The fastest way to get field values is as a range.

[apt.git] / cmdline / apt-key.in

diff --git a/cmdline/apt-key.in b/cmdline/apt-key.in
index b309142cf8471f71b56f83d29f691ffe67889517..c9ff4b3f44c4277bcdb0c247d71021510c905fb1 100644 (file)
--- a/cmdline/apt-key.in
+++ b/cmdline/apt-key.in
@@ -17,12 +17,13 @@ aptkey_echo() { echo "$@"; }
 
 requires_root() {
        if [ "$(id -u)" -ne 0 ]; then
 
 requires_root() {
        if [ "$(id -u)" -ne 0 ]; then

-               echo >&2 "ERROR: This command can only be used by root."
+               apt_error "This command can only be used by root."

                exit 1
        fi
 }
 
 command_available() {
                exit 1
        fi
 }
 
 command_available() {

+    if [ -x "$1" ]; then return 0; fi

     # command -v "$1" >/dev/null 2>&1 # not required by policy, see #747320
     # which "$1" >/dev/null 2>&1 # is in debianutils (essential) but not on non-debian systems
     local OLDIFS="$IFS"
     # command -v "$1" >/dev/null 2>&1 # not required by policy, see #747320
     # which "$1" >/dev/null 2>&1 # is in debianutils (essential) but not on non-debian systems
     local OLDIFS="$IFS"


@@ -60,11 +61,11 @@ add_keys_with_verify_against_master_keyring() {
     MASTER="$2"
 
     if [ ! -f "$ADD_KEYRING" ]; then
     MASTER="$2"
 
     if [ ! -f "$ADD_KEYRING" ]; then

-       echo >&2 "ERROR: '$ADD_KEYRING' not found"
+       apt_error "Keyring '$ADD_KEYRING' to be added not found"

        return
     fi
     if [ ! -f "$MASTER" ]; then
        return
     fi
     if [ ! -f "$MASTER" ]; then

-       echo >&2 "ERROR: '$MASTER' not found"
+       apt_error "Master-Keyring '$MASTER' not found"

        return
     fi
 
        return
     fi
 


@@ -126,13 +127,13 @@ net_update() {
     fi
 
     if [ -z "$ARCHIVE_KEYRING_URI" ]; then
     fi
 
     if [ -z "$ARCHIVE_KEYRING_URI" ]; then

-       echo >&2 "ERROR: Your distribution is not supported in net-update as no uri for the archive-keyring is set"
+       apt_error 'Your distribution is not supported in net-update as no uri for the archive-keyring is set'

        exit 1
     fi
     # in theory we would need to depend on wget for this, but this feature
     # isn't useable in debian anyway as we have no keyring uri nor a master key
     if ! command_available 'wget'; then
        exit 1
     fi
     # in theory we would need to depend on wget for this, but this feature
     # isn't useable in debian anyway as we have no keyring uri nor a master key
     if ! command_available 'wget'; then

-       echo >&2 "ERROR: an installed wget is required for a network-based update"
+       apt_error 'wget is required for a network-based update, but it is not installed'

        exit 1
     fi
     if [ ! -d "${APT_DIR}/var/lib/apt/keyrings" ]; then
        exit 1
     fi
     if [ ! -d "${APT_DIR}/var/lib/apt/keyrings" ]; then


@@ -155,9 +156,15 @@ net_update() {
 }
 
 update() {
 }
 
 update() {

+    if [ -z "$APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE" ]; then
+       echo >&2 "Warning: 'apt-key update' is deprecated and should not be used anymore!"
+       if [ -z "$ARCHIVE_KEYRING" ]; then
+           echo >&2 "Note: In your distribution this command is a no-op and can therefore be removed safely."
+           exit 0
+       fi
+    fi

     if [ ! -f "$ARCHIVE_KEYRING" ]; then
     if [ ! -f "$ARCHIVE_KEYRING" ]; then

-       echo >&2 "ERROR: Can't find the archive-keyring"
-       echo >&2 "Is the &keyring-package; package installed?"
+       apt_error "Can't find the archive-keyring (Is the &keyring-package; package installed?)"

