mirror of
https://github.com/NLnetLabs/unbound.git
synced 2025-12-24 08:39:51 -05:00
128 lines
4.5 KiB
Bash
Executable file
128 lines
4.5 KiB
Bash
Executable file
#!/bin/sh
|
|
# update-itar.sh - update from the interim trust anchor repository
|
|
# Copyright 2009, W.C.A. Wijngaards
|
|
# This file is BSD licensed, see doc/LICENSE.
|
|
|
|
# --- Some settings
|
|
|
|
# directory where unbound works
|
|
thedir="."
|
|
# where is the file that unbound is going to read
|
|
ub_ta_file="$thedir/anchors.mf"
|
|
# where is the itar master file format
|
|
itar_url="ftp://iana.org/itar/anchors.mf"
|
|
# where is the itar PGP signature
|
|
itar_sig="ftp://iana.org/itar/anchors.mf.sig"
|
|
|
|
# which command to fetch urls, cmd $dest $url. "wget -O" "curl -o"
|
|
fetch_cmd="wget -O"
|
|
# file with pgp public key
|
|
pgp_pub_key_file="$thedir/update-itar.key"
|
|
# our pgp keyring (goes into .gnupg directory)
|
|
pgp_keyring_file="update-itar.ring"
|
|
# pgp command to use
|
|
pgp_cmd="gpg"
|
|
|
|
|
|
# --- The script is below
|
|
usage ( )
|
|
{
|
|
echo "usage: update-itar"
|
|
echo " Updates the trust anchors from the interim trust"
|
|
echo " anchor repository, https://itar.iana.org, and checks PGP sig."
|
|
echo
|
|
echo " Updates $ub_ta_file with the latest keys."
|
|
echo " Read that file from the unbound config with"
|
|
echo " trust-anchor-file: "'"'"$ub_ta_file"'"'
|
|
echo
|
|
echo " Exit code 0 means anchors updated, 1 no changes, "
|
|
echo " others are errors. So, in a cronjob you can do:"
|
|
echo " cd /usr/local/etc/unbound # your unbound work dir"
|
|
echo " ./update-itar.sh && unbound-control reload"
|
|
exit 2
|
|
}
|
|
|
|
if test $# -ne 0; then
|
|
usage
|
|
fi
|
|
tmpf="/tmp/update-itar.$$"
|
|
|
|
# one argument: explanation string
|
|
error_exit ( )
|
|
{
|
|
if test -f $tmpf.log; then cat $tmpf.log; fi
|
|
rm -f $tmpf $tmpf.sig $tmpf.log
|
|
echo "Error updating trust anchors: $1"
|
|
exit 2
|
|
}
|
|
|
|
if test ! -f $pgp_pub_key_file || test ! -f $HOME/.gnupg/$pgp_keyring_file || \
|
|
test "$pgp_pub_key_file" -nt $HOME/.gnupg/$pgp_keyring_file; then
|
|
# default key contents right here
|
|
if test ! -f $pgp_pub_key_file; then
|
|
echo "creating default IANA ITAR pgp key file"
|
|
cat >$pgp_pub_key_file <<EOF
|
|
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
|
Version: GnuPG v1.4.5
|
|
|
|
mQGiBElr2DcRBAC+6YK6eSP7rzstvnMPQXMrpvVfuIR5FeTpGuwae9JP78V/iOXr
|
|
N0yW8Dn6kdAztCMuRizL1Ij9IgaD7pjn8h09VgR4cN4LDv75rcQeWLzNxKy4UNRF
|
|
aStL77RcIoTblBeCgHAK9FLzd0XfTGZCNaLNy9BYVSLyADOVDIqgBcrvBwCglz03
|
|
QhOMIgaSx/XuRh6kYtynZ6kD/2GXx6pFs57b7rww8yOpdurCSOMB1wuEXiIXznTI
|
|
06ARiib0G5VDvOdpy0LDU2526Q9f/WAERlhcExTgnTFigG4mRksUiDrrai4GIr+6
|
|
JaivcGFVYdZZ4mZ088jcwujS/UY3C0ryGR9ufYUDAnfx6frhSl6o6j5is+jeGndF
|
|
JYRAA/9B/1OXNVwFSiIxnP2aPUwsT1li1vaW8dhA/5PcuPLOVvEjPc1Pc16HGLhE
|
|
8CRmMn66LqB1ccInE5hLKGGvV3pctjan+IOhaq3OHt/a+buDtTPgykchMZ2k1AzT
|
|
RYk+gksxpIl6yTZsBH4hoRt8auxEJW8AiYbNtXXkNuWcoQL40bQsSUFOQSBUcnVz
|
|
dCBBbmNob3IgUmVwb3NpdG9yeSA8aXRhckBpYW5hLm9yZz6IYAQTEQIAIAUCSWvY
|
|
NwIbAwYLCQgHAwIEFQIIAwQWAgMBAh4BAheAAAoJEPR9+zCB1GT0GUAAn29/TacF
|
|
Teh87dls8pmkjxS4pKf1AKCJS/MvzR54AblO4DNMyc9q0G4frrkCDQRJa9g3EAgA
|
|
ywoLxF4HVb9o926UIXw8JxNIzDPkt8galAcKRUmHQMNa/QA80WMl9Ia6DIxavGlV
|
|
I5O1fvms297RV2KSSBjKWn6G+0me80A7aw0eHNg7habM5VtzDz5DhJbQFdJV9aYV
|
|
DoTSnY6uR6iSSRrdZNaYdlCwDS8lBCnOKoGMArHzVCa2EdCBeCUY/eObOXtu8Gm3
|
|
nDkuWeLPv08/0lvtr6d6VoDUEVPEsJAPONEYtpz/D+EZddUraF+3JscWqfRApBOz
|
|
/8WHaeTNdzIH+h1ntktiizA6eH40EM6coQQxtIRsxg1DPTxofdovreMkcMI0EUUP
|
|
awDn8gDtgG3g6Ud5zCdknwAEDQf/W3rxrEN6OZxJvWti8Iu6KOgxtuINiAsimPPX
|
|
qy9KHowyEE9EMPzgADjWC9Reyusr4CwcootjWw7ryUwU0fXvVULKhg32NzLsx/Ci
|
|
WtgCPSR58WZ1KKhnoB05+PTrwzhU+u64Cd/vJtFqGxSrANl2FAkPswHJMr8dMwAz
|
|
uni7zzLJ+homW1T5AaixwmN3jeDHWshJH9E9JIhr5Y/8AzMl1V10r2u1c2ej0lBJ
|
|
Y4GegI5cYAEBerS9d+mrbPlvbJ8AfuAuEf0y/PWJh0z1+Kck5qIbXMn/rpMBYvLJ
|
|
Uj5CfqWlh8+hxqSYJDXtLm8hBiQFiMEew0jOc2Tw4F91OZ+jyYhJBBgRAgAJBQJJ
|
|
a9g3AhsMAAoJEPR9+zCB1GT0AUwAn2ZtBwAyVxppdeTqilXufUvAkvjbAJ9dUpR1
|
|
9a17/5BvDDJcIxSEKTJmDw==
|
|
=zCNZ
|
|
-----END PGP PUBLIC KEY BLOCK-----
|
|
EOF
|
|
fi
|
|
# import the new key
|
|
$pgp_cmd --no-default-keyring --keyring $pgp_keyring_file \
|
|
--primary-keyring $pgp_keyring_file \
|
|
--import $pgp_pub_key_file >$tmpf.log 2>&1 \
|
|
|| error_exit "could not import pgp public key into keyring"
|
|
fi
|
|
|
|
$fetch_cmd $tmpf $itar_url >$tmpf.log 2>&1 \
|
|
|| error_exit "fetching $itar_url failed"
|
|
tail -2 $tmpf | grep "; End of file" >/dev/null 2>&1 || \
|
|
error_exit "The file fetched from $itar_url was partial"
|
|
$fetch_cmd $tmpf.sig $itar_sig >$tmpf.log 2>&1 \
|
|
|| error_exit "fetching $itar_sig failed"
|
|
|
|
# check the file with pgp
|
|
$pgp_cmd --no-default-keyring --keyring $pgp_keyring_file \
|
|
--verify $tmpf.sig $tmpf >$tmpf.log 2>&1 \
|
|
|| error_exit "the PGP signature failed!"
|
|
|
|
# check for differences
|
|
val=1
|
|
if diff "$ub_ta_file" $tmpf 2>/dev/null ; then
|
|
# echo "The interim trust anchor repository did not change."
|
|
:
|
|
else
|
|
echo "Updating $ub_ta_file"
|
|
cp $tmpf $ub_ta_file
|
|
val=0
|
|
fi
|
|
|
|
rm -f $tmpf $tmpf.sig $tmpf.log
|
|
exit $val
|