cmdline/apt-key

   1 #!/bin/sh
   2
   3 set -e
   4 unset GREP_OPTIONS
   5
   6 # We don't use a secret keyring, of course, but gpg panics and
   7 # implodes if there isn't one available
   8 GPG_CMD='gpg --ignore-time-conflict --no-options --no-default-keyring --secret-keyring /etc/apt/secring.gpg'
   9
  10 if [ "$(id -u)" -eq 0 ]; then
  11         GPG_CMD="$GPG_CMD --trustdb-name /etc/apt/trustdb.gpg"
  12 fi
  13
  14 GPG="$GPG_CMD"
  15
  16 MASTER_KEYRING=""
  17 ARCHIVE_KEYRING_URI=""
  18 #MASTER_KEYRING=/usr/share/keyrings/debian-master-keyring.gpg
  19 #ARCHIVE_KEYRING_URI=http://ftp.debian.org/debian/debian-archive-keyring.gpg
  20
  21 ARCHIVE_KEYRING=/usr/share/keyrings/debian-archive-keyring.gpg
  22 REMOVED_KEYS=/usr/share/keyrings/debian-archive-removed-keys.gpg
  23
  24 requires_root() {
  25         if [ "$(id -u)" -ne 0 ]; then
  26                 echo >&1 "ERROR: This command can only be used by root."
  27                 exit 1
  28         fi
  29 }
  30
  31 add_keys_with_verify_against_master_keyring() {
  32     ADD_KEYRING=$1
  33     MASTER=$2
  34
  35     if [ ! -f "$ADD_KEYRING" ]; then
  36         echo "ERROR: '$ADD_KEYRING' not found"
  37         return
  38     fi
  39     if [ ! -f "$MASTER" ]; then
  40         echo "ERROR: '$MASTER' not found"
  41         return
  42     fi
  43
  44     # when adding new keys, make sure that the archive-master-keyring
  45     # is honored. so:
  46     #   all keys that are exported must have a valid signature
  47     #   from a key in the $distro-master-keyring
  48     add_keys=`$GPG_CMD --keyring $ADD_KEYRING --with-colons --list-keys | grep ^pub | cut -d: -f5`
  49     master_keys=`$GPG_CMD --keyring $MASTER --with-colons --list-keys | grep ^pub | cut -d: -f5`
  50     for add_key in $add_keys; do
  51         ADDED=0
  52         for master_key in $master_keys; do
  53             if $GPG_CMD --keyring $ADD_KEYRING --list-sigs --with-colons $add_key | grep ^sig | cut -d: -f5 | grep -q $master_key; then
  54                 $GPG_CMD --quiet --batch --keyring $ADD_KEYRING --export $add_key | $GPG --import
  55                 ADDED=1
  56             fi
  57         done
  58         if [ $ADDED = 0 ]; then
  59             echo >&2 "Key '$add_key' not added. It is not signed with a master key"
  60         fi
  61     done
  62 }
  63
  64 # update the current archive signing keyring from a network URI
  65 # the archive-keyring keys needs to be signed with the master key
  66 # (otherwise it does not make sense from a security POV)
  67 net_update() {
  68     if [ -z "$ARCHIVE_KEYRING_URI" ]; then
  69         echo >&2 "ERROR: Your distribution is not supported in net-update as no uri for the archive-keyring is set"
  70         exit 1
  71     fi
  72     requires_root
  73     # in theory we would need to depend on wget for this, but this feature
  74     # isn't useable in debian anyway as we have no keyring uri nor a master key
  75     if ! which wget >/dev/null 2>&1; then
  76         echo >&2 "ERROR: an installed wget is required for a network-based update"
  77         exit 1
  78     fi
  79     if [ ! -d /var/lib/apt/keyrings ]; then
  80         mkdir -p /var/lib/apt/keyrings
  81     fi
  82     keyring=/var/lib/apt/keyrings/$(basename $ARCHIVE_KEYRING)
  83     old_mtime=0
  84     if [ -e $keyring ]; then
  85         old_mtime=$(stat -c %Y $keyring)
  86     fi
  87     (cd  /var/lib/apt/keyrings; wget -q -N $ARCHIVE_KEYRING_URI)
  88     if [ ! -e $keyring ]; then
  89         return
  90     fi
  91     new_mtime=$(stat -c %Y $keyring)
  92     if [ $new_mtime -ne $old_mtime ]; then
  93         echo "Checking for new archive signing keys now"
  94         add_keys_with_verify_against_master_keyring $keyring $MASTER_KEYRING
  95     fi
  96 }
  97
  98 update() {
  99     if [ ! -f $ARCHIVE_KEYRING ]; then
 100         echo >&2 "ERROR: Can't find the archive-keyring"
 101         echo >&2 "Is the debian-archive-keyring package installed?"
