summaryrefslogtreecommitdiff
path: root/cmdline/apt-key.in
blob: 463e4b4b49ea588c81c5100eff8ece216912285b (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
#!/bin/sh

set -e
unset GREP_OPTIONS

GPG_CMD="gpg --ignore-time-conflict --no-options --no-default-keyring"

# gpg needs a trustdb to function, but it can't be invalid (not even empty)
# so we create a temporary directory to store our fresh readable trustdb in
TRUSTDBDIR="$(mktemp -d)"
CURRENTTRAP="${CURRENTTRAP} rm -rf '${TRUSTDBDIR}';"
trap "${CURRENTTRAP}" 0 HUP INT QUIT ILL ABRT FPE SEGV PIPE TERM
chmod 700 "$TRUSTDBDIR"
# We also don't use a secret keyring, of course, but gpg panics and
# implodes if there isn't one available - and writeable for imports
SECRETKEYRING="${TRUSTDBDIR}/secring.gpg"
touch $SECRETKEYRING
GPG_CMD="$GPG_CMD --secret-keyring $SECRETKEYRING"
GPG_CMD="$GPG_CMD --trustdb-name ${TRUSTDBDIR}/trustdb.gpg"

# now create the trustdb with an (empty) dummy keyring
$GPG_CMD --quiet --check-trustdb --keyring $SECRETKEYRING
# and make sure that gpg isn't trying to update the file
GPG_CMD="$GPG_CMD --no-auto-check-trustdb --trust-model always"

GPG="$GPG_CMD"

APT_DIR="/"
eval $(apt-config shell APT_DIR Dir)

MASTER_KEYRING='&keyring-master-filename;'
eval $(apt-config shell MASTER_KEYRING APT::Key::MasterKeyring)
ARCHIVE_KEYRING='&keyring-filename;'
eval $(apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring)
REMOVED_KEYS='&keyring-removed-filename;'
eval $(apt-config shell REMOVED_KEYS APT::Key::RemovedKeys)
ARCHIVE_KEYRING_URI='&keyring-uri;'
eval $(apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI)
TMP_KEYRING=${APT_DIR}/var/lib/apt/keyrings/maybe-import-keyring.gpg

requires_root() {
	if [ "$(id -u)" -ne 0 ]; then
		echo >&1 "ERROR: This command can only be used by root."
		exit 1
	fi
}

# gpg defaults to mode 0600 for new keyrings. Create one with 0644 instead.
init_keyring() {
    for path; do
        if ! [ -e "$path" ]; then
            touch -- "$path"
            chmod 0644 -- "$path"
        fi
    done
}

add_keys_with_verify_against_master_keyring() {
    ADD_KEYRING=$1
    MASTER=$2

    if [ ! -f "$ADD_KEYRING" ]; then
	echo "ERROR: '$ADD_KEYRING' not found"
	return
    fi 
    if [ ! -f "$MASTER" ]; then
	echo "ERROR: '$MASTER' not found"
	return
    fi

    # when adding new keys, make sure that the archive-master-keyring
    # is honored. so:
    #   all keys that are exported must have a valid signature
    #   from a key in the $distro-master-keyring
    add_keys=`$GPG_CMD --keyring $ADD_KEYRING --with-colons --list-keys | grep ^pub | cut -d: -f5`
    all_add_keys=`$GPG_CMD --keyring $ADD_KEYRING --with-colons --list-keys | grep ^[ps]ub | cut -d: -f5`
    master_keys=`$GPG_CMD --keyring $MASTER --with-colons --list-keys | grep ^pub | cut -d: -f5`

    # ensure there are no colisions LP: #857472
    for all_add_key in $all_add_keys; do
	for master_key in $master_keys; do
            if [ "$all_add_key" = "$master_key" ]; then
                echo >&2 "Keyid collision for '$all_add_key' detected, operation aborted"
                return 1
            fi
        done
    done
    
    for add_key in $add_keys; do
        # export the add keyring one-by-one
        rm -f $TMP_KEYRING
        $GPG_CMD --keyring $ADD_KEYRING --output $TMP_KEYRING --export $add_key 
        # check if signed with the master key and only add in this case
        ADDED=0
	for master_key in $master_keys; do
	    if $GPG_CMD --keyring $MASTER --keyring $TMP_KEYRING --check-sigs --with-colons $add_key | grep '^sig:!:' | cut -d: -f5 | grep -q $master_key; then
		$GPG --import $TMP_KEYRING
		ADDED=1
	    fi
	done
	if [ $ADDED = 0 ]; then
	    echo >&2 "Key '$add_key' not added. It is not signed with a master key"
	fi
    done
    rm -f $TMP_KEYRING
}

