+ log "processing known_hosts file..."
+
+ hosts=$(meat "$KNOWN_HOSTS" | cut -d ' ' -f 1 | grep -v '^|.*$' | tr , ' ' | tr '\n' ' ')
+
+ if [ -z "$hosts" ] ; then
+ log "no hosts to process."
+ return
+ fi
+
+ # take all the hosts from the known_hosts file (first
+ # field), grep out all the hashed hosts (lines starting
+ # with '|')...
+ update_known_hosts $hosts
+}
+
+# process uids for the authorized_keys file
+process_uid_authorized_keys() {
+ local userID
+ local nKeys
+ local nKeysOK
+ local ok
+ local keyid
+
+ userID="$1"
+
+ log "processing user ID: $userID"
+
+ nKeys=0
+ nKeysOK=0
+
+ for line in $(process_user_id "$userID") ; do
+ # note that key was found
+ nKeys=$((nKeys+1))
+
+ ok=$(echo "$line" | cut -d: -f1)
+ keyid=$(echo "$line" | cut -d: -f2)
+
+ sshKey=$(gpg2ssh "$keyid")
+ if [ -z "$sshKey" ] ; then
+ log " ! key could not be translated."
+ continue
+ fi
+
+ # remove the old host key line
+ remove_line "$AUTHORIZED_KEYS" "$sshKey"
+
+ # if key OK, add new host line
+ if [ "$ok" -eq '0' ] ; then
+ # note that key was found ok
+ nKeysOK=$((nKeysOK+1))
+
+ ssh2authorized_keys "$userID" "$sshKey" >> "$AUTHORIZED_KEYS"
+ fi
+ done
+
+ # if at least one key was found...
+ if [ "$nKeys" -gt 0 ] ; then
+ # if ok keys were found, return 0
+ if [ "$nKeysOK" -gt 0 ] ; then
+ return 0
+ # else return 2
+ else
+ return 2
+ fi
+ # if no keys were found, return 1
+ else
+ return 1
+ fi
+}
+
+# update the authorized_keys files from a list of user IDs on command
+# line
+update_authorized_keys() {
+ local userID
+ local nIDs
+ local nIDsOK
+ local nIDsBAD
+
+ # the number of ids specified on command line
+ nIDs="$#"
+
+ nIDsOK=0
+ nIDsBAD=0
+
+ # set the trap to remove any lockfiles on exit
+ trap "lockfile-remove $AUTHORIZED_KEYS" EXIT
+
+ # create a lockfile on authorized_keys
+ lockfile-create "$AUTHORIZED_KEYS"
+
+ for userID ; do
+ # process the user ID, change return code if key not found for
+ # user ID
+ process_uid_authorized_keys "$userID"
+
+ # note the result
+ case "$?" in
+ 0)
+ nIDsOK=$((nIDsOK+1))
+ ;;
+ 2)
+ nIDsBAD=$((nIDsBAD+1))
+ ;;
+ esac
+
+ # touch the lockfile, for good measure.
+ lockfile-touch --oneshot "$AUTHORIZED_KEYS"
+ done
+
+ # remove the lockfile
+ lockfile-remove "$AUTHORIZED_KEYS"
+
+ # note if the authorized_keys file was updated
+ if [ "$nIDsOK" -gt 0 -o "$nIDsBAD" -gt 0 ] ; then
+ log "authorized_keys file updated."
+ fi
+
+ # if an acceptable id was found, return 0
+ if [ "$nIDsOK" -gt 0 ] ; then
+ return 0
+ # else if no ok ids were found...
+ else
+ # if no bad ids were found then no ids were found at all, and
+ # return 1
+ if [ "$nIDsBAD" -eq 0 ] ; then
+ return 1
+ # else if at least one bad id was found, return 2
+ else
+ return 2
+ fi
+ fi
+}
+
+# process an authorized_user_ids file for authorized_keys
+process_authorized_user_ids() {
+ local line
+ local nline
+ local userIDs
+
+ authorizedUserIDs="$1"
+
+ log "processing authorized_user_ids file..."
+
+ if ! meat "$authorizedUserIDs" ; then
+ log "no user IDs to process."
+ return
+ fi
+
+ nline=0
+
+ # extract user IDs from authorized_user_ids file
+ IFS=$'\n'
+ for line in $(meat "$authorizedUserIDs") ; do
+ userIDs["$nline"]="$line"
+ nline=$((nline+1))