 102         exit 1
 103     fi
 104     requires_root
 105
 106     # add new keys from the package;
 107
 108     # we do not use add_keys_with_verify_against_master_keyring here,
 109     # because "update" is run on regular package updates.  A
 110     # attacker might as well replace the master-archive-keyring file
 111     # in the package and add his own keys. so this check wouldn't
 112     # add any security. we *need* this check on net-update though
 113     $GPG_CMD --quiet --batch --keyring $ARCHIVE_KEYRING --export | $GPG --import
 114
 115     if [ -r "$REMOVED_KEYS" ]; then
 116         # remove no-longer supported/used keys
 117         keys=`$GPG_CMD --keyring $REMOVED_KEYS --with-colons --list-keys | grep ^pub | cut -d: -f5`
 118         for key in $keys; do
 119             if $GPG --list-keys --with-colons | grep ^pub | cut -d: -f5 | grep -q $key; then
 120                 $GPG --quiet --batch --delete-key --yes ${key}
 121             fi
 122         done
 123     else
 124         echo "Warning: removed keys keyring  $REMOVED_KEYS missing or not readable" >&2
 125     fi
 126 }
 127
 128
 129 usage() {
 130     echo "Usage: apt-key [--keyring file] [command] [arguments]"
 131     echo
 132     echo "Manage apt's list of trusted keys"
 133     echo
 134     echo "  apt-key add <file>          - add the key contained in <file> ('-' for stdin)"
 135     echo "  apt-key del <keyid>         - remove the key <keyid>"
 136     echo "  apt-key export <keyid>      - output the key <keyid>"
 137     echo "  apt-key exportall           - output all trusted keys"
 138     echo "  apt-key update              - update keys using the keyring package"
 139     echo "  apt-key net-update          - update keys using the network"
 140     echo "  apt-key list                - list keys"
 141     echo "  apt-key finger              - list fingerprints"
 142     echo "  apt-key adv                 - pass advanced options to gpg (download key)"
 143     echo
 144     echo "If no specific keyring file is given the command applies to all keyring files."
 145 }
 146
 147 # Determine on which keyring we want to work
 148 if [ "$1" = "--keyring" ]; then
 149         #echo "keyfile given"
 150         shift
 151         TRUSTEDFILE="$1"
 152         if [ -r "$TRUSTEDFILE" ]; then
 153                 GPG="$GPG --keyring $TRUSTEDFILE --primary-keyring $TRUSTEDFILE"
 154         else
 155                 echo >&2 "Error: The specified keyring »$TRUSTEDFILE« is missing or not readable"
 156                 exit 1
 157         fi
 158         shift
 159 # otherwise use the default
 160 else
 161         #echo "generate list"
 162         TRUSTEDFILE="/etc/apt/trusted.gpg"
 163         eval $(apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring)
 164         eval $(apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f)
 165         if [ -r "$TRUSTEDFILE" ]; then
 166                 GPG="$GPG --keyring $TRUSTEDFILE"
 167         fi
 168         GPG="$GPG --primary-keyring $TRUSTEDFILE"
 169         TRUSTEDPARTS="/etc/apt/trusted.gpg.d"
 170         eval $(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d)
 171         if [ -d "$TRUSTEDPARTS" ]; then
 172                 #echo "parts active"
 173                 for trusted in $(run-parts --list $TRUSTEDPARTS --regex '^.*\.gpg$'); do
 174                         #echo "part -> $trusted"
 175                         GPG="$GPG --keyring $trusted"
 176                 done
 177         fi
 178 fi
 179 #echo "COMMAND: $GPG"
 180
 181 command="$1"
 182 if [ -z "$command" ]; then
 183     usage
 184     exit 1
 185 fi
 186 shift
 187
 188 if [ "$command" != "help" ] && ! which gpg >/dev/null 2>&1; then
 189     echo >&2 "Warning: gnupg does not seem to be installed."
 190     echo >&2 "Warning: apt-key requires gnupg for most operations."
 191     echo >&2
 192 fi
 193
 194 case "$command" in
 195     add)
 196         requires_root
 197         $GPG --quiet --batch --import "$1"
 198         echo "OK"
 199         ;;
 200     del|rm|remove)
 201         requires_root
 202         $GPG --quiet --batch --delete-key --yes "$1"
 203         echo "OK"
 204         ;;
 205     update)
 206         update
 207         ;;
 208     net-update)
 209         net_update
 210         ;;
 211     list)
 212         $GPG --batch --list-keys
 213         ;;
 214     finger*)
 215         $GPG --batch --fingerprint
 216         ;;
 217     export)
 218         $GPG --armor --export "$1"
 219         ;;
 220     exportall)
 221         $GPG --armor --export
 222         ;;
 223     adv*)
 224         echo "Executing: $GPG $*"
 225         $GPG $*
 226         ;;
 227     help)
 228         usage
 229         ;;
 230     *)
 231         usage
 232         exit 1
 233         ;;
 234 esac