diff options
| author | Allan McRae <allan@archlinux.org> | 2011-08-23 16:10:06 +1000 |
|---|---|---|
| committer | Allan McRae <allan@archlinux.org> | 2011-08-29 11:55:23 +1000 |
| commit | e1b9f7b3005c4d6db9cc84e95a42d4beba6c7e24 (patch) | |
| tree | 6a91a52daad9982bbbc5d1423014f6d338efaed1 | |
| parent | 29dede2eb76ab5a139d4e8236be1037a7a86b6e5 (diff) | |
| download | pacman-e1b9f7b3005c4d6db9cc84e95a42d4beba6c7e24.tar.xz | |
pacman-key: rework and document holding keys in keyring
The HoldKey option was undocumented and was not suited for pacman.conf.
Instead use the file "/etc/pacman.d/gnupg/heldkeys" to contain a list
of keys not to be removed from the pacman keyring with the --populate
option.
Signed-off-by: Allan McRae <allan@archlinux.org>
| -rw-r--r-- | doc/pacman-key.8.txt | 8 | ||||
| -rw-r--r-- | scripts/pacman-key.sh.in | 12 |
2 files changed, 11 insertions, 9 deletions
diff --git a/doc/pacman-key.8.txt b/doc/pacman-key.8.txt index ff8d38df..3582b993 100644 --- a/doc/pacman-key.8.txt +++ b/doc/pacman-key.8.txt @@ -101,12 +101,16 @@ A distribution or other repository provided may want to provide a set of valid PGP keys used in the signing of its packages and repository databases that can be readily imported into the pacman keyring. This is achieved by providing a PGP keyring file `foo.gpg` that contains the keys for the foo keyring in the -directory +{pkgdatadir}/keyrings+. Optionally the file `foo-revoked` can be +directory +{pkgdatadir}/keyrings+. Optionally the file `foo-revoked` can be provided containing a list of revoked key IDs for that keyring. These files are required to be signed (detached) by a trusted PGP key that the user must -manually import to the pacman keyring. This prevents a potentially malicious +manually import to the pacman keyring. This prevents a potentially malicious repository adding keys to the pacman keyring without the users knowledge. +A key being marked as revoked always takes priority over the key being added to +the pacman keyring, regardless of the keyring it is provided in. To prevent a +key from being revoked when using --populate, its ID can be listed in ++{sysconfdir}/pacman.d/gnupg/holdkeys+. See Also -------- diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 6a350af6..7b9f80ba 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -232,17 +232,15 @@ populate_keyring() { fi done - # List of keys that must be kept installed, even if in the list of keys to be removed - local HOLD_KEYS="$(get_from "$CONFIG" "HoldKeys")" - - # Remove the keys that must be kept from the set of keys that should be removed - if [[ -n ${HOLD_KEYS} ]]; then - for key in ${HOLD_KEYS}; do + # Read list of keys that must be kept installed and remove them from the list + # of keys to be removed + if [[ -f "${PACMAN_KEYRING_DIR}/holdkeys" ]]; then + while read key; do key_id="$("${GPG_PACMAN[@]}" --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5)" if [[ -n "${removed_ids[$key_id]}" ]]; then unset removed_ids[$key_id] fi - done + done < "${PACMAN_KEYRING_DIR}/holdkeys" fi # Remove the keys not marked to keep |