        exit 1
     fi
 
        exit 1
     fi
 


@@ -172,11 +179,11 @@ update() {
 
     if [ -r "$REMOVED_KEYS" ]; then
        # remove no-longer supported/used keys
 
     if [ -r "$REMOVED_KEYS" ]; then
        # remove no-longer supported/used keys

-       get_fingerprints_of_keyring "$REMOVED_KEYS" | while read key; do
+       get_fingerprints_of_keyring "$(dearmor_filename "$REMOVED_KEYS")" | while read key; do

            foreach_keyring_do 'remove_key_from_keyring' "$key"
        done
     else
            foreach_keyring_do 'remove_key_from_keyring' "$key"
        done
     else

-       echo >&2 "Warning: removed keys keyring  $REMOVED_KEYS missing or not readable"
+       apt_warn "Removed keys keyring '$REMOVED_KEYS' missing or not readable"

     fi
 }
 
     fi
 }
 


@@ -188,19 +195,20 @@ remove_key_from_keyring() {
        return
     fi
 
        return
     fi
 

-    for KEY in "$@"; do
-       local FINGERPRINTS="${GPGHOMEDIR}/keyringfile.keylst"
-       get_fingerprints_of_keyring "$KEYRINGFILE" > "$FINGERPRINTS"
+    local FINGERPRINTS="${GPGHOMEDIR}/keyringfile.keylst"
+    local DEARMOR="$(dearmor_filename "$KEYRINGFILE")"
+    get_fingerprints_of_keyring "$DEARMOR" > "$FINGERPRINTS"

 
 

-        # strip leading 0x, if present:
-        KEY="${KEY#0x}"
+    for KEY in "$@"; do
+       # strip leading 0x, if present:
+       KEY="$(echo "${KEY#0x}" | tr -d ' ')"

 
        # check if the key is in this keyring
        if ! grep -iq "^[0-9A-F]*${KEY}$" "$FINGERPRINTS"; then
            continue
        fi
        if [ ! -w "$KEYRINGFILE" ]; then
 
        # check if the key is in this keyring
        if ! grep -iq "^[0-9A-F]*${KEY}$" "$FINGERPRINTS"; then
            continue
        fi
        if [ ! -w "$KEYRINGFILE" ]; then

-           echo >&2 "Key ${KEY} is in keyring ${KEYRINGFILE}, but can't be removed as it is read only."
+           apt_warn "Key ${KEY} is in keyring ${KEYRINGFILE}, but can't be removed as it is read only."

            continue
        fi
        # check if it is the only key in the keyring and if so remove the keyring altogether
            continue
        fi
        # check if it is the only key in the keyring and if so remove the keyring altogether


@@ -210,41 +218,55 @@ remove_key_from_keyring() {
        fi
        # we can't just modify pointed to files as these might be in /usr or something
        local REALTARGET
        fi
        # we can't just modify pointed to files as these might be in /usr or something
        local REALTARGET

-       if [ -L "$KEYRINGFILE" ]; then
-           REALTARGET="$(readlink -f "$KEYRINGFILE")"
-           mv -f "$KEYRINGFILE" "${KEYRINGFILE}.dpkg-tmp"
-           cp -a "$REALTARGET" "$KEYRINGFILE"
+       if [ -L "$DEARMOR" ]; then
+           REALTARGET="$(readlink -f "$DEARMOR")"
+           mv -f "$DEARMOR" "${DEARMOR}.dpkg-tmp"
+           cp -a "$REALTARGET" "$DEARMOR"

        fi
        # delete the key from the keyring
        fi
        # delete the key from the keyring

-       aptkey_execute "$GPG_SH" --keyring "$KEYRINGFILE" --batch --delete-keys --yes "$KEY"
+       aptkey_execute "$GPG_SH" --keyring "$DEARMOR" --batch --delete-keys --yes "$KEY"

        if [ -n "$REALTARGET" ]; then
            # the real backup is the old link, not the copy we made
        if [ -n "$REALTARGET" ]; then
            # the real backup is the old link, not the copy we made

