X-Git-Url: https://git.saurik.com/apt.git/blobdiff_plain/1f31762e69fd52fc67306d4b8af98c4e4519e2e4..a86f851619f720b8c4a74d01274c5e2bf012d451:/cmdline/apt-key?ds=sidebyside diff --git a/cmdline/apt-key b/cmdline/apt-key index e0c4b5e48..2c087acbc 100755 --- a/cmdline/apt-key +++ b/cmdline/apt-key @@ -1,18 +1,46 @@ #!/bin/sh set -e +unset GREP_OPTIONS # We don't use a secret keyring, of course, but gpg panics and # implodes if there isn't one available +SECRETKEYRING="$(mktemp)" +trap "rm -f '${SECRETKEYRING}'" 0 HUP INT QUIT ILL ABRT FPE SEGV PIPE TERM +GPG_CMD="gpg --ignore-time-conflict --no-options --no-default-keyring --secret-keyring ${SECRETKEYRING}" -GPG_CMD="gpg --ignore-time-conflict --no-options --no-default-keyring --secret-keyring /etc/apt/secring.gpg --trustdb-name /etc/apt/trustdb.gpg" -GPG="$GPG_CMD --keyring /etc/apt/trusted.gpg" +if [ "$(id -u)" -eq 0 ]; then + # we could use a tmpfile here too, but creation of this tends to be time-consuming + eval $(apt-config shell TRUSTDBDIR Dir::Etc/d) + GPG_CMD="$GPG_CMD --trustdb-name ${TRUSTDBDIR}/trustdb.gpg" +fi + +GPG="$GPG_CMD" + +MASTER_KEYRING="" +ARCHIVE_KEYRING_URI="" +#MASTER_KEYRING=/usr/share/keyrings/debian-master-keyring.gpg +#ARCHIVE_KEYRING_URI=http://ftp.debian.org/debian/debian-archive-keyring.gpg +ARCHIVE_KEYRING=/usr/share/keyrings/debian-archive-keyring.gpg +REMOVED_KEYS=/usr/share/keyrings/debian-archive-removed-keys.gpg + +requires_root() { + if [ "$(id -u)" -ne 0 ]; then + echo >&1 "ERROR: This command can only be used by root." + exit 1 + fi +} -MASTER_KEYRING=/usr/share/keyrings/ubuntu-master-keyring.gpg -ARCHIVE_KEYRING=/usr/share/keyrings/ubuntu-archive-keyring.gpg -REMOVED_KEYS=/usr/share/keyrings/ubuntu-archive-removed-keys.gpg -ARCHIVE_KEYRING_URI=http://archive.ubuntu.com/ubuntu/ubuntu-archive-keyring.gpg +# gpg defaults to mode 0600 for new keyrings. Create one with 0644 instead. +init_keyring() { + for path; do + if ! [ -e "$path" ]; then + touch -- "$path" + chmod 0644 -- "$path" + fi + done +} add_keys_with_verify_against_master_keyring() { ADD_KEYRING=$1 @@ -29,9 +57,8 @@ add_keys_with_verify_against_master_keyring() { # when adding new keys, make sure that the archive-master-keyring # is honored. so: - # all keys that are exported and have the name - # "Ubuntu Archive Automatic Signing Key" must have a valid signature - # from a key in the ubuntu-master-keyring + # all keys that are exported must have a valid signature + # from a key in the $distro-master-keyring add_keys=`$GPG_CMD --keyring $ADD_KEYRING --with-colons --list-keys | grep ^pub | cut -d: -f5` master_keys=`$GPG_CMD --keyring $MASTER --with-colons --list-keys | grep ^pub | cut -d: -f5` for add_key in $add_keys; do @@ -53,7 +80,15 @@ add_keys_with_verify_against_master_keyring() { # (otherwise it does not make sense from a security POV) net_update() { if [ -z "$ARCHIVE_KEYRING_URI" ]; then - echo "ERROR: no location for the archive-keyring given" + echo >&2 "ERROR: Your distribution is not supported in net-update as no uri for the archive-keyring is set" + exit 1 + fi + requires_root + # in theory we would need to depend on wget for this, but this feature + # isn't useable in debian anyway as we have no keyring uri nor a master key + if ! which wget >/dev/null 2>&1; then + echo >&2 "ERROR: an installed wget is required for a network-based update" + exit 1 fi if [ ! -d /var/lib/apt/keyrings ]; then mkdir -p /var/lib/apt/keyrings @@ -69,6 +104,7 @@ net_update() { fi new_mtime=$(stat -c %Y $keyring) if [ $new_mtime -ne $old_mtime ]; then + echo "Checking for new archive signing keys now" add_keys_with_verify_against_master_keyring $keyring $MASTER_KEYRING fi } @@ -76,30 +112,36 @@ net_update() { update() { if [ ! -f $ARCHIVE_KEYRING ]; then echo >&2 "ERROR: Can't find the archive-keyring" - echo >&2 "Is the ubuntu-keyring package installed?" + echo >&2 "Is the debian-archive-keyring package installed?" exit 1 fi + requires_root + + # add new keys from the package; - # add new keys, if no MASTER_KEYRING is used, use the traditional - # way - if [ -z "$MASTER_KEYRING" ]; then - $GPG_CMD --quiet --batch --keyring $ARCHIVE_KEYRING --export | $GPG --import + # we do not use add_keys_with_verify_against_master_keyring here, + # because "update" is run on regular package updates. A + # attacker might as well replace the master-archive-keyring file + # in the package and add his own keys. so this check wouldn't + # add any security. we *need* this check on net-update though + $GPG_CMD --quiet --batch --keyring $ARCHIVE_KEYRING --export | $GPG --import + + if [ -r "$REMOVED_KEYS" ]; then + # remove no-longer supported/used keys + keys=`$GPG_CMD --keyring $REMOVED_KEYS --with-colons --list-keys | grep ^pub | cut -d: -f5` + for key in $keys; do + if $GPG --list-keys --with-colons | grep ^pub | cut -d: -f5 | grep -q $key; then + $GPG --quiet --batch --delete-key --yes ${key} + fi + done else - add_keys_with_verify_against_master_keyring $ARCHIVE_KEYRING $MASTER_KEYRING + echo "Warning: removed keys keyring $REMOVED_KEYS missing or not readable" >&2 fi - - # remove no-longer supported/used keys - keys=`$GPG_CMD --keyring $REMOVED_KEYS --with-colons --list-keys | grep ^pub | cut -d: -f5` - for key in $keys; do - if $GPG --list-keys --with-colons | grep ^pub | cut -d: -f5 | grep -q $key; then - $GPG --quiet --batch --delete-key --yes ${key} - fi - done } usage() { - echo "Usage: apt-key [command] [arguments]" + echo "Usage: apt-key [--keyring file] [command] [arguments]" echo echo "Manage apt's list of trusted keys" echo @@ -110,9 +152,46 @@ usage() { echo " apt-key update - update keys using the keyring package" echo " apt-key net-update - update keys using the network" echo " apt-key list - list keys" + echo " apt-key finger - list fingerprints" + echo " apt-key adv - pass advanced options to gpg (download key)" echo + echo "If no specific keyring file is given the command applies to all keyring files." } +# Determine on which keyring we want to work +if [ "$1" = "--keyring" ]; then + #echo "keyfile given" + shift + TRUSTEDFILE="$1" + if [ -r "$TRUSTEDFILE" ] || [ "$2" = 'add' ] || [ "$2" = 'adv' ]; then + GPG="$GPG --keyring $TRUSTEDFILE --primary-keyring $TRUSTEDFILE" + else + echo >&2 "Error: The specified keyring »$TRUSTEDFILE« is missing or not readable" + exit 1 + fi + shift +# otherwise use the default +else + #echo "generate list" + TRUSTEDFILE="/etc/apt/trusted.gpg" + eval $(apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring) + eval $(apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f) + if [ -r "$TRUSTEDFILE" ]; then + GPG="$GPG --keyring $TRUSTEDFILE" + fi + GPG="$GPG --primary-keyring $TRUSTEDFILE" + TRUSTEDPARTS="/etc/apt/trusted.gpg.d" + eval $(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d) + if [ -d "$TRUSTEDPARTS" ]; then + #echo "parts active" + for trusted in $(run-parts --list $TRUSTEDPARTS --regex '^.*\.gpg$'); do + #echo "part -> $trusted" + GPG="$GPG --keyring $trusted" + done + fi +fi +#echo "COMMAND: $GPG" + command="$1" if [ -z "$command" ]; then usage @@ -128,32 +207,43 @@ fi case "$command" in add) + requires_root + init_keyring "$TRUSTEDFILE" $GPG --quiet --batch --import "$1" echo "OK" ;; del|rm|remove) + requires_root + init_keyring "$TRUSTEDFILE" $GPG --quiet --batch --delete-key --yes "$1" echo "OK" ;; update) + init_keyring "$TRUSTEDFILE" update ;; net-update) + init_keyring "$TRUSTEDFILE" net_update ;; list) + init_keyring "$TRUSTEDFILE" $GPG --batch --list-keys ;; finger*) + init_keyring "$TRUSTEDFILE" $GPG --batch --fingerprint ;; export) + init_keyring "$TRUSTEDFILE" $GPG --armor --export "$1" ;; exportall) + init_keyring "$TRUSTEDFILE" $GPG --armor --export ;; adv*) + init_keyring "$TRUSTEDFILE" echo "Executing: $GPG $*" $GPG $* ;;