path: root/scripts/pacman-key.sh.in

#!/bin/bash
#
#   pacman-key - manages pacman's keyring
#                Based on apt-key, from Debian
#   @configure_input@
#
#   Copyright (c) 2010-2016 Pacman Development Team <pacman-dev@archlinux.org>
#
#   This program is free software; you can redistribute it and/or modify
#   it under the terms of the GNU General Public License as published by
#   the Free Software Foundation; either version 2 of the License, or
#   (at your option) any later version.
#
#   This program is distributed in the hope that it will be useful,
#   but WITHOUT ANY WARRANTY; without even the implied warranty of
#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#   GNU General Public License for more details.
#
#   You should have received a copy of the GNU General Public License
#   along with this program.  If not, see <http://www.gnu.org/licenses/>.
#

# gettext initialization
export TEXTDOMAIN='pacman-scripts'
export TEXTDOMAINDIR='@localedir@'

declare -r myver="@PACKAGE_VERSION@"

LIBRARY=${LIBRARY:-'@libmakepkgdir@'}

# Import parseopts.sh
source "$LIBRARY"/util/parseopts.sh

# Options
ADD=0
DELETE=0
EDITKEY=0
EXPORT=0
FINGER=0
IMPORT=0
IMPORT_TRUSTDB=0
INIT=0
KEYSERVER=''
LISTKEYS=0
LISTSIGS=0
LSIGNKEY=0
POPULATE=0
RECEIVE=0
REFRESH=0
UPDATEDB=0
USE_COLOR='y'
VERIFY=0

DEFAULT_KEYSERVER='hkp://pool.sks-keyservers.net'

m4_include(library/output_format.sh)

usage() {
        printf "pacman-key (pacman) %s\n" ${myver}
        echo
        printf -- "$(gettext "Usage: %s [options] operation [targets]")\n" $(basename $0)
        echo
        printf -- "$(gettext "Manage pacman's list of trusted keys")\n"
        echo
        printf -- "$(gettext "Operations:")\n"
        printf -- "$(gettext "  -a, --add                 Add the specified keys (empty for stdin)")\n"
        printf -- "$(gettext "  -d, --delete              Remove the specified keyids")\n"
        printf -- "$(gettext "  -e, --export              Export the specified or all keyids")\n"
        printf -- "$(gettext "  -f, --finger              List fingerprint for specified or all keyids")\n"
        printf -- "$(gettext "  -l, --list-keys           List the specified or all keys")\n"
        printf -- "$(gettext "  -r, --recv-keys           Fetch the specified keyids")\n"
        printf -- "$(gettext "  -u, --updatedb            Update the trustdb of pacman")\n"
        printf -- "$(gettext "  -v, --verify              Verify the file(s) specified by the signature(s)")\n"
        printf -- "$(gettext "  --edit-key                Present a menu for key management task on keyids")\n"
        printf -- "$(gettext "  --import                  Imports pubring.gpg from dir(s)")\n"
        printf -- "$(gettext "  --import-trustdb          Imports ownertrust values from trustdb.gpg in dir(s)")\n"
        printf -- "$(gettext "  --init                    Ensure the keyring is properly initialized")\n"
        printf -- "$(gettext "  --list-sigs               List keys and their signatures")\n"
        printf -- "$(gettext "  --lsign-key               Locally sign the specified keyid")\n"
        printf -- "$(gettext "  --populate                Reload the default keys from the (given) keyrings\n\
                            in '%s'")\n" "@pkgdatadir@/keyrings"
        printf -- "$(gettext "  --refresh-keys            Update specified or all keys from a keyserver")\n"
        echo
        printf -- "$(gettext "Options:")\n"
        printf -- "$(gettext "  --config <file>           Use an alternate config file (instead of\n\
                            '%s')")\n" "@sysconfdir@/pacman.conf"
        printf -- "$(gettext "  --gpgdir <dir>            Set an alternate directory for GnuPG (instead\n\
                            of '%s')")\n" "@sysconfdir@/pacman.d/gnupg"
        printf -- "$(gettext "  --keyserver <server-url>  Specify a keyserver to use if necessary")\n"
        echo
        printf -- "$(gettext "  -h, --help                Show this help message and exit")\n"
        printf -- "$(gettext "  -V, --version             Show program version")\n"
}

version() {
        printf "pacman-key (pacman) %s\n" "${myver}"
        printf -- "$(gettext "\
Copyright (c) 2010-2016 Pacman Development Team <pacman-dev@archlinux.org>.\n\
This is free software; see the source for copying conditions.\n\
There is NO WARRANTY, to the extent permitted by law.\n")"
}

# read the config file "$1" which has key=value pairs, and return the key which
# matches "$2". the equals sign between pairs may be surrounded by any amount
# of whitespace. Optionally, "$3" can be specified which is the default value
# when no key is found.
get_from() {
        while IFS='=' read -r key value; do
                [[ -z $key || ${key:0:1} = '#' ]] && continue

                if [[ ${key%% *} = "$2" && -n ${value##* } ]]; then
                        echo "${value##* }"
                        return 0
                fi
        done < "$1"
        if [[ -n "$3" ]]; then
                printf '%s\n' "$3"
                return 0
        fi
        return 1
}

key_lookup_from_name() {
        local ids

        mapfile -t ids < \
                <("${GPG_PACMAN[@]}" --search-keys --batch --with-colons "$1" 2>/dev/null |
                        awk -F: '$1 == "pub" { print $2 }')

        # only return success on non-ambiguous lookup
        case ${#ids[*]} in
                0)
                        error "$(gettext "Failed to lookup key by name:") %s" "$name"
                        return 1
                        ;;
                1)
                        printf '%s' "${ids[0]}"
                        return 0
                        ;;
                *)
                        error "$(gettext "Key name is ambiguous:") %s" "$name"
                        return 1
                        ;;
        esac
}

generate_master_key() {
        # Generate the master key, which will be in both pubring and secring
        "${GPG_PACMAN[@]}" --gen-key --batch <<EOF
%echo Generating pacman keyring master key...
Key-Type: RSA
Key-Length: 2048
Key-Usage: sign
Name-Real: Pacman Keyring Master Key
Name-Email: pacman@localhost
Expire-Date: 0
%no-protection
%commit
%echo Done
EOF
}

secret_keys_available() {
        "${GPG_PACMAN[@]}" -K --with-colons | wc -l
}

# Adds the given gpg.conf option if it is not present in the file.
# Note that if we find it commented out, we won't add the option.
# args: $1 conffile, $2 option-name, $3 (optional) option-value
add_gpg_conf_option() {
        local conffile=$1; shift
        # looking for the option 'bare', only leading spaces or # chars allowed,
        # followed by at least one space and any other text or the end of line.
        if ! grep -q "^[[:space:]#]*$1\([[:space:]].*\)*$" "$conffile" &>/dev/null; then
                printf '%s\n' "$*" >> "$conffile"
        fi
}

check_keyids_exist() {
        local ret=0
        for key in "$@"; do
                # Verify if the key exists in pacman's keyring
                if ! "${GPG_PACMAN[@]}" --list-keys "$key" &>/dev/null ; then
                        error "$(gettext "The key identified by %s could not be found locally.")" "$key"
                        ret=1
                fi
        done
        if (( ret )); then
                exit 1
        fi
}

initialize() {
        local conffile keyserv
        # Check for simple existence rather than for a directory as someone
        # may want to use a symlink here
        [[ -e ${PACMAN_KEYRING_DIR} ]] || mkdir -p -m 755 "${PACMAN_KEYRING_DIR}"

        # keyring files
        [[ -f ${PACMAN_KEYRING_DIR}/pubring.gpg ]] || touch ${PACMAN_KEYRING_DIR}/pubring.gpg
        [[ -f ${PACMAN_KEYRING_DIR}/secring.gpg ]] || touch ${PACMAN_KEYRING_DIR}/secring.gpg
        [[ -f ${PACMAN_KEYRING_DIR}/trustdb.gpg ]] || "${GPG_PACMAN[@]}" --update-trustdb
        chmod 644 ${PACMAN_KEYRING_DIR}/{pubring,trustdb}.gpg
        chmod 600 ${PACMAN_KEYRING_DIR}/secring.gpg

