feature(keyringctl): use the export command purely to export keyrings

This gives more control over the export command that may be useful to
export a single packager to import it into gpg. This will also give more
flexibility to chain this function to the future verify stage.

By default the command exports the whole keyring directory.

2021-11-30 22:54:10 +01:00

2.4 KiB

Raw Blame History

archlinux-keyring

The archlinux-keyring project holds PGP packet material and tooling (keyringctl) to create the distribution keyring for Arch Linux. The keyring is used by pacman to establish the web of trust for the packagers of the distribution.

The PGP packets describing the main signing keys can be found below the keyring/main directory, while those of the packagers are located below the keyring/packager directory.

Requirements

The following packages need to be installed to be able to create a PGP keyring from the provided data structure and to install it:

make
python
sequoia-sq

Usage

Import

Import a new packager key by deriving the username from the filename.

./keyringctl import <username>.asc

Alternatively import a file or directory and override the username

./keyringctl import --name <username> <file_or_directory...>

Updates to existing keys will automatically derive the username from the known fingerprint.

./keyringctl import <file_or_directory...>

Main key imports support the same options plus a mandatory --main

./keyringctl import --main <username>.asc

Export

Export the whole keyring including main and packager to stdout

./keyringctl export

Limit to specific usernames using an output file

./keyringctl export <usernames...> --output <filename>

Only export specific certificate directories in keyring

./keyringctl export <directory...>

Installation

To install archlinux-keyring system-wide use the included Makefile:

make install

Contribute

Read our contributing guide to learn more about guidelines and how to provide fixes or improvements for the code base.

Releases

Releases of archlinux-keyring are created by its current maintainer Christian Hesse. Tags are signed using the PGP key with the ID 02FD1C7A934E614545849F19A6234074498E9CEE.

To verify a tag, first import the relevant PGP key:

gpg --auto-key-locate wkd --search-keys eworm@archlinux.org

Afterwards a tag can be verified from a clone of this repository:

git verify-tag <tag>

License

Archlinux-keyring is licensed under the terms of the GPL-3.0-or-later (see LICENSE).

2.4 KiB Raw Blame History