Load the key with `gpg -recv-key` and check the fingerprint in the script at the same time

Decision:

#!/bin/bash
set -e
tempName=$(mktemp)
gpg --status-fd 1 --keyserver keyserver.ubuntu.com --recv-keys $fingerprint 1> $tempName 2>/dev/null
grep "^\[GNUPG\:\] IMPORT_OK "[[:digit:]]*" "$fingerprint"$" $tempName
grep "^\[GNUPG\:\] IMPORT_RES 1" $tempName

      

        
        
        
      

    

This script will return with a non-zero exit code if the key cannot be loaded or the key server returns a malicious key. Beware: the malicious key still ends up in gpg-keyring, so if you're using it outside of the Dockerfile, you probably want to restore the original keyring afterwards. Commands to use in Dockerfile (adding rust PPA as an example):

RUN echo "deb http://ppa.launchpad.net/hansjorg/rust/ubuntu trusty main" >> /etc/apt/sources.list
RUN echo "deb-src http://ppa.launchpad.net/hansjorg/rust/ubuntu trusty main" >> /etc/apt/sources.list
RUN bash -c 'set -e;tempName=$(mktemp);apt-key adv --status-fd 1 --keyserver keyserver.ubuntu.com --recv-keys C03264CD6CADC10BFD6E708B37FD5E80BD6B6386 1> $tempName 2>/dev/null;grep "^\[GNUPG\:\] IMPORT_OK [[:digit:]]* C03264CD6CADC10BFD6E708B37FD5E80BD6B6386$" $tempName;grep "^\[GNUPG\:\] IMPORT_RES 1" $tempName'

      

        
        
        
      

    

Explanation:

The first building block to consider is the GnuPGs option --status-fd

. It tells gpg to write machine-readable output to the specified file descriptor. The file descriptor 1

always refers to stdout, so we will use that. Then we will need to find out what the output looks like --status-fd

. The documentation for this is not in the man page, but in doc/DETAILS

. Sample output looks like this:

# gpg --status-fd 1 --keyserver keyserver.ubuntu.com --recv-keys BD6B6386 2>/dev/null
[GNUPG:] IMPORTED 37FD5E80BD6B6386 Launchpad PPA for Hans Jørgen Hoel
[GNUPG:] IMPORT_OK 1 C03264CD6CADC10BFD6E708B37FD5E80BD6B6386
[GNUPG:] IMPORT_RES 1 0 1 1 0 0 0 0 0 0 0 0 0 0

      

        
        
        
      

    

So we're looking for strings IMPORT_OK

and IMPORT_RES

. The second parameter after IMPORT_OK

is the actual fingerprint of the imported key. The first parameter after IMPORT_RES

is the number of imported keys.

In the output, gpg accelerates newlines , so it is ok for lines starting with [GNUPG:]

to assert that we are not matching strings that are controlled by an attacker (for example, a name field in a key might contain \n[GNUPG:] IMPORT_OK 1 C03264CD6CADC10BFD6E708B37FD5E80BD6B6386]

and trick us into creating a match).

With grep we can match the line starting with [GNUPG] sometext

thru grep "^\[GNUPG\:\]"

, and for the whole line with grep "^\[GNUPG\:\] sometext$"

( ^

and $

represent the beginning and end of the line). According to the documentation, any number following IMPORT_OK

is fine for us, so we match with "[[:digit:]]*"

. Thus, as regular expressions we get "^\[GNUPG\:\] IMPORT_OK "[[:digit:]]*" "$fingerprint"$"

and"^\[GNUPG\:\] IMPORT_RES 1"

As we want to match the output twice, we store it in a temporary file (creating an empty temporary file with mktemp

and redirecting the output to that file). If it grep

doesn't match the strings, it returns with a nonzero error code. We can exploit this by instructing bash

to abort any error with set -e

. In general, we get:

set -e
tempName=$(mktemp)
gpg --status-fd 1 --keyserver keyserver.ubuntu.com --recv-keys $fingerprint 1> $tempName 2>/dev/null
grep "^\[GNUPG\:\] IMPORT_OK "[[:digit:]]*" "$fingerprint"$" $tempName
grep "^\[GNUPG\:\] IMPORT_RES 1" $tempName

      

        
        
        
      

    

How to use with apt

to add a repository key: apt-key

contains a command adv

to pass command line parameters directly to gpg (run the above command without redirecting the output to see the actual gpg command generated with apt-key

). Therefore, we can simply exchange gpg

with apt-key adv

to work with the repository key ring.