scripts/pacman-key.sh.in

   1 #!/bin/bash
   2 #
   3 #   pacman-key - manages pacman's keyring
   4 #                Based on apt-key, from Debian
   5 #   @configure_input@
   6 #
   7 #   Copyright (c) 2010-2012 Pacman Development Team <pacman-dev@archlinux.org>
   8 #
   9 #   This program is free software; you can redistribute it and/or modify
  10 #   it under the terms of the GNU General Public License as published by
  11 #   the Free Software Foundation; either version 2 of the License, or
  12 #   (at your option) any later version.
  13 #
  14 #   This program is distributed in the hope that it will be useful,
  15 #   but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 #   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17 #   GNU General Public License for more details.
  18 #
  19 #   You should have received a copy of the GNU General Public License
  20 #   along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 #
  22
  23 # gettext initialization
  24 export TEXTDOMAIN='pacman-scripts'
  25 export TEXTDOMAINDIR='@localedir@'
  26
  27 myver="@PACKAGE_VERSION@"
  28
  29 # Options
  30 ADD=0
  31 DELETE=0
  32 EDITKEY=0
  33 EXPORT=0
  34 FINGER=0
  35 IMPORT=0
  36 IMPORT_TRUSTDB=0
  37 INIT=0
  38 KEYSERVER=''
  39 LISTKEYS=0
  40 LISTSIGS=0
  41 LSIGNKEY=0
  42 POPULATE=0
  43 RECEIVE=0
  44 REFRESH=0
  45 UPDATEDB=0
  46 VERIFY=0
  47
  48 DEFAULT_KEYSERVER='hkp://keys.gnupg.net'
  49
  50 m4_include(library/output_format.sh)
  51
  52 m4_include(library/parse_options.sh)
  53
  54 usage() {
  55         printf "pacman-key (pacman) %s\n" ${myver}
  56         echo
  57         printf -- "$(gettext "Usage: %s [options]")\n" $(basename $0)
  58         echo
  59         printf -- "$(gettext "Manage pacman's list of trusted keys")\n"
  60         echo
  61         printf -- "$(gettext "Options:")\n"
  62         printf -- "$(gettext "  -a, --add [file(s)]       Add the specified keys (empty for stdin)")\n"
  63         printf -- "$(gettext "  -d, --delete <keyid(s)>   Remove the specified keyids")\n"
  64         printf -- "$(gettext "  -e, --export [keyid(s)]   Export the specified or all keyids")\n"
  65         printf -- "$(gettext "  -f, --finger [keyid(s)]   List fingerprint for specified or all keyids")\n"
  66         printf -- "$(gettext "  -h, --help                Show this help message and exit")\n"
  67         printf -- "$(gettext "  -l, --list-keys [keyid(s)] List the specified or all keys")\n"
  68         printf -- "$(gettext "  -r, --recv-keys <keyid(s)> Fetch the specified keyids")\n"
  69         printf -- "$(gettext "  -u, --updatedb            Update the trustdb of pacman")\n"
  70         printf -- "$(gettext "  -v, --verify <signature>  Verify the file specified by the signature")\n"
  71         printf -- "$(gettext "  -V, --version             Show program version")\n"
  72         printf -- "$(gettext "  --config <file>           Use an alternate config file (instead of\n\
  73                             '%s')")\n" "@sysconfdir@/pacman.conf"
  74         printf -- "$(gettext "  --edit-key <keyid(s)>     Present a menu for key management task on keyids")\n"
  75         printf -- "$(gettext "  --gpgdir <dir>            Set an alternate directory for GnuPG (instead\n\
  76                             of '%s')")\n" "@sysconfdir@/pacman.d/gnupg"
  77         printf -- "$(gettext "  --import <dir(s)>         Imports pubring.gpg from dir(s)")\n"
  78         printf -- "$(gettext "  --import-trustdb <dir(s)> Imports ownertrust values from trustdb.gpg in dir(s)")\n"
  79         printf -- "$(gettext "  --init                    Ensure the keyring is properly initialized")\n"
  80         printf -- "$(gettext "  --keyserver               Specify a keyserver to use if necessary")\n"
  81         printf -- "$(gettext "  --list-sigs [keyid(s)]    List keys and their signatures")\n"
  82         printf -- "$(gettext "  --lsign-key <keyid>       Locally sign the specified keyid")\n"
  83         printf -- "$(gettext "  --populate [keyring(s)]   Reload the default keys from the (given) keyrings\n\
  84                             in '%s'")\n" "@pkgdatadir@/keyrings"
  85         printf -- "$(gettext "  --refresh-keys [keyid(s)] Update specified or all keys from a keyserver")\n"
  86 }
  87
  88 version() {
  89         printf "pacman-key (pacman) %s\n" "${myver}"
  90         printf -- "$(gettext "\
  91 Copyright (c) 2010-2012 Pacman Development Team <pacman-dev@archlinux.org>.\n\
  92 This is free software; see the source for copying conditions.\n\
  93 There is NO WARRANTY, to the extent permitted by law.\n")"
  94 }
  95
  96 # read the config file "$1" which has key=value pairs, and return the key which
  97 # matches "$2". the equals sign between pairs may be surrounded by any amount
  98 # of whitespace. Optionally, "$3" can be specified which is the default value
  99 # when no key is found.
