Send patches - preferably formatted by git format-patch - to patches at archlinux32 dot org.
summaryrefslogtreecommitdiff
path: root/scripts/pacman-key.sh.in
AgeCommit message (Collapse)Author
2012-04-24pacman-key: allow verification of multiple sig filesDave Reisner
Loop through arguments passed to verify_sig and treat each as a signature to be verified against a source file. Output each file as its checked to avoid ambiguity. Signed-off-by: Dave Reisner <dreisner@archlinux.org>
2012-04-24scripts: avoid dumping usage on parser failDave Reisner
Avoid letting the error message from parseopts get lost in the usage output from pacman-key and makepkg (which is already verbose).
2012-04-24pacman-key: adopt parseopts for option parsingDave Reisner
This requires an ugly amount of reworking of how pacman-key handles options. The change simply to avoid passing keys, files, and directories as arguments to options, but to leave them as arguments to the overall program. This is reasonable since pacman-key limits the user to essentially one operation per invocation (like pacman). Since we now pass around the positional parameters to the various operations, we can add some better sanity checking. Each operation is responsible for testing input and making sure it can operate properly, otherwise it throws an error and exits. The doc is updated to reflect this, and uses similar verbiage as pacman, describing the non-option arguments now passed to pacman-key as targets. Similar to the doc, --help is reorganized to separate operations and options and remove argument tokens from operations. Signed-off-by: Dave Reisner <dreisner@archlinux.org>
2012-04-08Merge branch 'maint'Dan McGee
2012-04-08pacman-key: avoid use of tempfile in verify_sigDave Reisner
Use --status-fd rather than --status-file to keep this contained in a pipeline. Signed-off-by: Dave Reisner <dreisner@archlinux.org>
2012-04-08pacman-key: verify TRUST_ULTIMATE keys as goodDave Reisner
Extend our grep pattern to match TRUST_ULTIMATE, not just TRUST_FULLY, as these keys are to be trusted as well. Signed-off-by: Dave Reisner <dreisner@archlinux.org> Signed-off-by: Dan McGee <dan@archlinux.org>
2012-04-07Merge branch 'maint'Dan McGee
Conflicts: lib/libalpm/signing.c lib/libalpm/sync.c
2012-04-07Revert "parseopts: normalize options into an array"Dave Reisner
This was really only half a fix for FS#28445, as it still doesn't correctly handle the case of filenames with spaces. In the short term, there is no obvious fix for this. In the long term, I believe the correct decision is to rewrite the options parser to be more in line with GNU getopt_long. This reverts commits: ca4142714137b16feabac09c4cda86b0a75036f8. 969dcddbdf9d5dbd91aa414cdd193f3fb26b644b.
2012-04-07pacman-key: Actually verify signatures and exit with correct codesPierre Schmitz
We cannot rely on gpg's exit code. Instead we have to check the status-fd to figure out whether a signature is valid or not. In addition to this pacman-key --verify can now be used in scripts as it will return an exit code of 1 if the signature is invalid. Signed-off-by: Pierre Schmitz <pierre@archlinux.de> Signed-off-by: Dan McGee <dan@archlinux.org>
2012-03-29pacman-key: change to more reliable default keyserverAllan McRae
User reports indicate that the SKS keyservers are more reliable than both the gnupg.net and mit.edu ones. Signed-off-by: Allan McRae <allan@archlinux.org> Signed-off-by: Dan McGee <dan@archlinux.org>
2012-03-29pacman-key: make the -e option work as advertisedAllan McRae
Using -e without arguments failed to export all keys. Using --export worked as expected. Signed-off-by: Allan McRae <allan@archlinux.org> Signed-off-by: Dan McGee <dan@archlinux.org>
2012-03-08Merge branch 'maint'Dan McGee
Conflicts: lib/libalpm/be_package.c
2012-03-05pacman-key: Remove useless signature verification in --populate commandPierre Schmitz
Verifing the keyring at this point is useless as a malicious package is already installed and as such has several options to bypass this check anyway. Signed-off-by: Pierre Schmitz <pierre@archlinux.de> Signed-off-by: Dan McGee <dan@archlinux.org>
2012-02-20Merge branch 'maint'Dan McGee
Conflicts: contrib/pacsysclean.in src/pacman/conf.h
2012-02-16parseopts: normalize options into an arrayDave Reisner
Modify parse_options logic to fill an array instead of printing parsed options. Avoid eval like the plague. Because it is the plague. Fixes bugs such as FS#28445. Signed-off-by: Dave Reisner <dreisner@archlinux.org> Signed-off-by: Dan McGee <dan@archlinux.org>
2012-01-30Merge branch 'maint'Dan McGee
Conflicts: scripts/makepkg.sh.in
2012-01-30pacman-key: call gpg fewer times for revocation keysDave Reisner
Instead of iterating over the revocation keyfile and calling gpg once for each key, map the file into an array and call gpg once, iterating over this output to mark each key as revoked. Signed-off-by: Dave Reisner <dreisner@archlinux.org> Signed-off-by: Dan McGee <dan@archlinux.org>
2012-01-30pacman-key: simplify trusted keyring iterationDave Reisner
Signed-off-by: Dave Reisner <dreisner@archlinux.org> Signed-off-by: Dan McGee <dan@archlinux.org>
2012-01-30scripts: always use printf with embedded gettextDave Reisner
This addresses two problems: 1) echo's behavior is inconsistent when dealing with flags, and can potentially be problematic. $ echo -n $ echo -- -n -- -n 2) Always using the end of options markers prevents translated strings from throwing errors, as shown in FS#28069. The remaining "inconsistencies" are because printf is being used in a guaranteed safe manner, e.g. printf '%s\n' "$(gettext "--this can never break")" Signed-off-by: Dave Reisner <dreisner@archlinux.org> Signed-off-by: Dan McGee <dan@archlinux.org>
2012-01-23Merge branch 'maint'Dan McGee
Conflicts: lib/libalpm/diskspace.c src/pacman/util.h
2012-01-18Update copyright on changed files since beginning of yearDan McGee
Signed-off-by: Dan McGee <dan@archlinux.org>
2012-01-18Improve exit statuses and error messages in pacman-keycanyonknight
Return codes from gpg commands are currently lost. This adds the functionality of taking non-zero exit statuses from gpg. This includes error reporting for all gpg commands that are run individually, run in a loop, and run through a pipe. Includes the check_keyids_exist function which verifies a key exists locally prior to attempted local manipulation of the key. If a gpg command has a non-zero status, pacman-key will now exit with a non-zero status. It will print a gettext error message of gpg's failure. Signed-off-by: canyonknight <canyonknight@gmail.com> Signed-off-by: Allan McRae <allan@archlinux.org> Signed-off-by: Dan McGee <dan@archlinux.org>
2012-01-18Turn gpg commands into functions in pacman-keycanyonknight
Adds functions for every gpg command. By pulling out the gpg commands from the "program start" section, additional commands can be run before or after a specific gpg command without adding additional clutter to the function call section. Adds an explicit exit status of 0 to prevent arithmetic expansions from returning non-zero, thereby falsely causing pacman-key to have a non-zero exit status. This change creates the framework for additional error messages and better exit statuses being added to every pacman-key gpg call. Signed-off-by: canyonknight <canyonknight@gmail.com> Signed-off-by: Allan McRae <allan@archlinux.org> Signed-off-by: Dan McGee <dan@archlinux.org>
2011-12-23Merge branch 'maint'Dan McGee
2011-12-23pacman-key: Add missing quotesTimothy Redaelli
Signed-off-by: Timothy Redaelli <timothy.redaelli@gmail.com> Signed-off-by: Dan McGee <dan@archlinux.org>
2011-12-07scripts/*: Declare several constant variables read-onlyLukas Fleischer
Be more semantically accurate and avoid accidental overwriting of some configuration variables that are considered to be constant. Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de> Signed-off-by: Dan McGee <dan@archlinux.org>
2011-10-17pacman-key: add a default keyserver timeout value on --initDan McGee
The default is supposidely 30 seconds from the gpg manpage, but that sure wasn't what I was seeing- it was somewhere closer to two minutes of silence. Add a more reasonable 10 second timeout value which should be good enough for any keyserver that doesn't totally stink at it's job. Signed-off-by: Dan McGee <dan@archlinux.org>
2011-10-11pacman-key: don't escape single quote in usage messageDan McGee
This screws up gettext and causes the message to display always untranslated. Signed-off-by: Dan McGee <dan@archlinux.org>
2011-10-05pacman-key: treat foo-trusted as an ownertrust export fileDan McGee
This allows it to serve double-duty. In order to allow users to base verification decisions off of both a valid signature and a trusted signature, we need to assign some level of owner trust to the keys we designate as trusted on import. Signed-off-by: Dan McGee <dan@archlinux.org>
2011-10-05pacman-key: refine and clarify import/import-trustdb behaviorDan McGee
* --import now only imports keys from pubkey.gpg and does not import owner trust; if you want to have both simply run the operations in sequence. * --import-trustdb has been simplified; it will overwrite existing values in the trust database as before, but there is no need to export it first as those values are safe if left untouched. * Fix the manpage referring to a non-existent option. Signed-off-by: Dan McGee <dan@archlinux.org>
2011-09-30pacman-key: remove errexit flag from shebangDave Reisner
We're ill equipped to be using this flag as we don't trap and respond to the ERR signal. The result is that if is ever tripped, pacman-key will instantly exit with no indication of why. At the same time, we're already fairly good about doing our own error checking and verbalizing it before dying. Signed-off-by: Dave Reisner <dreisner@archlinux.org> Signed-off-by: Dan McGee <dan@archlinux.org>
2011-09-30pacman-key: return 0 from get_from if default value usedAllan McRae
This prevents the error trap being set off when GPGDir is commented in pacman.conf. Bug introduced in 507b01b9. Signed-off-by: Allan McRae <allan@archlinux.org> Signed-off-by: Dan McGee <dan@archlinux.org>
2011-09-27pacman-key: use consistent punctuation in error messagesDan McGee
Signed-off-by: Dan McGee <dan@archlinux.org>
2011-09-26pacman-key: allow get_from to return a default valueDave Reisner
Keep the non-zero return val to let the caller know that the key wasn't found. Signed-off-by: Dave Reisner <dreisner@archlinux.org> Signed-off-by: Dan McGee <dan@archlinux.org>
2011-09-26pacman-key: simplify writing to config fileDave Reisner
Signed-off-by: Dave Reisner <dreisner@archlinux.org> Signed-off-by: Dan McGee <dan@archlinux.org>
2011-09-22pacman-key: add an additional plain text 'foo-trusted' fileDan McGee
This is similar to the 'foo-revoked' file we had. This will be used to inform the user what keys in the shipped keyring need to be explicitly trusted by the user. A distro such as Arch will likely have 3-4 master keys listed in this trusted file, but an additional 25 developer keys present in the keyring that the user shouldn't have to directly sign. We use this list to prompt the user to sign the keys locally. If the key is already signed locally gpg will print a bit of junk but will continue without pestering the user. Signed-off-by: Dan McGee <dan@archlinux.org>
2011-09-22pacman-key: factor out validate_with_gpg() methodDan McGee
This was copy-pasted code for the most part once the filename was factored out. Signed-off-by: Dan McGee <dan@archlinux.org>
2011-09-22pacman-key: remove holdkeys functionalityDan McGee
We're putting the cart ahead of the horse a bit here. Given that our keyring is not one where everything is implicitly trusted (ala gpgv), keeping or deleting a key has no bearing on its trusted status, only whether we can actually verify things signed by said key. If we need to address this down the road, we can find a solution that works for the problem at hand rather than trying to solve it now before signing is even widespread. Signed-off-by: Dan McGee <dan@archlinux.org>
2011-09-22pacman-key: implement promptless lsigningDan McGee
Signed-off-by: Dan McGee <dan@archlinux.org>
2011-09-22pacman-key: disable, don't remove, revoked keysDan McGee
Unlike our protégé apt-key, removing a key from our keyring is not sufficient to prevent it from being trusted or used for verification. We are better off flagging it as disabled and leaving it in the keyring so it cannot be reimported or fetched at a later date from a keyserver and continue to be used. Implement the logic to disable the key instead of delete it, figuring out --command-fd in the process. Note that the surefire way to disable a key involves including said key in the keyring package, such that it is both in foobar.gpg and foobar-revoked. Signed-off-by: Dan McGee <dan@archlinux.org>
2011-09-22pacman-key: simplify import in populateDan McGee
This finishes the cleanup started in 710e83999bbf. We can do a straight import from another keyring rather than all the funky parsing and piping business we were doing. Signed-off-by: Dan McGee <dan@archlinux.org>
2011-09-22pacman-key: don't hide --verify details in populateDan McGee
Otherwise we're hiding extremely relevant bits like this one: gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Signed-off-by: Dan McGee <dan@archlinux.org>
2011-09-22pacman-key: print message in populate if signature is missingDan McGee
Rather than saying it was invalid, tell the user no signature exists. Signed-off-by: Dan McGee <dan@archlinux.org>
2011-09-22pacman-key: clean up populate outputDan McGee
* Ensure usage message is indented correctly * Show short filenames for both the gpg keyring and revocation file Signed-off-by: Dan McGee <dan@archlinux.org>
2011-09-22pacman-key: ensure array iterations are quotedDan McGee
When doing something like `pacman-key --edit-key 'Dan McGee'`, one would expect it to work, and not fail. Signed-off-by: Dan McGee <dan@archlinux.org>
2011-09-02pacman-key: add --refresh-keys operationDan McGee
This allows new signatures to be pulled, revocations to be found, etc. Signed-off-by: Dan McGee <dan@archlinux.org>
2011-09-02pacman-key: split keyserver to a separate optionDan McGee
This also renames '--receive' to '-recv-keys' to match the wrapped gpg option name, rather than invent a new one, now that the calling convention is the same. Signed-off-by: Dan McGee <dan@archlinux.org>
2011-09-02pacman-key help and documentation cleanupDan McGee
We were using the mystical [<foobar>] options which is some sort of cross between a <required> argument and an [optional] one. Remove this madness and do some other general cleanup/consistency work in the manpage. Signed-off-by: Dan McGee <dan@archlinux.org>
2011-09-02pacman-key: document --lsign-keyDan McGee
Signed-off-by: Dan McGee <dan@archlinux.org>
2011-08-30pacman-key: add --lsign-key operationDan McGee
This allows local signing of a given key to help establish the web of trust rooted at the generated (or imported) master key. Signed-off-by: Dan McGee <dan@archlinux.org>