-           mv -f "${KEYRINGFILE}.dpkg-tmp" "${KEYRINGFILE}~"
+           mv -f "${DEARMOR}.dpkg-tmp" "${DEARMOR}~"
+       fi
+       if [ "$DEARMOR" != "$KEYRINGFILE" ]; then
+           mv -f "$KEYRINGFILE" "${KEYRINGFILE}~"
+           create_new_keyring "$KEYRINGFILE"
+           aptkey_execute "$GPG_SH" --keyring "$DEARMOR" --armor --export > "$KEYRINGFILE"

        fi
        fi

+       get_fingerprints_of_keyring "$DEARMOR" > "$FINGERPRINTS"

     done
 }
 
     done
 }
 

+accessible_file_exists() {
+   if ! test -s "$1"; then
+      return 1
+   fi
+   if test -r "$1"; then
+      return 0
+   fi
+   apt_warn "The key(s) in the keyring $1 are ignored as the file is not readable by user '$USER' executing apt-key."
+   return 1
+}
+

 foreach_keyring_do() {
    local ACTION="$1"
    shift
    # if a --keyring was given, just work on this one
    if [ -n "$FORCED_KEYRING" ]; then
 foreach_keyring_do() {
    local ACTION="$1"
    shift
    # if a --keyring was given, just work on this one
    if [ -n "$FORCED_KEYRING" ]; then

-       $ACTION "$FORCED_KEYRING" "$@"
+       $ACTION "$TRUSTEDFILE" "$@"

    else
        # otherwise all known keyrings are up for inspection
    else
        # otherwise all known keyrings are up for inspection

-       if [ -s "$TRUSTEDFILE" ]; then
+       if accessible_file_exists "$TRUSTEDFILE"; then

            $ACTION "$TRUSTEDFILE" "$@"
        fi
        local TRUSTEDPARTS="/etc/apt/trusted.gpg.d"
        eval "$(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d)"
        if [ -d "$TRUSTEDPARTS" ]; then
            $ACTION "$TRUSTEDFILE" "$@"
        fi
        local TRUSTEDPARTS="/etc/apt/trusted.gpg.d"
        eval "$(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d)"
        if [ -d "$TRUSTEDPARTS" ]; then

-           # strip / suffix as gpg will double-slash in that case (#665411)
-           local STRIPPED_TRUSTEDPARTS="${TRUSTEDPARTS%/}"
-           if [ "${STRIPPED_TRUSTEDPARTS}/" = "$TRUSTEDPARTS" ]; then
-               TRUSTEDPARTS="$STRIPPED_TRUSTEDPARTS"
-           fi
-           for trusted in $(find "$TRUSTEDPARTS" -mindepth 1 -maxdepth 1 -regex '^.*\.gpg$' | sort); do
-               if [ -s "$trusted" ]; then
+           TRUSTEDPARTS="$(readlink -f "$TRUSTEDPARTS")"
+           local TRUSTEDPARTSLIST="$(cd /; find "$TRUSTEDPARTS" -mindepth 1 -maxdepth 1 \( -name '*.gpg' -o -name '*.asc' \))"
+           for trusted in $(echo "$TRUSTEDPARTSLIST" | sort); do
+               if accessible_file_exists "$trusted"; then

                    $ACTION "$trusted" "$@"
                fi
            done
                    $ACTION "$trusted" "$@"
                fi
            done


@@ -252,11 +274,41 @@ foreach_keyring_do() {
    fi
 }
 
    fi
 }
 

-run_cmd_on_keyring() {
+list_keys_in_keyring() {

     local KEYRINGFILE="$1"
     shift
     # fingerprint and co will fail if key isn't in this keyring
     local KEYRINGFILE="$1"
     shift
     # fingerprint and co will fail if key isn't in this keyring