 100 get_from() {
 101         while IFS='=' read -r key value; do
 102                 [[ -z $key || ${key:0:1} = '#' ]] && continue
 103
 104                 if [[ ${key%% *} = "$2" && -n ${value##* } ]]; then
 105                         echo "${value##* }"
 106                         return 0
 107                 fi
 108         done < "$1"
 109         if [[ -n "$3" ]]; then
 110                 printf '%s\n' "$3"
 111                 return 0
 112         fi
 113         return 1
 114 }
 115
 116 generate_master_key() {
 117         # Generate the master key, which will be in both pubring and secring
 118         "${GPG_PACMAN[@]}" --gen-key --batch <<EOF
 119 %echo Generating pacman keychain master key...
 120 Key-Type: RSA
 121 Key-Length: 2048
 122 Key-Usage: sign
 123 Name-Real: Pacman Keychain Master Key
 124 Name-Email: pacman@localhost
 125 Expire-Date: 0
 126 %commit
 127 %echo Done
 128 EOF
 129 }
 130
 131 secret_keys_available() {
 132         "${GPG_PACMAN[@]}" -K --with-colons | wc -l
 133 }
 134
 135 # Adds the given gpg.conf option if it is not present in the file.
 136 # Note that if we find it commented out, we won't add the option.
 137 # args: $1 conffile, $2 option-name, $3 (optional) option-value
 138 add_gpg_conf_option() {
 139         local conffile=$1; shift
 140         # looking for the option 'bare', only leading spaces or # chars allowed,
 141         # followed by at least one space and any other text or the end of line.
 142         if ! grep -q "^[[:space:]#]*$1\([[:space:]].*\)*$" "$conffile" &>/dev/null; then
 143                 printf '%s\n' "$*" >> "$conffile"
 144         fi
 145 }
 146
 147 check_keyids_exist() {
 148         local ret=0
 149         for key in "${KEYIDS[@]}"; do
 150                 # Verify if the key exists in pacman's keyring
 151                 if ! "${GPG_PACMAN[@]}" --list-keys "$key" &>/dev/null ; then
 152                         error "$(gettext "The key identified by %s could not be found locally.")" "$key"
 153                         ret=1
 154                 fi
 155         done
 156         if (( ret )); then
 157                 exit 1
 158         fi
 159 }
 160
 161 initialize() {
 162         local conffile keyserv
 163         # Check for simple existence rather than for a directory as someone
 164         # may want to use a symlink here
 165         [[ -e ${PACMAN_KEYRING_DIR} ]] || mkdir -p -m 755 "${PACMAN_KEYRING_DIR}"
 166
 167         # keyring files
 168         [[ -f ${PACMAN_KEYRING_DIR}/pubring.gpg ]] || touch ${PACMAN_KEYRING_DIR}/pubring.gpg
 169         [[ -f ${PACMAN_KEYRING_DIR}/secring.gpg ]] || touch ${PACMAN_KEYRING_DIR}/secring.gpg
 170         [[ -f ${PACMAN_KEYRING_DIR}/trustdb.gpg ]] || "${GPG_PACMAN[@]}" --update-trustdb
 171         chmod 644 ${PACMAN_KEYRING_DIR}/{pubring,trustdb}.gpg
 172         chmod 600 ${PACMAN_KEYRING_DIR}/secring.gpg
