+find_gpgv_status_fd() {
+ while [ -n "$1" ]; do
+ if [ "$1" = '--status-fd' ]; then
+ shift
+ echo "$1"
+ break
+ fi
+ shift
+ done
+}
+GPGSTATUSFD="$(find_gpgv_status_fd "$@")"
+
+apt_warn() {
+ if [ -z "$GPGHOMEDIR" ]; then
+ echo >&2 'W:' "$@"
+ else
+ echo 'W:' "$@" > "${GPGHOMEDIR}/aptwarnings.log"
+ fi
+ if [ -n "$GPGSTATUSFD" ]; then
+ echo >&${GPGSTATUSFD} '[APTKEY:] WARNING' "$@"
+ fi
+}
+apt_error() {
+ if [ -z "$GPGHOMEDIR" ]; then
+ echo >&2 'E:' "$@"
+ else
+ echo 'E:' "$@" > "${GPGHOMEDIR}/aptwarnings.log"
+ fi
+ if [ -n "$GPGSTATUSFD" ]; then
+ echo >&${GPGSTATUSFD} '[APTKEY:] ERROR' "$@"
+ fi
+}
+
+cleanup_gpg_home() {
+ if [ -z "$GPGHOMEDIR" ]; then return; fi
+ if [ -s "$GPGHOMEDIR/aptwarnings.log" ]; then
+ cat >&2 "$GPGHOMEDIR/aptwarnings.log"
+ fi
+ if command_available 'gpgconf'; then
+ GNUPGHOME="${GPGHOMEDIR}" gpgconf --kill gpg-agent >/dev/null 2>&1 || true
+ fi
+ rm -rf "$GPGHOMEDIR"
+}
+
+create_gpg_home() {
+ # gpg needs (in different versions more or less) files to function correctly,
+ # so we give it its own homedir and generate some valid content for it later on
+ if [ -n "$TMPDIR" ]; then
+ # tmpdir is a directory and current user has rwx access to it
+ # same tests as in apt-pkg/contrib/fileutl.cc GetTempDir()
+ if [ ! -d "$TMPDIR" ] || [ ! -r "$TMPDIR" ] || [ ! -w "$TMPDIR" ] || [ ! -x "$TMPDIR" ]; then
+ unset TMPDIR
+ fi
+ fi
+ GPGHOMEDIR="$(mktemp -d)"
+ CURRENTTRAP="${CURRENTTRAP} cleanup_gpg_home;"
+ trap "${CURRENTTRAP}" 0 HUP INT QUIT ILL ABRT FPE SEGV PIPE TERM
+ if [ -z "$GPGHOMEDIR" ]; then
+ apt_error "Could not create temporary gpg home directory in $TMPDIR (wrong permissions?)"
+ exit 28
+ fi
+ chmod 700 "$GPGHOMEDIR"
+}
+
+prepare_gpg_home() {
+ # crude detection if we are called from a maintainerscript where the
+ # package depends on gnupg or not. We accept recommends here as
+ # well as the script hopefully uses apt-key optionally then like e.g.
+ # debian-archive-keyring for (upgrade) cleanup did
+ if [ -n "$DPKG_MAINTSCRIPT_PACKAGE" ] && [ -z "$APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE" ]; then
+ if ! dpkg-query --show --showformat '${Pre-Depends}${Depends}${Recommends}\n' "$DPKG_MAINTSCRIPT_PACKAGE" 2>/dev/null | grep -q gnupg; then
+ cat >&2 <<EOF
+Warning: The $DPKG_MAINTSCRIPT_NAME maintainerscript of the package $DPKG_MAINTSCRIPT_PACKAGE
+Warning: seems to use apt-key (provided by apt) without depending on gnupg or gnupg2.
+Warning: This will BREAK in the future and should be fixed by the package maintainer(s).
+Note: Check first if apt-key functionality is needed at all - it probably isn't!
+EOF
+ fi
+ fi
+ eval "$(apt-config shell GPG_EXE Apt::Key::gpgcommand)"
+ if [ -n "$GPG_EXE" ] && command_available "$GPG_EXE"; then
+ true
+ elif command_available 'gpg'; then
+ GPG_EXE="gpg"
+ elif command_available 'gpg2'; then
+ GPG_EXE="gpg2"
+ elif command_available 'gpg1'; then
+ GPG_EXE="gpg1"
+ else
+ apt_error 'gnupg, gnupg2 and gnupg1 do not seem to be installed, but one of them is required for this operation'
+ exit 255
+ fi
+
+ create_gpg_home
+
+ # create the trustdb with an (empty) dummy keyring
+ # older gpgs required it, newer gpgs even warn that it isn't needed,
+ # but require it nonetheless for some commands, so we just play safe
+ # here for the foreseeable future and create a dummy one
+ touch "${GPGHOMEDIR}/empty.gpg"
+ if ! "$GPG_EXE" --ignore-time-conflict --no-options --no-default-keyring \
+ --homedir "$GPGHOMEDIR" --quiet --check-trustdb --keyring "${GPGHOMEDIR}/empty.gpg" >"${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
+ cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
+ false
+ fi
+
+ # now tell gpg that it shouldn't try to maintain this trustdb file
+ echo "#!/bin/sh
+exec '$(escape_shell "${GPG_EXE}")' --ignore-time-conflict --no-options --no-default-keyring \\
+--homedir '$(escape_shell "${GPGHOMEDIR}")' --no-auto-check-trustdb --trust-model always \"\$@\"" > "${GPGHOMEDIR}/gpg.0.sh"
+ GPG_SH="${GPGHOMEDIR}/gpg.0.sh"
+ GPG="$GPG_SH"
+
+ # We don't usually need a secret keyring, of course, but
+ # for advanced operations, we might really need a secret keyring after all
+ if [ -n "$FORCED_SECRET_KEYRING" ] && [ -r "$FORCED_SECRET_KEYRING" ]; then
+ if ! aptkey_execute "$GPG" -v --batch --import "$FORCED_SECRET_KEYRING" >"${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
+ cat >&2 "${GPGHOMEDIR}/gpgoutput.log"
+ false
+ fi
+ else
+ # and then, there are older versions of gpg which panic and implode
+ # if there isn't one available - and writeable for imports
+ # and even if not output is littered with the creation of a secring,
+ # so lets call import once to have it create what it wants in silence
+ echo -n | aptkey_execute "$GPG" --batch --import >/dev/null 2>&1 || true
+ fi
+}
+
+warn_on_script_usage() {
+ if [ -n "$APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE" ]; then
+ return
+ fi
+ # (Maintainer) scripts should not be using apt-key
+ if [ -n "$DPKG_MAINTSCRIPT_PACKAGE" ]; then
+ echo >&2 "Warning: apt-key should not be used in scripts (called from $DPKG_MAINTSCRIPT_NAME maintainerscript of the package ${DPKG_MAINTSCRIPT_PACKAGE})"
+ elif [ ! -t 1 ]; then
+ echo >&2 "Warning: apt-key output should not be parsed (stdout is not a terminal)"
+ fi
+}
+
+if [ "$command" != 'help' ] && [ "$command" != 'verify' ]; then
+ prepare_gpg_home
projects / apt.git / blobdiff