summaryrefslogtreecommitdiff
path: root/files
diff options
context:
space:
mode:
Diffstat (limited to 'files')
-rw-r--r--files/plugins/check_gpg8
1 files changed, 8 insertions, 0 deletions
diff --git a/files/plugins/check_gpg b/files/plugins/check_gpg
index 1a8df84..bf4b930 100644
--- a/files/plugins/check_gpg
+++ b/files/plugins/check_gpg
@@ -82,6 +82,14 @@ if [ -z "$1" ]; then
fi
key="$1"
+# GPG is too stupid to error out when asked to refresh a key that's not in the
+# local keyring so we need to perform another call to verify this first.
+output=$( { gpg $homedir --list-key "$key" >/dev/null && gpg $homedir --refresh "$key" >/dev/null; } 2>&1 )
+if [ $? -ne 0 ]; then
+ echo "UNKNOWN: $output"
+ exit 3
+fi
+
if [ "$(gpg $homedir --check-sig "$key" | grep "^rev!")" != "" ]; then
echo "CRITICAL: key '$key' has been revoked!"
exit 1