X-Git-Url: https://git.saurik.com/apt.git/blobdiff_plain/c9bb37c725104e6108636d2e5d5b2a72dfe74998..a86f851619f720b8c4a74d01274c5e2bf012d451:/cmdline/apt-key diff --git a/cmdline/apt-key b/cmdline/apt-key index c1dbb0d05..2c087acbc 100755 --- a/cmdline/apt-key +++ b/cmdline/apt-key @@ -1,19 +1,47 @@ #!/bin/sh set -e +unset GREP_OPTIONS # We don't use a secret keyring, of course, but gpg panics and # implodes if there isn't one available +SECRETKEYRING="$(mktemp)" +trap "rm -f '${SECRETKEYRING}'" 0 HUP INT QUIT ILL ABRT FPE SEGV PIPE TERM +GPG_CMD="gpg --ignore-time-conflict --no-options --no-default-keyring --secret-keyring ${SECRETKEYRING}" -GPG_CMD="gpg --ignore-time-conflict --no-options --no-default-keyring --secret-keyring /etc/apt/secring.gpg --trustdb-name /etc/apt/trustdb.gpg" -GPG="$GPG_CMD --keyring /etc/apt/trusted.gpg" +if [ "$(id -u)" -eq 0 ]; then + # we could use a tmpfile here too, but creation of this tends to be time-consuming + eval $(apt-config shell TRUSTDBDIR Dir::Etc/d) + GPG_CMD="$GPG_CMD --trustdb-name ${TRUSTDBDIR}/trustdb.gpg" +fi +GPG="$GPG_CMD" MASTER_KEYRING="" +ARCHIVE_KEYRING_URI="" #MASTER_KEYRING=/usr/share/keyrings/debian-master-keyring.gpg +#ARCHIVE_KEYRING_URI=http://ftp.debian.org/debian/debian-archive-keyring.gpg + ARCHIVE_KEYRING=/usr/share/keyrings/debian-archive-keyring.gpg REMOVED_KEYS=/usr/share/keyrings/debian-archive-removed-keys.gpg +requires_root() { + if [ "$(id -u)" -ne 0 ]; then + echo >&1 "ERROR: This command can only be used by root." + exit 1 + fi +} + +# gpg defaults to mode 0600 for new keyrings. Create one with 0644 instead. +init_keyring() { + for path; do + if ! [ -e "$path" ]; then + touch -- "$path" + chmod 0644 -- "$path" + fi + done +} + add_keys_with_verify_against_master_keyring() { ADD_KEYRING=$1 MASTER=$2 @@ -29,16 +57,15 @@ add_keys_with_verify_against_master_keyring() { # when adding new keys, make sure that the archive-master-keyring # is honored. so: - # all keys that are exported and have the name - # "Ubuntu Archive Automatic Signing Key" must have a valid signature - # from a key in the ubuntu-master-keyring + # all keys that are exported must have a valid signature + # from a key in the $distro-master-keyring add_keys=`$GPG_CMD --keyring $ADD_KEYRING --with-colons --list-keys | grep ^pub | cut -d: -f5` master_keys=`$GPG_CMD --keyring $MASTER --with-colons --list-keys | grep ^pub | cut -d: -f5` for add_key in $add_keys; do ADDED=0 for master_key in $master_keys; do if $GPG_CMD --keyring $ADD_KEYRING --list-sigs --with-colons $add_key | grep ^sig | cut -d: -f5 | grep -q $master_key; then - $GPG_CMD --quiet --batch --keyring $ARCHIVE_KEYRING --export $add_key | $GPG --import + $GPG_CMD --quiet --batch --keyring $ADD_KEYRING --export $add_key | $GPG --import ADDED=1 fi done @@ -48,33 +75,73 @@ add_keys_with_verify_against_master_keyring() { done } +# update the current archive signing keyring from a network URI +# the archive-keyring keys needs to be signed with the master key +# (otherwise it does not make sense from a security POV) +net_update() { + if [ -z "$ARCHIVE_KEYRING_URI" ]; then + echo >&2 "ERROR: Your distribution is not supported in net-update as no uri for the archive-keyring is set" + exit 1 + fi + requires_root + # in theory we would need to depend on wget for this, but this feature + # isn't useable in debian anyway as we have no keyring uri nor a master key + if ! which wget >/dev/null 2>&1; then + echo >&2 "ERROR: an installed wget is required for a network-based update" + exit 1 + fi + if [ ! -d /var/lib/apt/keyrings ]; then + mkdir -p /var/lib/apt/keyrings + fi + keyring=/var/lib/apt/keyrings/$(basename $ARCHIVE_KEYRING) + old_mtime=0 + if [ -e $keyring ]; then + old_mtime=$(stat -c %Y $keyring) + fi + (cd /var/lib/apt/keyrings; wget -q -N $ARCHIVE_KEYRING_URI) + if [ ! -e $keyring ]; then + return + fi + new_mtime=$(stat -c %Y $keyring) + if [ $new_mtime -ne $old_mtime ]; then + echo "Checking for new archive signing keys now" + add_keys_with_verify_against_master_keyring $keyring $MASTER_KEYRING + fi +} + update() { if [ ! -f $ARCHIVE_KEYRING ]; then echo >&2 "ERROR: Can't find the archive-keyring" echo >&2 "Is the debian-archive-keyring package installed?" exit 1 fi + requires_root + + # add new keys from the package; - # add new keys, if no MASTER_KEYRING is used, use the traditional - # way - if [ -z "$MASTER_KEYRING" ]; then - $GPG_CMD --quiet --batch --keyring $ARCHIVE_KEYRING --export | $GPG --import + # we do not use add_keys_with_verify_against_master_keyring here, + # because "update" is run on regular package updates. A + # attacker might as well replace the master-archive-keyring file + # in the package and add his own keys. so this check wouldn't + # add any security. we *need* this check on net-update though + $GPG_CMD --quiet --batch --keyring $ARCHIVE_KEYRING --export | $GPG --import + + if [ -r "$REMOVED_KEYS" ]; then + # remove no-longer supported/used keys + keys=`$GPG_CMD --keyring $REMOVED_KEYS --with-colons --list-keys | grep ^pub | cut -d: -f5` + for key in $keys; do + if $GPG --list-keys --with-colons | grep ^pub | cut -d: -f5 | grep -q $key; then + $GPG --quiet --batch --delete-key --yes ${key} + fi + done else - add_keys_with_verify_against_master_keyring $ARCHIVE_KEYRING $MASTER_KEYRING + echo "Warning: removed keys keyring $REMOVED_KEYS missing or not readable" >&2 fi - - # remove no-longer supported/used keys - keys=`$GPG_CMD --keyring $REMOVED_KEYS --with-colons --list-keys | grep ^pub | cut -d: -f5` - for key in $keys; do - if $GPG --list-keys --with-colons | grep ^pub | cut -d: -f5 | grep -q $key; then - $GPG --quiet --batch --delete-key --yes ${key} - fi - done } usage() { - echo "Usage: apt-key [command] [arguments]" + echo "Usage: apt-key [--keyring file] [command] [arguments]" echo echo "Manage apt's list of trusted keys" echo @@ -83,10 +150,48 @@ usage() { echo " apt-key export - output the key " echo " apt-key exportall - output all trusted keys" echo " apt-key update - update keys using the keyring package" + echo " apt-key net-update - update keys using the network" echo " apt-key list - list keys" + echo " apt-key finger - list fingerprints" + echo " apt-key adv - pass advanced options to gpg (download key)" echo + echo "If no specific keyring file is given the command applies to all keyring files." } +# Determine on which keyring we want to work +if [ "$1" = "--keyring" ]; then + #echo "keyfile given" + shift + TRUSTEDFILE="$1" + if [ -r "$TRUSTEDFILE" ] || [ "$2" = 'add' ] || [ "$2" = 'adv' ]; then + GPG="$GPG --keyring $TRUSTEDFILE --primary-keyring $TRUSTEDFILE" + else + echo >&2 "Error: The specified keyring »$TRUSTEDFILE« is missing or not readable" + exit 1 + fi + shift +# otherwise use the default +else + #echo "generate list" + TRUSTEDFILE="/etc/apt/trusted.gpg" + eval $(apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring) + eval $(apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f) + if [ -r "$TRUSTEDFILE" ]; then + GPG="$GPG --keyring $TRUSTEDFILE" + fi + GPG="$GPG --primary-keyring $TRUSTEDFILE" + TRUSTEDPARTS="/etc/apt/trusted.gpg.d" + eval $(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d) + if [ -d "$TRUSTEDPARTS" ]; then + #echo "parts active" + for trusted in $(run-parts --list $TRUSTEDPARTS --regex '^.*\.gpg$'); do + #echo "part -> $trusted" + GPG="$GPG --keyring $trusted" + done + fi +fi +#echo "COMMAND: $GPG" + command="$1" if [ -z "$command" ]; then usage @@ -102,29 +207,43 @@ fi case "$command" in add) + requires_root + init_keyring "$TRUSTEDFILE" $GPG --quiet --batch --import "$1" echo "OK" ;; del|rm|remove) + requires_root + init_keyring "$TRUSTEDFILE" $GPG --quiet --batch --delete-key --yes "$1" echo "OK" ;; update) + init_keyring "$TRUSTEDFILE" update ;; + net-update) + init_keyring "$TRUSTEDFILE" + net_update + ;; list) + init_keyring "$TRUSTEDFILE" $GPG --batch --list-keys ;; finger*) + init_keyring "$TRUSTEDFILE" $GPG --batch --fingerprint ;; export) + init_keyring "$TRUSTEDFILE" $GPG --armor --export "$1" ;; exportall) + init_keyring "$TRUSTEDFILE" $GPG --armor --export ;; adv*) + init_keyring "$TRUSTEDFILE" echo "Executing: $GPG $*" $GPG $* ;;