-    aptkey_execute "$GPG_SH" --keyring "$KEYRINGFILE" --batch "$@" 2>/dev/null || true
+    aptkey_execute "$GPG_SH" --keyring "$(dearmor_filename "$KEYRINGFILE")" "$@" > "${GPGHOMEDIR}/gpgoutput.log" 2> "${GPGHOMEDIR}/gpgoutput.err" || true
+    if [ ! -s "${GPGHOMEDIR}/gpgoutput.log" ]; then
+       return
+    fi
+    # we fake gpg header here to refer to the real asc file rather than a temp file
+    if [ "${KEYRINGFILE##*.}" = 'asc' ]; then
+       if expr match "$(sed -n '2p' "${GPGHOMEDIR}/gpgoutput.log")" '^-\+$' >/dev/null 2>&1; then
+           echo "$KEYRINGFILE"
+           echo "$KEYRINGFILE" | sed 's#[^-]#-#g'
+           sed '1,2d' "${GPGHOMEDIR}/gpgoutput.log" || true
+       else
+           cat "${GPGHOMEDIR}/gpgoutput.log"
+       fi
+    else
+       cat "${GPGHOMEDIR}/gpgoutput.log"
+    fi
+    if [ -s "${GPGHOMEDIR}/gpgoutput.err" ]; then
+       cat >&2 "${GPGHOMEDIR}/gpgoutput.err"
+    fi
+}
+
+export_key_from_to() {
+    local FROM="$1"
+    local TO="$2"
+    shift 2
+    if ! aptkey_execute "$GPG_SH" --keyring "$(dearmor_filename "$FROM")" --export "$@" > "$TO" 2> "${GPGHOMEDIR}/gpgoutput.log"; then
+       cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
+       false
+    else
+       chmod 0644 -- "$TO"
+    fi

 }
 
 import_keyring_into_keyring() {
 }
 
 import_keyring_into_keyring() {


@@ -274,12 +326,11 @@ import_keyring_into_keyring() {
     if [ ! -s "$TO" ]; then
        if [ -s "$FROM" ]; then
            if [ -z "$2" ]; then
     if [ ! -s "$TO" ]; then
        if [ -s "$FROM" ]; then
            if [ -z "$2" ]; then

-               if ! aptkey_execute "$GPG_SH" --keyring "$FROM" --export ${1:+"$1"} > "$TO" 2> "${GPGHOMEDIR}/gpgoutput.log"; then
-                   cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
-                   false
-               else
-                   chmod 0644 -- "$TO"
+               local OPTS
+               if [ "${TO##*.}" = 'asc' ]; then
+                   OPTS='--armor'

                fi
                fi

+               export_key_from_to "$(dearmor_filename "$FROM")" "$TO" $OPTS ${1:+"$1"}

            else
                create_new_keyring "$TO"
            fi
            else
                create_new_keyring "$TO"
            fi


@@ -289,44 +340,61 @@ import_keyring_into_keyring() {
     elif [ -s "$FROM" ]; then
        local EXPORTLIMIT="$1"
        if [ -n "$1$2" ]; then shift; fi
     elif [ -s "$FROM" ]; then
        local EXPORTLIMIT="$1"
        if [ -n "$1$2" ]; then shift; fi

-       if ! aptkey_execute "$GPG_SH" --keyring "$FROM" --export ${EXPORTLIMIT:+"$EXPORTLIMIT"} \
-          | aptkey_execute "$GPG_SH" --keyring "$TO" --batch --import "$@" > "${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
+       local DEARMORTO="$(dearmor_filename "$TO")"
+       if ! aptkey_execute "$GPG_SH" --keyring "$(dearmor_filename "$FROM")" --export ${EXPORTLIMIT:+"$EXPORTLIMIT"} \
+          | aptkey_execute "$GPG_SH" --keyring "$DEARMORTO" --batch --import "$@" > "${GPGHOMEDIR}/gpgoutput.log" 2>&1; then

            cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
            false
        fi
            cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
            false
        fi

+       if [ "$DEARMORTO" != "$TO" ]; then
+           export_key_from_to "$DEARMORTO" "${DEARMORTO}.asc" --armor
+           if ! cmp -s "$TO" "${DEARMORTO}.asc" 2>/dev/null; then
+               cp -a "$TO" "${TO}~"
+               mv -f "${DEARMORTO}.asc" "$TO"
+           fi
+       fi

     fi
 }
 
     fi
 }
 

-merge_all_trusted_keyrings_into_pubring() {
-    # does the same as:
-    # foreach_keyring_do 'import_keys_from_keyring' "${GPGHOMEDIR}/pubring.gpg"
-    # but without using gpg, just cat and find
-    local PUBRING="${GPGHOMEDIR}/pubring.gpg"
-    # if a --keyring was given, just use this one
-    if [ -n "$FORCED_KEYRING" ]; then
-       if [ -s "$FORCED_KEYRING" ]; then
-           cp --dereference "$FORCED_KEYRING" "$PUBRING"
+dearmor_keyring() {
+    # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=831409#67
+    # The awk script is more complex through to skip surrounding garbage and
+    # to support multiple keys in one file (old gpgs generate version headers
+    # which get printed with the original and hence result in garbage input for base64
+    awk '/^-----BEGIN/{ x = 1; }
+/^$/{ if (x == 1) { x = 2; }; }
+/^[^=-]/{ if (x == 2) { print $0; }; }
+/^-----END/{ x = 0; }' | base64 -d
+}
+dearmor_filename() {
+    if [ "${1##*.}" = 'asc' ]; then
+       local trusted="${GPGHOMEDIR}/${1##*/}.gpg"
+       if [ -s "$1" ]; then
+           dearmor_keyring < "$1" > "$trusted"

        fi
        fi

+       echo "$trusted"
+    elif [ "${1##*.}" = 'gpg' ]; then
+       echo "$1"
+    elif [ "$(head -n 1 "$1" 2>/dev/null)" = '-----BEGIN PGP PUBLIC KEY BLOCK-----' ]; then
+       local trusted="${GPGHOMEDIR}/${1##*/}.gpg"
+       dearmor_keyring < "$1" > "$trusted"
+       echo "$trusted"

     else
     else

-       # otherwise all known keyrings are merged
-       local TRUSTEDPARTS="/etc/apt/trusted.gpg.d"
-       eval $(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d)
-       if [ -d "$TRUSTEDPARTS" ]; then
-           # ignore errors mostly for non-existing $TRUSTEDFILE
-           {
-              cat "$TRUSTEDFILE" || true
-              for parts in $(find -L "$TRUSTEDPARTS" -type f -name '*.gpg'); do
-                 cat "$parts" || true
-              done
-           } > "$PUBRING" 2>/dev/null
-       elif [ -s "$TRUSTEDFILE" ]; then
-           cp --dereference "$TRUSTEDFILE" "$PUBRING"
-       fi
+       echo "$1"

     fi
     fi

+}
+catfile() {
+    cat "$(dearmor_filename "$1")" >> "$2"
+}

 
 

-    if [ ! -s "$PUBRING" ]; then
-       touch "$PUBRING"
-    fi
+merge_all_trusted_keyrings_into_pubring() {
+    # does the same as:
+    # foreach_keyring_do 'import_keys_from_keyring' "${GPGHOMEDIR}/pubring.gpg"
+    # but without using gpg, just cat and find
+    local PUBRING="$(readlink -f "${GPGHOMEDIR}")/pubring.gpg"
+    rm -f "$PUBRING"
+    touch "$PUBRING"
+    foreach_keyring_do 'catfile' "$PUBRING"

 }
 
 import_keys_from_keyring() {
 }
 
 import_keys_from_keyring() {


@@ -340,6 +408,10 @@ merge_keys_into_keyrings() {
 merge_back_changes() {
     if [ -n "$FORCED_KEYRING" ]; then
        # if the keyring was forced merge is already done
 merge_back_changes() {
     if [ -n "$FORCED_KEYRING" ]; then
        # if the keyring was forced merge is already done

+       if [ "$FORCED_KEYRING" != "$TRUSTEDFILE" ]; then
+           mv -f "$FORCED_KEYRING" "${FORCED_KEYRING}~"
+           export_key_from_to "$TRUSTEDFILE" "$FORCED_KEYRING" --armor
+       fi

        return
     fi
     if [ -s "${GPGHOMEDIR}/pubring.gpg" ]; then
        return
     fi
     if [ -s "${GPGHOMEDIR}/pubring.gpg" ]; then


