From 7d961c849bf4dab481e261bdb91304f6a4744d8c Mon Sep 17 00:00:00 2001 From: Dan McGee Date: Wed, 21 Sep 2011 16:19:12 -0500 Subject: pacman-key: disable, don't remove, revoked keys MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Unlike our protégé apt-key, removing a key from our keyring is not sufficient to prevent it from being trusted or used for verification. We are better off flagging it as disabled and leaving it in the keyring so it cannot be reimported or fetched at a later date from a keyserver and continue to be used. Implement the logic to disable the key instead of delete it, figuring out --command-fd in the process. Note that the surefire way to disable a key involves including said key in the keyring package, such that it is both in foobar.gpg and foobar-revoked. Signed-off-by: Dan McGee --- scripts/pacman-key.sh.in | 34 +++++++++++++--------------------- 1 file changed, 13 insertions(+), 21 deletions(-) (limited to 'scripts') diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 39da83da..72614c6e 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -275,22 +275,14 @@ populate_keyring() { # Read the revoked key IDs to an array. The conversion from whatever is inside the file # to key ids is important, because key ids are the only guarantee of identification # for the keys. - local -A removed_ids + local -A revoked_ids for keyring in "${KEYRINGIDS[@]}"; do if [[ -f "${KEYRING_IMPORT_DIR}/${keyring}-revoked" ]]; then while read key; do - local key_values name - # extract key ID (field 5) and the name of owner (field 10) - key_values="$("${GPG_PACMAN[@]}" --quiet --with-colons --list-key "${key}" 2>/dev/null | grep ^pub | cut -d: -f5,10 --output-delimiter=' ')" - if [[ -n $key_values ]]; then - # The first word is the key_id - key_id="${key_values%% *}" - # the rest is the name of the owner - name="${key_values#* }" - if [[ -n ${key_id} ]]; then - # Mark this key to be deleted - removed_ids[$key_id]="$name" - fi + key_id="$("${GPG_PACMAN[@]}" --quiet --with-colons --list-key "${key}" 2>/dev/null | grep ^pub | cut -d: -f5)" + if [[ -n ${key_id} ]]; then + # Mark this key to be disabled + revoked_ids[$key_id]="${keyring}" fi done < "${KEYRING_IMPORT_DIR}/${keyring}-revoked" fi @@ -300,19 +292,19 @@ populate_keyring() { # of keys to be removed if [[ -f "${PACMAN_KEYRING_DIR}/holdkeys" ]]; then while read key; do - key_id="$("${GPG_PACMAN[@]}" --quiet --with-colons --list-key "${key}" | grep ^pub | cut -d: -f5)" - if [[ -n "${removed_ids[$key_id]}" ]]; then - unset removed_ids[$key_id] + key_id="$("${GPG_PACMAN[@]}" --quiet --with-colons --list-key "${key}" 2>/dev/null | grep ^pub | cut -d: -f5)" + if [[ -n "${revoked_ids[$key_id]}" ]]; then + unset revoked_ids[$key_id] fi done < "${PACMAN_KEYRING_DIR}/holdkeys" fi # Remove the keys not marked to keep - if (( ${#removed_ids[@]} > 0 )); then - msg "$(gettext "Removing revoked keys from keyring...")" - for key_id in "${!removed_ids[@]}"; do - echo " removing key $key_id - ${removed_ids[$key_id]}" - "${GPG_PACMAN[@]}" --quiet --batch --yes --delete-key "${key_id}" + if (( ${#revoked_ids[@]} > 0 )); then + msg "$(gettext "Disabling revoked keys in keyring...")" + for key_id in "${!revoked_ids[@]}"; do + msg2 "$(gettext "Disabling key %s...")" "${key_id}" + printf 'disable\nquit\n' | LANG=C "${GPG_PACMAN[@]}" --command-fd 0 --quiet --batch --edit-key "${key_id}" 2>/dev/null done fi } -- cgit v1.2.3-70-g09d2