pacman-key: receive keys from WKD with -r/--recv-keys

If an email address is specified, we use --locate-key to look up the key
using WKD and keyserver as a fallback. If the key is specified as a key
ID, this doesn't work, so we use the normal keyserver-based --recv-keys.

Note that --refresh-keys still uses the keyservers exclusively for
refreshing, though the situation might potentially be improved in a new
version of GnuPG:
https://lists.gnupg.org/pipermail/gnupg-users/2019-July/062169.html

Signed-off-by: Jonas Witschel <diabonas@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>

1 files changed, 17 insertions, 8 deletions

diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in
index 117acc40..8c8ffc3f 100644
--- a/scripts/pacman-key.sh.in
+++ b/scripts/pacman-key.sh.in
@@ -461,25 +461,34 @@ lsign_keys() {
 }
 
 receive_keys() {
-	local name id keyids
+	local ret=0 name id keyids emails
 
 	# if the key is not a hex ID, do a lookup
 	for name; do
 		if [[ $name = ?(0x)+([0-9a-fA-F]) ]]; then
 			keyids+=("$name")
-		else
-			if id=$(key_lookup_from_name "$name"); then
-				keyids+=("$id")
-			fi
+		elif [[ $name = *@*.* ]]; then
+			emails+=("$name")
+		elif id=$(key_lookup_from_name "$name"); then
+			keyids+=("$id")
 		fi
 	done
 
-	(( ${#keyids[*]} > 0 )) || exit 1
+	(( ${#keyids[*]}+${#emails[*]} > 0 )) || exit 1
+
+	if (( ${#emails[*]} > 0 )) && \
+	   ! "${GPG_PACMAN[@]}" --auto-key-locate clear,nodefault,wkd,keyserver \
+	                        --locate-key "${emails[@]}" ; then
+		error "$(gettext "Remote key not fetched correctly from WKD or keyserver.")"
+		ret=1
+	fi
 
-	if ! "${GPG_PACMAN[@]}" --recv-keys "${keyids[@]}" ; then
+	if (( ${#keyids[*]} > 0 )) && ! "${GPG_PACMAN[@]}" --recv-keys "${keyids[@]}" ; then
 		error "$(gettext "Remote key not fetched correctly from keyserver.")"
-		exit 1
+		ret=1
 	fi
+
+	exit $ret
 }
 
 refresh_keys() {