyrings. Create one with 0644 instead.
 392     if ! [ -e "$TRUSTEDFILE" ]; then
 393         if [ -w "$(dirname "$TRUSTEDFILE")" ]; then
 394             touch -- "$TRUSTEDFILE"
 395             chmod 0644 -- "$TRUSTEDFILE"
 396         fi
 397     fi
 398 }
 399
 400 aptkey_execute() { sh "$@"; }
 401
 402 usage() {
 403     echo "Usage: apt-key [--keyring file] [command] [arguments]"
 404     echo
 405     echo "Manage apt's list of trusted keys"
 406     echo
 407     echo "  apt-key add <file>          - add the key contained in <file> ('-' for stdin)"
 408     echo "  apt-key del <keyid>         - remove the key <keyid>"
 409     echo "  apt-key export <keyid>      - output the key <keyid>"
 410     echo "  apt-key exportall           - output all trusted keys"
 411     echo "  apt-key update              - update keys using the keyring package"
 412     echo "  apt-key net-update          - update keys using the network"
 413     echo "  apt-key list                - list keys"
 414     echo "  apt-key finger              - list fingerprints"
 415     echo "  apt-key adv                 - pass advanced options to gpg (download key)"
 416     echo
 417     echo "If no specific keyring file is given the command applies to all keyring files."
 418 }
 419
 420 while [ -n "$1" ]; do
 421    case "$1" in
 422       --keyring)
 423          shift
 424          TRUSTEDFILE="$1"
 425          FORCED_KEYRING="$1"
 426          ;;
 427       --keyid)
 428          shift
 429          FORCED_KEYID="$1"
 430          ;;
 431       --secret-keyring)
 432          shift
 433          FORCED_SECRET_KEYRING="$1"
 434          ;;
 435       --readonly)
 436          merge_back_changes() { true; }
 437          create_new_keyring() { if [ ! -r "$FORCED_KEYRING" ]; then TRUSTEDFILE='/dev/null'; FORCED_KEYRING="$TRUSTEDFILE"; fi; }
 438          ;;
 439       --fakeroot)
 440          requires_root() { true; }
 441          ;;
 442       --quiet)
 443          aptkey_echo() { true; }
 444          ;;
 445       --debug1)
 446          # some cmds like finger redirect stderr to /dev/null …
 447         aptkey_execute() { echo 'EXEC:' "$@"; sh "$@"; }
 448         ;;
 449       --debug2)
 450          # … other more complicated ones pipe gpg into gpg.
 451         aptkey_execute() { echo >&2 'EXEC:' "$@"; sh "$@"; }
 452         ;;
 453       --*)
 454          echo >&2 "Unknown option: $1"
 455          usage
 456          exit 1;;
 457       *)
 458          break;;
 459    esac
 460    shift
 461 done
 462
 463 if [ -z "$TRUSTEDFILE" ]; then
 464    TRUSTEDFILE="/etc/apt/trusted.gpg"
 465    eval $(apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring)
 466    eval $(apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f)
 467 fi
 468
 469 command="$1"
 470 if [ -z "$command" ]; then
 471     usage
 472     exit 1
 473 fi
 474 shift
 475
 476 find_gpgv_status_fd() {
 477    while [ -n "$1" ]; do
 478         if [ "$1" = '--status-fd' ]; then
 479                 shift
 480                 echo "$1"
 481                 break
 482         fi
 483         shift
 484    done
 485 }
 486 GPGSTATUSFD="$(find_gpgv_status_fd "$@")"
 487
 488 apt_warn() {
 489     if [ -z "$GPGHOMEDIR" ]; then
 490         echo >&2 'W:' "$@"
 491     else
 492         echo 'W:' "$@" > "${GPGHOMEDIR}/aptwarnings.log"
 493     fi
 494     if [ -n "$GPGSTATUSFD" ]; then
 495         echo >&${GPGSTATUSFD} '[APTKEY:] WARNING' "$@"
 496     fi
 497 }
 498 apt_error() {
 499     if [ -z "$GPGHOMEDIR" ]; then
 500         echo >&2 'E:' "$@"
 501     else
 502         echo 'E:' "$@" > "${GPGHOMEDIR}/aptwarnings.log"
 503     fi
 504     if [ -n "$GPGSTATUSFD" ]; then
 505         echo >&${GPGSTATUSFD} '[APTKEY:] ERROR' "$@"
 506     fi
 507 }
 508
 509 cleanup_gpg_home() {
 510     if [ -z "$GPGHOMEDIR" ]; then return; fi
 511     if [ -s "$GPGHOMEDIR/aptwarnings.log" ]; then
 512         cat >&2 "$GPGHOMEDIR/aptwarnings.log"
 513     fi
 514     if command_available 'gpgconf'; then