        # gpg.conf
        conffile="${PACMAN_KEYRING_DIR}/gpg.conf"
        [[ -f $conffile ]] || touch "$conffile"
        chmod 644 "$conffile"
        add_gpg_conf_option "$conffile" 'no-greeting'
        add_gpg_conf_option "$conffile" 'no-permission-warning'
        add_gpg_conf_option "$conffile" 'lock-never'
        keyserv=${KEYSERVER:-$DEFAULT_KEYSERVER}
        add_gpg_conf_option "$conffile" 'keyserver' "$keyserv"
        add_gpg_conf_option "$conffile" 'keyserver-options' 'timeout=10'

        # set up a private signing key (if none available)
        if [[ $(secret_keys_available) -lt 1 ]]; then
                generate_master_key
                UPDATEDB=1
        fi
}

check_keyring() {
        if [[ ! -r ${PACMAN_KEYRING_DIR}/pubring.gpg || \
                        ! -r ${PACMAN_KEYRING_DIR}/trustdb.gpg ]]; then
                error "$(gettext "You do not have sufficient permissions to read the %s keyring.")" "pacman"
                msg "$(gettext "Use '%s' to correct the keyring permissions.")" "pacman-key --init"
                exit 1
        fi

        if (( (EXPORT || FINGER || LIST || VERIFY) && EUID != 0 )); then
                if ! grep -q "^[[:space:]]*lock-never[[:space:]]*$" ${PACMAN_KEYRING_DIR}/gpg.conf &>/dev/null; then
                        error "$(gettext "You do not have sufficient permissions to run this command.")"
                        msg "$(gettext "Use '%s' to correct the keyring permissions.")" "pacman-key --init"
                        exit 1
                fi
        fi

        if (( LSIGNKEY )); then
                if [[ $(secret_keys_available) -lt 1 ]]; then
                        error "$(gettext "There is no secret key available to sign with.")"
                        msg "$(gettext "Use '%s' to generate a default secret key.")" "pacman-key --init"
                        exit 1
                fi
        fi
}

populate_keyring() {
        local KEYRING_IMPORT_DIR='@pkgdatadir@/keyrings'

        local keyring KEYRINGIDS=("$@")
        local ret=0
        if (( ${#KEYRINGIDS[*]} == 0 )); then
                # get list of all available keyrings
                shopt -s nullglob
                KEYRINGIDS=("$KEYRING_IMPORT_DIR"/*.gpg)
                shopt -u nullglob
                KEYRINGIDS=("${KEYRINGIDS[@]##*/}")
                KEYRINGIDS=("${KEYRINGIDS[@]%.gpg}")
                if (( ${#KEYRINGIDS[*]} == 0 )); then
                        error "$(gettext "No keyring files exist in %s.")" "$KEYRING_IMPORT_DIR"
                        ret=1
                fi
        else
                # verify listed keyrings exist
                for keyring in "${KEYRINGIDS[@]}"; do
                        if [[ ! -f "$KEYRING_IMPORT_DIR/$keyring.gpg" ]]; then
                                error "$(gettext "The keyring file %s does not exist.")" "$KEYRING_IMPORT_DIR/$keyring.gpg"
                                ret=1
                        fi
                done
        fi

        if (( ret )); then
                exit 1
        fi

        # Variable used for iterating on keyrings
        local keys key_id

        # Add keys from requested keyrings
        for keyring in "${KEYRINGIDS[@]}"; do
                msg "$(gettext "Appending keys from %s.gpg...")" "$keyring"
                "${GPG_PACMAN[@]}" --quiet --import "${KEYRING_IMPORT_DIR}/${keyring}.gpg"
        done

        # Read the trusted key IDs to an array. Because this is an ownertrust
        # file, we know we have the full 40 hex digit fingerprint values.
        # Format of ownertrust dump file:
        #  40CHARFINGERPRINTXXXXXXXXXXXXXXXXXXXXXXX:6:
        #  40CHARFINGERPRINTXXXXXXXXXXXXXXXXXXXXXXX:5:
        local -A trusted_ids
        for keyring in "${KEYRINGIDS[@]}"; do
                if [[ -s "${KEYRING_IMPORT_DIR}/${keyring}-trusted" ]]; then
                        while IFS=: read key_id _; do
                                # skip blank lines, comments; these are valid in this file
                                [[ -z $key_id || ${key_id:0:1} = \# ]] && continue

                                # Mark this key to be lsigned
                                trusted_ids[$key_id]=$keyring
                        done < "${KEYRING_IMPORT_DIR}/${keyring}-trusted"
                fi
        done

        if (( ${#trusted_ids[@]} > 0 )); then
                msg "$(gettext "Locally signing trusted keys in keyring...")"
                lsign_keys "${!trusted_ids[@]}"
                msg "$(gettext "Importing owner trust values...")"
                for keyring in "${KEYRINGIDS[@]}"; do
                        if [[ -s "${KEYRING_IMPORT_DIR}/${keyring}-trusted" ]]; then
                                "${GPG_PACMAN[@]}" --import-ownertrust "${KEYRING_IMPORT_DIR}/${keyring}-trusted"
                        fi
                done
        fi

        local -A revoked_ids
        for keyring in "${KEYRINGIDS[@]}"; do
                if [[ -s $KEYRING_IMPORT_DIR/$keyring-revoked ]]; then
                        while read -r key_id; do
                                revoked_ids["$key_id"]=1
                        done <"$KEYRING_IMPORT_DIR/$keyring-revoked"
                fi
        done

        if (( ${#revoked_ids[@]} > 0 )); then
                msg "$(gettext "Disabling revoked keys in keyring...")"
                for key_id in "${!revoked_ids[@]}"; do
                        msg2 "$(gettext "Disabling key %s...")" "${key_id}"
                        printf 'disable\nquit\n' | LANG=C "${GPG_PACMAN[@]}" --command-fd 0 --quiet --batch --edit-key "${key_id}" 2>/dev/null
                done
        fi
}

add_keys() {
        if ! "${GPG_PACMAN[@]}" --quiet --batch --import "$@" ; then
                error "$(gettext "A specified keyfile could not be added to the keyring.")"
                exit 1
        fi
}

delete_keys() {
        check_keyids_exist "$@"
        if ! "${GPG_PACMAN[@]}" --quiet --batch --delete-key --yes "$@" ; then
                error "$(gettext "A specified key could not be removed from the keyring.")"
                exit 1
        fi
}

edit_keys() {
        check_keyids_exist "$@"
        local ret=0
        for key in "$@"; do
                if ! "${GPG_PACMAN[@]}" --edit-key "$key" ; then
                        error "$(gettext "The key identified by %s could not be edited.")" "$key"
                        ret=1
                fi
        done
        if (( ret )); then
                exit 1
        fi
}

export_keys() {
        check_keyids_exist "$@"
        if ! "${GPG_PACMAN[@]}" --armor --export "$@" ; then
                error "$(gettext "A specified key could not be exported from the keyring.")"
                exit 1
        fi
}

finger_keys() {
        check_keyids_exist
        if ! "${GPG_PACMAN[@]}" --batch --fingerprint "$@" ; then
                error "$(gettext "The fingerprint of a specified key could not be determined.")"
                exit 1
        fi
}

import_trustdb() {
        local importdir
        local ret=0
        for importdir in "$@"; do
                if [[ -f "${importdir}/trustdb.gpg" ]]; then
                        gpg --homedir "${importdir}" --export-ownertrust | \
                                "${GPG_PACMAN[@]}" --import-ownertrust -
                        if (( PIPESTATUS )); then
                                error "$(gettext "%s could not be imported.")" "${importdir}/trustdb.gpg"
                                ret=1
                        fi
                else
                        error "$(gettext "File %s does not exist and could not be imported.")" "${importdir}/trustdb.gpg"
                        ret=1
                fi
        done
        if (( ret )); then
                exit 1
        fi
}

import() {
        local importdir
        local ret=0
        for importdir in "$@"; do
                if [[ -f "${importdir}/pubring.gpg" ]]; then
                        if ! "${GPG_PACMAN[@]}" --quiet --batch --import "${importdir}/pubring.gpg" ; then
                                error "$(gettext "%s could not be imported.")" "${importdir}/pubring.gpg"
                                ret=1
                        fi
                else
                        error "$(gettext "File %s does not exist and could not be imported.")" "${importdir}/pubring.gpg"
                        ret=1
                fi
        done
        if (( ret )); then
                exit 1
        fi
}

