summaryrefslogtreecommitdiff
path: root/cmdline/apt-key.in
AgeCommit message (Collapse)Author
2014-10-20test if TMPDIR is accessible before usingDavid Kalnischkies
Private temporary directories as created by e.g. libpam-tmpdir are nice, but they are also very effective in preventing our priviledge dropping to work as TMPDIR will be set to a directory only root has access to, so working with it as _apt will fail. We circumvent this by extending our check for a usable TMPDIR setting by checking access rights. Closes: 765951
2014-09-29Test if TMPDIR is a directory in apt-key and if not unset itMichael Vogt
This prevents a failure in mktemp -d - it will blindly trust TMPDIR and not use something else if the dir is not there.
2014-09-27add and use 'apt-key verify' which prefers gpgv over gpgDavid Kalnischkies
gnupg/gnupg2 can do verify just fine of course, so we don't need to use gpgv here, but it is what we always used in the past, so there might be scripts expecting a certain output and more importantly the output of apt-cdrom contains messages from gpg and even with all the settings we activate to prevent it, it still shows (in some versions) a quiet scary: "gpg: WARNING: Using untrusted key!" message. Keeping the use of gpgv is the simplest way to prevent it. We are increasing also the "Breaks: apt" version from libapt as it requires a newer apt-key than might be installed in partial upgrades.
2014-09-27miscellaneous small cleanups in apt-keyDavid Kalnischkies
Git-Dch: Ignore
2014-09-27add --readonly option for apt-key advDavid Kalnischkies
Some advanced commands can be executed without the keyring being modified like --verify, so this adds an option to disable the mergeback and uses it for our gpg calling code. Git-Dch: Ignore
2014-09-27use only one --keyring in gpg interactionsDavid Kalnischkies
We were down to at most two keyrings before, but gnupg upstream plans dropping support for multiple keyrings in the longrun, so with a single keyring we hope to be future proof – and 'apt-key adv' isn't a problem anymore as every change to the keys is merged back, so we have now the same behavior as before, but support an unlimited amount of trusted.gpg.d keyrings.
2014-09-27add --secret-keyring option for apt-keyDavid Kalnischkies
For some advanced usecases it might be handy to specify the secret keyring to be used (e.g. as it is used in the testcases), but specifying it via a normal option for gnupg might not be available forever: http://lists.gnupg.org/pipermail/gnupg-users/2013-August/047180.html Git-Dch: Ignore
2014-09-27allow to specify fingerprints in 'apt-key del'David Kalnischkies
2014-09-27add a test for apt-key export{,all}David Kalnischkies
Git-Dch: Ignore
2014-09-27respect --keyring also in merged keyring commandsDavid Kalnischkies
Git-Dch: Ignore
2014-09-27support gnupg2 as drop-in replacement for gnupgDavid Kalnischkies
If both are available APT will still prefer gpg over gpg2 as it is a bit more lightweight, but it shouldn't be a problem to use one or the other (at least at the moment, who knows what will happen in the future).
2014-09-27delay gnupg setup in apt-key until it is neededDavid Kalnischkies
'apt-key help' and incorrect usage do not need a functioning gnupg setup, as well as we shouldn't try to setup gnupg before we actually test if it is available (and print a message if it is not).
2014-09-27merge fragment keyrings in apt-key to avoid hitting gpg limitsDavid Kalnischkies
gnupg has a hardlimit of 40 (at the moment) keyrings per invocation, which can be exceeded with (many) repositories. That is rather misfortune as the longrun goal was to drop gnupg dependency at some point in the future, but this can now be considered missed and dropped. It also means that 'apt-key adv' commands might not have the behaviour one would expect it to have as it mainly operates on a big temporary keyring, so commands modifying keys will break. Doing this was never a good idea anyway through, so lets just hope nothing break too badly. Closes: 733028
2014-09-27refactor key removal code to reuse it in next stepDavid Kalnischkies
Git-Dch: Ignore
2014-09-27set a primary-keyring only if we have access to itDavid Kalnischkies
2014-09-27support (multiple) arguments properly in apt-keyDavid Kalnischkies
2014-09-27only create new trusted.gpg if directory is writeableDavid Kalnischkies
2014-09-27all errors should be printed to stderrDavid Kalnischkies
Git-Dch: Ignore
2014-09-27add a (hidden) --quiet option for apt-keyDavid Kalnischkies
2014-09-27remove leftover debug output from multikey softlinkDavid Kalnischkies
Git-Dch: Ignore
2014-02-22Fix typos in documentation (codespell)Michael Vogt
2014-01-16use gpg --homedir instead of explicit file placementDavid Kalnischkies
Avoids that gpg gets the idea it could use files from the user which weren't overridden specifically like secret keyring and trustdb as before.
2013-12-19fix apt-key net-update test to use the buildin webserverMichael Vogt
2013-12-13make apt-key net-update actually testableMichael Vogt
2013-12-01generate apt-key script with vendor info about keysDavid Kalnischkies
The apt-key script uses quiet a few keyring files for operation which are specific to the distribution it is build on and is hence one of the most patched parts – even if it is not that often used anymore now that a fragment directory for trusted.gpg exists.