 515         GNUPGHOME="${GPGHOMEDIR}" gpgconf --kill gpg-agent >/dev/null 2>&1 || true
 516     fi
 517     rm -rf "$GPGHOMEDIR"
 518 }
 519
 520 create_gpg_home() {
 521     # gpg needs (in different versions more or less) files to function correctly,
 522     # so we give it its own homedir and generate some valid content for it later on
 523     if [ -n "$TMPDIR" ]; then
 524         # tmpdir is a directory and current user has rwx access to it
 525         # same tests as in apt-pkg/contrib/fileutl.cc GetTempDir()
 526         if [ ! -d "$TMPDIR" ] || [ ! -r "$TMPDIR" ] || [ ! -w "$TMPDIR" ] || [ ! -x "$TMPDIR" ]; then
 527             unset TMPDIR
 528         fi
 529     fi
 530     GPGHOMEDIR="$(mktemp -d)"
 531     CURRENTTRAP="${CURRENTTRAP} cleanup_gpg_home;"
 532     trap "${CURRENTTRAP}" 0 HUP INT QUIT ILL ABRT FPE SEGV PIPE TERM
 533     if [ -z "$GPGHOMEDIR" ]; then
 534         apt_error "Could not create temporary gpg home directory in $TMPDIR (wrong permissions?)"
 535         exit 28
 536     fi
 537     chmod 700 "$GPGHOMEDIR"
 538 }
 539
 540 prepare_gpg_home() {
 541     # crude detection if we are called from a maintainerscript where the
 542     # package depends on gnupg or not. We accept recommends here as
 543     # well as the script hopefully uses apt-key optionally then like e.g.
 544     # debian-archive-keyring for (upgrade) cleanup did
 545     if [ -n "$DPKG_MAINTSCRIPT_PACKAGE" ] && [ -z "$APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE" ]; then
 546         if ! dpkg-query --show --showformat '${Pre-Depends}${Depends}${Recommends}\n' "$DPKG_MAINTSCRIPT_PACKAGE" 2>/dev/null | grep -q gnupg; then
 547             cat >&2 <<EOF
 548 Warning: The $DPKG_MAINTSCRIPT_NAME maintainerscript of the package $DPKG_MAINTSCRIPT_PACKAGE
 549 Warning: seems to use apt-key (provided by apt) without depending on gnupg or gnupg2.
 550 Warning: This will BREAK in the future and should be fixed by the package maintainer(s).
 551 Note: Check first if apt-key functionality is needed at all - it probably isn't!
 552 EOF
 553         fi
 554     fi
 555     eval "$(apt-config shell GPG_EXE Apt::Key::gpgcommand)"
 556     if [ -n "$GPG_EXE" ] && command_available "$GPG_EXE"; then
 557         true
 558     elif command_available 'gpg'; then
 559         GPG_EXE="gpg"
 560     elif command_available 'gpg2'; then
 561         GPG_EXE="gpg2"
 562     elif command_available 'gpg1'; then
 563         GPG_EXE="gpg1"
 564     else
 565         apt_error 'gnupg, gnupg2 and gnupg1 do not seem to be installed, but one of them is required for this operation'
 566         exit 255
 567     fi
 568
 569     create_gpg_home
 570
 571     # create the trustdb with an (empty) dummy keyring
 572     # older gpgs required it, newer gpgs even warn that it isn't needed,
 573     # but require it nonetheless for some commands, so we just play safe
 574     # here for the foreseeable future and create a dummy one
 575     touch "${GPGHOMEDIR}/empty.gpg"
 576     if ! "$GPG_EXE" --ignore-time-conflict --no-options --no-default-keyring \
 577        --homedir "$GPGHOMEDIR" --quiet --check-trustdb --keyring "${GPGHOMEDIR}/empty.gpg" >"${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
 578        cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
 579        false
 580     fi
 581
 582     # now tell gpg that it shouldn't try to maintain this trustdb file
 583     echo "#!/bin/sh
 584 exec '$(escape_shell "${GPG_EXE}")' --ignore-time-conflict --no-options --no-default-keyring \\
 585 --homedir '$(escape_shell "${GPGHOMEDIR}")' --no-auto-check-trustdb --trust-model always \"\$@\"" > "${GPGHOMEDIR}/gpg.0.sh"
 586     GPG_SH="${GPGHOMEDIR}/gpg.0.sh"
 587     GPG="$GPG_SH"
 588
 589     # We don't usually need a secret keyring, of course, but
 590     # for advanced operations, we might really need a secret keyring after all
 591     if [ -n "$FORCED_SECRET_KEYRING" ] && [ -r "$FORCED_SECRET_KEYRING" ]; then
