+export_key_from_to() {
+ local FROM="$1"
+ local TO="$2"
+ shift 2
+ if ! aptkey_execute "$GPG_SH" --keyring "$(dearmor_filename "$FROM")" --export "$@" > "$TO" 2> "${GPGHOMEDIR}/gpgoutput.log"; then
+ cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
+ false
+ else
+ chmod 0644 -- "$TO"
+ fi
+}
+
+import_keyring_into_keyring() {
+ local FROM="${1:-${GPGHOMEDIR}/pubring.gpg}"
+ local TO="${2:-${GPGHOMEDIR}/pubring.gpg}"
+ shift 2
+ rm -f "${GPGHOMEDIR}/gpgoutput.log"
+ # the idea is simple: We take keys from one keyring and copy it to another
+ # we do this with so many checks in between to ensure that WE control the
+ # creation, so we know that the (potentially) created $TO keyring is a
+ # simple keyring rather than a keybox as gpg2 would create it which in turn
+ # can't be read by gpgv.
+ # BEWARE: This is designed more in the way to work with the current
+ # callers, than to have a well defined it would be easy to add new callers to.
+ if [ ! -s "$TO" ]; then
+ if [ -s "$FROM" ]; then
+ if [ -z "$2" ]; then
+ local OPTS
+ if [ "${TO##*.}" = 'asc' ]; then
+ OPTS='--armor'
+ fi
+ export_key_from_to "$(dearmor_filename "$FROM")" "$TO" $OPTS ${1:+"$1"}
+ else
+ create_new_keyring "$TO"
+ fi
+ else
+ create_new_keyring "$TO"
+ fi
+ elif [ -s "$FROM" ]; then
+ local EXPORTLIMIT="$1"
+ if [ -n "$1$2" ]; then shift; fi
+ local DEARMORTO="$(dearmor_filename "$TO")"
+ if ! aptkey_execute "$GPG_SH" --keyring "$(dearmor_filename "$FROM")" --export ${EXPORTLIMIT:+"$EXPORTLIMIT"} \
+ | aptkey_execute "$GPG_SH" --keyring "$DEARMORTO" --batch --import "$@" > "${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
+ cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
+ false
+ fi
+ if [ "$DEARMORTO" != "$TO" ]; then
+ export_key_from_to "$DEARMORTO" "${DEARMORTO}.asc" --armor
+ if ! cmp -s "$TO" "${DEARMORTO}.asc" 2>/dev/null; then
+ cp -a "$TO" "${TO}~"
+ mv -f "${DEARMORTO}.asc" "$TO"
+ fi
+ fi
+ fi
+}
+
+dearmor_keyring() {
+ # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=831409#67
+ # The awk script is more complex through to skip surrounding garbage and
+ # to support multiple keys in one file (old gpgs generate version headers
+ # which get printed with the original and hence result in garbage input for base64
+ awk '/^-----BEGIN/{ x = 1; }
+/^$/{ if (x == 1) { x = 2; }; }
+/^[^=-]/{ if (x == 2) { print $0; }; }
+/^-----END/{ x = 0; }' | base64 -d
+}
+dearmor_filename() {
+ if [ "${1##*.}" = 'asc' ]; then
+ local trusted="${GPGHOMEDIR}/${1##*/}.gpg"
+ if [ -s "$1" ]; then
+ dearmor_keyring < "$1" > "$trusted"
+ fi
+ echo "$trusted"
+ elif [ "${1##*.}" = 'gpg' ]; then
+ echo "$1"
+ elif [ "$(head -n 1 "$1" 2>/dev/null)" = '-----BEGIN PGP PUBLIC KEY BLOCK-----' ]; then
+ local trusted="${GPGHOMEDIR}/${1##*/}.gpg"
+ dearmor_keyring < "$1" > "$trusted"
+ echo "$trusted"
+ else
+ echo "$1"
+ fi
+}
+catfile() {
+ cat "$(dearmor_filename "$1")" >> "$2"
+}
+
+merge_all_trusted_keyrings_into_pubring() {
+ # does the same as:
+ # foreach_keyring_do 'import_keys_from_keyring' "${GPGHOMEDIR}/pubring.gpg"
+ # but without using gpg, just cat and find
+ local PUBRING="$(readlink -f "${GPGHOMEDIR}")/pubring.gpg"
+ rm -f "$PUBRING"
+ touch "$PUBRING"
+ foreach_keyring_do 'catfile' "$PUBRING"
projects / apt.git / blobdiff