list_keys() {
        check_keyids_exist
        if ! "${GPG_PACMAN[@]}" --batch --list-keys "$@" ; then
                error "$(gettext "A specified key could not be listed.")"
                exit 1
        fi
}

list_sigs() {
        check_keyids_exist
        if ! "${GPG_PACMAN[@]}" --batch --list-sigs "$@" ; then
                error "$(gettext "A specified signature could not be listed.")"
                exit 1
        fi
}

lsign_keys() {
        check_keyids_exist

        local ret=0
        for key_id in "$@"; do
                msg2 "$(gettext "Locally signing key %s...")" "${key_id}"
                # we cannot use --yes here as gpg would still ask for confirmation if a key has more than one uid
                printf 'y\ny\n' | LANG=C "${GPG_PACMAN[@]}" --command-fd 0 --quiet --batch --lsign-key "${key_id}" 2>/dev/null
                if (( PIPESTATUS[1] )); then
                        error "$(gettext "%s could not be locally signed.")" "${key_id}"
                        ret=1
                fi
        done

        if (( ret )); then
                exit 1
        fi
}

receive_keys() {
        local name id keyids

        # if the key is not a hex ID, do a lookup
        for name; do
                if [[ $name = ?(0x)+([0-9a-fA-F]) ]]; then
                        keyids+=("$name")
                else
                        if id=$(key_lookup_from_name "$name"); then
                                keyids+=("$id")
                        fi
                fi
        done

        (( ${#keyids[*]} > 0 )) || exit 1

        if ! "${GPG_PACMAN[@]}" --recv-keys "${keyids[@]}" ; then
                error "$(gettext "Remote key not fetched correctly from keyserver.")"
                exit 1
        fi
}

refresh_keys() {
        check_keyids_exist "$@"
        if ! "${GPG_PACMAN[@]}" --refresh-keys "$@" ; then
                error "$(gettext "A specified local key could not be updated from a keyserver.")"
                exit 1
        fi
}

verify_sig() {
        local ret=0
        for sig; do
                msg "Checking %s..." "$sig"
                if grep -q 'BEGIN PGP SIGNATURE' "$sig"; then
                        error "$(gettext "Cannot use armored signatures for packages: %s")" "$sig"
                        return 1
                fi
                if ! "${GPG_PACMAN[@]}" --status-fd 1 --verify "$sig" | grep -qE '^\[GNUPG:\] TRUST_(FULLY|ULTIMATE).*$'; then
                        error "$(gettext "The signature identified by %s could not be verified.")" "$sig"
                        ret=1
                fi
        done
        exit $ret
}

updatedb() {
        msg "$(gettext "Updating trust database...")"
        if ! "${GPG_PACMAN[@]}" --batch --check-trustdb ; then
                error "$(gettext "Trust database could not be updated.")"
                exit 1
        fi
}

# PROGRAM START
if ! type gettext &>/dev/null; then
        gettext() {
                echo "$@"
        }
fi

OPT_SHORT="adefhlruvV"
OPT_LONG=('add' 'config:' 'delete' 'edit-key' 'export' 'finger' 'gpgdir:'
          'help' 'import' 'import-trustdb' 'init' 'keyserver:' 'list-keys' 'list-sigs'
          'lsign-key' 'nocolor' 'populate' 'recv-keys' 'refresh-keys' 'updatedb'
          'verify' 'version')
if ! parseopts "$OPT_SHORT" "${OPT_LONG[@]}" -- "$@"; then
        exit 1 # E_INVALID_OPTION;
fi
set -- "${OPTRET[@]}"
unset OPT_SHORT OPT_LONG OPTRET

if [[ $1 == "--" ]]; then
        usage;
        exit 0;
fi

while (( $# )); do
        case $1 in
                -a|--add)         ADD=1 UPDATEDB=1 ;;
                --config)         shift; CONFIG=$1 ;;
                -d|--delete)      DELETE=1 UPDATEDB=1 ;;
                --edit-key)       EDITKEY=1 UPDATEDB=1 ;;
                -e|--export)      EXPORT=1 ;;
                -f|--finger)      FINGER=1 ;;
                --gpgdir)         shift; PACMAN_KEYRING_DIR=$1 ;;
                --import)         IMPORT=1 UPDATEDB=1 ;;
                --import-trustdb) IMPORT_TRUSTDB=1 UPDATEDB=1 ;;
                --init)           INIT=1 ;;
                --keyserver)      shift; KEYSERVER=$1 ;;
                -l|--list-keys)   LISTKEYS=1 ;;
                --list-sigs)      LISTSIGS=1 ;;
                --lsign-key)      LSIGNKEY=1 UPDATEDB=1 ;;
                --nocolor)        USE_COLOR='n';;
                --populate)       POPULATE=1 UPDATEDB=1 ;;
                -r|--recv-keys)   RECEIVE=1 UPDATEDB=1 ;;
                --refresh-keys)   REFRESH=1 ;;
                -u|--updatedb)    UPDATEDB=1 ;;
                -v|--verify)      VERIFY=1 ;;

                -h|--help)        usage; exit 0 ;;
                -V|--version)     version; exit 0 ;;

                --)               shift; break 2 ;;
        esac
        shift
done

m4_include(library/term_colors.sh)

if ! type -p gpg >/dev/null; then
        error "$(gettext "Cannot find the %s binary required for all %s operations.")" "gpg" "pacman-key"
        exit 1
fi

if (( (ADD || DELETE || EDITKEY || IMPORT || IMPORT_TRUSTDB || INIT || LSIGNKEY || POPULATE || RECEIVE || REFRESH || UPDATEDB) && EUID != 0 )); then
        error "$(gettext "%s needs to be run as root for this operation.")" "pacman-key"
        exit 1
fi

CONFIG=${CONFIG:-@sysconfdir@/pacman.conf}
if [[ ! -r "${CONFIG}" ]]; then
        error "$(gettext "%s configuration file '%s' not found.")" "pacman" "$CONFIG"
        exit 1
fi

# if PACMAN_KEYRING_DIR isn't assigned, try to get it from the config
# file, falling back on a hard default
PACMAN_KEYRING_DIR=${PACMAN_KEYRING_DIR:-$(get_from "$CONFIG" "GPGDir" "@sysconfdir@/pacman.d/gnupg")}

GPG_PACMAN=(gpg --homedir "${PACMAN_KEYRING_DIR}" --no-permission-warning)
if [[ -n ${KEYSERVER} ]]; then
        GPG_PACMAN+=(--keyserver "${KEYSERVER}")
fi

# check only a single operation has been given
# don't include UPDATEDB in here as other opts can induce it
numopt=$(( ADD + DELETE + EDITKEY + EXPORT + FINGER + IMPORT + IMPORT_TRUSTDB +
                INIT + LISTKEYS + LISTSIGS + LSIGNKEY + POPULATE + RECEIVE + REFRESH + VERIFY ))

case $numopt in
        0)
                if (( ! UPDATEDB )); then
                        error "$(gettext "no operation specified (use -h for help)")"
                        exit 1
                fi
                ;;
        [!1])
                error "$(gettext "Multiple operations specified.")"
                msg "$(gettext "Please run %s with each operation separately.")" "pacman-key"
                exit 1
                ;;
esac

# check for targets where needed
if (( (ADD || DELETE || EDIT || IMPORT || IMPORT_TRUSTDB ||
                LSIGNKEY || RECEIVE || VERIFY) && $# == 0 )); then
        error "$(gettext "No targets specified")"
        exit 1
fi

(( ! INIT )) && check_keyring

(( ADD )) && add_keys "$@"
(( DELETE )) && delete_keys "$@"
(( EDITKEY )) && edit_keys "$@"
(( EXPORT )) && export_keys "$@"
(( FINGER )) && finger_keys "$@"
(( IMPORT )) && import "$@"
(( IMPORT_TRUSTDB)) && import_trustdb "$@"
(( INIT )) && initialize
(( LISTKEYS )) && list_keys "$@"
(( LISTSIGS )) && list_sigs "$@"
(( LSIGNKEY )) && lsign_keys "$@"
(( POPULATE )) && populate_keyring "$@"
(( RECEIVE )) && receive_keys "$@"
(( REFRESH )) && refresh_keys "$@"
(( VERIFY )) && verify_sig "$@"

(( UPDATEDB )) && updatedb

exit 0

# vim: set noet: