pacman-key: rework importing distro/repo provided keyrings

The current --reload option, apart from being non-clear in its naming,
is very limited in that only one keyring can be provided.  A distribution
may want to provide multiple keyrings for various subsets of its
organisation or custom repo providers may also want to provide a keyring.

This patch adds a --populate option that reads keyrings from (by default)
/usr/share/pacman/keyrings.  A keyring is named foo.gpg, with optional
foo-revoked file providing a list of revoked key ids.  These files are
required to be signed (detached) by a key trusted by pacman-key, in
practice probably by the key that signed the package providing these
files. The --populate flag either updates the pacman keyring using all
keyrings in the directory or individual keyrings can be specified.

Signed-off-by: Allan McRae <allan@archlinux.org>

3 files changed, 83 insertions, 76 deletions

diff --git a/doc/pacman-key.8.txt b/doc/pacman-key.8.txt
index 9dc175cf..f61c2eca 100644
--- a/doc/pacman-key.8.txt
+++ b/doc/pacman-key.8.txt
@@ -80,8 +80,12 @@ Options
 *-r, \--receive* <keyserver> <keyid(s)>::
 	Fetch the specified keyids from the specified key server URL.
 
-*\--reload*::
-	Reloads the keys from the keyring package.
+*\--populate* [<keyring(s)>]::
+	Reload the default keys from the (optionally provided) keyrings in
+	+{pkgdatadir}/keyrings+. Each keyring is provided in a file foo.gpg that
+	contains the keys for the foo keyring. Optionally the file foo-revoked
+	contains a list of revoked key IDs for that keyring. These files are
+	required to be signed (detached) by a trusted PGP key.
 
 *-u, \--updatedb*::
 	Equivalent to \--check-trustdb in GnuPG.
diff --git a/scripts/Makefile.am b/scripts/Makefile.am
index 802b8f4e..52a784ab 100644
--- a/scripts/Makefile.am
+++ b/scripts/Makefile.am
@@ -44,6 +44,7 @@ edit = sed \
 	-e 's|@localedir[@]|$(localedir)|g' \
 	-e 's|@sysconfdir[@]|$(sysconfdir)|g' \
 	-e 's|@localstatedir[@]|$(localstatedir)|g' \
+	-e 's|@pkgdatadir[@]|$(pkgdatadir)|g' \
 	-e 's|@prefix[@]|$(prefix)|g' \
 	-e '1s|!/bin/bash|!$(BASH_SHELL)|g' \
 	-e 's|@PACKAGE_VERSION[@]|$(REAL_PACKAGE_VERSION)|g' \
diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in
index 74ecfcf1..85801006 100644
--- a/scripts/pacman-key.sh.in
+++ b/scripts/pacman-key.sh.in
@@ -37,8 +37,8 @@ IMPORT_TRUSTDB=0
 INIT=0
 LISTKEYS=0
 LISTSIGS=0
+POPULATE=0
 RECEIVE=0
-RELOAD=0
 UPDATEDB=0
 VERIFY=0
 
@@ -73,7 +73,8 @@ usage() {
 	echo "$(gettext "  --import-trustdb <dir(s)> Imports ownertrust values from trustdb.gpg in dir(s)")"
 	echo "$(gettext "  --init                    Ensure the keyring is properly initialized")"
 	echo "$(gettext "  --list-sigs [<keyid(s)>]  List keys and their signatures")"
-	echo "$(gettext "  --reload                  Reload the default keys")"
+	printf "$(gettext "  --populate [<keyring(s)]  Reload the default keys from the (given) keyrings\n\
+                            in '%s'")\n" "@pkgdatadir@/keyrings"
 }
 
 version() {
@@ -139,75 +140,88 @@ check_keyring() {
 
 verify_keyring_input() {
 	local ret=0;
+	local KEYRING_IMPORT_DIR='@pkgdatadir@/keyrings'
 
-	# Verify signatures of related files, if they exist
-	if [[ -r "${ADDED_KEYS}" ]]; then
-		msg "$(gettext "Verifying official keys file signature...")"
-		if ! "${GPG_PACMAN[@]}" --verify "${ADDED_KEYS}.sig" &>/dev/null; then
+	# Verify signatures of keyring files and association revocation files if they exist
+	msg "$(gettext "Verifying keyring file signatures...")"
+	local keyring
+	for keyring in ${KEYRINGIDS[@]}; do
+		if ! "${GPG_PACMAN[@]}" --verify "${KEYRING_IMPORT_DIR}/${keyring}.gpg.sig" &>/dev/null; then
 			error "$(gettext "The signature of file %s is not valid.")" "${ADDED_KEYS}"
 			ret=1
 		fi
-	fi
 
-	if [[ -r "${DEPRECATED_KEYS}" ]]; then
-		msg "$(gettext "Verifying deprecated keys file signature...")"
-		if ! "${GPG_PACMAN[@]}" --verify "${DEPRECATED_KEYS}.sig" &>/dev/null; then
-			error "$(gettext "The signature of file %s is not valid.")" "${DEPRECATED_KEYS}"
-			ret=1
+		if [[ -f "${KEYRING_IMPORT_DIR}/${keyring}-revoked" ]]; then
+			if ! "${GPG_PACMAN[@]}" --verify "${KEYRING_IMPORT_DIR}/${keyring}-revoked.sig" &>/dev/null; then
+				error "$(gettext "The signature of file %s is not valid.")" "${KEYRING_IMPORT_DIR}/${keyring}-revoked"
+				ret=1
+			fi
 		fi
-	fi
+	done
 
-	if [[ -r "${REMOVED_KEYS}" ]]; then
-		msg "$(gettext "Verifying deleted keys file signature...")"
-		if ! "${GPG_PACMAN[@]}" --verify "${REMOVED_KEYS}.sig" &>/dev/null; then
-			error "$(gettext "The signature of file %s is not valid.")" "${REMOVED_KEYS}"
+	return $ret
+}
+
+populate_keyring() {
+	local KEYRING_IMPORT_DIR='@pkgdatadir@/keyrings'
+	local GPG_NOKEYRING=(gpg --batch --quiet --ignore-time-conflict --no-options --no-default-keyring --homedir ${PACMAN_KEYRING_DIR} --no-permission-warning)
+
+	local keyring
+	local ret=0
+	if [[ -z ${KEYRINGIDS[@]} ]]; then
+		# get list of all available keyrings
+		shopt -s nullglob
+		KEYRINGIDS=("$KEYRING_IMPORT_DIR"/*.gpg)
+		shopt -u nullglob
+		KEYRINGIDS=("${KEYRINGIDS[@]##*/}")
+		KEYRINGIDS=("${KEYRINGIDS[@]%.gpg}")
+		if [[ -z ${KEYRINGIDS[@]} ]]; then
+			error "$(gettext "No keyring files exist in %s.")" "$KEYRING_IMPORT_DIR"
 			ret=1
 		fi
+	else
+		# verify listed keyrings exist
+		for keyring in ${KEYRINGIDS[@]}; do
+			if [[ ! -f "$KEYRING_IMPORT_DIR/$keyring.gpg" ]]; then
+				error "$(gettext "The keyring file %s does not exist.")" "$KEYRING_IMPORT_DIR/$keyring.gpg"
+				ret=1
+			fi
+		done
 	fi
 
-	return $ret
-}
+	if (( ret )); then
+		exit 1
+	fi
 
-reload_keyring() {
-	local PACMAN_SHARE_DIR='@prefix@/share/pacman'
-	local GPG_NOKEYRING=(gpg --batch --quiet --ignore-time-conflict --no-options --no-default-keyring --homedir ${PACMAN_KEYRING_DIR})
+	verify_keyring_input || exit 1
 
 	# Variable used for iterating on keyrings
 	local key
 	local key_id
 
-	# Keyring with keys to be added to the keyring
-	local ADDED_KEYS="${PACMAN_SHARE_DIR}/addedkeys.gpg"
-
-	# Keyring with keys that were deprecated and will eventually be deleted
-	local DEPRECATED_KEYS="${PACMAN_SHARE_DIR}/deprecatedkeys.gpg"
-
-	# List of keys removed from the keyring. This file is not a keyring, unlike the others.
-	# It is a textual list of values that gpg recogniezes as identifiers for keys.
-	local REMOVED_KEYS="${PACMAN_SHARE_DIR}/removedkeys"
-
-	verify_keyring_input || exit 1
-
 	# Read the key ids to an array. The conversion from whatever is inside the file
 	# to key ids is important, because key ids are the only guarantee of identification
 	# for the keys.
 	local -A removed_ids
-	if [[ -r "${REMOVED_KEYS}" ]]; then
-		while read key; do
-			local key_values name
-			key_values="$("${GPG_PACMAN[@]}" --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5,10 --output-delimiter=' ')"
-			if [[ -n $key_values ]]; then
-				# The first word is the key_id
-				key_id="${key_values%% *}"
-				# the rest if the name of the owner
-				name="${key_values#* }"
-				if [[ -n ${key_id} ]]; then
-					# Mark this key to be deleted
-					removed_ids[$key_id]="$name"
+	for keyring in ${KEYRINGIDS[@]}; do
+		if [[ -f "${KEYRING_IMPORT_DIR}/${keyring}-revoked" ]]; then
+			while read key; do
+				local key_values name
+				# extract key ID (field 5) and the name of owner (field 10)
+				key_values="$("${GPG_PACMAN[@]}" --quiet --with-colons --list-key "${key}" 2>/dev/null | grep ^pub | cut -d: -f5,10 --output-delimiter=' ')"
+				if [[ -n $key_values ]]; then
+					# The first word is the key_id
+					key_id="${key_values%% *}"
+					# the rest is the name of the owner
+					name="${key_values#* }"
+					if [[ -n ${key_id} ]]; then
+						# Mark this key to be deleted
+						removed_ids[$key_id]="$name"
+					fi
 				fi
-			fi
-		done < "${REMOVED_KEYS}"
-	fi
+			done < "${KEYRING_IMPORT_DIR}/${keyring}-revoked"
+		fi
+	done
 
 	# List of keys that must be kept installed, even if in the list of keys to be removed
 	local HOLD_KEYS="$(get_from "$CONFIG" "HoldKeys")"
@@ -222,33 +236,21 @@ reload_keyring() {
 		done
 	fi
 
-	# Add keys from the current set of keys from pacman-keyring package. The web of trust will
-	# be updated automatically.
-	if [[ -r "${ADDED_KEYS}" ]]; then
-		msg "$(gettext "Appending official keys...")"
-		local add_keys="$("${GPG_NOKEYRING[@]}" --keyring "${ADDED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5)"
-		for key_id in ${add_keys}; do
-			# There is no point in adding a key that will be deleted right after
-			if [[ -z "${removed_ids[$key_id]}" ]]; then
-				"${GPG_NOKEYRING[@]}" --keyring "${ADDED_KEYS}" --export "${key_id}" | "${GPG_PACMAN[@]}" --import
-			fi
-		done
-	fi
-
-	if [[ -r "${DEPRECATED_KEYS}" ]]; then
-		msg "$(gettext "Appending deprecated keys...")"
-		local add_keys="$("${GPG_NOKEYRING[@]}" --keyring "${DEPRECATED_KEYS}" --with-colons --list-keys | grep ^pub | cut -d: -f5)"
+	# Add keys from requested keyrings
+	for keyring in ${KEYRINGIDS[@]}; do
+		msg "$(gettext "Appending keys from %s.gpg...")" "$keyring"
+		local add_keys="$("${GPG_NOKEYRING[@]}" --keyring "${KEYRING_IMPORT_DIR}/${keyring}.gpg" --with-colons --list-keys | grep ^pub | cut -d: -f5)"
 		for key_id in ${add_keys}; do
 			# There is no point in adding a key that will be deleted right after
 			if [[ -z "${removed_ids[$key_id]}" ]]; then
-				"${GPG_NOKEYRING[@]}" --keyring "${DEPRECATED_KEYS}" --export "${key_id}" | "${GPG_PACMAN[@]}" --import
+				"${GPG_NOKEYRING[@]}" --keyring "${KEYRING_IMPORT_DIR}/${keyring}.gpg" --export "${key_id}" | "${GPG_PACMAN[@]}" --import
 			fi
 		done
-	fi
+	done
 
 	# Remove the keys not marked to keep
 	if (( ${#removed_ids[@]} > 0 )); then
-		msg "$(gettext "Removing deleted keys from keyring...")"
+		msg "$(gettext "Removing revoked keys from keyring...")"
 		for key_id in "${!removed_ids[@]}"; do
 			echo "  removing key $key_id - ${removed_ids[$key_id]}"
 			"${GPG_PACMAN[@]}" --quiet --batch --yes --delete-key "${key_id}"
@@ -321,8 +323,8 @@ fi
 
 OPT_SHORT="a::d:e:f::hl::r:uv:V"
 OPT_LONG="add::,config:,delete:,edit-key:,export::,finger::,gpgdir:"
-OPT_LONG+=",help,import:,import-trustdb:,init,list-keys::,list-sigs::,,receive:"
-OPT_LONG+=",reload,updatedb,verify:,version"
+OPT_LONG+=",help,import:,import-trustdb:,init,list-keys::,list-sigs::"
+OPT_LONG+=",populate::,receive:,updatedb,verify:,version"
 if ! OPT_TEMP="$(parse_options $OPT_SHORT $OPT_LONG "$@")"; then
 	echo; usage; exit 1 # E_INVALID_OPTION;
 fi
@@ -348,8 +350,8 @@ while true; do
 		--init)           INIT=1 ;;
 		-l|--list-keys)   LISTKEYS=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
 		--list-sigs)      LISTSIGS=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
+		--populate)       POPULATE=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYRINGIDS=($1) ;;
 		-r|--receive)     RECEIVE=1; shift; TMP=($1); KEYSERVER=${TMP[0]}; KEYIDS=(${TMP[@]:1}); unset TMP;;
-		--reload)         RELOAD=1 ;;
 		-u|--updatedb)    UPDATEDB=1 ;;
 		-v|--verify)      VERIFY=1; shift; SIGNATURE=$1 ;;
 
@@ -368,7 +370,7 @@ if ! type -p gpg >/dev/null; then
 	exit 1
 fi
 
-if (( (ADD || DELETE || EDITKEY || IMPORT || IMPORT_TRUSTDB || INIT || RECEIVE || RELOAD || UPDATEDB) && EUID != 0 )); then
+if (( (ADD || DELETE || EDITKEY || IMPORT || IMPORT_TRUSTDB || INIT || POPULATE || RECEIVE || UPDATEDB) && EUID != 0 )); then
 	error "$(gettext "%s needs to be run as root for this operation.")" "pacman-key"
 	exit 1
 fi
@@ -387,7 +389,7 @@ GPG_PACMAN=(gpg --homedir ${PACMAN_KEYRING_DIR} --no-permission-warning)
 
 # check only a single operation has been given
 numopt=$(( ADD + DELETE + EDITKEY + EXPORT + FINGER + IMPORT + IMPORT_TRUSTDB +
-		INIT + LISTKEYS + LISTSIGS + RECEIVE + RELOAD + UPDATEDB + VERIFY ))
+		INIT + LISTKEYS + LISTSIGS + POPULATE + RECEIVE + UPDATEDB + VERIFY ))
 
 case $numopt in
 	0)
@@ -413,8 +415,8 @@ esac
 (( INIT )) && initialize
 (( LISTKEYS )) && "${GPG_PACMAN[@]}" --batch --list-keys "${KEYIDS[@]}"
 (( LISTSIGS )) && "${GPG_PACMAN[@]}" --batch --list-sigs "${KEYIDS[@]}"
+(( POPULATE )) && populate_keyring
 (( RECEIVE )) && receive_keys
-(( RELOAD )) && reload_keyring
 (( UPDATEDB )) && "${GPG_PACMAN[@]}" --batch --check-trustdb
 (( VERIFY )) && "${GPG_PACMAN[@]}" --verify $SIGNATURE