# update the current archive signing keyring from a network URI
# the archive-keyring keys needs to be signed with the master key
# (otherwise it does not make sense from a security POV)
net_update() {
    # Disabled for now as code is insecure (LP: #1013639 (and 857472, 1013128))
    APT_KEY_NET_UPDATE_ENABLED=""
    eval $(apt-config shell APT_KEY_NET_UPDATE_ENABLED APT::Key::Net-Update-Enabled)
    if [ -z "$APT_KEY_NET_UPDATE_ENABLED" ]; then
        exit 1
    fi

    if [ -z "$ARCHIVE_KEYRING_URI" ]; then
	echo >&2 "ERROR: Your distribution is not supported in net-update as no uri for the archive-keyring is set"
	exit 1
    fi
    requires_root
    # in theory we would need to depend on wget for this, but this feature
    # isn't useable in debian anyway as we have no keyring uri nor a master key
    if ! which wget >/dev/null 2>&1; then
	echo >&2 "ERROR: an installed wget is required for a network-based update"
	exit 1
    fi
    if [ ! -d ${APT_DIR}/var/lib/apt/keyrings ]; then
	mkdir -p ${APT_DIR}/var/lib/apt/keyrings
    fi
    keyring=${APT_DIR}/var/lib/apt/keyrings/$(basename $ARCHIVE_KEYRING_URI)
    old_mtime=0
    if [ -e $keyring ]; then
	old_mtime=$(stat -c %Y $keyring)
    fi
    (cd  ${APT_DIR}/var/lib/apt/keyrings; wget --timeout=90 -q -N $ARCHIVE_KEYRING_URI)
    if [ ! -e $keyring ]; then
	return
    fi
    new_mtime=$(stat -c %Y $keyring)
    if [ $new_mtime -ne $old_mtime ]; then
	echo "Checking for new archive signing keys now"
	add_keys_with_verify_against_master_keyring $keyring $MASTER_KEYRING
    fi
}

update() {
    if [ ! -f $ARCHIVE_KEYRING ]; then
	echo >&2 "ERROR: Can't find the archive-keyring"
	echo >&2 "Is the &keyring-package; package installed?"
	exit 1
    fi
    requires_root

    # add new keys from the package;

    # we do not use add_keys_with_verify_against_master_keyring here,
    # because "update" is run on regular package updates.  A
    # attacker might as well replace the master-archive-keyring file
    # in the package and add his own keys. so this check wouldn't
    # add any security. we *need* this check on net-update though
    $GPG_CMD --quiet --batch --keyring $ARCHIVE_KEYRING --export | $GPG --import

    if [ -r "$REMOVED_KEYS" ]; then
	# remove no-longer supported/used keys
	keys=`$GPG_CMD --keyring $REMOVED_KEYS --with-colons --list-keys | grep ^pub | cut -d: -f5`
	for key in $keys; do
	    if $GPG --list-keys --with-colons | grep ^pub | cut -d: -f5 | grep -q $key; then
		$GPG --quiet --batch --delete-key --yes ${key}
	    fi
	done
    else
	echo "Warning: removed keys keyring  $REMOVED_KEYS missing or not readable" >&2
    fi
}

remove_key_from_keyring() {
    local GPG="$GPG_CMD --keyring $1"
    # check if the key is in this keyring: the key id is in the 5 column at the end
    if ! $GPG --with-colons --list-keys 2>&1 | grep -q "^pub:[^:]*:[^:]*:[^:]*:[0-9A-F]\+$2:"; then
	return
    fi
    if [ ! -w "$1" ]; then
	echo >&2 "Key ${2} is in keyring ${1}, but can't be removed as it is read only."
	return
    fi
    # check if it is the only key in the keyring and if so remove the keyring alltogether
    if [ '1' = "$($GPG --with-colons --list-keys | grep "^pub:[^:]*:[^:]*:[^:]*:[0-9A-F]\+:" | wc -l)" ]; then
	mv -f "$1" "${1}~" # behave like gpg
	return
    fi
    # we can't just modify pointed to files as these might be in /usr or something
    local REALTARGET
    if [ -L "$1" ]; then
	REALTARGET="$(readlink -f "$1")"
	mv -f "$1" "${1}.dpkg-tmp"
	cp -a "$REALTARGET" "$1"
	ls "$(dirname $1)"
    fi
    # delete the key from the keyring
    $GPG --batch --delete-key --yes "$2"
    if [ -n "$REALTARGET" ]; then
	# the real backup is the old link, not the copy we made
	mv -f "${1}.dpkg-tmp" "${1}~"
    fi
}