@@ -383,6 +455,7 @@ exec sh '($(escape_shell "${GPG}")' --keyring '$(escape_shell "${TRUSTEDFILE}")'
 exec sh '$(escape_shell "${GPG}")' --keyring '$(escape_shell "${GPGHOMEDIR}/pubring.gpg")' \"\$@\"" > "${GPGHOMEDIR}/gpg.1.sh"
        GPG="${GPGHOMEDIR}/gpg.1.sh"
     else
 exec sh '$(escape_shell "${GPG}")' --keyring '$(escape_shell "${GPGHOMEDIR}/pubring.gpg")' \"\$@\"" > "${GPGHOMEDIR}/gpg.1.sh"
        GPG="${GPGHOMEDIR}/gpg.1.sh"
     else

+       TRUSTEDFILE="$(dearmor_filename "$FORCED_KEYRING")"

        create_new_keyring "$TRUSTEDFILE"
        echo "#!/bin/sh
 exec sh '$(escape_shell "${GPG}")' --keyring '$(escape_shell "${TRUSTEDFILE}")' \"\$@\"" > "${GPGHOMEDIR}/gpg.1.sh"
        create_new_keyring "$TRUSTEDFILE"
        echo "#!/bin/sh
 exec sh '$(escape_shell "${GPG}")' --keyring '$(escape_shell "${TRUSTEDFILE}")' \"\$@\"" > "${GPGHOMEDIR}/gpg.1.sh"


@@ -392,10 +465,10 @@ exec sh '$(escape_shell "${GPG}")' --keyring '$(escape_shell "${TRUSTEDFILE}")'
 
 create_new_keyring() {
     # gpg defaults to mode 0600 for new keyrings. Create one with 0644 instead.
 
 create_new_keyring() {
     # gpg defaults to mode 0600 for new keyrings. Create one with 0644 instead.

-    if ! [ -e "$TRUSTEDFILE" ]; then
-       if [ -w "$(dirname "$TRUSTEDFILE")" ]; then
-           touch -- "$TRUSTEDFILE"
-           chmod 0644 -- "$TRUSTEDFILE"
+    if ! [ -e "$1" ]; then
+       if [ -w "$(dirname "$1")" ]; then
+           touch -- "$1"
+           chmod 0644 -- "$1"

        fi
     fi
 }
        fi
     fi
 }


@@ -476,6 +549,50 @@ if [ -z "$command" ]; then
 fi
 shift
 
 fi
 shift
 

+find_gpgv_status_fd() {
+   while [ -n "$1" ]; do
+       if [ "$1" = '--status-fd' ]; then
+               shift
+               echo "$1"
+               break
+       fi
+       shift
+   done
+}
+GPGSTATUSFD="$(find_gpgv_status_fd "$@")"
+
+apt_warn() {
+    if [ -z "$GPGHOMEDIR" ]; then
+       echo >&2 'W:' "$@"
+    else
+       echo 'W:' "$@" > "${GPGHOMEDIR}/aptwarnings.log"
+    fi
+    if [ -n "$GPGSTATUSFD" ]; then
+       echo >&${GPGSTATUSFD} '[APTKEY:] WARNING' "$@"
+    fi
+}
+apt_error() {
+    if [ -z "$GPGHOMEDIR" ]; then
+       echo >&2 'E:' "$@"
+    else
+       echo 'E:' "$@" > "${GPGHOMEDIR}/aptwarnings.log"
+    fi
+    if [ -n "$GPGSTATUSFD" ]; then
+       echo >&${GPGSTATUSFD} '[APTKEY:] ERROR' "$@"
+    fi
+}
+
+cleanup_gpg_home() {
+    if [ -z "$GPGHOMEDIR" ]; then return; fi
+    if [ -s "$GPGHOMEDIR/aptwarnings.log" ]; then
+       cat >&2 "$GPGHOMEDIR/aptwarnings.log"
+    fi
+    if command_available 'gpgconf'; then
+       GNUPGHOME="${GPGHOMEDIR}" gpgconf --kill gpg-agent >/dev/null 2>&1 || true
+    fi
+    rm -rf "$GPGHOMEDIR"
+}
+

 create_gpg_home() {
     # gpg needs (in different versions more or less) files to function correctly,
     # so we give it its own homedir and generate some valid content for it later on
 create_gpg_home() {
     # gpg needs (in different versions more or less) files to function correctly,
     # so we give it its own homedir and generate some valid content for it later on


@@ -487,8 +604,12 @@ create_gpg_home() {
        fi
     fi
     GPGHOMEDIR="$(mktemp -d)"
        fi
     fi
     GPGHOMEDIR="$(mktemp -d)"

-    CURRENTTRAP="${CURRENTTRAP} rm -rf '$(escape_shell "${GPGHOMEDIR}")';"
+    CURRENTTRAP="${CURRENTTRAP} cleanup_gpg_home;"

     trap "${CURRENTTRAP}" 0 HUP INT QUIT ILL ABRT FPE SEGV PIPE TERM
     trap "${CURRENTTRAP}" 0 HUP INT QUIT ILL ABRT FPE SEGV PIPE TERM

+    if [ -z "$GPGHOMEDIR" ]; then
+       apt_error "Could not create temporary gpg home directory in $TMPDIR (wrong permissions?)"
+       exit 28
+    fi

     chmod 700 "$GPGHOMEDIR"
 }
 
     chmod 700 "$GPGHOMEDIR"
 }
 


@@ -497,7 +618,7 @@ prepare_gpg_home() {
     # package depends on gnupg or not. We accept recommends here as
     # well as the script hopefully uses apt-key optionally then like e.g.
     # debian-archive-keyring for (upgrade) cleanup did
     # package depends on gnupg or not. We accept recommends here as
     # well as the script hopefully uses apt-key optionally then like e.g.
     # debian-archive-keyring for (upgrade) cleanup did

-    if [ -n "$DPKG_MAINTSCRIPT_PACKAGE" ]; then
+    if [ -n "$DPKG_MAINTSCRIPT_PACKAGE" ] && [ -z "$APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE" ]; then

        if ! dpkg-query --show --showformat '${Pre-Depends}${Depends}${Recommends}\n' "$DPKG_MAINTSCRIPT_PACKAGE" 2>/dev/null | grep -q gnupg; then
            cat >&2 <<EOF
 Warning: The $DPKG_MAINTSCRIPT_NAME maintainerscript of the package $DPKG_MAINTSCRIPT_PACKAGE
        if ! dpkg-query --show --showformat '${Pre-Depends}${Depends}${Recommends}\n' "$DPKG_MAINTSCRIPT_PACKAGE" 2>/dev/null | grep -q gnupg; then
            cat >&2 <<EOF
 Warning: The $DPKG_MAINTSCRIPT_NAME maintainerscript of the package $DPKG_MAINTSCRIPT_PACKAGE


@@ -514,10 +635,10 @@ EOF
        GPG_EXE="gpg"
     elif command_available 'gpg2'; then
        GPG_EXE="gpg2"
        GPG_EXE="gpg"
     elif command_available 'gpg2'; then
        GPG_EXE="gpg2"

+    elif command_available 'gpg1'; then
+       GPG_EXE="gpg1"

     else
     else

-       echo >&2 "Error: gnupg or gnupg2 do not seem to be installed,"
-       echo >&2 "Error: but apt-key requires gnupg or gnupg2 for this operation."
-       echo >&2
+       apt_error 'gnupg, gnupg2 and gnupg1 do not seem to be installed, but one of them is required for this operation'

        exit 255
     fi
 
        exit 255
     fi
 


@@ -557,12 +678,25 @@ exec '$(escape_shell "${GPG_EXE}")' --ignore-time-conflict --no-options --no-def
     fi
 }
 
     fi
 }
 

+warn_on_script_usage() {
+    if [ -n "$APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE" ]; then
+       return
+    fi
+    # (Maintainer) scripts should not be using apt-key
+    if [ -n "$DPKG_MAINTSCRIPT_PACKAGE" ]; then
+       echo >&2 "Warning: apt-key should not be used in scripts (called from $DPKG_MAINTSCRIPT_NAME maintainerscript of the package ${DPKG_MAINTSCRIPT_PACKAGE})"
+    elif [ ! -t 1 ]; then
+       echo >&2 "Warning: apt-key output should not be parsed (stdout is not a terminal)"
+    fi
+}
+

 if [ "$command" != 'help' ] && [ "$command" != 'verify' ]; then
     prepare_gpg_home
 fi
 
 case "$command" in
     add)
 if [ "$command" != 'help' ] && [ "$command" != 'verify' ]; then
     prepare_gpg_home
 fi
 
 case "$command" in
     add)

+       warn_on_script_usage

        requires_root
        setup_merged_keyring
        aptkey_execute "$GPG" --quiet --batch --import "$@"
        requires_root
        setup_merged_keyring
        aptkey_execute "$GPG" --quiet --batch --import "$@"


@@ -570,11 +704,13 @@ case "$command" in
        aptkey_echo "OK"
         ;;
     del|rm|remove)
        aptkey_echo "OK"
         ;;
     del|rm|remove)

+       # no script warning here as removing 'add' usage needs 'del' for cleanup

        requires_root
        foreach_keyring_do 'remove_key_from_keyring' "$@"
        aptkey_echo "OK"
         ;;
     update)
        requires_root
        foreach_keyring_do 'remove_key_from_keyring' "$@"
        aptkey_echo "OK"
         ;;
     update)

+       warn_on_script_usage

        requires_root
        setup_merged_keyring
        update
        requires_root
        setup_merged_keyring
        update


@@ -586,19 +722,19 @@ case "$command" in
        net_update
        merge_back_changes
        ;;
        net_update
        merge_back_changes
        ;;

-    list)
-       foreach_keyring_do 'run_cmd_on_keyring' --list-keys "$@"
-       ;;
-    finger*)
-       foreach_keyring_do 'run_cmd_on_keyring' --fingerprint "$@"
+    list|finger*)
+       warn_on_script_usage
+       foreach_keyring_do 'list_keys_in_keyring' --fingerprint "$@"

        ;;
     export|exportall)
        ;;
     export|exportall)

+       warn_on_script_usage

        merge_all_trusted_keyrings_into_pubring
        aptkey_execute "$GPG_SH" --keyring "${GPGHOMEDIR}/pubring.gpg" --armor --export "$@"
        ;;
     adv*)
        merge_all_trusted_keyrings_into_pubring
        aptkey_execute "$GPG_SH" --keyring "${GPGHOMEDIR}/pubring.gpg" --armor --export "$@"
        ;;
     adv*)

+       warn_on_script_usage

        setup_merged_keyring
        setup_merged_keyring

-       aptkey_echo "Executing: $GPG $*"
+       aptkey_echo "Executing: $GPG" "$@"

        aptkey_execute "$GPG" "$@"
        merge_back_changes
        ;;
        aptkey_execute "$GPG" "$@"
        merge_back_changes
        ;;


@@ -608,8 +744,9 @@ case "$command" in
        if [ -n "$GPGV" ] && command_available "$GPGV"; then true;
        elif command_available 'gpgv'; then GPGV='gpgv';
        elif command_available 'gpgv2'; then GPGV='gpgv2';
        if [ -n "$GPGV" ] && command_available "$GPGV"; then true;
        elif command_available 'gpgv'; then GPGV='gpgv';
        elif command_available 'gpgv2'; then GPGV='gpgv2';

+       elif command_available 'gpgv1'; then GPGV='gpgv1';

        else
        else

-          echo >&2 'ERROR: gpgv or gpgv2 required for verification'
+          apt_error 'gpgv, gpgv2 or gpgv1 required for verification, but neither seems installed'

           exit 29
        fi
        # for a forced keyid we need gpg --export, so full wrapping required
           exit 29
        fi
        # for a forced keyid we need gpg --export, so full wrapping required


@@ -620,7 +757,7 @@ case "$command" in
        fi
        setup_merged_keyring
        if [ -n "$FORCED_KEYRING" ]; then
        fi
        setup_merged_keyring
        if [ -n "$FORCED_KEYRING" ]; then

-           "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "${FORCED_KEYRING}" --ignore-time-conflict "$@"
+           "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "$(dearmor_filename "${FORCED_KEYRING}")" --ignore-time-conflict "$@"

        else
            "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "${GPGHOMEDIR}/pubring.gpg" --ignore-time-conflict "$@"
        fi
        else
            "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "${GPGHOMEDIR}/pubring.gpg" --ignore-time-conflict "$@"
        fi