 173
 174         # gpg.conf
 175         conffile="${PACMAN_KEYRING_DIR}/gpg.conf"
 176         [[ -f $conffile ]] || touch "$conffile"
 177         chmod 644 "$conffile"
 178         add_gpg_conf_option "$conffile" 'no-greeting'
 179         add_gpg_conf_option "$conffile" 'no-permission-warning'
 180         add_gpg_conf_option "$conffile" 'lock-never'
 181         keyserv=${KEYSERVER:-$DEFAULT_KEYSERVER}
 182         add_gpg_conf_option "$conffile" 'keyserver' "$keyserv"
 183         add_gpg_conf_option "$conffile" 'keyserver-options' 'timeout=10'
 184
 185         # set up a private signing key (if none available)
 186         if [[ $(secret_keys_available) -lt 1 ]]; then
 187                 generate_master_key
 188                 UPDATEDB=1
 189         fi
 190 }
 191
 192 check_keyring() {
 193         if [[ ! -r ${PACMAN_KEYRING_DIR}/pubring.gpg || \
 194                         ! -r ${PACMAN_KEYRING_DIR}/trustdb.gpg ]]; then
 195                 error "$(gettext "You do not have sufficient permissions to read the %s keyring.")" "pacman"
 196                 msg "$(gettext "Use '%s' to correct the keyring permissions.")" "pacman-key --init"
 197                 exit 1
 198         fi
 199
 200         if (( (EXPORT || FINGER || LIST || VERIFY) && EUID != 0 )); then
 201                 if ! grep -q "^[[:space:]]*lock-never[[:space:]]*$" ${PACMAN_KEYRING_DIR}/gpg.conf &>/dev/null; then
 202                         error "$(gettext "You do not have sufficient permissions to run this command.")"
 203                         msg "$(gettext "Use '%s' to correct the keyring permissions.")" "pacman-key --init"
 204                         exit 1
 205                 fi
 206         fi
 207
 208         if (( LSIGNKEY )); then
 209                 if [[ $(secret_keys_available) -lt 1 ]]; then
 210                         error "$(gettext "There is no secret key available to sign with.")"
 211                         msg "$(gettext "Use '%s' to generate a default secret key.")" "pacman-key --init"
 212                         exit 1
 213                 fi
 214         fi
 215 }
 216
 217 validate_with_gpg() {
 218         msg2 "$(gettext "Verifying %s...")" "$1"
 219         if [[ ! -f "$1.sig" ]]; then
 220                 error "$(gettext "File %s is unsigned, cannot continue.")" "$1"
 221                 return 1
 222         elif ! "${GPG_PACMAN[@]}" --verify "$1.sig"; then
 223                 error "$(gettext "The signature of file %s is not valid.")" "$1"
 224                 return 1
 225         fi
 226         return 0
 227 }
 228
 229 verify_keyring_input() {
 230         local ret=0;
 231         local KEYRING_IMPORT_DIR='@pkgdatadir@/keyrings'
 232
 233         # Verify signatures of keyring files and trusted/revoked files if they exist
 234         msg "$(gettext "Verifying keyring file signatures...")"
 235         local keyring keyfile
 236         for keyring in "${KEYRINGIDS[@]}"; do
 237                 keyfile="${KEYRING_IMPORT_DIR}/${keyring}.gpg"
 238                 validate_with_gpg "${keyfile}" || ret=1
 239
 240                 keyfile="${KEYRING_IMPORT_DIR}/${keyring}-trusted"
 241                 if [[ -f "${keyfile}" ]]; then
 242                         validate_with_gpg "${keyfile}" || ret=1
 243                 fi
 244
 245                 keyfile="${KEYRING_IMPORT_DIR}/${keyring}-revoked"
 246                 if [[ -f "${keyfile}" ]]; then
 247                         validate_with_gpg "${keyfile}" || ret=1
 248                 fi
 249         done
 250
 251         return $ret
 252 }
 253
 254 populate_keyring() {
 255         local KEYRING_IMPORT_DIR='@pkgdatadir@/keyrings'
 256
 257         local keyring
 258         local ret=0
 259         if [[ -z ${KEYRINGIDS[@]} ]]; then
 260                 # get list of all available keyrings
 261                 shopt -s nullglob
 262                 KEYRINGIDS=("$KEYRING_IMPORT_DIR"/*.gpg)
 263                 shopt -u nullglob
 264                 KEYRINGIDS=("${KEYRINGIDS[@]##*/}")
 265                 KEYRINGIDS=("${KEYRINGIDS[@]%.gpg}")
 266                 if [[ -z ${KEYRINGIDS[@]} ]]; then
 267                         error "$(gettext "No keyring files exist in %s.")" "$KEYRING_IMPORT_DIR"
 268                         ret=1
 269                 fi
 270         else
 271                 # verify listed keyrings exist
 272                 for keyring in "${KEYRINGIDS[@]}"; do
 273                         if [[ ! -f "$KEYRING_IMPORT_DIR/$keyring.gpg" ]]; then
 274                                 error "$(gettext "The keyring file %s does not exist.")" "$KEYRING_IMPORT_DIR/$keyring.gpg"
 275                                 ret=1
 276                         fi
 277                 done
 278         fi
 279
 280         if (( ret )); then
 281                 exit 1
 282         fi
 283
 284         verify_keyring_input || exit 1
 285
 286         # Variable used for iterating on keyrings
 287         local key
 288         local key_id
 289
 290         # Add keys from requested keyrings
 291         for keyring in "${KEYRINGIDS[@]}"; do
 292                 msg "$(gettext "Appending keys from %s.gpg...")" "$keyring"
 293                 "${GPG_PACMAN[@]}" --import "${KEYRING_IMPORT_DIR}/${keyring}.gpg"
 294         done
 295
 296         # Read the trusted key IDs to an array. Because this is an ownertrust
 297         # file, we know we have the full 40 hex digit fingerprint values.
 298         # Format of ownertrust dump file:
 299         #  40CHARFINGERPRINTXXXXXXXXXXXXXXXXXXXXXXX:6:
 300         #  40CHARFINGERPRINTXXXXXXXXXXXXXXXXXXXXXXX:5:
 301         local -A trusted_ids
 302         for keyring in "${KEYRINGIDS[@]}"; do
 303                 if [[ -f "${KEYRING_IMPORT_DIR}/${keyring}-trusted" ]]; then
 304                         while read key; do
 305                                 # skip comments; these are valid in this file
 306                                 [[ $key = \#* ]] && continue
 307                                 key_id="${key%%:*}"
 308                                 if [[ -n ${key_id} ]]; then
 309                                         # Mark this key to be lsigned
 310                                         trusted_ids[$key_id]="${keyring}"
 311                                 fi
 312                         done < "${KEYRING_IMPORT_DIR}/${keyring}-trusted"
 313                 fi
 314         done
 315
 316         if (( ${#trusted_ids[@]} > 0 )); then
 317                 msg "$(gettext "Locally signing trusted keys in keyring...")"
 318                 for key_id in "${!trusted_ids[@]}"; do
 319                         msg2 "$(gettext "Locally signing key %s...")" "${key_id}"
 320                         "${GPG_PACMAN[@]}" --quiet --lsign-key "${key_id}"
 321                 done
 322                 msg "$(gettext "Importing owner trust values...")"
 323                 for keyring in "${KEYRINGIDS[@]}"; do
 324                         if [[ -f "${KEYRING_IMPORT_DIR}/${keyring}-trusted" ]]; then
 325                                 "${GPG_PACMAN[@]}" --import-ownertrust "${KEYRING_IMPORT_DIR}/${keyring}-trusted"
 326                         fi
 327                 done
 328         fi
 329
 330         # Read the revoked key IDs to an array. The conversion from whatever is
 331         # inside the file to key ids is important, because key ids are the only
 332         # guarantee of identification for the keys.
 333         local -A revoked_ids
 334         for keyring in "${KEYRINGIDS[@]}"; do
 335                 if [[ -f "${KEYRING_IMPORT_DIR}/${keyring}-revoked" ]]; then
 336                         while read key; do
 337                                 key_id="$("${GPG_PACMAN[@]}" --quiet --with-colons --list-key "${key}" 2>/dev/null | grep ^pub | cut -d: -f5)"
 338                                 if [[ -n ${key_id} ]]; then
 339                                         # Mark this key to be disabled
 340                                         revoked_ids[$key_id]="${keyring}"
 341                                 fi
 342                         done < "${KEYRING_IMPORT_DIR}/${keyring}-revoked"
 343                 fi
 344         done
 345
 346         if (( ${#revoked_ids[@]} > 0 )); then
 347                 msg "$(gettext "Disabling revoked keys in keyring...")"
 348                 for key_id in "${!revoked_ids[@]}"; do
 349                         msg2 "$(gettext "Disabling key %s...")" "${key_id}"
 350                         printf 'disable\nquit\n' | LANG=C "${GPG_PACMAN[@]}" --command-fd 0 --quiet --batch --edit-key "${key_id}" 2>/dev/null
 351                 done
 352         fi
 353 }
 354
 355 add_keys() {
 356         if ! "${GPG_PACMAN[@]}" --quiet --batch --import "${KEYFILES[@]}" ; then
 357                 error "$(gettext "A specified keyfile could not be added to the gpg keychain.")"
 358                 exit 1
 359         fi
 360 }
 361
 362 delete_keys() {
 363         check_keyids_exist
 364         if ! "${GPG_PACMAN[@]}" --quiet --batch --delete-key --yes "${KEYIDS[@]}" ; then
 365                 error "$(gettext "A specified key could not be removed from the gpg keychain.")"
 366                 exit 1
 367         fi
 368 }
 369
 370 edit_keys() {
 371         check_keyids_exist
 372         local ret=0
 373         for key in "${KEYIDS[@]}"; do
 374                 if ! "${GPG_PACMAN[@]}" --edit-key "$key" ; then
 375                         error "$(gettext "The key identified by %s could not be edited.")" "$key"
 376                         ret=1
 377                 fi
 378         done
 379         if (( ret )); then
 380                 exit 1
 381         fi
 382 }
 383
 384 export_keys() {
 385         check_keyids_exist
 386         if ! "${GPG_PACMAN[@]}" --armor --export "${KEYIDS[@]}" ; then
 387                 error "$(gettext "A specified key could not be exported from the gpg keychain.")"
 388                 exit 1
 389         fi
 390 }
 391
 392 finger_keys() {
 393         check_keyids_exist
 394         if ! "${GPG_PACMAN[@]}" --batch --fingerprint "${KEYIDS[@]}" ; then
 395                 error "$(gettext "The fingerprint of a specified key could not be determined.")"
 396                 exit 1
 397         fi
 398 }
 399
 400 import_trustdb() {
 401         local importdir
 402         local ret=0
 403         for importdir in "${IMPORT_DIRS[@]}"; do
 404                 if [[ -f "${importdir}/trustdb.gpg" ]]; then
 405                         gpg --homedir "${importdir}" --export-ownertrust | \
 406                                 "${GPG_PACMAN[@]}" --import-ownertrust -
 407                         if (( PIPESTATUS )); then
 408                                 error "$(gettext "%s could not be imported.")" "${importdir}/trustdb.gpg"
 409                                 ret=1
 410                         fi
 411                 else
 412                         error "$(gettext "File %s does not exist and could not be imported.")" "${importdir}/trustdb.gpg"
 413                         ret=1
 414                 fi
 415         done
 416         if (( ret )); then
 417                 exit 1
 418         fi
 419 }
 420
 421 import() {
 422         local importdir
 423         local ret=0
 424         for importdir in "${IMPORT_DIRS[@]}"; do
 425                 if [[ -f "${importdir}/pubring.gpg" ]]; then
 426                         if ! "${GPG_PACMAN[@]}" --quiet --batch --import "${importdir}/pubring.gpg" ; then
 427                                 error "$(gettext "%s could not be imported.")" "${importdir}/pubring.gpg"
 428                                 ret=1
 429                         fi
 430                 else
 431                         error "$(gettext "File %s does not exist and could not be imported.")" "${importdir}/pubring.gpg"
 432                         ret=1
 433                 fi
 434         done
 435         if (( ret )); then
 436                 exit 1
 437         fi
 438 }
 439
 440 list_keys() {
 441         check_keyids_exist
 442         if ! "${GPG_PACMAN[@]}" --batch --list-keys "${KEYIDS[@]}" ; then
 443                 error "$(gettext "A specified key could not be listed.")"