remove_key() {
    requires_root

    # if a --keyring was given, just remove from there
    if [ -n "$FORCED_KEYRING" ]; then
	remove_key_from_keyring "$FORCED_KEYRING" "$1"
    else
	# otherwise all known keyrings are up for inspection
	local TRUSTEDFILE="/etc/apt/trusted.gpg"
	eval $(apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring)
	eval $(apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f)
	remove_key_from_keyring "$TRUSTEDFILE" "$1"
	TRUSTEDPARTS="/etc/apt/trusted.gpg.d"
	eval $(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d)
	if [ -d "$TRUSTEDPARTS" ]; then
	    for trusted in $(run-parts --list "$TRUSTEDPARTS" --regex '^.*\.gpg$'); do
		remove_key_from_keyring "$trusted" "$1"
	    done
	fi
    fi
    echo "OK"
}


usage() {
    echo "Usage: apt-key [--keyring file] [command] [arguments]"
    echo
    echo "Manage apt's list of trusted keys"
    echo
    echo "  apt-key add <file>          - add the key contained in <file> ('-' for stdin)"
    echo "  apt-key del <keyid>         - remove the key <keyid>"
    echo "  apt-key export <keyid>      - output the key <keyid>"
    echo "  apt-key exportall           - output all trusted keys"
    echo "  apt-key update              - update keys using the keyring package"
    echo "  apt-key net-update          - update keys using the network"
    echo "  apt-key list                - list keys"
    echo "  apt-key finger              - list fingerprints"
    echo "  apt-key adv                 - pass advanced options to gpg (download key)"
    echo
    echo "If no specific keyring file is given the command applies to all keyring files."
}

while [ -n "$1" ]; do
   case "$1" in
      --keyring)
	 shift
	 TRUSTEDFILE="$1"
	 FORCED_KEYRING="$1"
	 if [ -r "$TRUSTEDFILE" ] || [ "$2" = 'add' ] || [ "$2" = 'adv' ]; then
	    GPG="$GPG --keyring $TRUSTEDFILE --primary-keyring $TRUSTEDFILE"
	 else
	    echo >&2 "Error: The specified keyring »$TRUSTEDFILE« is missing or not readable"
	    exit 1
	 fi
	 shift
	 ;;
      --fakeroot)
	 requires_root() { true; }
	 shift
	 ;;
      --*)
	 echo >&2 "Unknown option: $1"
	 usage
	 exit 1;;
      *)
	 break;;
   esac
done

if [ -z "$TRUSTEDFILE" ]; then
   TRUSTEDFILE="/etc/apt/trusted.gpg"
   eval $(apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring)
   eval $(apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f)
   if [ -r "$TRUSTEDFILE" ]; then
      GPG="$GPG --keyring $TRUSTEDFILE"
   fi
   GPG="$GPG --primary-keyring $TRUSTEDFILE"
   TRUSTEDPARTS="/etc/apt/trusted.gpg.d"
   eval $(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d)
   if [ -d "$TRUSTEDPARTS" ]; then
      # strip / suffix as gpg will double-slash in that case (#665411)
      STRIPPED_TRUSTEDPARTS="${TRUSTEDPARTS%/}"
      if [ "${STRIPPED_TRUSTEDPARTS}/" = "$TRUSTEDPARTS" ]; then
	 TRUSTEDPARTS="$STRIPPED_TRUSTEDPARTS"
      fi
      for trusted in $(run-parts --list "$TRUSTEDPARTS" --regex '^.*\.gpg$'); do
	 GPG="$GPG --keyring $trusted"
      done
   fi
fi

command="$1"
if [ -z "$command" ]; then
    usage
    exit 1
fi
shift

if [ "$command" != "help" ] && ! which gpg >/dev/null 2>&1; then
    echo >&2 "Warning: gnupg does not seem to be installed."
    echo >&2 "Warning: apt-key requires gnupg for most operations."
    echo >&2
fi

case "$command" in
    add)
        requires_root
        init_keyring "$TRUSTEDFILE"
        $GPG --quiet --batch --import "$1"
        echo "OK"
        ;;
    del|rm|remove)
        init_keyring "$TRUSTEDFILE"
	remove_key "$1"
        ;;
    update)
        init_keyring "$TRUSTEDFILE"
	update
	;;
    net-update)
        init_keyring "$TRUSTEDFILE"
	net_update
	;;
    list)
        init_keyring "$TRUSTEDFILE"
        $GPG --batch --list-keys
        ;;
    finger*)
        init_keyring "$TRUSTEDFILE"
        $GPG --batch --fingerprint
        ;;
    export)
        init_keyring "$TRUSTEDFILE"
        $GPG --armor --export "$1"
        ;;
    exportall)
        init_keyring "$TRUSTEDFILE"
        $GPG --armor --export
        ;;
    adv*)
        init_keyring "$TRUSTEDFILE"
        echo "Executing: $GPG $*"
        $GPG $*
        ;;
    help)
        usage
        ;;
    *)
        usage
        exit 1
        ;;
esac