cmdline/apt-key.in

   1 #!/bin/sh
   2
   3 set -e
   4 unset GREP_OPTIONS
   5 export IFS="$(printf "\n\b")"
   6
   7 MASTER_KEYRING='&keyring-master-filename;'
   8 eval "$(apt-config shell MASTER_KEYRING APT::Key::MasterKeyring)"
   9 ARCHIVE_KEYRING='&keyring-filename;'
  10 eval "$(apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring)"
  11 REMOVED_KEYS='&keyring-removed-filename;'
  12 eval "$(apt-config shell REMOVED_KEYS APT::Key::RemovedKeys)"
  13 ARCHIVE_KEYRING_URI='&keyring-uri;'
  14 eval "$(apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI)"
  15
  16 aptkey_echo() { echo "$@"; }
  17
  18 requires_root() {
  19         if [ "$(id -u)" -ne 0 ]; then
  20                 echo >&2 "ERROR: This command can only be used by root."
  21                 exit 1
  22         fi
  23 }
  24
  25 command_available() {
  26     if [ -x "$1" ]; then return 0; fi
  27     # command -v "$1" >/dev/null 2>&1 # not required by policy, see #747320
  28     # which "$1" >/dev/null 2>&1 # is in debianutils (essential) but not on non-debian systems
  29     local OLDIFS="$IFS"
  30     IFS=:
  31     for p in $PATH; do
  32         if [ -x "${p}/${1}" ]; then
  33             IFS="$OLDIFS"
  34             return 0
  35         fi
  36     done
  37     IFS="$OLDIFS"
  38     return 1
  39 }
  40
  41 escape_shell() {
  42     echo "$@" | sed -e "s#'#'\"'\"'#g"
  43 }
  44
  45 get_fingerprints_of_keyring() {
  46     aptkey_execute "$GPG_SH" --keyring "$1" --with-colons --fingerprint | while read publine; do
  47         # search for a public key
  48         if [ "${publine%%:*}" != 'pub' ]; then continue; fi
  49         # search for the associated fingerprint (should be the very next line)
  50         while read fprline; do
  51            if [ "${fprline%%:*}" = 'sub' ]; then break; # should never happen
  52            elif [ "${fprline%%:*}" != 'fpr' ]; then continue; fi
  53            echo "$fprline" | cut -d':' -f 10
  54         done
  55         # order in the keyring shouldn't be important
  56     done | sort
  57 }
  58
  59 add_keys_with_verify_against_master_keyring() {
  60     ADD_KEYRING="$1"
  61     MASTER="$2"
  62
  63     if [ ! -f "$ADD_KEYRING" ]; then
  64         echo >&2 "ERROR: '$ADD_KEYRING' not found"
  65         return
  66     fi
  67     if [ ! -f "$MASTER" ]; then
  68         echo >&2 "ERROR: '$MASTER' not found"
  69         return
  70     fi
  71
  72     # when adding new keys, make sure that the archive-master-keyring
  73     # is honored. so:
  74     #   all keys that are exported must have a valid signature
  75     #   from a key in the $distro-master-keyring
  76     add_keys="$(get_fingerprints_of_keyring "$ADD_KEYRING")"
  77     all_add_keys="$(aptkey_execute "$GPG_SH" --keyring "$ADD_KEYRING" --with-colons --list-keys | grep ^[ps]ub | cut -d: -f5)"
  78     master_keys="$(aptkey_execute "$GPG_SH" --keyring "$MASTER" --with-colons --list-keys | grep ^pub | cut -d: -f5)"
  79
  80     # ensure there are no colisions LP: #857472
  81     for all_add_key in $all_add_keys; do
  82         for master_key in $master_keys; do
  83             if [ "$all_add_key" = "$master_key" ]; then
  84                 echo >&2 "Keyid collision for '$all_add_key' detected, operation aborted"
  85                 return 1
  86             fi
  87         done
  88     done
  89
  90     for add_key in $add_keys; do
  91         # export the add keyring one-by-one
  92         local TMP_KEYRING="${GPGHOMEDIR}/tmp-keyring.gpg"
  93         aptkey_execute "$GPG_SH" --batch --yes --keyring "$ADD_KEYRING" --output "$TMP_KEYRING" --export "$add_key"
