cmdline/apt-key.in

   1 #!/bin/sh
   2
   3 set -e
   4 unset GREP_OPTIONS GPGHOMEDIR CURRENTTRAP
   5 export IFS="$(printf "\n\b")"
   6
   7 MASTER_KEYRING='&keyring-master-filename;'
   8 eval "$(apt-config shell MASTER_KEYRING APT::Key::MasterKeyring)"
   9 ARCHIVE_KEYRING='&keyring-filename;'
  10 eval "$(apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring)"
  11 REMOVED_KEYS='&keyring-removed-filename;'
  12 eval "$(apt-config shell REMOVED_KEYS APT::Key::RemovedKeys)"
  13 ARCHIVE_KEYRING_URI='&keyring-uri;'
  14 eval "$(apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI)"
  15
  16 aptkey_echo() { echo "$@"; }
  17
  18 requires_root() {
  19         if [ "$(id -u)" -ne 0 ]; then
  20                 apt_error "This command can only be used by root."
  21                 exit 1
  22         fi
  23 }
  24
  25 command_available() {
  26     if [ -x "$1" ]; then return 0; fi
  27     # command -v "$1" >/dev/null 2>&1 # not required by policy, see #747320
  28     # which "$1" >/dev/null 2>&1 # is in debianutils (essential) but not on non-debian systems
  29     local OLDIFS="$IFS"
  30     IFS=:
  31     for p in $PATH; do
  32         if [ -x "${p}/${1}" ]; then
  33             IFS="$OLDIFS"
  34             return 0
  35         fi
  36     done
  37     IFS="$OLDIFS"
  38     return 1
  39 }
  40
  41 escape_shell() {
  42     echo "$@" | sed -e "s#'#'\"'\"'#g"
  43 }
  44
  45 get_fingerprints_of_keyring() {
  46     aptkey_execute "$GPG_SH" --keyring "$1" --with-colons --fingerprint | while read publine; do
  47         # search for a public key
  48         if [ "${publine%%:*}" != 'pub' ]; then continue; fi
  49         # search for the associated fingerprint (should be the very next line)
  50         while read fprline; do
  51            if [ "${fprline%%:*}" = 'sub' ]; then break; # should never happen
  52            elif [ "${fprline%%:*}" != 'fpr' ]; then continue; fi
  53            echo "$fprline" | cut -d':' -f 10
  54         done
  55         # order in the keyring shouldn't be important
  56     done | sort
  57 }
  58
  59 add_keys_with_verify_against_master_keyring() {
  60     ADD_KEYRING="$1"
  61     MASTER="$2"
  62
  63     if [ ! -f "$ADD_KEYRING" ]; then
  64         apt_error "Keyring '$ADD_KEYRING' to be added not found"
  65         return
  66     fi
  67     if [ ! -f "$MASTER" ]; then
  68         apt_error "Master-Keyring '$MASTER' not found"
  69         return
  70     fi
  71
  72     # when adding new keys, make sure that the archive-master-keyring
  73     # is honored. so:
  74     #   all keys that are exported must have a valid signature
  75     #   from a key in the $distro-master-keyring
  76     add_keys="$(get_fingerprints_of_keyring "$ADD_KEYRING")"
  77     all_add_keys="$(aptkey_execute "$GPG_SH" --keyring "$ADD_KEYRING" --with-colons --list-keys | grep ^[ps]ub | cut -d: -f5)"
  78     master_keys="$(aptkey_execute "$GPG_SH" --keyring "$MASTER" --with-colons --list-keys | grep ^pub | cut -d: -f5)"
  79
  80     # ensure there are no colisions LP: #857472
  81     for all_add_key in $all_add_keys; do
  82         for master_key in $master_keys; do
  83             if [ "$all_add_key" = "$master_key" ]; then
  84                 echo >&2 "Keyid collision for '$all_add_key' detected, operation aborted"
  85                 return 1
  86             fi
  87         done
  88     done
  89
  90     for add_key in $add_keys; do
  91         # export the add keyring one-by-one
  92         local TMP_KEYRING="${GPGHOMEDIR}/tmp-keyring.gpg"
  93         aptkey_execute "$GPG_SH" --batch --yes --keyring "$ADD_KEYRING" --output "$TMP_KEYRING" --export "$add_key"
  94         if ! aptkey_execute "$GPG_SH" --batch --yes --keyring "$TMP_KEYRING" --import "$MASTER" > "${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
  95             cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
  96             false
  97         fi
  98         # check if signed with the master key and only add in this case
  99         ADDED=0
 100         for master_key in $master_keys; do
 101             if aptkey_execute "$GPG_SH" --keyring "$TMP_KEYRING" --check-sigs --with-colons "$add_key" \
 102                | grep '^sig:!:' | cut -d: -f5 | grep -q "$master_key"; then
 103                 aptkey_execute "$GPG_SH" --batch --yes --keyring "$ADD_KEYRING" --export "$add_key" \
 104                    | aptkey_execute "$GPG" --batch --yes --import
 105                 ADDED=1
 106             fi
 107         done
 108         if [ $ADDED = 0 ]; then
 109             echo >&2 "Key '$add_key' not added. It is not signed with a master key"
 110         fi
 111         rm -f "${TMP_KEYRING}"
 112     done
 113 }
 114
 115 # update the current archive signing keyring from a network URI
 116 # the archive-keyring keys needs to be signed with the master key
 117 # (otherwise it does not make sense from a security POV)
 118 net_update() {
 119     local APT_DIR='/'
 120     eval $(apt-config shell APT_DIR Dir)
 121
 122     # Disabled for now as code is insecure (LP: #1013639 (and 857472, 1013128))
 123     APT_KEY_NET_UPDATE_ENABLED=""
 124     eval $(apt-config shell APT_KEY_NET_UPDATE_ENABLED APT::Key::Net-Update-Enabled)
 125     if [ -z "$APT_KEY_NET_UPDATE_ENABLED" ]; then
 126         exit 1
 127     fi
 128
 129     if [ -z "$ARCHIVE_KEYRING_URI" ]; then
 130         apt_error 'Your distribution is not supported in net-update as no uri for the archive-keyring is set'
 131         exit 1
 132     fi
 133     # in theory we would need to depend on wget for this, but this feature
 134     # isn't useable in debian anyway as we have no keyring uri nor a master key
 135     if ! command_available 'wget'; then
 136         apt_error 'wget is required for a network-based update, but it is not installed'
 137         exit 1
 138     fi
 139     if [ ! -d "${APT_DIR}/var/lib/apt/keyrings" ]; then
 140         mkdir -p "${APT_DIR}/var/lib/apt/keyrings"
 141     fi
 142     keyring="${APT_DIR}/var/lib/apt/keyrings/$(basename "$ARCHIVE_KEYRING_URI")"
 143     old_mtime=0
 144     if [ -e $keyring ]; then
 145         old_mtime=$(stat -c %Y "$keyring")
 146     fi
 147     (cd  "${APT_DIR}/var/lib/apt/keyrings"; wget --timeout=90 -q -N "$ARCHIVE_KEYRING_URI")
 148     if [ ! -e "$keyring" ]; then
 149         return
 150     fi
 151     new_mtime=$(stat -c %Y "$keyring")
 152     if [ $new_mtime -ne $old_mtime ]; then
 153         aptkey_echo "Checking for new archive signing keys now"
 154         add_keys_with_verify_against_master_keyring "$keyring" "$MASTER_KEYRING"
 155     fi
 156 }
 157
 158 update() {
 159     if [ -z "$APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE" ]; then
 160         echo >&2 "Warning: 'apt-key update' is deprecated and should not be used anymore!"
 161         if [ -z "$ARCHIVE_KEYRING" ]; then
 162             echo >&2 "Note: In your distribution this command is a no-op and can therefore be removed safely."
 163             exit 0
 164         fi
 165     fi
 166     if [ ! -f "$ARCHIVE_KEYRING" ]; then
 167         apt_error "Can't find the archive-keyring (Is the &keyring-package; package installed?)"
 168         exit 1
 169     fi
 170
 171     # add new keys from the package;
 172
 173     # we do not use add_keys_with_verify_against_master_keyring here,
 174     # because "update" is run on regular package updates.  A
 175     # attacker might as well replace the master-archive-keyring file
 176     # in the package and add his own keys. so this check wouldn't
 177     # add any security. we *need* this check on net-update though
 178     import_keyring_into_keyring "$ARCHIVE_KEYRING" '' && cat "${GPGHOMEDIR}/gpgoutput.log"
 179
 180     if [ -r "$REMOVED_KEYS" ]; then
 181         # remove no-longer supported/used keys
 182         get_fingerprints_of_keyring "$(dearmor_filename "$REMOVED_KEYS")" | while read key; do
 183             foreach_keyring_do 'remove_key_from_keyring' "$key"
 184         done
 185     else
 186         apt_warn "Removed keys keyring '$REMOVED_KEYS' missing or not readable"
 187     fi
 188 }
 189
 190 remove_key_from_keyring() {
 191     local KEYRINGFILE="$1"
 192     shift
 193     # non-existent keyrings have by definition no keys
 194     if [ ! -e "$KEYRINGFILE" ]; then
 195        return
 196     fi
 197
 198     local FINGERPRINTS="${GPGHOMEDIR}/keyringfile.keylst"
 199     local DEARMOR="$(dearmor_filename "$KEYRINGFILE")"
 200     get_fingerprints_of_keyring "$DEARMOR" > "$FINGERPRINTS"
 201
 202     for KEY in "$@"; do
 203         # strip leading 0x, if present:
 204         KEY="$(echo "${KEY#0x}" | tr -d ' ')"
 205
 206         # check if the key is in this keyring
 207         if ! grep -iq "^[0-9A-F]*${KEY}$" "$FINGERPRINTS"; then
 208             continue
 209         fi
 210         if [ ! -w "$KEYRINGFILE" ]; then
 211             apt_warn "Key ${KEY} is in keyring ${KEYRINGFILE}, but can't be removed as it is read only."
 212             continue
 213         fi
 214         # check if it is the only key in the keyring and if so remove the keyring altogether
 215         if [ '1' = "$(uniq "$FINGERPRINTS" | wc -l)" ]; then
 216             mv -f "$KEYRINGFILE" "${KEYRINGFILE}~" # behave like gpg
 217             return
 218         fi
 219         # we can't just modify pointed to files as these might be in /usr or something
 220         local REALTARGET
 221         if [ -L "$DEARMOR" ]; then
 222             REALTARGET="$(readlink -f "$DEARMOR")"
 223             mv -f "$DEARMOR" "${DEARMOR}.dpkg-tmp"
 224             cp -a "$REALTARGET" "$DEARMOR"
 225         fi
 226         # delete the key from the keyring
 227         aptkey_execute "$GPG_SH" --keyring "$DEARMOR" --batch --delete-keys --yes "$KEY"
 228         if [ -n "$REALTARGET" ]; then
 229             # the real backup is the old link, not the copy we made
 230             mv -f "${DEARMOR}.dpkg-tmp" "${DEARMOR}~"
 231         fi
 232         if [ "$DEARMOR" != "$KEYRINGFILE" ]; then
 233             mv -f "$KEYRINGFILE" "${KEYRINGFILE}~"
 234             create_new_keyring "$KEYRINGFILE"
 235             aptkey_execute "$GPG_SH" --keyring "$DEARMOR" --armor --export > "$KEYRINGFILE"
 236         fi
 237         get_fingerprints_of_keyring "$DEARMOR" > "$FINGERPRINTS"
 238     done
 239 }
 240
 241 accessible_file_exists() {
 242    if ! test -s "$1"; then
 243       return 1
 244    fi
 245    if test -r "$1"; then
 246       return 0
 247    fi
 248    apt_warn "The key(s) in the keyring $1 are ignored as the file is not readable by user '$USER' executing apt-key."
 249    return 1
 250 }
 251
 252 foreach_keyring_do() {
 253    local ACTION="$1"
 254    shift
 255    # if a --keyring was given, just work on this one
 256    if [ -n "$FORCED_KEYRING" ]; then
 257         $ACTION "$TRUSTEDFILE" "$@"
 258    else
 259         # otherwise all known keyrings are up for inspection
 260         if accessible_file_exists "$TRUSTEDFILE"; then
 261             $ACTION "$TRUSTEDFILE" "$@"
 262         fi
 263         local TRUSTEDPARTS="/etc/apt/trusted.gpg.d"
 264         eval "$(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d)"
 265         if [ -d "$TRUSTEDPARTS" ]; then
 266             TRUSTEDPARTS="$(readlink -f "$TRUSTEDPARTS")"
 267             local TRUSTEDPARTSLIST="$(cd /; find "$TRUSTEDPARTS" -mindepth 1 -maxdepth 1 \( -name '*.gpg' -o -name '*.asc' \))"
 268             for trusted in $(echo "$TRUSTEDPARTSLIST" | sort); do
 269                 if accessible_file_exists "$trusted"; then
 270                     $ACTION "$trusted" "$@"
 271                 fi
 272             done
 273         fi
 274    fi
 275 }
 276
 277 list_keys_in_keyring() {
 278     local KEYRINGFILE="$1"
 279     shift
 280     # fingerprint and co will fail if key isn't in this keyring
 281     aptkey_execute "$GPG_SH" --keyring "$(dearmor_filename "$KEYRINGFILE")" "$@" > "${GPGHOMEDIR}/gpgoutput.log" 2> "${GPGHOMEDIR}/gpgoutput.err" || true
 282     if [ ! -s "${GPGHOMEDIR}/gpgoutput.log" ]; then
 283         return
 284     fi
 285     # we fake gpg header here to refer to the real asc file rather than a temp file
 286     if [ "${KEYRINGFILE##*.}" = 'asc' ]; then
 287         if expr match "$(sed -n '2p' "${GPGHOMEDIR}/gpgoutput.log")" '^-\+$' >/dev/null 2>&1; then
 288             echo "$KEYRINGFILE"
 289             echo "$KEYRINGFILE" | sed 's#[^-]#-#g'
 290             sed '1,2d' "${GPGHOMEDIR}/gpgoutput.log" || true
 291         else
 292             cat "${GPGHOMEDIR}/gpgoutput.log"
 293         fi
 294     else
 295         cat "${GPGHOMEDIR}/gpgoutput.log"
 296     fi
 297     if [ -s "${GPGHOMEDIR}/gpgoutput.err" ]; then
 298         cat >&2 "${GPGHOMEDIR}/gpgoutput.err"
 299     fi
 300 }
 301
 302 export_key_from_to() {
 303     local FROM="$1"
 304     local TO="$2"
 305     shift 2
 306     if ! aptkey_execute "$GPG_SH" --keyring "$(dearmor_filename "$FROM")" --export "$@" > "$TO" 2> "${GPGHOMEDIR}/gpgoutput.log"; then
 307         cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
 308         false
 309     else
 310         chmod 0644 -- "$TO"
 311     fi
 312 }
 313
 314 import_keyring_into_keyring() {
 315     local FROM="${1:-${GPGHOMEDIR}/pubring.gpg}"
 316     local TO="${2:-${GPGHOMEDIR}/pubring.gpg}"
 317     shift 2
 318     rm -f "${GPGHOMEDIR}/gpgoutput.log"
 319     # the idea is simple: We take keys from one keyring and copy it to another
 320     # we do this with so many checks in between to ensure that WE control the
 321     # creation, so we know that the (potentially) created $TO keyring is a
 322     # simple keyring rather than a keybox as gpg2 would create it which in turn
 323     # can't be read by gpgv.
 324     # BEWARE: This is designed more in the way to work with the current
 325     # callers, than to have a well defined it would be easy to add new callers to.
 326     if [ ! -s "$TO" ]; then
 327         if [ -s "$FROM" ]; then
 328             if [ -z "$2" ]; then
 329                 local OPTS
 330                 if [ "${TO##*.}" = 'asc' ]; then
 331                     OPTS='--armor'
 332                 fi
 333                 export_key_from_to "$(dearmor_filename "$FROM")" "$TO" $OPTS ${1:+"$1"}
 334             else
 335                 create_new_keyring "$TO"
 336             fi
 337         else
 338             create_new_keyring "$TO"
 339         fi
 340     elif [ -s "$FROM" ]; then
 341         local EXPORTLIMIT="$1"
 342         if [ -n "$1$2" ]; then shift; fi
 343         local DEARMORTO="$(dearmor_filename "$TO")"
 344         if ! aptkey_execute "$GPG_SH" --keyring "$(dearmor_filename "$FROM")" --export ${EXPORTLIMIT:+"$EXPORTLIMIT"} \
 345            | aptkey_execute "$GPG_SH" --keyring "$DEARMORTO" --batch --import "$@" > "${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
 346             cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
 347             false
 348         fi
 349         if [ "$DEARMORTO" != "$TO" ]; then
 350             export_key_from_to "$DEARMORTO" "${DEARMORTO}.asc" --armor
 351             if ! cmp -s "$TO" "${DEARMORTO}.asc" 2>/dev/null; then
 352                 cp -a "$TO" "${TO}~"
 353                 mv -f "${DEARMORTO}.asc" "$TO"
 354             fi
 355         fi
 356     fi
 357 }
 358
 359 dearmor_keyring() {
 360     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=831409#67
 361     # The awk script is more complex through to skip surrounding garbage and
 362     # to support multiple keys in one file (old gpgs generate version headers
 363     # which get printed with the original and hence result in garbage input for base64
 364     awk '/^-----BEGIN/{ x = 1; }
 365 /^$/{ if (x == 1) { x = 2; }; }
 366 /^[^=-]/{ if (x == 2) { print $0; }; }
 367 /^-----END/{ x = 0; }' | base64 -d
 368 }
 369 dearmor_filename() {
 370     if [ "${1##*.}" = 'asc' ]; then
 371         local trusted="${GPGHOMEDIR}/${1##*/}.gpg"
 372         if [ -s "$1" ]; then
 373             dearmor_keyring < "$1" > "$trusted"
 374         fi
 375         echo "$trusted"
 376     elif [ "${1##*.}" = 'gpg' ]; then
 377         echo "$1"
 378     elif [ "$(head -n 1 "$1" 2>/dev/null)" = '-----BEGIN PGP PUBLIC KEY BLOCK-----' ]; then
 379         local trusted="${GPGHOMEDIR}/${1##*/}.gpg"
 380         dearmor_keyring < "$1" > "$trusted"
 381         echo "$trusted"
 382     else
 383         echo "$1"
 384     fi
 385 }
 386 catfile() {
 387     cat "$(dearmor_filename "$1")" >> "$2"
 388 }
 389
 390 merge_all_trusted_keyrings_into_pubring() {
 391     # does the same as:
 392     # foreach_keyring_do 'import_keys_from_keyring' "${GPGHOMEDIR}/pubring.gpg"
 393     # but without using gpg, just cat and find
 394     local PUBRING="$(readlink -f "${GPGHOMEDIR}")/pubring.gpg"
 395     rm -f "$PUBRING"
 396     touch "$PUBRING"
 397     foreach_keyring_do 'catfile' "$PUBRING"
 398 }
 399
 400 import_keys_from_keyring() {
 401     import_keyring_into_keyring "$1" "$2"
 402 }
 403
 404 merge_keys_into_keyrings() {
 405     import_keyring_into_keyring "$2" "$1" '' --import-options 'merge-only'
 406 }
 407
 408 merge_back_changes() {
 409     if [ -n "$FORCED_KEYRING" ]; then
 410         # if the keyring was forced merge is already done
 411         if [ "$FORCED_KEYRING" != "$TRUSTEDFILE" ]; then
 412             mv -f "$FORCED_KEYRING" "${FORCED_KEYRING}~"
 413             export_key_from_to "$TRUSTEDFILE" "$FORCED_KEYRING" --armor
 414         fi
 415         return
 416     fi
 417     if [ -s "${GPGHOMEDIR}/pubring.gpg" ]; then
 418         # merge all updated keys
 419         foreach_keyring_do 'merge_keys_into_keyrings' "${GPGHOMEDIR}/pubring.gpg"
 420     fi
 421     # look for keys which were added or removed
 422     get_fingerprints_of_keyring "${GPGHOMEDIR}/pubring.orig.gpg" > "${GPGHOMEDIR}/pubring.orig.keylst"
 423     get_fingerprints_of_keyring "${GPGHOMEDIR}/pubring.gpg" > "${GPGHOMEDIR}/pubring.keylst"
 424     comm -3 "${GPGHOMEDIR}/pubring.keylst" "${GPGHOMEDIR}/pubring.orig.keylst" > "${GPGHOMEDIR}/pubring.diff"
 425     # key isn't part of new keyring, so remove
 426     cut -f 2 "${GPGHOMEDIR}/pubring.diff" | while read key; do
 427         if [ -z "$key" ]; then continue; fi
 428         foreach_keyring_do 'remove_key_from_keyring' "$key"
 429     done
 430     # key is only part of new keyring, so we need to import it
 431     cut -f 1 "${GPGHOMEDIR}/pubring.diff" | while read key; do
 432         if [ -z "$key" ]; then continue; fi
 433         import_keyring_into_keyring '' "$TRUSTEDFILE" "$key"
 434     done
 435 }
 436
 437 setup_merged_keyring() {
 438     if [ -n "$FORCED_KEYID" ]; then
 439         merge_all_trusted_keyrings_into_pubring
 440         FORCED_KEYRING="${GPGHOMEDIR}/forcedkeyid.gpg"
 441         TRUSTEDFILE="${FORCED_KEYRING}"
 442         echo "#!/bin/sh
 443 exec sh '($(escape_shell "${GPG}")' --keyring '$(escape_shell "${TRUSTEDFILE}")' \"\$@\"" > "${GPGHOMEDIR}/gpg.1.sh"
 444         GPG="${GPGHOMEDIR}/gpg.1.sh"
 445         # ignore error as this "just" means we haven't found the forced keyid and the keyring will be empty
 446         import_keyring_into_keyring '' "$TRUSTEDFILE" "$FORCED_KEYID" || true
 447     elif [ -z "$FORCED_KEYRING" ]; then
 448         merge_all_trusted_keyrings_into_pubring
 449         if [ -r "${GPGHOMEDIR}/pubring.gpg" ]; then
 450             cp -a "${GPGHOMEDIR}/pubring.gpg" "${GPGHOMEDIR}/pubring.orig.gpg"
 451         else
 452            touch "${GPGHOMEDIR}/pubring.gpg" "${GPGHOMEDIR}/pubring.orig.gpg"
 453         fi
 454         echo "#!/bin/sh
 455 exec sh '$(escape_shell "${GPG}")' --keyring '$(escape_shell "${GPGHOMEDIR}/pubring.gpg")' \"\$@\"" > "${GPGHOMEDIR}/gpg.1.sh"
 456         GPG="${GPGHOMEDIR}/gpg.1.sh"
 457     else
 458         TRUSTEDFILE="$(dearmor_filename "$FORCED_KEYRING")"
 459         create_new_keyring "$TRUSTEDFILE"
 460         echo "#!/bin/sh
 461 exec sh '$(escape_shell "${GPG}")' --keyring '$(escape_shell "${TRUSTEDFILE}")' \"\$@\"" > "${GPGHOMEDIR}/gpg.1.sh"
 462         GPG="${GPGHOMEDIR}/gpg.1.sh"
 463     fi
 464 }
 465
 466 create_new_keyring() {
 467     # gpg defaults to mode 0600 for new keyrings. Create one with 0644 instead.
