cmdline/apt-key.in

   1 #!/bin/sh
   2
   3 set -e
   4 unset GREP_OPTIONS
   5 export IFS="$(printf "\n\b")"
   6
   7 MASTER_KEYRING='&keyring-master-filename;'
   8 eval "$(apt-config shell MASTER_KEYRING APT::Key::MasterKeyring)"
   9 ARCHIVE_KEYRING='&keyring-filename;'
  10 eval "$(apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring)"
  11 REMOVED_KEYS='&keyring-removed-filename;'
  12 eval "$(apt-config shell REMOVED_KEYS APT::Key::RemovedKeys)"
  13 ARCHIVE_KEYRING_URI='&keyring-uri;'
  14 eval "$(apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI)"
  15
  16 aptkey_echo() { echo "$@"; }
  17
  18 requires_root() {
  19         if [ "$(id -u)" -ne 0 ]; then
  20                 echo >&2 "ERROR: This command can only be used by root."
  21                 exit 1
  22         fi
  23 }
  24
  25 command_available() {
  26     if [ -x "$1" ]; then return 0; fi
  27     # command -v "$1" >/dev/null 2>&1 # not required by policy, see #747320
  28     # which "$1" >/dev/null 2>&1 # is in debianutils (essential) but not on non-debian systems
  29     local OLDIFS="$IFS"
  30     IFS=:
  31     for p in $PATH; do
  32         if [ -x "${p}/${1}" ]; then
  33             IFS="$OLDIFS"
  34             return 0
  35         fi
  36     done
  37     IFS="$OLDIFS"
  38     return 1
  39 }
  40
  41 escape_shell() {
  42     echo "$@" | sed -e "s#'#'\"'\"'#g"
  43 }
  44
  45 get_fingerprints_of_keyring() {
  46     aptkey_execute "$GPG_SH" --keyring "$1" --with-colons --fingerprint | while read publine; do
  47         # search for a public key
  48         if [ "${publine%%:*}" != 'pub' ]; then continue; fi
  49         # search for the associated fingerprint (should be the very next line)
  50         while read fprline; do
  51            if [ "${fprline%%:*}" = 'sub' ]; then break; # should never happen
  52            elif [ "${fprline%%:*}" != 'fpr' ]; then continue; fi
  53            echo "$fprline" | cut -d':' -f 10
  54         done
  55         # order in the keyring shouldn't be important
  56     done | sort
  57 }
  58
  59 add_keys_with_verify_against_master_keyring() {
  60     ADD_KEYRING="$1"
  61     MASTER="$2"
  62
  63     if [ ! -f "$ADD_KEYRING" ]; then
  64         echo >&2 "ERROR: '$ADD_KEYRING' not found"
  65         return
  66     fi
  67     if [ ! -f "$MASTER" ]; then
  68         echo >&2 "ERROR: '$MASTER' not found"
  69         return
  70     fi
  71
  72     # when adding new keys, make sure that the archive-master-keyring
  73     # is honored. so:
  74     #   all keys that are exported must have a valid signature
  75     #   from a key in the $distro-master-keyring
  76     add_keys="$(get_fingerprints_of_keyring "$ADD_KEYRING")"
  77     all_add_keys="$(aptkey_execute "$GPG_SH" --keyring "$ADD_KEYRING" --with-colons --list-keys | grep ^[ps]ub | cut -d: -f5)"
  78     master_keys="$(aptkey_execute "$GPG_SH" --keyring "$MASTER" --with-colons --list-keys | grep ^pub | cut -d: -f5)"
  79
  80     # ensure there are no colisions LP: #857472
  81     for all_add_key in $all_add_keys; do
  82         for master_key in $master_keys; do
  83             if [ "$all_add_key" = "$master_key" ]; then
  84                 echo >&2 "Keyid collision for '$all_add_key' detected, operation aborted"
  85                 return 1
  86             fi
  87         done
  88     done
  89
  90     for add_key in $add_keys; do
  91         # export the add keyring one-by-one
  92         local TMP_KEYRING="${GPGHOMEDIR}/tmp-keyring.gpg"
  93         aptkey_execute "$GPG_SH" --batch --yes --keyring "$ADD_KEYRING" --output "$TMP_KEYRING" --export "$add_key"
  94         if ! aptkey_execute "$GPG_SH" --batch --yes --keyring "$TMP_KEYRING" --import "$MASTER" > "${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
  95             cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
  96             false
  97         fi
  98         # check if signed with the master key and only add in this case
  99         ADDED=0
 100         for master_key in $master_keys; do
 101             if aptkey_execute "$GPG_SH" --keyring "$TMP_KEYRING" --check-sigs --with-colons "$add_key" \
 102                | grep '^sig:!:' | cut -d: -f5 | grep -q "$master_key"; then
 103                 aptkey_execute "$GPG_SH" --batch --yes --keyring "$ADD_KEYRING" --export "$add_key" \
 104                    | aptkey_execute "$GPG" --batch --yes --import
 105                 ADDED=1
 106             fi
 107         done
 108         if [ $ADDED = 0 ]; then
 109             echo >&2 "Key '$add_key' not added. It is not signed with a master key"
 110         fi
 111         rm -f "${TMP_KEYRING}"
 112     done
 113 }
 114
 115 # update the current archive signing keyring from a network URI
 116 # the archive-keyring keys needs to be signed with the master key
 117 # (otherwise it does not make sense from a security POV)
 118 net_update() {
 119     local APT_DIR='/'
 120     eval $(apt-config shell APT_DIR Dir)
 121
 122     # Disabled for now as code is insecure (LP: #1013639 (and 857472, 1013128))
 123     APT_KEY_NET_UPDATE_ENABLED=""
 124     eval $(apt-config shell APT_KEY_NET_UPDATE_ENABLED APT::Key::Net-Update-Enabled)
 125     if [ -z "$APT_KEY_NET_UPDATE_ENABLED" ]; then
 126         exit 1
 127     fi
 128
 129     if [ -z "$ARCHIVE_KEYRING_URI" ]; then
 130         echo >&2 "ERROR: Your distribution is not supported in net-update as no uri for the archive-keyring is set"
 131         exit 1
 132     fi
 133     # in theory we would need to depend on wget for this, but this feature
 134     # isn't useable in debian anyway as we have no keyring uri nor a master key
 135     if ! command_available 'wget'; then
 136         echo >&2 "ERROR: an installed wget is required for a network-based update"
 137         exit 1
 138     fi
 139     if [ ! -d "${APT_DIR}/var/lib/apt/keyrings" ]; then
 140         mkdir -p "${APT_DIR}/var/lib/apt/keyrings"
 141     fi
 142     keyring="${APT_DIR}/var/lib/apt/keyrings/$(basename "$ARCHIVE_KEYRING_URI")"
 143     old_mtime=0
 144     if [ -e $keyring ]; then
 145         old_mtime=$(stat -c %Y "$keyring")
 146     fi
 147     (cd  "${APT_DIR}/var/lib/apt/keyrings"; wget --timeout=90 -q -N "$ARCHIVE_KEYRING_URI")
 148     if [ ! -e "$keyring" ]; then
 149         return
 150     fi
 151     new_mtime=$(stat -c %Y "$keyring")
 152     if [ $new_mtime -ne $old_mtime ]; then
 153         aptkey_echo "Checking for new archive signing keys now"
 154         add_keys_with_verify_against_master_keyring "$keyring" "$MASTER_KEYRING"
 155     fi
 156 }
 157
 158 update() {
 159     if [ -z "$APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE" ]; then
 160         echo >&2 "Warning: 'apt-key update' is deprecated and should not be used anymore!"
 161         if [ -z "$ARCHIVE_KEYRING" ]; then
 162             echo >&2 "Note: In your distribution this command is a no-op and can therefore be removed safely."
 163             exit 0
 164         fi
 165     fi
 166     if [ ! -f "$ARCHIVE_KEYRING" ]; then
 167         echo >&2 "ERROR: Can't find the archive-keyring"
 168         echo >&2 "Is the &keyring-package; package installed?"
 169         exit 1
 170     fi
 171
 172     # add new keys from the package;
 173
 174     # we do not use add_keys_with_verify_against_master_keyring here,
 175     # because "update" is run on regular package updates.  A
 176     # attacker might as well replace the master-archive-keyring file
 177     # in the package and add his own keys. so this check wouldn't
 178     # add any security. we *need* this check on net-update though
 179     import_keyring_into_keyring "$ARCHIVE_KEYRING" '' && cat "${GPGHOMEDIR}/gpgoutput.log"
 180
 181     if [ -r "$REMOVED_KEYS" ]; then
 182         # remove no-longer supported/used keys
 183         get_fingerprints_of_keyring "$REMOVED_KEYS" | while read key; do
 184             foreach_keyring_do 'remove_key_from_keyring' "$key"
 185         done
 186     else
 187         echo >&2 "Warning: removed keys keyring  $REMOVED_KEYS missing or not readable"
 188     fi
 189 }
 190
 191 remove_key_from_keyring() {
 192     local KEYRINGFILE="$1"
 193     shift
 194     # non-existent keyrings have by definition no keys
 195     if [ ! -e "$KEYRINGFILE" ]; then
 196        return
 197     fi
 198
 199     for KEY in "$@"; do
 200         local FINGERPRINTS="${GPGHOMEDIR}/keyringfile.keylst"
 201         get_fingerprints_of_keyring "$KEYRINGFILE" > "$FINGERPRINTS"
 202
 203         # strip leading 0x, if present:
 204         KEY="$(echo "${KEY#0x}" | tr -d ' ')"
 205
 206         # check if the key is in this keyring
 207         if ! grep -iq "^[0-9A-F]*${KEY}$" "$FINGERPRINTS"; then
 208             continue
 209         fi
 210         if [ ! -w "$KEYRINGFILE" ]; then
 211             echo >&2 "Key ${KEY} is in keyring ${KEYRINGFILE}, but can't be removed as it is read only."
 212             continue
 213         fi
 214         # check if it is the only key in the keyring and if so remove the keyring altogether
 215         if [ '1' = "$(uniq "$FINGERPRINTS" | wc -l)" ]; then
 216             mv -f "$KEYRINGFILE" "${KEYRINGFILE}~" # behave like gpg
 217             return
 218         fi
 219         # we can't just modify pointed to files as these might be in /usr or something
 220         local REALTARGET
 221         if [ -L "$KEYRINGFILE" ]; then
 222             REALTARGET="$(readlink -f "$KEYRINGFILE")"
 223             mv -f "$KEYRINGFILE" "${KEYRINGFILE}.dpkg-tmp"
 224             cp -a "$REALTARGET" "$KEYRINGFILE"
 225         fi
 226         # delete the key from the keyring
 227         aptkey_execute "$GPG_SH" --keyring "$KEYRINGFILE" --batch --delete-keys --yes "$KEY"
 228         if [ -n "$REALTARGET" ]; then
 229             # the real backup is the old link, not the copy we made
 230             mv -f "${KEYRINGFILE}.dpkg-tmp" "${KEYRINGFILE}~"
 231         fi
 232     done
 233 }
 234
 235 accessible_file_exists() {
 236    if ! test -s "$1"; then
 237       return 1
 238    fi
 239    if test -r "$1"; then
 240       return 0
 241    fi
 242    warn "The key(s) in the keyring $1 are ignored as the file is not readable by user '$USER' executing apt-key."
 243    return 1
 244 }
 245
 246 foreach_keyring_do() {
 247    local ACTION="$1"
 248    shift
 249    # if a --keyring was given, just work on this one
 250    if [ -n "$FORCED_KEYRING" ]; then
 251         $ACTION "$FORCED_KEYRING" "$@"
 252    else
 253         # otherwise all known keyrings are up for inspection
 254         if accessible_file_exists "$TRUSTEDFILE"; then
 255             $ACTION "$TRUSTEDFILE" "$@"
 256         fi
 257         local TRUSTEDPARTS="/etc/apt/trusted.gpg.d"
 258         eval "$(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d)"
 259         if [ -d "$TRUSTEDPARTS" ]; then
 260             TRUSTEDPARTS="$(readlink -f "$TRUSTEDPARTS")"
 261             local TRUSTEDPARTSLIST="$(cd /; find "$TRUSTEDPARTS" -mindepth 1 -maxdepth 1 -name '*.gpg')"
 262             for trusted in $(echo "$TRUSTEDPARTSLIST" | sort); do
 263                 if accessible_file_exists "$trusted"; then
 264                     $ACTION "$trusted" "$@"
 265                 fi
 266             done
 267         fi
 268    fi
 269 }
 270
 271 run_cmd_on_keyring() {
 272     local KEYRINGFILE="$1"
 273     shift
 274     # fingerprint and co will fail if key isn't in this keyring
 275     aptkey_execute "$GPG_SH" --keyring "$KEYRINGFILE" --batch "$@" 2>/dev/null || true
 276 }
 277
 278 import_keyring_into_keyring() {
 279     local FROM="${1:-${GPGHOMEDIR}/pubring.gpg}"
 280     local TO="${2:-${GPGHOMEDIR}/pubring.gpg}"
 281     shift 2
 282     rm -f "${GPGHOMEDIR}/gpgoutput.log"
 283     # the idea is simple: We take keys from one keyring and copy it to another
 284     # we do this with so many checks in between to ensure that WE control the
 285     # creation, so we know that the (potentially) created $TO keyring is a
 286     # simple keyring rather than a keybox as gpg2 would create it which in turn
 287     # can't be read by gpgv.
 288     # BEWARE: This is designed more in the way to work with the current
 289     # callers, than to have a well defined it would be easy to add new callers to.
 290     if [ ! -s "$TO" ]; then
 291         if [ -s "$FROM" ]; then
 292             if [ -z "$2" ]; then
 293                 if ! aptkey_execute "$GPG_SH" --keyring "$FROM" --export ${1:+"$1"} > "$TO" 2> "${GPGHOMEDIR}/gpgoutput.log"; then
 294                     cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
 295                     false
 296                 else
 297                     chmod 0644 -- "$TO"
 298                 fi
 299             else
 300                 create_new_keyring "$TO"
 301             fi
 302         else
 303             create_new_keyring "$TO"
 304         fi
 305     elif [ -s "$FROM" ]; then
 306         local EXPORTLIMIT="$1"
 307         if [ -n "$1$2" ]; then shift; fi
 308         if ! aptkey_execute "$GPG_SH" --keyring "$FROM" --export ${EXPORTLIMIT:+"$EXPORTLIMIT"} \
 309            | aptkey_execute "$GPG_SH" --keyring "$TO" --batch --import "$@" > "${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
 310             cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
 311             false
 312         fi
 313     fi
 314 }
 315
 316 catfile() {
 317    cat "$1" >> "$2"
 318 }
 319
 320 merge_all_trusted_keyrings_into_pubring() {
 321     # does the same as:
 322     # foreach_keyring_do 'import_keys_from_keyring' "${GPGHOMEDIR}/pubring.gpg"
 323     # but without using gpg, just cat and find
 324     local PUBRING="$(readlink -f "${GPGHOMEDIR}")/pubring.gpg"
 325     rm -f "$PUBRING"
 326     touch "$PUBRING"
 327     foreach_keyring_do 'catfile' "$PUBRING"
 328 }
 329
 330 import_keys_from_keyring() {
 331     import_keyring_into_keyring "$1" "$2"
 332 }
 333
 334 merge_keys_into_keyrings() {
 335     import_keyring_into_keyring "$2" "$1" '' --import-options 'merge-only'
 336 }
 337
 338 merge_back_changes() {
 339     if [ -n "$FORCED_KEYRING" ]; then
 340         # if the keyring was forced merge is already done
 341         return
 342     fi
 343     if [ -s "${GPGHOMEDIR}/pubring.gpg" ]; then
 344         # merge all updated keys
 345         foreach_keyring_do 'merge_keys_into_keyrings' "${GPGHOMEDIR}/pubring.gpg"
 346     fi
 347     # look for keys which were added or removed
 348     get_fingerprints_of_keyring "${GPGHOMEDIR}/pubring.orig.gpg" > "${GPGHOMEDIR}/pubring.orig.keylst"
 349     get_fingerprints_of_keyring "${GPGHOMEDIR}/pubring.gpg" > "${GPGHOMEDIR}/pubring.keylst"
 350     comm -3 "${GPGHOMEDIR}/pubring.keylst" "${GPGHOMEDIR}/pubring.orig.keylst" > "${GPGHOMEDIR}/pubring.diff"
 351     # key isn't part of new keyring, so remove
 352     cut -f 2 "${GPGHOMEDIR}/pubring.diff" | while read key; do
 353         if [ -z "$key" ]; then continue; fi
 354         foreach_keyring_do 'remove_key_from_keyring' "$key"
 355     done
 356     # key is only part of new keyring, so we need to import it
 357     cut -f 1 "${GPGHOMEDIR}/pubring.diff" | while read key; do
 358         if [ -z "$key" ]; then continue; fi
 359         import_keyring_into_keyring '' "$TRUSTEDFILE" "$key"
 360     done
 361 }
 362
 363 setup_merged_keyring() {
 364     if [ -n "$FORCED_KEYID" ]; then
 365         merge_all_trusted_keyrings_into_pubring
 366         FORCED_KEYRING="${GPGHOMEDIR}/forcedkeyid.gpg"
 367         TRUSTEDFILE="${FORCED_KEYRING}"
 368         echo "#!/bin/sh
 369 exec sh '($(escape_shell "${GPG}")' --keyring '$(escape_shell "${TRUSTEDFILE}")' \"\$@\"" > "${GPGHOMEDIR}/gpg.1.sh"
 370         GPG="${GPGHOMEDIR}/gpg.1.sh"
 371         # ignore error as this "just" means we haven't found the forced keyid and the keyring will be empty
 372         import_keyring_into_keyring '' "$TRUSTEDFILE" "$FORCED_KEYID" || true
 373     elif [ -z "$FORCED_KEYRING" ]; then
 374         merge_all_trusted_keyrings_into_pubring
 375         if [ -r "${GPGHOMEDIR}/pubring.gpg" ]; then
 376             cp -a "${GPGHOMEDIR}/pubring.gpg" "${GPGHOMEDIR}/pubring.orig.gpg"
 377         else
 378            touch "${GPGHOMEDIR}/pubring.gpg" "${GPGHOMEDIR}/pubring.orig.gpg"
 379         fi
 380         echo "#!/bin/sh
 381 exec sh '$(escape_shell "${GPG}")' --keyring '$(escape_shell "${GPGHOMEDIR}/pubring.gpg")' \"\$@\"" > "${GPGHOMEDIR}/gpg.1.sh"
 382         GPG="${GPGHOMEDIR}/gpg.1.sh"
 383     else
 384         create_new_keyring "$TRUSTEDFILE"
 385         echo "#!/bin/sh
 386 exec sh '$(escape_shell "${GPG}")' --keyring '$(escape_shell "${TRUSTEDFILE}")' \"\$@\"" > "${GPGHOMEDIR}/gpg.1.sh"
 387         GPG="${GPGHOMEDIR}/gpg.1.sh"
 388     fi
 389 }
 390
 391 create_new_keyring() {
 392     # gpg defaults to mode 0600 for new keyrings. Create one with 0644 instead.
 393     if ! [ -e "$TRUSTEDFILE" ]; then
 394         if [ -w "$(dirname "$TRUSTEDFILE")" ]; then
 395             touch -- "$TRUSTEDFILE"
 396             chmod 0644 -- "$TRUSTEDFILE"
 397         fi
 398     fi
 399 }
 400
 401 aptkey_execute() { sh "$@"; }
 402
 403 usage() {
 404     echo "Usage: apt-key [--keyring file] [command] [arguments]"
 405     echo
 406     echo "Manage apt's list of trusted keys"
 407     echo
 408     echo "  apt-key add <file>          - add the key contained in <file> ('-' for stdin)"
 409     echo "  apt-key del <keyid>         - remove the key <keyid>"
 410     echo "  apt-key export <keyid>      - output the key <keyid>"
 411     echo "  apt-key exportall           - output all trusted keys"
 412     echo "  apt-key update              - update keys using the keyring package"
 413     echo "  apt-key net-update          - update keys using the network"
 414     echo "  apt-key list                - list keys"
 415     echo "  apt-key finger              - list fingerprints"
 416     echo "  apt-key adv                 - pass advanced options to gpg (download key)"
 417     echo
 418     echo "If no specific keyring file is given the command applies to all keyring files."
 419 }
 420
 421 while [ -n "$1" ]; do
 422    case "$1" in
 423       --keyring)
 424          shift
 425          TRUSTEDFILE="$1"
 426          FORCED_KEYRING="$1"
 427          ;;
 428       --keyid)
 429          shift
 430          FORCED_KEYID="$1"
 431          ;;
 432       --secret-keyring)
 433          shift
 434          FORCED_SECRET_KEYRING="$1"
 435          ;;
 436       --readonly)
 437          merge_back_changes() { true; }
 438          create_new_keyring() { if [ ! -r "$FORCED_KEYRING" ]; then TRUSTEDFILE='/dev/null'; FORCED_KEYRING="$TRUSTEDFILE"; fi; }
 439          ;;
 440       --fakeroot)
 441          requires_root() { true; }
 442          ;;
 443       --quiet)
 444          aptkey_echo() { true; }
 445          ;;
 446       --debug1)
 447          # some cmds like finger redirect stderr to /dev/null …
 448         aptkey_execute() { echo 'EXEC:' "$@"; sh "$@"; }
 449         ;;
 450       --debug2)
 451          # … other more complicated ones pipe gpg into gpg.
 452         aptkey_execute() { echo >&2 'EXEC:' "$@"; sh "$@"; }
 453         ;;
 454       --*)
 455          echo >&2 "Unknown option: $1"
 456          usage
 457          exit 1;;
 458       *)
 459          break;;
 460    esac
 461    shift
 462 done
 463
 464 if [ -z "$TRUSTEDFILE" ]; then
 465    TRUSTEDFILE="/etc/apt/trusted.gpg"
 466    eval $(apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring)
 467    eval $(apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f)
 468 fi
 469
 470 command="$1"
 471 if [ -z "$command" ]; then
 472     usage
 473     exit 1
 474 fi
 475 shift
 476
 477 find_gpgv_status_fd() {
 478    while [ -n "$1" ]; do
 479         if [ "$1" = '--status-fd' ]; then
 480                 shift
 481                 echo "$1"
 482                 break
 483         fi
 484         shift
 485    done
 486 }
 487 GPGSTATUSFD="$(find_gpgv_status_fd "$@")"
 488
 489 warn() {
 490     if [ -z "$GPGHOMEDIR" ]; then
 491         echo >&2 'W:' "$@"
 492     else
 493         echo 'W:' "$@" > "${GPGHOMEDIR}/aptwarnings.log"
 494     fi
 495     if [ -n "$GPGSTATUSFD" ]; then
 496         echo >&${GPGSTATUSFD} '[APTKEY:] WARNING' "$@"
 497     fi
 498 }
 499
 500 cleanup_gpg_home() {
 501     if [ -z "$GPGHOMEDIR" ]; then return; fi
 502     if [ -s "$GPGHOMEDIR/aptwarnings.log" ]; then
 503         cat >&2 "$GPGHOMEDIR/aptwarnings.log"
 504     fi
 505     if command_available 'gpgconf'; then
 506         GNUPGHOME="${GPGHOMEDIR}" gpgconf --kill gpg-agent >/dev/null 2>&1 || true
 507     fi
 508     rm -rf "$GPGHOMEDIR"
 509 }
 510
 511 create_gpg_home() {
 512     # gpg needs (in different versions more or less) files to function correctly,
 513     # so we give it its own homedir and generate some valid content for it later on
 514     if [ -n "$TMPDIR" ]; then
 515         # tmpdir is a directory and current user has rwx access to it
 516         # same tests as in apt-pkg/contrib/fileutl.cc GetTempDir()
 517         if [ ! -d "$TMPDIR" ] || [ ! -r "$TMPDIR" ] || [ ! -w "$TMPDIR" ] || [ ! -x "$TMPDIR" ]; then
 518             unset TMPDIR
 519         fi
 520     fi
 521     GPGHOMEDIR="$(mktemp -d)"
 522     CURRENTTRAP="${CURRENTTRAP} cleanup_gpg_home;"
 523     trap "${CURRENTTRAP}" 0 HUP INT QUIT ILL ABRT FPE SEGV PIPE TERM
 524     if [ -z "$GPGHOMEDIR" ]; then
 525         echo "ERROR: Could not create temporary gpg home directory in apt-key ($TMPDIR)"
 526         exit 28
 527     fi
 528     chmod 700 "$GPGHOMEDIR"
 529 }
 530
 531 prepare_gpg_home() {
 532     # crude detection if we are called from a maintainerscript where the
 533     # package depends on gnupg or not. We accept recommends here as
 534     # well as the script hopefully uses apt-key optionally then like e.g.
 535     # debian-archive-keyring for (upgrade) cleanup did
 536     if [ -n "$DPKG_MAINTSCRIPT_PACKAGE" ] && [ -z "$APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE" ]; then
 537         if ! dpkg-query --show --showformat '${Pre-Depends}${Depends}${Recommends}\n' "$DPKG_MAINTSCRIPT_PACKAGE" 2>/dev/null | grep -q gnupg; then
 538             cat >&2 <<EOF
 539 Warning: The $DPKG_MAINTSCRIPT_NAME maintainerscript of the package $DPKG_MAINTSCRIPT_PACKAGE
 540 Warning: seems to use apt-key (provided by apt) without depending on gnupg or gnupg2.
 541 Warning: This will BREAK in the future and should be fixed by the package maintainer(s).
 542 Note: Check first if apt-key functionality is needed at all - it probably isn't!
 543 EOF
 544         fi
 545     fi
 546     eval "$(apt-config shell GPG_EXE Apt::Key::gpgcommand)"
 547     if [ -n "$GPG_EXE" ] && command_available "$GPG_EXE"; then
 548         true
 549     elif command_available 'gpg'; then
 550         GPG_EXE="gpg"
 551     elif command_available 'gpg2'; then
 552         GPG_EXE="gpg2"
 553     elif command_available 'gpg1'; then
 554         GPG_EXE="gpg1"
 555     else
 556         echo >&2 "Error: gnupg, gnupg2 and gnupg1 do not seem to be installed,"
 557         echo >&2 "Error: but apt-key requires gnupg, gnupg2 or gnupg1 for this operation."
 558         echo >&2
 559         exit 255
 560     fi
 561
 562     create_gpg_home
 563
 564     # create the trustdb with an (empty) dummy keyring
 565     # older gpgs required it, newer gpgs even warn that it isn't needed,
 566     # but require it nonetheless for some commands, so we just play safe
 567     # here for the foreseeable future and create a dummy one
 568     touch "${GPGHOMEDIR}/empty.gpg"
 569     if ! "$GPG_EXE" --ignore-time-conflict --no-options --no-default-keyring \
 570        --homedir "$GPGHOMEDIR" --quiet --check-trustdb --keyring "${GPGHOMEDIR}/empty.gpg" >"${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
 571        cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
 572        false
 573     fi
 574
 575     # now tell gpg that it shouldn't try to maintain this trustdb file
 576     echo "#!/bin/sh
 577 exec '$(escape_shell "${GPG_EXE}")' --ignore-time-conflict --no-options --no-default-keyring \\
 578 --homedir '$(escape_shell "${GPGHOMEDIR}")' --no-auto-check-trustdb --trust-model always \"\$@\"" > "${GPGHOMEDIR}/gpg.0.sh"
 579     GPG_SH="${GPGHOMEDIR}/gpg.0.sh"
 580     GPG="$GPG_SH"
 581
 582     # We don't usually need a secret keyring, of course, but
 583     # for advanced operations, we might really need a secret keyring after all
 584     if [ -n "$FORCED_SECRET_KEYRING" ] && [ -r "$FORCED_SECRET_KEYRING" ]; then
 585         if ! aptkey_execute "$GPG" -v --batch --import "$FORCED_SECRET_KEYRING" >"${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
 586             cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
 587             false
 588         fi
 589     else
 590        # and then, there are older versions of gpg which panic and implode
 591        # if there isn't one available - and writeable for imports
 592        # and even if not output is littered with the creation of a secring,
 593        # so lets call import once to have it create what it wants in silence
 594        echo -n | aptkey_execute "$GPG" --batch --import >/dev/null 2>&1 || true
