Verified Commit e5a2665a authored by David Runge's avatar David Runge 🐿
Browse files

Script to refresh existing keys of archlinux-keyring

Add script to refresh existing keys of archlinux-keyring on user
systems based on the state of the distribution's Web Key Directory
Invalid or revoked keys are ignored.
parent 11c500a1
# SPDX-License-Identifier: GPL-3.0-or-later
# Update all locally existing PGP keys in pacman's gnupg keyring, that are
# relevant for Arch Linux packaging using the distribution's Web Key Directory
# (WKD).
# This ensures, that new signatures on already existing keys are fetched before
# a new version of archlinux-keyring is installed. Fetching signatures early
# prevents marginal trust issues with packages that are signed by keys which
# only gain full trust when updating to a new version of archlinux-keyring in
# that same system upgrade action.
set -eu
readonly main_key_domain_match="$"
readonly packager_domain_match="$"
readonly homedir="$(pacman-conf GPGDir)"
# force update a key using WKD
# a list of <fingerprint> <mbox> tuples of all keys in the keyring
# e.g.:
# C7E7849466FE2358343588377258734B41C31549
# 8FC15A064950A99DD1BD14DD39E4B877E62EB915
gpg --homedir "$homedir" --no-permission-warning --list-keys --list-options show-only-fpr-mbox
# a list of <fingerprints> of all revoked keys and keys that have no valid main
# key signatures
gpg --homedir "$homedir" --no-permission-warning --list-keys --with-colons |
awk -F: '$1 == "pub" && $2 ~ /-|q|r/ { getline; print $10 }'
if (( EUID != 0 )); then
printf "This script must be run as root.\n" >&2
exit 1
# first update the main signing keys, then the packager keys
for domain_match in "$main_key_domain_match" "$packager_domain_match"; do
while read -ra fpr_email; do
if [[ ${fpr_email[1]} =~ $domain_match && ! "$old_fingerprints" =~ ${fpr_email[0]} ]]; then
printf "Refreshing key %s with UID %s...\n" "${fpr_email[0]}" "${fpr_email[1]}"
"${gpg_locate_external[@]}" "${fpr_email[1]}"
printf "Skipping key %s with UID %s...\n" "${fpr_email[0]}" "${fpr_email[1]}"
done <<< "$fingerprint_mboxes"
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment