cmdline/apt-key.in

   1 #!/bin/sh
   2
   3 set -e
   4 unset GREP_OPTIONS
   5
   6 APT_DIR="/"
   7 eval $(apt-config shell APT_DIR Dir)
   8
   9 MASTER_KEYRING='&keyring-master-filename;'
  10 eval $(apt-config shell MASTER_KEYRING APT::Key::MasterKeyring)
  11 ARCHIVE_KEYRING='&keyring-filename;'
  12 eval $(apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring)
  13 REMOVED_KEYS='&keyring-removed-filename;'
  14 eval $(apt-config shell REMOVED_KEYS APT::Key::RemovedKeys)
  15 ARCHIVE_KEYRING_URI='&keyring-uri;'
  16 eval $(apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI)
  17
  18 aptkey_echo() { echo "$@"; }
  19
  20 requires_root() {
  21         if [ "$(id -u)" -ne 0 ]; then
  22                 echo >&2 "ERROR: This command can only be used by root."
  23                 exit 1
  24         fi
  25 }
  26
  27 get_fingerprints_of_keyring() {
  28     $GPG_CMD --keyring "$1" --with-colons --fingerprint | while read publine; do
  29         # search for a public key
  30         if [ "${publine%%:*}" != 'pub' ]; then continue; fi
  31         # search for the associated fingerprint (should be the very next line)
  32         while read fprline; do
  33            if [ "${fprline%%:*}" = 'sub' ]; then break; # should never happen
  34            elif [ "${fprline%%:*}" != 'fpr' ]; then continue; fi
  35            echo "$fprline" | cut -d':' -f 10
  36         done
  37     done
  38 }
  39
  40 add_keys_with_verify_against_master_keyring() {
  41     ADD_KEYRING=$1
  42     MASTER=$2
  43
  44     if [ ! -f "$ADD_KEYRING" ]; then
  45         echo >&2 "ERROR: '$ADD_KEYRING' not found"
  46         return
  47     fi
  48     if [ ! -f "$MASTER" ]; then
  49         echo >&2 "ERROR: '$MASTER' not found"
  50         return
  51     fi
  52
  53     # when adding new keys, make sure that the archive-master-keyring
  54     # is honored. so:
  55     #   all keys that are exported must have a valid signature
  56     #   from a key in the $distro-master-keyring
  57     add_keys="$(get_fingerprints_of_keyring "$ADD_KEYRING")"
  58     all_add_keys=`$GPG_CMD --keyring $ADD_KEYRING --with-colons --list-keys | grep ^[ps]ub | cut -d: -f5`
  59     master_keys=`$GPG_CMD --keyring $MASTER --with-colons --list-keys | grep ^pub | cut -d: -f5`
  60
  61     # ensure there are no colisions LP: #857472
  62     for all_add_key in $all_add_keys; do
  63         for master_key in $master_keys; do
  64             if [ "$all_add_key" = "$master_key" ]; then
  65                 echo >&2 "Keyid collision for '$all_add_key' detected, operation aborted"
  66                 return 1
  67             fi
  68         done
  69     done
  70
  71     for add_key in $add_keys; do
  72         # export the add keyring one-by-one
  73         local TMP_KEYRING="${GPGHOMEDIR}/tmp-keyring.gpg"
  74         $GPG_CMD --batch --yes --keyring "$ADD_KEYRING" --output "$TMP_KEYRING" --export "$add_key"
  75         if ! $GPG_CMD --batch --yes --keyring "$TMP_KEYRING" --import "$MASTER" > "${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
  76             cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
  77             false
  78         fi
  79         # check if signed with the master key and only add in this case
  80         ADDED=0
  81         for master_key in $master_keys; do
  82             if $GPG_CMD --keyring $TMP_KEYRING --check-sigs --with-colons $add_key | grep '^sig:!:' | cut -d: -f5 | grep -q $master_key; then
  83                 $GPG_CMD --batch --yes --keyring "$ADD_KEYRING" --export "$add_key" | $GPG --batch --yes --import
  84                 ADDED=1
  85             fi
  86         done
  87         if [ $ADDED = 0 ]; then
  88             echo >&2 "Key '$add_key' not added. It is not signed with a master key"
  89         fi
  90         rm -f "${TMP_KEYRING}"
  91     done
  92 }
  93
  94 # update the current archive signing keyring from a network URI
  95 # the archive-keyring keys needs to be signed with the master key
  96 # (otherwise it does not make sense from a security POV)
  97 net_update() {
  98     # Disabled for now as code is insecure (LP: #1013639 (and 857472, 1013128))
  99     APT_KEY_NET_UPDATE_ENABLED=""
 100     eval $(apt-config shell APT_KEY_NET_UPDATE_ENABLED APT::Key::Net-Update-Enabled)
 101     if [ -z "$APT_KEY_NET_UPDATE_ENABLED" ]; then
 102         exit 1
 103     fi
 104
 105     if [ -z "$ARCHIVE_KEYRING_URI" ]; then
 106         echo >&2 "ERROR: Your distribution is not supported in net-update as no uri for the archive-keyring is set"
 107         exit 1
 108     fi
 109     # in theory we would need to depend on wget for this, but this feature
 110     # isn't useable in debian anyway as we have no keyring uri nor a master key
 111     if ! which wget >/dev/null 2>&1; then
 112         echo >&2 "ERROR: an installed wget is required for a network-based update"
 113         exit 1
 114     fi
 115     if [ ! -d ${APT_DIR}/var/lib/apt/keyrings ]; then
 116         mkdir -p ${APT_DIR}/var/lib/apt/keyrings
 117     fi
 118     keyring=${APT_DIR}/var/lib/apt/keyrings/$(basename $ARCHIVE_KEYRING_URI)
 119     old_mtime=0
 120     if [ -e $keyring ]; then
 121         old_mtime=$(stat -c %Y $keyring)
 122     fi
 123     (cd  ${APT_DIR}/var/lib/apt/keyrings; wget --timeout=90 -q -N $ARCHIVE_KEYRING_URI)
 124     if [ ! -e $keyring ]; then
 125         return
 126     fi
 127     new_mtime=$(stat -c %Y $keyring)
 128     if [ $new_mtime -ne $old_mtime ]; then
 129         aptkey_echo "Checking for new archive signing keys now"
 130         add_keys_with_verify_against_master_keyring $keyring $MASTER_KEYRING
 131     fi
 132 }
 133
 134 update() {
 135     if [ ! -f $ARCHIVE_KEYRING ]; then
 136         echo >&2 "ERROR: Can't find the archive-keyring"
 137         echo >&2 "Is the &keyring-package; package installed?"
 138         exit 1
 139     fi
 140
 141     # add new keys from the package;
 142
 143     # we do not use add_keys_with_verify_against_master_keyring here,
 144     # because "update" is run on regular package updates.  A
 145     # attacker might as well replace the master-archive-keyring file
 146     # in the package and add his own keys. so this check wouldn't
 147     # add any security. we *need* this check on net-update though
 148     import_keyring_into_keyring "$ARCHIVE_KEYRING" '' && cat "${GPGHOMEDIR}/gpgoutput.log"
 149
 150     if [ -r "$REMOVED_KEYS" ]; then
 151         # remove no-longer supported/used keys
 152         get_fingerprints_of_keyring "$REMOVED_KEYS" | while read key; do
 153             foreach_keyring_do 'remove_key_from_keyring' "$key"
 154         done
 155     else
 156         echo >&2 "Warning: removed keys keyring  $REMOVED_KEYS missing or not readable"
 157     fi
 158 }
 159
 160 remove_key_from_keyring() {
 161     local KEYRINGFILE="$1"
 162     shift
 163     # non-existent keyrings have by definition no keys
 164     if [ ! -e "$KEYRINGFILE" ]; then
 165        return
 166     fi
 167
 168     local GPG="$GPG_CMD --keyring $KEYRINGFILE"
 169     for KEY in "$@"; do
 170         # check if the key is in this keyring: the key id is in the 5 column at the end
 171         if ! get_fingerprints_of_keyring "$KEYRINGFILE" | grep -iq "^[0-9A-F]*${KEY}$"; then
 172             continue
 173         fi
 174         if [ ! -w "$KEYRINGFILE" ]; then
 175             echo >&2 "Key ${KEY} is in keyring ${KEYRINGFILE}, but can't be removed as it is read only."
 176             continue
 177         fi
 178         # check if it is the only key in the keyring and if so remove the keyring altogether
 179         if [ '1' = "$(get_fingerprints_of_keyring "$KEYRINGFILE" | wc -l)" ]; then
 180             mv -f "$KEYRINGFILE" "${KEYRINGFILE}~" # behave like gpg
 181             return
 182         fi
 183         # we can't just modify pointed to files as these might be in /usr or something
 184         local REALTARGET
 185         if [ -L "$KEYRINGFILE" ]; then
 186             REALTARGET="$(readlink -f "$KEYRINGFILE")"
 187             mv -f "$KEYRINGFILE" "${KEYRINGFILE}.dpkg-tmp"
 188             cp -a "$REALTARGET" "$KEYRINGFILE"
 189         fi
 190         # delete the key from the keyring
 191         $GPG --batch --delete-key --yes "$KEY"
 192         if [ -n "$REALTARGET" ]; then
 193             # the real backup is the old link, not the copy we made
 194             mv -f "${KEYRINGFILE}.dpkg-tmp" "${KEYRINGFILE}~"
 195         fi
 196     done
 197 }
 198
 199 foreach_keyring_do() {
 200    local ACTION="$1"
 201    shift
 202    # if a --keyring was given, just work on this one
 203    if [ -n "$FORCED_KEYRING" ]; then
 204         $ACTION "$FORCED_KEYRING" "$@"
 205    else
 206         # otherwise all known keyrings are up for inspection
 207         if [ -s "$TRUSTEDFILE" ]; then
 208             $ACTION "$TRUSTEDFILE" "$@"
 209         fi
 210         local TRUSTEDPARTS="/etc/apt/trusted.gpg.d"
 211         eval $(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d)
 212         if [ -d "$TRUSTEDPARTS" ]; then
 213             # strip / suffix as gpg will double-slash in that case (#665411)
 214             local STRIPPED_TRUSTEDPARTS="${TRUSTEDPARTS%/}"
 215             if [ "${STRIPPED_TRUSTEDPARTS}/" = "$TRUSTEDPARTS" ]; then
 216                 TRUSTEDPARTS="$STRIPPED_TRUSTEDPARTS"
 217             fi
 218             for trusted in $(run-parts --list "$TRUSTEDPARTS" --regex '^.*\.gpg$'); do
 219                 if [ -s "$trusted" ]; then
 220                     $ACTION "$trusted" "$@"
 221                 fi
 222             done
 223         fi
 224    fi
 225 }
 226
 227 run_cmd_on_keyring() {
 228     local KEYRINGFILE="$1"
 229     shift
 230     # fingerprint and co will fail if key isn't in this keyring
 231     $GPG_CMD --keyring "$KEYRINGFILE" --batch "$@" 2>/dev/null || true
 232 }
 233
 234 import_keyring_into_keyring() {
 235     local FROM="${1:-${GPGHOMEDIR}/pubring.gpg}"
 236     local TO="${2:-${GPGHOMEDIR}/pubring.gpg}"
 237     shift 2
 238     rm -f "${GPGHOMEDIR}/gpgoutput.log"
 239     # the idea is simple: We take keys from one keyring and copy it to another
 240     # we do this with so many checks inbetween to ensure that WE control the
 241     # creation, so we know that the (potentially) created $TO keyring is a
 242     # simple keyring rather than a keybox as gpg2 would create it which in turn
 243     # can't be read by gpgv.
 244     # BEWARE: This is designed more in the way to work with the current
 245     # callers, than to have a well defined it would be easy to add new callers to.
 246     if [ ! -s "$TO" ]; then
 247         if [ -s "$FROM" ]; then
 248             if [ -z "$2" ]; then
 249                 if ! $GPG_CMD --keyring "$FROM" --export ${1:+"$1"} > "$TO" 2> "${GPGHOMEDIR}/gpgoutput.log"; then
 250                     cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
 251                     false
 252                 else
 253                     chmod 0644 -- "$TO"
 254                 fi
 255             else
 256                 create_new_keyring "$TO"
 257             fi
 258         else
 259             create_new_keyring "$TO"
 260         fi
 261     elif [ -s "$FROM" ]; then
 262         local EXPORTLIMIT="$1"
 263         if [ -n "$1$2" ]; then shift; fi
 264         if ! $GPG_CMD --keyring "$FROM" --export ${EXPORTLIMIT:+"$EXPORTLIMIT"} | $GPG_CMD --keyring "$TO" --batch --import "$@" > "${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
 265             cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
 266             false
 267         fi
 268     fi
 269 }
 270
 271 import_keys_from_keyring() {
 272     import_keyring_into_keyring "$1" "$2"
 273 }
 274
 275 merge_keys_into_keyrings() {
 276     import_keyring_into_keyring "$2" "$1" '' --import-options 'merge-only'
 277 }
 278
 279 merge_back_changes() {
 280     if [ -n "$FORCED_KEYRING" ]; then
 281         # if the keyring was forced merge is already done
 282         return
 283     fi
 284     if [ -s "${GPGHOMEDIR}/pubring.gpg" ]; then
 285         # merge all updated keys
 286         foreach_keyring_do 'merge_keys_into_keyrings' "${GPGHOMEDIR}/pubring.gpg"
 287     fi
 288     # look for keys which were added or removed
 289     get_fingerprints_of_keyring "${GPGHOMEDIR}/pubring.orig.gpg" > "${GPGHOMEDIR}/pubring.orig.keylst"
 290     get_fingerprints_of_keyring "${GPGHOMEDIR}/pubring.gpg" > "${GPGHOMEDIR}/pubring.keylst"
 291     sort "${GPGHOMEDIR}/pubring.keylst" "${GPGHOMEDIR}/pubring.orig.keylst" | uniq --unique | while read key; do
 292         if grep -q "^${key}$" "${GPGHOMEDIR}/pubring.orig.keylst"; then
 293             # key isn't part of new keyring, so remove
 294             foreach_keyring_do 'remove_key_from_keyring' "$key"
 295         elif grep -q "^${key}$" "${GPGHOMEDIR}/pubring.keylst"; then
 296             # key is part of new keyring, so we need to import it
 297             import_keyring_into_keyring '' "$TRUSTEDFILE" "$key"
 298         else
 299             echo >&2 "Errror: Key ${key} (dis)appeared out of nowhere"
 300         fi
 301     done
 302 }
 303
 304 setup_merged_keyring() {
 305     if [ -n "$FORCED_KEYID" ]; then
 306         foreach_keyring_do 'import_keys_from_keyring' "${GPGHOMEDIR}/pubring.gpg"
 307         FORCED_KEYRING="${GPGHOMEDIR}/forcedkeyid.gpg"
 308         TRUSTEDFILE="${FORCED_KEYRING}"
 309         GPG="$GPG --keyring $TRUSTEDFILE"
 310         # ignore error as this "just" means we haven't found the forced keyid and the keyring will be empty
 311         import_keyring_into_keyring '' "$TRUSTEDFILE" "$FORCED_KEYID" || true
 312     elif [ -z "$FORCED_KEYRING" ]; then
 313         foreach_keyring_do 'import_keys_from_keyring' "${GPGHOMEDIR}/pubring.gpg"
 314         if [ -r "${GPGHOMEDIR}/pubring.gpg" ]; then
 315             cp -a "${GPGHOMEDIR}/pubring.gpg" "${GPGHOMEDIR}/pubring.orig.gpg"
 316         else
 317            touch "${GPGHOMEDIR}/pubring.gpg" "${GPGHOMEDIR}/pubring.orig.gpg"
 318         fi
 319         GPG="$GPG --keyring ${GPGHOMEDIR}/pubring.gpg"
 320     else
 321         create_new_keyring "$TRUSTEDFILE"
 322         GPG="$GPG --keyring $TRUSTEDFILE"
 323     fi
 324 }
 325
 326 create_new_keyring() {
 327     # gpg defaults to mode 0600 for new keyrings. Create one with 0644 instead.
 328     if ! [ -e "$TRUSTEDFILE" ]; then
 329         if [ -w "$(dirname "$TRUSTEDFILE")" ]; then
 330             touch -- "$TRUSTEDFILE"
 331             chmod 0644 -- "$TRUSTEDFILE"
 332         fi
 333     fi
 334 }
 335
 336 usage() {
 337     echo "Usage: apt-key [--keyring file] [command] [arguments]"
 338     echo
 339     echo "Manage apt's list of trusted keys"
 340     echo
 341     echo "  apt-key add <file>          - add the key contained in <file> ('-' for stdin)"
 342     echo "  apt-key del <keyid>         - remove the key <keyid>"
 343     echo "  apt-key export <keyid>      - output the key <keyid>"
 344     echo "  apt-key exportall           - output all trusted keys"
 345     echo "  apt-key update              - update keys using the keyring package"
 346     echo "  apt-key net-update          - update keys using the network"
 347     echo "  apt-key list                - list keys"
 348     echo "  apt-key finger              - list fingerprints"
 349     echo "  apt-key adv                 - pass advanced options to gpg (download key)"
 350     echo
 351     echo "If no specific keyring file is given the command applies to all keyring files."
 352 }
 353
 354 while [ -n "$1" ]; do
 355    case "$1" in
 356       --keyring)
 357          shift
 358          TRUSTEDFILE="$1"
 359          FORCED_KEYRING="$1"
 360          ;;
 361       --keyid)
 362          shift
 363          FORCED_KEYID="$1"
 364          ;;
 365       --secret-keyring)
 366          shift
 367          FORCED_SECRET_KEYRING="$1"
 368          ;;
 369       --readonly)
 370          merge_back_changes() { true; }
 371          create_new_keyring() { if [ ! -r $FORCED_KEYRING ]; then TRUSTEDFILE='/dev/null'; FORCED_KEYRING="$TRUSTEDFILE"; fi; }
 372          ;;
 373       --fakeroot)
 374          requires_root() { true; }
 375          ;;
 376       --quiet)
 377          aptkey_echo() { true; }
 378          ;;
 379       --debug1)
 380          # some cmds like finger redirect stderr to /dev/null …
 381         aptkey_execute() { echo 'EXEC:' "$@"; "$@"; }
 382         ;;
 383       --debug2)
 384          # … other more complicated ones pipe gpg into gpg.
 385         aptkey_execute() { echo >&2 'EXEC:' "$@"; "$@"; }
 386         ;;
 387       --*)
 388          echo >&2 "Unknown option: $1"
 389          usage
 390          exit 1;;
 391       *)
 392          break;;
 393    esac
 394    shift
 395 done
 396
 397 if [ -z "$TRUSTEDFILE" ]; then
 398    TRUSTEDFILE="/etc/apt/trusted.gpg"
 399    eval $(apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring)
 400    eval $(apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f)
 401 fi
 402
 403 command="$1"
 404 if [ -z "$command" ]; then
 405     usage
 406     exit 1
 407 fi
 408 shift
 409
 410 if [ "$command" != "help" ]; then
 411     eval $(apt-config shell GPG_EXE Apt::Key::gpgcommand)
 412
 413     if [ -n "$GPG_EXE" ] && which "$GPG_EXE" >/dev/null 2>&1; then
 414         true
 415     elif which gpg >/dev/null 2>&1; then
 416         GPG_EXE="gpg"
 417     elif which gpg2 >/dev/null 2>&1; then
 418         GPG_EXE="gpg2"
 419     else
 420         echo >&2 "Error: gnupg or gnupg2 do not seem to be installed,"
 421         echo >&2 "Error: but apt-key requires gnupg or gnupg2 for operation."
 422         echo >&2
 423         exit 255
 424     fi
 425
 426     if type aptkey_execute >/dev/null 2>&1; then
 427         GPG_EXE="aptkey_execute $GPG_EXE"
 428     fi
 429     GPG_CMD="$GPG_EXE --ignore-time-conflict --no-options --no-default-keyring"
 430
 431     # gpg needs (in different versions more or less) files to function correctly,
 432     # so we give it its own homedir and generate some valid content for it
 433     if [ -n "$TMPDIR" ]; then
 434        # tmpdir is a directory and current user has rwx access to it
 435        # same tests as in apt-pkg/contrib/fileutl.cc GetTempDir()
 436        if [ ! -d "$TMPDIR" ] || [ ! -r "$TMPDIR" ] || [ ! -w "$TMPDIR" ] || [ ! -x "$TMPDIR" ]; then
 437           unset TMPDIR
 438        fi
 439     fi
 440     GPGHOMEDIR="$(mktemp -d)"
 441     CURRENTTRAP="${CURRENTTRAP} rm -rf '${GPGHOMEDIR}';"
 442     trap "${CURRENTTRAP}" 0 HUP INT QUIT ILL ABRT FPE SEGV PIPE TERM
 443     chmod 700 "$GPGHOMEDIR"
 444     # We don't use a secret keyring, of course, but gpg panics and
 445     # implodes if there isn't one available - and writeable for imports
 446     SECRETKEYRING="${GPGHOMEDIR}/secring.gpg"
 447     touch $SECRETKEYRING
 448     GPG_CMD="$GPG_CMD --homedir $GPGHOMEDIR"
 449     # create the trustdb with an (empty) dummy keyring
 450     # older gpgs required it, newer gpgs even warn that it isn't needed,
 451     # but require it nonetheless for some commands, so we just play safe
 452     # here for the foreseeable future and create a dummy one
 453     $GPG_CMD --quiet --check-trustdb --keyring $SECRETKEYRING >/dev/null 2>&1
 454     # tell gpg that it shouldn't try to maintain a trustdb file
 455     GPG_CMD="$GPG_CMD --no-auto-check-trustdb --trust-model always"
 456     GPG="$GPG_CMD"
 457
 458     # for advanced operations, we might really need a secret keyring after all
 459     if [ -n "$FORCED_SECRET_KEYRING" ] && [ -r "$FORCED_SECRET_KEYRING" ]; then
 460         rm -f "$SECRETKEYRING"
 461         cp -a "$FORCED_SECRET_KEYRING" "$SECRETKEYRING"
 462     fi
 463
 464     # older gpg versions need a secring file, but newer versions take it as
 465     # a hint to start a migration from earlier versions. The file is empty
 466     # anyhow, so nothing actually happens, but its three lines of output
 467     # nobody expects to see in apt-key context, so trigger it in silence
 468     echo -n | $GPG --batch --import >/dev/null 2>&1 || true
 469 fi
 470
 471 case "$command" in
 472     add)
 473         requires_root
 474         setup_merged_keyring
 475         $GPG --quiet --batch --import "$@"
 476         merge_back_changes
 477         aptkey_echo "OK"
 478         ;;
 479     del|rm|remove)
 480         requires_root
 481         foreach_keyring_do 'remove_key_from_keyring' "$@"
 482         aptkey_echo "OK"
 483         ;;
 484     update)
 485         requires_root
 486         setup_merged_keyring
 487         update
 488         merge_back_changes
 489         ;;
 490     net-update)
 491         requires_root
 492         setup_merged_keyring
 493         net_update
 494         merge_back_changes
 495         ;;
 496     list)
 497         foreach_keyring_do 'run_cmd_on_keyring' --list-keys "$@"
 498         ;;
 499     finger*)
 500         foreach_keyring_do 'run_cmd_on_keyring' --fingerprint "$@"
 501         ;;
 502     export|exportall)
 503         foreach_keyring_do 'import_keys_from_keyring' "${GPGHOMEDIR}/pubring.gpg"
 504         $GPG_CMD --keyring "${GPGHOMEDIR}/pubring.gpg" --armor --export "$@"
 505         ;;
 506     adv*)
 507         setup_merged_keyring
 508         aptkey_echo "Executing: $GPG $*"
 509         $GPG "$@"
 510         merge_back_changes
 511         ;;
 512     verify)
 513         setup_merged_keyring
 514         GPGV=''
 515         eval $(apt-config shell GPGV Apt::Key::gpgvcommand)
 516         if [ -n "$GPGV" ] && ! which "$GPGV" >/dev/null 2>&1; then GPGV='';
 517         elif which gpgv >/dev/null 2>&1; then GPGV='gpgv';
 518         elif which gpgv2 >/dev/null 2>&1; then GPGV='gpgv2';
 519         fi
 520         if [ -n "$GPGV" ]; then
 521             if [ -n "$FORCED_KEYRING" ]; then
 522                 $GPGV --homedir "${GPGHOMEDIR}" --keyring "${FORCED_KEYRING}" --ignore-time-conflict "$@"
 523             else
 524                 $GPGV --homedir "${GPGHOMEDIR}" --keyring "${GPGHOMEDIR}/pubring.gpg" --ignore-time-conflict "$@"
 525             fi
 526         else
 527             $GPG --verify "$@"
 528         fi
 529         ;;
 530     help)
 531         usage
 532         ;;
 533     *)
 534         usage
 535         exit 1
 536         ;;
 537 esac