 444                 exit 1
 445         fi
 446 }
 447
 448 list_sigs() {
 449         check_keyids_exist
 450         if ! "${GPG_PACMAN[@]}" --batch --list-sigs "${KEYIDS[@]}" ; then
 451                 error "$(gettext "A specified signature could not be listed.")"
 452                 exit 1
 453         fi
 454 }
 455
 456 lsign_keys() {
 457         check_keyids_exist
 458         printf 'y\ny\n' | LANG=C "${GPG_PACMAN[@]}" --command-fd 0 --quiet --batch --lsign-key "${KEYIDS[@]}" 2>/dev/null
 459         if (( PIPESTATUS[1] )); then
 460                 error "$(gettext "A specified key could not be locally signed.")"
 461                 exit 1
 462         fi
 463 }
 464
 465 receive_keys() {
 466         if ! "${GPG_PACMAN[@]}" --recv-keys "${KEYIDS[@]}" ; then
 467                 error "$(gettext "Remote key not fetched correctly from keyserver.")"
 468                 exit 1
 469         fi
 470 }
 471
 472 refresh_keys() {
 473         check_keyids_exist
 474         if ! "${GPG_PACMAN[@]}" --refresh-keys "${KEYIDS[@]}" ; then
 475                 error "$(gettext "A specified local key could not be updated from a keyserver.")"
 476                 exit 1
 477         fi
 478 }
 479
 480 verify_sig() {
 481         if ! "${GPG_PACMAN[@]}" --verify $SIGNATURE ; then
 482                 error "$(gettext "The signature identified by %s could not be verified.")" "$SIGNATURE"
 483                 exit 1
 484         fi
 485 }
 486
 487 updatedb() {
 488         msg "$(gettext "Updating trust database...")"
 489         if ! "${GPG_PACMAN[@]}" --batch --check-trustdb ; then
 490                 error "$(gettext "Trust database could not be updated.")"
 491                 exit 1
 492         fi
 493 }
 494
 495 # PROGRAM START
 496 if ! type gettext &>/dev/null; then
 497         gettext() {
 498                 echo "$@"
 499         }
 500 fi
 501
 502 OPT_SHORT="a::d:e:f::hl::r:uv:V"
 503 OPT_LONG="add::,config:,delete:,edit-key:,export::,finger::,gpgdir:"
 504 OPT_LONG+=",help,import:,import-trustdb:,init,keyserver:,list-keys::,list-sigs::"
 505 OPT_LONG+=",lsign-key:,populate::,recv-keys:,refresh-keys::,updatedb"
 506 OPT_LONG+=",verify:,version"
 507 if ! parse_options $OPT_SHORT $OPT_LONG "$@"; then
 508         echo; usage; exit 1 # E_INVALID_OPTION;
 509 fi
 510 set -- "${OPTRET[@]}"
 511 unset OPT_SHORT OPT_LONG OPTRET
 512
 513 if [[ $1 == "--" ]]; then
 514         usage;
 515         exit 0;
 516 fi
 517
 518 while true; do
 519         case "$1" in
 520                 -a|--add)         ADD=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYFILES=($1); UPDATEDB=1 ;;
 521                 --config)         shift; CONFIG=$1 ;;
 522                 -d|--delete)      DELETE=1; shift; KEYIDS=($1); UPDATEDB=1 ;;
 523                 --edit-key)       EDITKEY=1; shift; KEYIDS=($1); UPDATEDB=1 ;;
 524                 -e|--export)      EXPORT=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
 525                 -f|--finger)      FINGER=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
 526                 --gpgdir)         shift; PACMAN_KEYRING_DIR=$1 ;;
 527                 --import)         IMPORT=1; shift; IMPORT_DIRS=($1); UPDATEDB=1 ;;
 528                 --import-trustdb) IMPORT_TRUSTDB=1; shift; IMPORT_DIRS=($1); UPDATEDB=1 ;;
 529                 --init)           INIT=1 ;;
 530                 --keyserver)      shift; KEYSERVER=$1 ;;
 531                 -l|--list-keys)   LISTKEYS=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
 532                 --list-sigs)      LISTSIGS=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
 533                 --lsign-key)      LSIGNKEY=1; shift; KEYIDS=($1); UPDATEDB=1 ;;
 534                 --populate)       POPULATE=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYRINGIDS=($1); UPDATEDB=1 ;;
 535                 -r|--recv-keys)   RECEIVE=1; shift; KEYIDS=($1); UPDATEDB=1 ;;
 536                 --refresh-keys)   REFRESH=1; [[ -n $2 && ${2:0:1} != "-" ]] && shift && KEYIDS=($1) ;;
 537                 -u|--updatedb)    UPDATEDB=1 ;;
 538                 -v|--verify)      VERIFY=1; shift; SIGNATURE=$1 ;;
 539
 540                 -h|--help)        usage; exit 0 ;;
 541                 -V|--version)     version; exit 0 ;;
 542
 543                 --)               OPT_IND=0; shift; break;;
 544                 *)                usage; exit 1 ;;
 545         esac
 546         shift
 547 done
 548
 549
 550 if ! type -p gpg >/dev/null; then
 551     error "$(gettext "Cannot find the %s binary required for all %s operations.")" "gpg" "pacman-key"
 552         exit 1
 553 fi
 554
 555 if (( (ADD || DELETE || EDITKEY || IMPORT || IMPORT_TRUSTDB || INIT || LSIGNKEY || POPULATE || RECEIVE || REFRESH || UPDATEDB) && EUID != 0 )); then
 556         error "$(gettext "%s needs to be run as root for this operation.")" "pacman-key"
 557         exit 1
 558 fi
 559
 560 CONFIG=${CONFIG:-@sysconfdir@/pacman.conf}
 561 if [[ ! -r "${CONFIG}" ]]; then
 562         error "$(gettext "%s configuration file '%s' not found.")" "pacman" "$CONFIG"
 563         exit 1
 564 fi
 565
 566 # if PACMAN_KEYRING_DIR isn't assigned, try to get it from the config
 567 # file, falling back on a hard default
 568 PACMAN_KEYRING_DIR=${PACMAN_KEYRING_DIR:-$(get_from "$CONFIG" "GPGDir" "@sysconfdir@/pacman.d/gnupg")}
 569
 570 GPG_PACMAN=(gpg --homedir "${PACMAN_KEYRING_DIR}" --no-permission-warning)
 571 if [[ -n ${KEYSERVER} ]]; then
 572         GPG_PACMAN+=(--keyserver "${KEYSERVER}")
 573 fi
 574
 575 # check only a single operation has been given
 576 # don't include UPDATEDB in here as other opts can induce it
 577 numopt=$(( ADD + DELETE + EDITKEY + EXPORT + FINGER + IMPORT + IMPORT_TRUSTDB +
 578                 INIT + LISTKEYS + LISTSIGS + LSIGNKEY + POPULATE + RECEIVE + REFRESH + VERIFY ))
 579
 580 case $numopt in
 581         0)
 582                 if (( ! UPDATEDB )); then
 583                         error "$(gettext "no operation specified (use -h for help)")"
 584                         exit 1
 585                 fi
 586                 ;;
 587         [!1])
 588                 error "$(gettext "Multiple operations specified.")"
 589                 msg "$(gettext "Please run %s with each operation separately.")" "pacman-key"
 590                 exit 1
 591                 ;;
 592 esac
 593
 594 (( ! INIT )) && check_keyring
 595
 596 (( ADD )) && add_keys
 597 (( DELETE )) && delete_keys
 598 (( EDITKEY )) && edit_keys
 599 (( EXPORT )) && export_keys
 600 (( FINGER )) && finger_keys
 601 (( IMPORT )) && import
 602 (( IMPORT_TRUSTDB)) && import_trustdb
 603 (( INIT )) && initialize
 604 (( LISTKEYS )) && list_keys
 605 (( LISTSIGS )) && list_sigs
 606 (( LSIGNKEY )) && lsign_keys
 607 (( POPULATE )) && populate_keyring
 608 (( RECEIVE )) && receive_keys
 609 (( REFRESH )) && refresh_keys
 610 (( VERIFY )) && verify_sig
 611
 612 (( UPDATEDB )) && updatedb
 613
 614 exit 0
 615
 616 # vim: set ts=2 sw=2 noet: