X-Git-Url: https://git.saurik.com/apt.git/blobdiff_plain/549da1a850f0fd50e0a55415452ecaa735d49451..a86f851619f720b8c4a74d01274c5e2bf012d451:/cmdline/apt-key diff --git a/cmdline/apt-key b/cmdline/apt-key index 3f886987e..2c087acbc 100755 --- a/cmdline/apt-key +++ b/cmdline/apt-key @@ -1,13 +1,21 @@ #!/bin/sh set -e +unset GREP_OPTIONS # We don't use a secret keyring, of course, but gpg panics and # implodes if there isn't one available +SECRETKEYRING="$(mktemp)" +trap "rm -f '${SECRETKEYRING}'" 0 HUP INT QUIT ILL ABRT FPE SEGV PIPE TERM +GPG_CMD="gpg --ignore-time-conflict --no-options --no-default-keyring --secret-keyring ${SECRETKEYRING}" -GPG_CMD="gpg --ignore-time-conflict --no-options --no-default-keyring --secret-keyring /etc/apt/secring.gpg --trustdb-name /etc/apt/trustdb.gpg" -GPG="$GPG_CMD --keyring /etc/apt/trusted.gpg" +if [ "$(id -u)" -eq 0 ]; then + # we could use a tmpfile here too, but creation of this tends to be time-consuming + eval $(apt-config shell TRUSTDBDIR Dir::Etc/d) + GPG_CMD="$GPG_CMD --trustdb-name ${TRUSTDBDIR}/trustdb.gpg" +fi +GPG="$GPG_CMD" MASTER_KEYRING="" ARCHIVE_KEYRING_URI="" @@ -17,6 +25,23 @@ ARCHIVE_KEYRING_URI="" ARCHIVE_KEYRING=/usr/share/keyrings/debian-archive-keyring.gpg REMOVED_KEYS=/usr/share/keyrings/debian-archive-removed-keys.gpg +requires_root() { + if [ "$(id -u)" -ne 0 ]; then + echo >&1 "ERROR: This command can only be used by root." + exit 1 + fi +} + +# gpg defaults to mode 0600 for new keyrings. Create one with 0644 instead. +init_keyring() { + for path; do + if ! [ -e "$path" ]; then + touch -- "$path" + chmod 0644 -- "$path" + fi + done +} + add_keys_with_verify_against_master_keyring() { ADD_KEYRING=$1 MASTER=$2 @@ -55,7 +80,15 @@ add_keys_with_verify_against_master_keyring() { # (otherwise it does not make sense from a security POV) net_update() { if [ -z "$ARCHIVE_KEYRING_URI" ]; then - echo "ERROR: no location for the archive-keyring given" + echo >&2 "ERROR: Your distribution is not supported in net-update as no uri for the archive-keyring is set" + exit 1 + fi + requires_root + # in theory we would need to depend on wget for this, but this feature + # isn't useable in debian anyway as we have no keyring uri nor a master key + if ! which wget >/dev/null 2>&1; then + echo >&2 "ERROR: an installed wget is required for a network-based update" + exit 1 fi if [ ! -d /var/lib/apt/keyrings ]; then mkdir -p /var/lib/apt/keyrings @@ -82,6 +115,7 @@ update() { echo >&2 "Is the debian-archive-keyring package installed?" exit 1 fi + requires_root # add new keys from the package; @@ -92,18 +126,22 @@ update() { # add any security. we *need* this check on net-update though $GPG_CMD --quiet --batch --keyring $ARCHIVE_KEYRING --export | $GPG --import - # remove no-longer supported/used keys - keys=`$GPG_CMD --keyring $REMOVED_KEYS --with-colons --list-keys | grep ^pub | cut -d: -f5` - for key in $keys; do - if $GPG --list-keys --with-colons | grep ^pub | cut -d: -f5 | grep -q $key; then - $GPG --quiet --batch --delete-key --yes ${key} - fi - done + if [ -r "$REMOVED_KEYS" ]; then + # remove no-longer supported/used keys + keys=`$GPG_CMD --keyring $REMOVED_KEYS --with-colons --list-keys | grep ^pub | cut -d: -f5` + for key in $keys; do + if $GPG --list-keys --with-colons | grep ^pub | cut -d: -f5 | grep -q $key; then + $GPG --quiet --batch --delete-key --yes ${key} + fi + done + else + echo "Warning: removed keys keyring $REMOVED_KEYS missing or not readable" >&2 + fi } usage() { - echo "Usage: apt-key [command] [arguments]" + echo "Usage: apt-key [--keyring file] [command] [arguments]" echo echo "Manage apt's list of trusted keys" echo @@ -114,9 +152,46 @@ usage() { echo " apt-key update - update keys using the keyring package" echo " apt-key net-update - update keys using the network" echo " apt-key list - list keys" + echo " apt-key finger - list fingerprints" + echo " apt-key adv - pass advanced options to gpg (download key)" echo + echo "If no specific keyring file is given the command applies to all keyring files." } +# Determine on which keyring we want to work +if [ "$1" = "--keyring" ]; then + #echo "keyfile given" + shift + TRUSTEDFILE="$1" + if [ -r "$TRUSTEDFILE" ] || [ "$2" = 'add' ] || [ "$2" = 'adv' ]; then + GPG="$GPG --keyring $TRUSTEDFILE --primary-keyring $TRUSTEDFILE" + else + echo >&2 "Error: The specified keyring »$TRUSTEDFILE« is missing or not readable" + exit 1 + fi + shift +# otherwise use the default +else + #echo "generate list" + TRUSTEDFILE="/etc/apt/trusted.gpg" + eval $(apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring) + eval $(apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f) + if [ -r "$TRUSTEDFILE" ]; then + GPG="$GPG --keyring $TRUSTEDFILE" + fi + GPG="$GPG --primary-keyring $TRUSTEDFILE" + TRUSTEDPARTS="/etc/apt/trusted.gpg.d" + eval $(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d) + if [ -d "$TRUSTEDPARTS" ]; then + #echo "parts active" + for trusted in $(run-parts --list $TRUSTEDPARTS --regex '^.*\.gpg$'); do + #echo "part -> $trusted" + GPG="$GPG --keyring $trusted" + done + fi +fi +#echo "COMMAND: $GPG" + command="$1" if [ -z "$command" ]; then usage @@ -132,32 +207,43 @@ fi case "$command" in add) + requires_root + init_keyring "$TRUSTEDFILE" $GPG --quiet --batch --import "$1" echo "OK" ;; del|rm|remove) + requires_root + init_keyring "$TRUSTEDFILE" $GPG --quiet --batch --delete-key --yes "$1" echo "OK" ;; update) + init_keyring "$TRUSTEDFILE" update ;; net-update) + init_keyring "$TRUSTEDFILE" net_update ;; list) + init_keyring "$TRUSTEDFILE" $GPG --batch --list-keys ;; finger*) + init_keyring "$TRUSTEDFILE" $GPG --batch --fingerprint ;; export) + init_keyring "$TRUSTEDFILE" $GPG --armor --export "$1" ;; exportall) + init_keyring "$TRUSTEDFILE" $GPG --armor --export ;; adv*) + init_keyring "$TRUSTEDFILE" echo "Executing: $GPG $*" $GPG $* ;;