 592         if ! aptkey_execute "$GPG" -v --batch --import "$FORCED_SECRET_KEYRING" >"${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
 593             cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
 594             false
 595         fi
 596     else
 597        # and then, there are older versions of gpg which panic and implode
 598        # if there isn't one available - and writeable for imports
 599        # and even if not output is littered with the creation of a secring,
 600        # so lets call import once to have it create what it wants in silence
 601        echo -n | aptkey_execute "$GPG" --batch --import >/dev/null 2>&1 || true
 602     fi
 603 }
 604
 605 warn_on_script_usage() {
 606     if [ -n "$APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE" ]; then
 607         return
 608     fi
 609     # (Maintainer) scripts should not be using apt-key
 610     if [ -n "$DPKG_MAINTSCRIPT_PACKAGE" ]; then
 611         echo >&2 "Warning: apt-key should not be used in scripts (called from $DPKG_MAINTSCRIPT_NAME maintainerscript of the package ${DPKG_MAINTSCRIPT_PACKAGE})"
 612     elif [ ! -t 1 ]; then
 613         echo >&2 "Warning: apt-key output should not be parsed (stdout is not a terminal)"
 614     fi
 615 }
 616
 617 if [ "$command" != 'help' ] && [ "$command" != 'verify' ]; then
 618     prepare_gpg_home
 619 fi
 620
 621 case "$command" in
 622     add)
 623         warn_on_script_usage
 624         requires_root
 625         setup_merged_keyring
 626         aptkey_execute "$GPG" --quiet --batch --import "$@"
 627         merge_back_changes
 628         aptkey_echo "OK"
 629         ;;
 630     del|rm|remove)
 631         # no script warning here as removing 'add' usage needs 'del' for cleanup
 632         requires_root
 633         foreach_keyring_do 'remove_key_from_keyring' "$@"
 634         aptkey_echo "OK"
 635         ;;
 636     update)
 637         warn_on_script_usage
 638         requires_root
 639         setup_merged_keyring
 640         update
 641         merge_back_changes
 642         ;;
 643     net-update)
 644         requires_root
 645         setup_merged_keyring
 646         net_update
 647         merge_back_changes
 648         ;;
 649     list|finger*)
 650         warn_on_script_usage
 651         foreach_keyring_do 'run_cmd_on_keyring' --fingerprint "$@"
 652         ;;
 653     export|exportall)
 654         warn_on_script_usage
 655         merge_all_trusted_keyrings_into_pubring
 656         aptkey_execute "$GPG_SH" --keyring "${GPGHOMEDIR}/pubring.gpg" --armor --export "$@"
 657         ;;
 658     adv*)
 659         warn_on_script_usage
 660         setup_merged_keyring
 661         aptkey_echo "Executing: $GPG $*"
 662         aptkey_execute "$GPG" "$@"
 663         merge_back_changes
 664         ;;
 665     verify)
 666         GPGV=''
 667         eval $(apt-config shell GPGV Apt::Key::gpgvcommand)
 668         if [ -n "$GPGV" ] && command_available "$GPGV"; then true;
 669         elif command_available 'gpgv'; then GPGV='gpgv';
 670         elif command_available 'gpgv2'; then GPGV='gpgv2';
 671         elif command_available 'gpgv1'; then GPGV='gpgv1';
 672         else
 673            apt_error 'gpgv, gpgv2 or gpgv1 required for verification, but neither seems installed'
 674            exit 29
 675         fi
 676         # for a forced keyid we need gpg --export, so full wrapping required
 677         if [ -n "$FORCED_KEYID" ]; then
 678             prepare_gpg_home
 679         else
 680             create_gpg_home
 681         fi
 682         setup_merged_keyring
 683         if [ -n "$FORCED_KEYRING" ]; then
 684             "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "${FORCED_KEYRING}" --ignore-time-conflict "$@"
 685         else
 686             "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "${GPGHOMEDIR}/pubring.gpg" --ignore-time-conflict "$@"
 687         fi
 688         ;;
 689     help)
 690         usage
 691         ;;
 692     *)
 693         usage
 694         exit 1
 695         ;;
 696 esac