 595     fi
 596 }
 597
 598 warn_on_script_usage() {
 599     if [ -n "$APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE" ]; then
 600         return
 601     fi
 602     # (Maintainer) scripts should not be using apt-key
 603     if [ -n "$DPKG_MAINTSCRIPT_PACKAGE" ]; then
 604         echo >&2 "Warning: apt-key should not be used in scripts (called from $DPKG_MAINTSCRIPT_NAME maintainerscript of the package ${DPKG_MAINTSCRIPT_PACKAGE})"
 605     elif [ ! -t 1 ]; then
 606         echo >&2 "Warning: apt-key output should not be parsed (stdout is not a terminal)"
 607     fi
 608 }
 609
 610 if [ "$command" != 'help' ] && [ "$command" != 'verify' ]; then
 611     prepare_gpg_home
 612 fi
 613
 614 case "$command" in
 615     add)
 616         warn_on_script_usage
 617         requires_root
 618         setup_merged_keyring
 619         aptkey_execute "$GPG" --quiet --batch --import "$@"
 620         merge_back_changes
 621         aptkey_echo "OK"
 622         ;;
 623     del|rm|remove)
 624         # no script warning here as removing 'add' usage needs 'del' for cleanup
 625         requires_root
 626         foreach_keyring_do 'remove_key_from_keyring' "$@"
 627         aptkey_echo "OK"
 628         ;;
 629     update)
 630         warn_on_script_usage
 631         requires_root
 632         setup_merged_keyring
 633         update
 634         merge_back_changes
 635         ;;
 636     net-update)
 637         requires_root
 638         setup_merged_keyring
 639         net_update
 640         merge_back_changes
 641         ;;
 642     list|finger*)
 643         warn_on_script_usage
 644         foreach_keyring_do 'run_cmd_on_keyring' --fingerprint "$@"
 645         ;;
 646     export|exportall)
 647         warn_on_script_usage
 648         merge_all_trusted_keyrings_into_pubring
 649         aptkey_execute "$GPG_SH" --keyring "${GPGHOMEDIR}/pubring.gpg" --armor --export "$@"
 650         ;;
 651     adv*)
 652         warn_on_script_usage
 653         setup_merged_keyring
 654         aptkey_echo "Executing: $GPG $*"
 655         aptkey_execute "$GPG" "$@"
 656         merge_back_changes
 657         ;;
 658     verify)
 659         GPGV=''
 660         eval $(apt-config shell GPGV Apt::Key::gpgvcommand)
 661         if [ -n "$GPGV" ] && command_available "$GPGV"; then true;
 662         elif command_available 'gpgv'; then GPGV='gpgv';
 663         elif command_available 'gpgv2'; then GPGV='gpgv2';
 664         elif command_available 'gpgv1'; then GPGV='gpgv1';
 665         else
 666            echo >&2 'ERROR: gpgv, gpgv2 or gpgv1 required for verification'
 667            exit 29
 668         fi
 669         # for a forced keyid we need gpg --export, so full wrapping required
 670         if [ -n "$FORCED_KEYID" ]; then
 671             prepare_gpg_home
 672         else
 673             create_gpg_home
 674         fi
 675         setup_merged_keyring
 676         if [ -n "$FORCED_KEYRING" ]; then
 677             "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "${FORCED_KEYRING}" --ignore-time-conflict "$@"
 678         else
 679             "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "${GPGHOMEDIR}/pubring.gpg" --ignore-time-conflict "$@"
 680         fi
 681         ;;
 682     help)
 683         usage
 684         ;;
 685     *)
 686         usage
 687         exit 1
 688         ;;
 689 esac