 468     if ! [ -e "$1" ]; then
 469         if [ -w "$(dirname "$1")" ]; then
 470             touch -- "$1"
 471             chmod 0644 -- "$1"
 472         fi
 473     fi
 474 }
 475
 476 aptkey_execute() { sh "$@"; }
 477
 478 usage() {
 479     echo "Usage: apt-key [--keyring file] [command] [arguments]"
 480     echo
 481     echo "Manage apt's list of trusted keys"
 482     echo
 483     echo "  apt-key add <file>          - add the key contained in <file> ('-' for stdin)"
 484     echo "  apt-key del <keyid>         - remove the key <keyid>"
 485     echo "  apt-key export <keyid>      - output the key <keyid>"
 486     echo "  apt-key exportall           - output all trusted keys"
 487     echo "  apt-key update              - update keys using the keyring package"
 488     echo "  apt-key net-update          - update keys using the network"
 489     echo "  apt-key list                - list keys"
 490     echo "  apt-key finger              - list fingerprints"
 491     echo "  apt-key adv                 - pass advanced options to gpg (download key)"
 492     echo
 493     echo "If no specific keyring file is given the command applies to all keyring files."
 494 }
 495
 496 while [ -n "$1" ]; do
 497    case "$1" in
 498       --keyring)
 499          shift
 500          TRUSTEDFILE="$1"
 501          FORCED_KEYRING="$1"
 502          ;;
 503       --keyid)
 504          shift
 505          FORCED_KEYID="$1"
 506          ;;
 507       --secret-keyring)
 508          shift
 509          FORCED_SECRET_KEYRING="$1"
 510          ;;
 511       --readonly)
 512          merge_back_changes() { true; }
 513          create_new_keyring() { if [ ! -r "$FORCED_KEYRING" ]; then TRUSTEDFILE='/dev/null'; FORCED_KEYRING="$TRUSTEDFILE"; fi; }
 514          ;;
 515       --fakeroot)
 516          requires_root() { true; }
 517          ;;
 518       --quiet)
 519          aptkey_echo() { true; }
 520          ;;
 521       --debug1)
 522          # some cmds like finger redirect stderr to /dev/null …
 523         aptkey_execute() { echo 'EXEC:' "$@"; sh "$@"; }
 524         ;;
 525       --debug2)
 526          # … other more complicated ones pipe gpg into gpg.
 527         aptkey_execute() { echo >&2 'EXEC:' "$@"; sh "$@"; }
 528         ;;
 529       --homedir)
 530          # force usage of a specific homedir instead of creating a temporary
 531          shift
 532          GPGHOMEDIR="$1"
 533         ;;
 534       --*)
 535          echo >&2 "Unknown option: $1"
 536          usage
 537          exit 1;;
 538       *)
 539          break;;
 540    esac
 541    shift
 542 done
 543
 544 if [ -z "$TRUSTEDFILE" ]; then
 545    TRUSTEDFILE="/etc/apt/trusted.gpg"
 546    eval $(apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring)
 547    eval $(apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f)
 548 fi
 549
 550 command="$1"
 551 if [ -z "$command" ]; then
 552     usage
 553     exit 1
 554 fi
 555 shift
 556
 557 find_gpgv_status_fd() {
 558    while [ -n "$1" ]; do
 559         if [ "$1" = '--status-fd' ]; then
 560                 shift
 561                 echo "$1"
 562                 break
 563         fi
 564         shift
 565    done
 566 }
 567 GPGSTATUSFD="$(find_gpgv_status_fd "$@")"
 568
 569 apt_warn() {
 570     if [ -z "$GPGHOMEDIR" ]; then
 571         echo >&2 'W:' "$@"
 572     else
 573         echo 'W:' "$@" > "${GPGHOMEDIR}/aptwarnings.log"
 574     fi
 575     if [ -n "$GPGSTATUSFD" ]; then
 576         echo >&${GPGSTATUSFD} '[APTKEY:] WARNING' "$@"
 577     fi
 578 }
 579 apt_error() {
 580     if [ -z "$GPGHOMEDIR" ]; then
 581         echo >&2 'E:' "$@"
 582     else
 583         echo 'E:' "$@" > "${GPGHOMEDIR}/aptwarnings.log"
 584     fi
 585     if [ -n "$GPGSTATUSFD" ]; then
 586         echo >&${GPGSTATUSFD} '[APTKEY:] ERROR' "$@"
 587     fi
 588 }
 589
 590 cleanup_gpg_home() {
 591     if [ -z "$GPGHOMEDIR" ]; then return; fi
 592     if [ -s "$GPGHOMEDIR/aptwarnings.log" ]; then
 593         cat >&2 "$GPGHOMEDIR/aptwarnings.log"
 594     fi
 595     if command_available 'gpgconf'; then
 596         GNUPGHOME="${GPGHOMEDIR}" gpgconf --kill gpg-agent >/dev/null 2>&1 || true
 597     fi
 598     rm -rf "$GPGHOMEDIR"
 599 }
 600
 601 # gpg needs (in different versions more or less) files to function correctly,
 602 # so we give it its own homedir and generate some valid content for it later on
 603 create_gpg_home() {
 604     # for cases in which we want to cache a homedir due to expensive setup
 605     if [ -n "$GPGHOMEDIR" ]; then
 606         return
 607     fi
 608     if [ -n "$TMPDIR" ]; then
 609         # tmpdir is a directory and current user has rwx access to it
 610         # same tests as in apt-pkg/contrib/fileutl.cc GetTempDir()
 611         if [ ! -d "$TMPDIR" ] || [ ! -r "$TMPDIR" ] || [ ! -w "$TMPDIR" ] || [ ! -x "$TMPDIR" ]; then
 612             unset TMPDIR
 613         fi
 614     fi
 615     GPGHOMEDIR="$(mktemp --directory --tmpdir 'apt-key-gpghome.XXXXXXXXXX')"
 616     CURRENTTRAP="${CURRENTTRAP} cleanup_gpg_home;"
 617     trap "${CURRENTTRAP}" 0 HUP INT QUIT ILL ABRT FPE SEGV PIPE TERM
 618     if [ -z "$GPGHOMEDIR" ]; then
 619         apt_error "Could not create temporary gpg home directory in $TMPDIR (wrong permissions?)"
 620         exit 28
 621     fi
 622     chmod 700 "$GPGHOMEDIR"
 623 }
 624
 625 prepare_gpg_home() {
 626     # crude detection if we are called from a maintainerscript where the
 627     # package depends on gnupg or not. We accept recommends here as
 628     # well as the script hopefully uses apt-key optionally then like e.g.
 629     # debian-archive-keyring for (upgrade) cleanup did
 630     if [ -n "$DPKG_MAINTSCRIPT_PACKAGE" ] && [ -z "$APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE" ]; then
 631         if ! dpkg-query --show --showformat '${Pre-Depends}${Depends}${Recommends}\n' "$DPKG_MAINTSCRIPT_PACKAGE" 2>/dev/null | grep -q gnupg; then
 632             cat >&2 <<EOF
 633 Warning: The $DPKG_MAINTSCRIPT_NAME maintainerscript of the package $DPKG_MAINTSCRIPT_PACKAGE
 634 Warning: seems to use apt-key (provided by apt) without depending on gnupg or gnupg2.
 635 Warning: This will BREAK in the future and should be fixed by the package maintainer(s).
 636 Note: Check first if apt-key functionality is needed at all - it probably isn't!
 637 EOF
 638         fi
 639     fi
 640     eval "$(apt-config shell GPG_EXE Apt::Key::gpgcommand)"
 641     if [ -n "$GPG_EXE" ] && command_available "$GPG_EXE"; then
 642         true
 643     elif command_available 'gpg'; then
 644         GPG_EXE="gpg"
 645     elif command_available 'gpg2'; then
 646         GPG_EXE="gpg2"
 647     elif command_available 'gpg1'; then
 648         GPG_EXE="gpg1"
 649     else
 650         apt_error 'gnupg, gnupg2 and gnupg1 do not seem to be installed, but one of them is required for this operation'
 651         exit 255
 652     fi
 653
 654     create_gpg_home
 655
 656     # now tell gpg that it shouldn't try to maintain this trustdb file
 657     echo "#!/bin/sh
 658 exec '$(escape_shell "${GPG_EXE}")' --ignore-time-conflict --no-options --no-default-keyring \\
 659 --homedir '$(escape_shell "${GPGHOMEDIR}")' --no-auto-check-trustdb --trust-model always \"\$@\"" > "${GPGHOMEDIR}/gpg.0.sh"
 660     GPG_SH="${GPGHOMEDIR}/gpg.0.sh"
 661     GPG="$GPG_SH"
 662
 663     # create the trustdb with an (empty) dummy keyring
 664     # older gpgs required it, newer gpgs even warn that it isn't needed,
 665     # but require it nonetheless for some commands, so we just play safe
 666     # here for the foreseeable future and create a dummy one
 667     touch "${GPGHOMEDIR}/empty.gpg"
 668     if ! "$GPG_EXE" --ignore-time-conflict --no-options --no-default-keyring \
 669        --homedir "$GPGHOMEDIR" --quiet --check-trustdb --keyring "${GPGHOMEDIR}/empty.gpg" >"${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
 670        cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
 671        false
 672     fi
 673
 674     # We don't usually need a secret keyring, of course, but
 675     # for advanced operations, we might really need a secret keyring after all
 676     if [ -n "$FORCED_SECRET_KEYRING" ] && [ -r "$FORCED_SECRET_KEYRING" ]; then
 677         if ! aptkey_execute "$GPG" -v --batch --import "$FORCED_SECRET_KEYRING" >"${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
 678             # already imported keys cause gpg1 to fail for some reason… ignore this error
 679             if ! grep -q 'already in secret keyring' "${GPGHOMEDIR}/gpgoutput.log"; then
 680                 cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
 681                 false
 682             fi
 683         fi
 684     else
 685        # and then, there are older versions of gpg which panic and implode
 686        # if there isn't one available - and writeable for imports
 687        # and even if not output is littered with the creation of a secring,
 688        # so lets call import once to have it create what it wants in silence
 689        echo -n | aptkey_execute "$GPG" --batch --import >/dev/null 2>&1 || true
 690     fi
 691 }
 692
 693 warn_on_script_usage() {
 694     if [ -n "$APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE" ]; then
 695         return
 696     fi
 697     # (Maintainer) scripts should not be using apt-key
 698     if [ -n "$DPKG_MAINTSCRIPT_PACKAGE" ]; then
 699         echo >&2 "Warning: apt-key should not be used in scripts (called from $DPKG_MAINTSCRIPT_NAME maintainerscript of the package ${DPKG_MAINTSCRIPT_PACKAGE})"
 700     elif [ ! -t 1 ]; then
 701         echo >&2 "Warning: apt-key output should not be parsed (stdout is not a terminal)"
 702     fi
 703 }
 704
 705 if [ "$command" != 'help' ] && [ "$command" != 'verify' ]; then
 706     prepare_gpg_home
 707 fi
 708
 709 case "$command" in
 710     add)
 711         warn_on_script_usage
 712         requires_root
 713         setup_merged_keyring
 714         aptkey_execute "$GPG" --quiet --batch --import "$@"
 715         merge_back_changes
 716         aptkey_echo "OK"
 717         ;;
 718     del|rm|remove)
 719         # no script warning here as removing 'add' usage needs 'del' for cleanup
 720         requires_root
 721         foreach_keyring_do 'remove_key_from_keyring' "$@"
 722         aptkey_echo "OK"
 723         ;;
 724     update)
 725         warn_on_script_usage
 726         requires_root
 727         setup_merged_keyring
 728         update
 729         merge_back_changes
 730         ;;
 731     net-update)
 732         requires_root
 733         setup_merged_keyring
 734         net_update
 735         merge_back_changes
 736         ;;
 737     list|finger*)
 738         warn_on_script_usage
 739         foreach_keyring_do 'list_keys_in_keyring' --fingerprint "$@"
 740         ;;
 741     export|exportall)
 742         warn_on_script_usage
 743         merge_all_trusted_keyrings_into_pubring
 744         aptkey_execute "$GPG_SH" --keyring "${GPGHOMEDIR}/pubring.gpg" --armor --export "$@"
 745         ;;
 746     adv*)
 747         warn_on_script_usage
 748         setup_merged_keyring
 749         aptkey_echo "Executing: $GPG" "$@"
 750         aptkey_execute "$GPG" "$@"
 751         merge_back_changes
 752         ;;
 753     verify)
 754         GPGV=''
 755         eval $(apt-config shell GPGV Apt::Key::gpgvcommand)
 756         if [ -n "$GPGV" ] && command_available "$GPGV"; then true;
 757         elif command_available 'gpgv'; then GPGV='gpgv';
 758         elif command_available 'gpgv2'; then GPGV='gpgv2';
 759         elif command_available 'gpgv1'; then GPGV='gpgv1';
 760         else
 761            apt_error 'gpgv, gpgv2 or gpgv1 required for verification, but neither seems installed'
 762            exit 29
 763         fi
 764         # for a forced keyid we need gpg --export, so full wrapping required
 765         if [ -n "$FORCED_KEYID" ]; then
 766             prepare_gpg_home
 767         else
 768             create_gpg_home
 769         fi
 770         setup_merged_keyring
 771         if [ -n "$FORCED_KEYRING" ]; then
 772             "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "$(dearmor_filename "${FORCED_KEYRING}")" --ignore-time-conflict "$@"
 773         else
 774             "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "${GPGHOMEDIR}/pubring.gpg" --ignore-time-conflict "$@"
 775         fi
 776         ;;
 777     help)
 778         usage
 779         ;;
 780     *)
 781         usage
 782         exit 1
 783         ;;
 784 esac