diff options
| -rwxr-xr-x | cmdline/apt-key | 19 | ||||
| -rw-r--r-- | debian/changelog | 10 |
2 files changed, 29 insertions, 0 deletions
diff --git a/cmdline/apt-key b/cmdline/apt-key index e2dbd8af7..d4b61b356 100755 --- a/cmdline/apt-key +++ b/cmdline/apt-key @@ -12,6 +12,7 @@ GPG="$GPG_CMD --keyring /etc/apt/trusted.gpg" MASTER_KEYRING=/usr/share/keyrings/ubuntu-master-keyring.gpg ARCHIVE_KEYRING=/usr/share/keyrings/ubuntu-archive-keyring.gpg REMOVED_KEYS=/usr/share/keyrings/ubuntu-archive-removed-keys.gpg +ARCHIVE_KEYRING_URI=http://archive.ubuntu.com/ubuntu/ubuntu-archive-keyring.gpg add_keys_with_verify_against_master_keyring() { ADD_KEYRING=$1 @@ -47,6 +48,20 @@ add_keys_with_verify_against_master_keyring() { done } +# update the current archive signing keyring from a network URI +# the archive-keyring keys needs to be signed with the master key +# (otherwise it does not make sense from a security POV) +net_update() { + if [ -z "$ARCHIVE_KEYRING_URI" ]; then + echo "ERROR: no location for the archive-keyring given" + fi + if [ ! -d /var/lib/apt/keyrings ]; then + mkdir -p /var/lib/apt/keyrings + fi + (cd /var/lib/apt/keyrings; wget -q -N $ARCHIVE_KEYRING_URI) + add_keys_with_verify_against_master_keyring /var/lib/apt/keyrings/$(basename $ARCHIVE_KEYRING) $MASTER_KEYRING +} + update() { if [ ! -f $ARCHIVE_KEYRING ]; then echo >&2 "ERROR: Can't find the archive-keyring" @@ -82,6 +97,7 @@ usage() { echo " apt-key export <keyid> - output the key <keyid>" echo " apt-key exportall - output all trusted keys" echo " apt-key update - update keys using the keyring package" + echo " apt-key net-update - update keys using the network" echo " apt-key list - list keys" echo } @@ -111,6 +127,9 @@ case "$command" in update) update ;; + net-update) + net_update + ;; list) $GPG --batch --list-keys ;; diff --git a/debian/changelog b/debian/changelog index 50def78bb..c71695fd1 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,13 @@ +apt (0.7.9ubuntu10) hardy; urgency=low + + * cmdline/apt-key: + - add "net-update" command that fetches the + ubuntu-archive-keyring.gpg and add keys from it that are + signed by the ubuntu-master-keyring.gpg + (apt-archive-key-signatures spec) + + -- + apt (0.7.9ubuntu9) hardy; urgency=low * fix FTBFS due to incorrect intltool build-depends |