  94         if ! aptkey_execute "$GPG_SH" --batch --yes --keyring "$TMP_KEYRING" --import "$MASTER" > "${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
  95             cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
  96             false
  97         fi
  98         # check if signed with the master key and only add in this case
  99         ADDED=0
 100         for master_key in $master_keys; do
 101             if aptkey_execute "$GPG_SH" --keyring "$TMP_KEYRING" --check-sigs --with-colons "$add_key" \
 102                | grep '^sig:!:' | cut -d: -f5 | grep -q "$master_key"; then
 103                 aptkey_execute "$GPG_SH" --batch --yes --keyring "$ADD_KEYRING" --export "$add_key" \
 104                    | aptkey_execute "$GPG" --batch --yes --import
 105                 ADDED=1
 106             fi
 107         done
 108         if [ $ADDED = 0 ]; then
 109             echo >&2 "Key '$add_key' not added. It is not signed with a master key"
 110         fi
 111         rm -f "${TMP_KEYRING}"
 112     done
 113 }
 114
 115 # update the current archive signing keyring from a network URI
 116 # the archive-keyring keys needs to be signed with the master key
 117 # (otherwise it does not make sense from a security POV)
 118 net_update() {
 119     local APT_DIR='/'
 120     eval $(apt-config shell APT_DIR Dir)
 121
 122     # Disabled for now as code is insecure (LP: #1013639 (and 857472, 1013128))
 123     APT_KEY_NET_UPDATE_ENABLED=""
 124     eval $(apt-config shell APT_KEY_NET_UPDATE_ENABLED APT::Key::Net-Update-Enabled)
 125     if [ -z "$APT_KEY_NET_UPDATE_ENABLED" ]; then
 126         exit 1
 127     fi
 128
 129     if [ -z "$ARCHIVE_KEYRING_URI" ]; then
 130         echo >&2 "ERROR: Your distribution is not supported in net-update as no uri for the archive-keyring is set"
 131         exit 1
 132     fi
 133     # in theory we would need to depend on wget for this, but this feature
 134     # isn't useable in debian anyway as we have no keyring uri nor a master key
 135     if ! command_available 'wget'; then
 136         echo >&2 "ERROR: an installed wget is required for a network-based update"
 137         exit 1
 138     fi
 139     if [ ! -d "${APT_DIR}/var/lib/apt/keyrings" ]; then
 140         mkdir -p "${APT_DIR}/var/lib/apt/keyrings"
 141     fi
 142     keyring="${APT_DIR}/var/lib/apt/keyrings/$(basename "$ARCHIVE_KEYRING_URI")"
 143     old_mtime=0
 144     if [ -e $keyring ]; then
 145         old_mtime=$(stat -c %Y "$keyring")
 146     fi
 147     (cd  "${APT_DIR}/var/lib/apt/keyrings"; wget --timeout=90 -q -N "$ARCHIVE_KEYRING_URI")
 148     if [ ! -e "$keyring" ]; then
 149         return
 150     fi
 151     new_mtime=$(stat -c %Y "$keyring")
 152     if [ $new_mtime -ne $old_mtime ]; then
 153         aptkey_echo "Checking for new archive signing keys now"
 154         add_keys_with_verify_against_master_keyring "$keyring" "$MASTER_KEYRING"
 155     fi
 156 }
 157
 158 update() {
 159     if [ -z "$APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE" ]; then
 160         echo >&2 "Warning: 'apt-key update' is deprecated and should not be used anymore!"
 161         if [ -z "$ARCHIVE_KEYRING" ]; then
 162             echo >&2 "Note: In your distribution this command is a no-op and can therefore be removed safely."
 163             exit 0
 164         fi
 165     fi
 166     if [ ! -f "$ARCHIVE_KEYRING" ]; then
 167         echo >&2 "ERROR: Can't find the archive-keyring"
 168         echo >&2 "Is the &keyring-package; package installed?"
 169         exit 1
 170     fi
 171
 172     # add new keys from the package;
 173
 174     # we do not use add_keys_with_verify_against_master_keyring here,
 175     # because "update" is run on regular package updates.  A
 176     # attacker might as well replace the master-archive-keyring file
 177     # in the package and add his own keys. so this check wouldn't
 178     # add any security. we *need* this check on net-update though
 179     import_keyring_into_keyring "$ARCHIVE_KEYRING" '' && cat "${GPGHOMEDIR}/gpgoutput.log"
 180
 181     if [ -r "$REMOVED_KEYS" ]; then
 182         # remove no-longer supported/used keys
 183         get_fingerprints_of_keyring "$REMOVED_KEYS" | while read key; do
 184             foreach_keyring_do 'remove_key_from_keyring' "$key"
 185         done
 186     else
 187         echo >&2 "Warning: removed keys keyring  $REMOVED_KEYS missing or not readable"
 188     fi
 189 }
 190
 191 remove_key_from_keyring() {
 192     local KEYRINGFILE="$1"
 193     shift
 194     # non-existent keyrings have by definition no keys
 195     if [ ! -e "$KEYRINGFILE" ]; then
 196        return
 197     fi
 198
 199     for KEY in "$@"; do
 200         local FINGERPRINTS="${GPGHOMEDIR}/keyringfile.keylst"
 201         get_fingerprints_of_keyring "$KEYRINGFILE" > "$FINGERPRINTS"
 202
 203         # strip leading 0x, if present:
 204         KEY="${KEY#0x}"
 205
 206         # check if the key is in this keyring
 207         if ! grep -iq "^[0-9A-F]*${KEY}$" "$FINGERPRINTS"; then
 208             continue
 209         fi
 210         if [ ! -w "$KEYRINGFILE" ]; then
 211             echo >&2 "Key ${KEY} is in keyring ${KEYRINGFILE}, but can't be removed as it is read only."
 212             continue
 213         fi
 214         # check if it is the only key in the keyring and if so remove the keyring altogether
 215         if [ '1' = "$(uniq "$FINGERPRINTS" | wc -l)" ]; then
 216             mv -f "$KEYRINGFILE" "${KEYRINGFILE}~" # behave like gpg
 217             return
 218         fi
 219         # we can't just modify pointed to files as these might be in /usr or something
 220         local REALTARGET
 221         if [ -L "$KEYRINGFILE" ]; then
 222             REALTARGET="$(readlink -f "$KEYRINGFILE")"
 223             mv -f "$KEYRINGFILE" "${KEYRINGFILE}.dpkg-tmp"
 224             cp -a "$REALTARGET" "$KEYRINGFILE"
 225         fi
 226         # delete the key from the keyring
 227         aptkey_execute "$GPG_SH" --keyring "$KEYRINGFILE" --batch --delete-keys --yes "$KEY"
 228         if [ -n "$REALTARGET" ]; then
 229             # the real backup is the old link, not the copy we made
 230             mv -f "${KEYRINGFILE}.dpkg-tmp" "${KEYRINGFILE}~"
 231         fi
 232     done
 233 }
 234
 235 foreach_keyring_do() {
 236    local ACTION="$1"
 237    shift
 238    # if a --keyring was given, just work on this one
 239    if [ -n "$FORCED_KEYRING" ]; then
 240         $ACTION "$FORCED_KEYRING" "$@"
 241    else
 242         # otherwise all known keyrings are up for inspection
 243         if [ -s "$TRUSTEDFILE" ]; then
 244             $ACTION "$TRUSTEDFILE" "$@"
 245         fi
 246         local TRUSTEDPARTS="/etc/apt/trusted.gpg.d"
 247         eval "$(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d)"
 248         if [ -d "$TRUSTEDPARTS" ]; then
 249             TRUSTEDPARTS="$(readlink -f "$TRUSTEDPARTS")"
 250             local TRUSTEDPARTSLIST="$(cd /; find "$TRUSTEDPARTS" -mindepth 1 -maxdepth 1 -name '*.gpg')"
 251             for trusted in $(echo "$TRUSTEDPARTSLIST" | sort); do
 252                 if [ -s "$trusted" ]; then
 253                     $ACTION "$trusted" "$@"
 254                 fi
 255             done
 256         fi
 257    fi
 258 }
 259
 260 run_cmd_on_keyring() {
 261     local KEYRINGFILE="$1"
 262     shift
 263     # fingerprint and co will fail if key isn't in this keyring
 264     aptkey_execute "$GPG_SH" --keyring "$KEYRINGFILE" --batch "$@" 2>/dev/null || true
 265 }
 266
 267 import_keyring_into_keyring() {
 268     local FROM="${1:-${GPGHOMEDIR}/pubring.gpg}"
 269     local TO="${2:-${GPGHOMEDIR}/pubring.gpg}"
 270     shift 2
 271     rm -f "${GPGHOMEDIR}/gpgoutput.log"
 272     # the idea is simple: We take keys from one keyring and copy it to another
 273     # we do this with so many checks in between to ensure that WE control the
 274     # creation, so we know that the (potentially) created $TO keyring is a
 275     # simple keyring rather than a keybox as gpg2 would create it which in turn
 276     # can't be read by gpgv.
 277     # BEWARE: This is designed more in the way to work with the current
 278     # callers, than to have a well defined it would be easy to add new callers to.
 279     if [ ! -s "$TO" ]; then
 280         if [ -s "$FROM" ]; then
 281             if [ -z "$2" ]; then
 282                 if ! aptkey_execute "$GPG_SH" --keyring "$FROM" --export ${1:+"$1"} > "$TO" 2> "${GPGHOMEDIR}/gpgoutput.log"; then
 283                     cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
 284                     false
 285                 else
 286                     chmod 0644 -- "$TO"
 287                 fi
 288             else
 289                 create_new_keyring "$TO"
 290             fi
 291         else
 292             create_new_keyring "$TO"
 293         fi
 294     elif [ -s "$FROM" ]; then
 295         local EXPORTLIMIT="$1"
 296         if [ -n "$1$2" ]; then shift; fi
 297         if ! aptkey_execute "$GPG_SH" --keyring "$FROM" --export ${EXPORTLIMIT:+"$EXPORTLIMIT"} \
 298            | aptkey_execute "$GPG_SH" --keyring "$TO" --batch --import "$@" > "${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
 299             cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
 300             false
 301         fi
 302     fi
 303 }
 304
 305 merge_all_trusted_keyrings_into_pubring() {
 306     # does the same as:
 307     # foreach_keyring_do 'import_keys_from_keyring' "${GPGHOMEDIR}/pubring.gpg"
 308     # but without using gpg, just cat and find
 309     local PUBRING="$(readlink -f "${GPGHOMEDIR}/pubring.gpg")"
 310     # if a --keyring was given, just use this one
 311     if [ -n "$FORCED_KEYRING" ]; then
 312         if [ -s "$FORCED_KEYRING" ]; then
 313             cp --dereference "$FORCED_KEYRING" "$PUBRING"
 314         fi
 315     else
 316         # otherwise all known keyrings are merged
 317         local TRUSTEDPARTS="/etc/apt/trusted.gpg.d"
 318         eval $(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d)
 319         if [ -d "$TRUSTEDPARTS" ]; then
 320             rm -f "$PUBRING"
 321             if [ -s "$TRUSTEDFILE" ]; then
 322                 cat "$TRUSTEDFILE" > "$PUBRING"
 323             fi
 324             TRUSTEDPARTS="$(readlink -f "$TRUSTEDPARTS")"
 325             (cd /; find "$TRUSTEDPARTS" -mindepth 1 -maxdepth 1 -name '*.gpg' -exec cat {} + >> "$PUBRING";)
 326         elif [ -s "$TRUSTEDFILE" ]; then
 327             cp --dereference "$TRUSTEDFILE" "$PUBRING"
 328         fi
 329     fi
 330
 331     if [ ! -s "$PUBRING" ]; then
 332         touch "$PUBRING"
 333     fi
 334 }
 335
 336 import_keys_from_keyring() {
 337     import_keyring_into_keyring "$1" "$2"
 338 }
 339
 340 merge_keys_into_keyrings() {
 341     import_keyring_into_keyring "$2" "$1" '' --import-options 'merge-only'
 342 }
 343
 344 merge_back_changes() {
 345     if [ -n "$FORCED_KEYRING" ]; then
 346         # if the keyring was forced merge is already done
 347         return
 348     fi
 349     if [ -s "${GPGHOMEDIR}/pubring.gpg" ]; then
 350         # merge all updated keys
 351         foreach_keyring_do 'merge_keys_into_keyrings' "${GPGHOMEDIR}/pubring.gpg"
 352     fi
 353     # look for keys which were added or removed
 354     get_fingerprints_of_keyring "${GPGHOMEDIR}/pubring.orig.gpg" > "${GPGHOMEDIR}/pubring.orig.keylst"
 355     get_fingerprints_of_keyring "${GPGHOMEDIR}/pubring.gpg" > "${GPGHOMEDIR}/pubring.keylst"
 356     comm -3 "${GPGHOMEDIR}/pubring.keylst" "${GPGHOMEDIR}/pubring.orig.keylst" > "${GPGHOMEDIR}/pubring.diff"
 357     # key isn't part of new keyring, so remove
 358     cut -f 2 "${GPGHOMEDIR}/pubring.diff" | while read key; do
 359         if [ -z "$key" ]; then continue; fi
 360         foreach_keyring_do 'remove_key_from_keyring' "$key"
 361     done
 362     # key is only part of new keyring, so we need to import it
 363     cut -f 1 "${GPGHOMEDIR}/pubring.diff" | while read key; do
 364         if [ -z "$key" ]; then continue; fi
 365         import_keyring_into_keyring '' "$TRUSTEDFILE" "$key"
 366     done
 367 }
 368
 369 setup_merged_keyring() {
 370     if [ -n "$FORCED_KEYID" ]; then
 371         merge_all_trusted_keyrings_into_pubring
 372         FORCED_KEYRING="${GPGHOMEDIR}/forcedkeyid.gpg"
 373         TRUSTEDFILE="${FORCED_KEYRING}"
 374         echo "#!/bin/sh
 375 exec sh '($(escape_shell "${GPG}")' --keyring '$(escape_shell "${TRUSTEDFILE}")' \"\$@\"" > "${GPGHOMEDIR}/gpg.1.sh"
 376         GPG="${GPGHOMEDIR}/gpg.1.sh"
 377         # ignore error as this "just" means we haven't found the forced keyid and the keyring will be empty
 378         import_keyring_into_keyring '' "$TRUSTEDFILE" "$FORCED_KEYID" || true
 379     elif [ -z "$FORCED_KEYRING" ]; then
 380         merge_all_trusted_keyrings_into_pubring
 381         if [ -r "${GPGHOMEDIR}/pubring.gpg" ]; then
 382             cp -a "${GPGHOMEDIR}/pubring.gpg" "${GPGHOMEDIR}/pubring.orig.gpg"
 383         else
 384            touch "${GPGHOMEDIR}/pubring.gpg" "${GPGHOMEDIR}/pubring.orig.gpg"
 385         fi
 386         echo "#!/bin/sh
 387 exec sh '$(escape_shell "${GPG}")' --keyring '$(escape_shell "${GPGHOMEDIR}/pubring.gpg")' \"\$@\"" > "${GPGHOMEDIR}/gpg.1.sh"
 388         GPG="${GPGHOMEDIR}/gpg.1.sh"
 389     else
 390         create_new_keyring "$TRUSTEDFILE"
 391         echo "#!/bin/sh
 392 exec sh '$(escape_shell "${GPG}")' --keyring '$(escape_shell "${TRUSTEDFILE}")' \"\$@\"" > "${GPGHOMEDIR}/gpg.1.sh"
 393         GPG="${GPGHOMEDIR}/gpg.1.sh"
 394     fi
 395 }
 396
 397 create_new_keyring() {
 398     # gpg defaults to mode 0600 for new keyrings. Create one with 0644 instead.
 399     if ! [ -e "$TRUSTEDFILE" ]; then
 400         if [ -w "$(dirname "$TRUSTEDFILE")" ]; then
 401             touch -- "$TRUSTEDFILE"
 402             chmod 0644 -- "$TRUSTEDFILE"
 403         fi
 404     fi
 405 }
 406
 407 aptkey_execute() { sh "$@"; }
 408
 409 usage() {
 410     echo "Usage: apt-key [--keyring file] [command] [arguments]"
 411     echo
 412     echo "Manage apt's list of trusted keys"
 413     echo
 414     echo "  apt-key add <file>          - add the key contained in <file> ('-' for stdin)"
 415     echo "  apt-key del <keyid>         - remove the key <keyid>"
 416     echo "  apt-key export <keyid>      - output the key <keyid>"
 417     echo "  apt-key exportall           - output all trusted keys"
 418     echo "  apt-key update              - update keys using the keyring package"
 419     echo "  apt-key net-update          - update keys using the network"
 420     echo "  apt-key list                - list keys"
 421     echo "  apt-key finger              - list fingerprints"
 422     echo "  apt-key adv                 - pass advanced options to gpg (download key)"
 423     echo
 424     echo "If no specific keyring file is given the command applies to all keyring files."
 425 }
 426
 427 while [ -n "$1" ]; do
 428    case "$1" in
 429       --keyring)
 430          shift
 431          TRUSTEDFILE="$1"
 432          FORCED_KEYRING="$1"
 433          ;;
 434       --keyid)
 435          shift
 436          FORCED_KEYID="$1"
 437          ;;
 438       --secret-keyring)
 439          shift
 440          FORCED_SECRET_KEYRING="$1"
 441          ;;
 442       --readonly)
 443          merge_back_changes() { true; }
 444          create_new_keyring() { if [ ! -r "$FORCED_KEYRING" ]; then TRUSTEDFILE='/dev/null'; FORCED_KEYRING="$TRUSTEDFILE"; fi; }
 445          ;;
 446       --fakeroot)
 447          requires_root() { true; }
 448          ;;
 449       --quiet)
 450          aptkey_echo() { true; }
 451          ;;
 452       --debug1)
 453          # some cmds like finger redirect stderr to /dev/null …
 454         aptkey_execute() { echo 'EXEC:' "$@"; sh "$@"; }
 455         ;;
 456       --debug2)
 457          # … other more complicated ones pipe gpg into gpg.
 458         aptkey_execute() { echo >&2 'EXEC:' "$@"; sh "$@"; }
 459         ;;
 460       --*)
 461          echo >&2 "Unknown option: $1"
 462          usage
 463          exit 1;;
 464       *)
 465          break;;
 466    esac
 467    shift
 468 done
 469
 470 if [ -z "$TRUSTEDFILE" ]; then
 471    TRUSTEDFILE="/etc/apt/trusted.gpg"
 472    eval $(apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring)
 473    eval $(apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f)
 474 fi
 475
 476 command="$1"
 477 if [ -z "$command" ]; then
 478     usage
 479     exit 1
 480 fi
 481 shift
 482
 483 cleanup_gpg_home() {
 484     if [ -z "$GPGHOMEDIR" ]; then return; fi
 485     if command_available 'gpgconf'; then
 486         GNUPGHOME="${GPGHOMEDIR}" gpgconf --kill gpg-agent >/dev/null 2>&1 || true
 487     fi
 488     rm -rf "$GPGHOMEDIR"
 489 }
 490
 491 create_gpg_home() {
 492     # gpg needs (in different versions more or less) files to function correctly,
 493     # so we give it its own homedir and generate some valid content for it later on
 494     if [ -n "$TMPDIR" ]; then
 495         # tmpdir is a directory and current user has rwx access to it
 496         # same tests as in apt-pkg/contrib/fileutl.cc GetTempDir()
 497         if [ ! -d "$TMPDIR" ] || [ ! -r "$TMPDIR" ] || [ ! -w "$TMPDIR" ] || [ ! -x "$TMPDIR" ]; then
 498             unset TMPDIR
 499         fi
 500     fi
 501     GPGHOMEDIR="$(mktemp -d)"
 502     CURRENTTRAP="${CURRENTTRAP} cleanup_gpg_home;"
 503     trap "${CURRENTTRAP}" 0 HUP INT QUIT ILL ABRT FPE SEGV PIPE TERM
 504     if [ -z "$GPGHOMEDIR" ]; then
 505         echo "ERROR: Could not create temporary gpg home directory in apt-key ($TMPDIR)"
 506         exit 28
 507     fi
 508     chmod 700 "$GPGHOMEDIR"
 509 }
 510
 511 prepare_gpg_home() {
 512     # crude detection if we are called from a maintainerscript where the
 513     # package depends on gnupg or not. We accept recommends here as
 514     # well as the script hopefully uses apt-key optionally then like e.g.
 515     # debian-archive-keyring for (upgrade) cleanup did
 516     if [ -n "$DPKG_MAINTSCRIPT_PACKAGE" ] && [ -z "$APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE" ]; then
 517         if ! dpkg-query --show --showformat '${Pre-Depends}${Depends}${Recommends}\n' "$DPKG_MAINTSCRIPT_PACKAGE" 2>/dev/null | grep -q gnupg; then
 518             cat >&2 <<EOF
 519 Warning: The $DPKG_MAINTSCRIPT_NAME maintainerscript of the package $DPKG_MAINTSCRIPT_PACKAGE
 520 Warning: seems to use apt-key (provided by apt) without depending on gnupg or gnupg2.
 521 Warning: This will BREAK in the future and should be fixed by the package maintainer(s).
 522 Note: Check first if apt-key functionality is needed at all - it probably isn't!
 523 EOF
 524         fi
 525     fi
 526     eval "$(apt-config shell GPG_EXE Apt::Key::gpgcommand)"
 527     if [ -n "$GPG_EXE" ] && command_available "$GPG_EXE"; then
 528         true
 529     elif command_available 'gpg'; then
 530         GPG_EXE="gpg"
 531     elif command_available 'gpg2'; then
 532         GPG_EXE="gpg2"
 533     else
 534         echo >&2 "Error: gnupg or gnupg2 do not seem to be installed,"
 535         echo >&2 "Error: but apt-key requires gnupg or gnupg2 for this operation."
 536         echo >&2
 537         exit 255
 538     fi
 539
 540     create_gpg_home
 541
 542     # create the trustdb with an (empty) dummy keyring
 543     # older gpgs required it, newer gpgs even warn that it isn't needed,
 544     # but require it nonetheless for some commands, so we just play safe
 545     # here for the foreseeable future and create a dummy one
 546     touch "${GPGHOMEDIR}/empty.gpg"
 547     if ! "$GPG_EXE" --ignore-time-conflict --no-options --no-default-keyring \
 548        --homedir "$GPGHOMEDIR" --quiet --check-trustdb --keyring "${GPGHOMEDIR}/empty.gpg" >"${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
 549        cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
 550        false
 551     fi
 552
 553     # now tell gpg that it shouldn't try to maintain this trustdb file
 554     echo "#!/bin/sh
 555 exec '$(escape_shell "${GPG_EXE}")' --ignore-time-conflict --no-options --no-default-keyring \\
 556 --homedir '$(escape_shell "${GPGHOMEDIR}")' --no-auto-check-trustdb --trust-model always \"\$@\"" > "${GPGHOMEDIR}/gpg.0.sh"
 557     GPG_SH="${GPGHOMEDIR}/gpg.0.sh"
 558     GPG="$GPG_SH"
 559
 560     # We don't usually need a secret keyring, of course, but
 561     # for advanced operations, we might really need a secret keyring after all
 562     if [ -n "$FORCED_SECRET_KEYRING" ] && [ -r "$FORCED_SECRET_KEYRING" ]; then
 563         if ! aptkey_execute "$GPG" -v --batch --import "$FORCED_SECRET_KEYRING" >"${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
 564             cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
 565             false
 566         fi
 567     else
 568        # and then, there are older versions of gpg which panic and implode
 569        # if there isn't one available - and writeable for imports
 570        # and even if not output is littered with the creation of a secring,
 571        # so lets call import once to have it create what it wants in silence
 572        echo -n | aptkey_execute "$GPG" --batch --import >/dev/null 2>&1 || true
 573     fi
 574 }
 575
 576 warn_on_script_usage() {
 577     if [ -n "$APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE" ]; then
 578         return
 579     fi
 580     # (Maintainer) scripts should not be using apt-key
 581     if [ -n "$DPKG_MAINTSCRIPT_PACKAGE" ]; then
 582         echo >&2 "Warning: apt-key should not be used in scripts (called from $DPKG_MAINTSCRIPT_NAME maintainerscript of the package ${DPKG_MAINTSCRIPT_PACKAGE})"
 583     elif [ ! -t 1 ]; then
 584         echo >&2 "Warning: apt-key output should not be parsed (stdout is not a terminal)"
 585     fi
 586 }
 587
 588 if [ "$command" != 'help' ] && [ "$command" != 'verify' ]; then
 589     prepare_gpg_home
 590 fi
 591
 592 case "$command" in
 593     add)
 594         warn_on_script_usage
 595         requires_root
 596         setup_merged_keyring
 597         aptkey_execute "$GPG" --quiet --batch --import "$@"
 598         merge_back_changes
 599         aptkey_echo "OK"
 600         ;;
 601     del|rm|remove)
 602         # no script warning here as removing 'add' usage needs 'del' for cleanup
 603         requires_root
 604         foreach_keyring_do 'remove_key_from_keyring' "$@"
 605         aptkey_echo "OK"
 606         ;;
 607     update)
 608         warn_on_script_usage
 609         requires_root
 610         setup_merged_keyring
 611         update
 612         merge_back_changes
 613         ;;
 614     net-update)
 615         requires_root
 616         setup_merged_keyring
 617         net_update
 618         merge_back_changes
 619         ;;
 620     list|finger*)
 621         warn_on_script_usage
 622         foreach_keyring_do 'run_cmd_on_keyring' --fingerprint "$@"
 623         ;;
 624     export|exportall)
 625         warn_on_script_usage
 626         merge_all_trusted_keyrings_into_pubring
 627         aptkey_execute "$GPG_SH" --keyring "${GPGHOMEDIR}/pubring.gpg" --armor --export "$@"
 628         ;;
 629     adv*)
 630         warn_on_script_usage
 631         setup_merged_keyring
 632         aptkey_echo "Executing: $GPG $*"
 633         aptkey_execute "$GPG" "$@"
 634         merge_back_changes
 635         ;;
 636     verify)
 637         GPGV=''
 638         eval $(apt-config shell GPGV Apt::Key::gpgvcommand)
 639         if [ -n "$GPGV" ] && command_available "$GPGV"; then true;
 640         elif command_available 'gpgv'; then GPGV='gpgv';
 641         elif command_available 'gpgv2'; then GPGV='gpgv2';
 642         else
 643            echo >&2 'ERROR: gpgv or gpgv2 required for verification'
 644            exit 29
 645         fi
 646         # for a forced keyid we need gpg --export, so full wrapping required
 647         if [ -n "$FORCED_KEYID" ]; then
 648             prepare_gpg_home
 649         else
 650             create_gpg_home
 651         fi
 652         setup_merged_keyring
 653         if [ -n "$FORCED_KEYRING" ]; then
 654             "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "${FORCED_KEYRING}" --ignore-time-conflict "$@"
 655         else
 656             "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "${GPGHOMEDIR}/pubring.gpg" --ignore-time-conflict "$@"
 657         fi
 658         ;;
 659     help)
 660         usage
 661         ;;
 662     *)
 663         usage
 664         exit 1
 665         ;;
 666 esac