- # find all 'pub' and 'sub' lines in the gpg output, which each
- # represent a retrieved key for the user ID
- echo "$gpgOut" | cut -d: -f1,2,5,10,12 | \
- while IFS=: read -r type validity keyid uidfpr usage ; do
- case $type in
- 'pub'|'sub')
- # get the ssh key of the gpg key
- sshKeyGPG=$(gpg2ssh "$keyid")
-
- # if one of keys found matches the one offered by the
- # host, then output info
- if [ "$sshKeyGPG" = "$sshKeyOffered" ] ; then
- log "An OpenPGP key matching the ssh key offered by the host was found:"
- log
-
- # do some crazy "Here Strings" redirection to get the key to
- # ssh-keygen, since it doesn't read from stdin cleanly
- sshFingerprint=$(ssh-keygen -l -f /dev/stdin \
- <<<$(echo "$sshKeyGPG") | \
- awk '{ print $2 }')
-
- # get the sigs for the matching key
- gpgSigOut=$(gpg --check-sigs \
- --list-options show-uid-validity \
- "$keyid")
-
- # output the sigs, but only those on the user ID
- # we are looking for
- echo "$gpgSigOut" | awk '
+ # output header
+ log info <<EOF
+-------------------- Monkeysphere warning -------------------
+Monkeysphere found OpenPGP keys for this hostname, but none had full validity.
+EOF
+
+ # if the host key is retrieved from the host, check against known
+ # OpenPGP keys
+ if [ "$sshKeyOffered" ] ; then
+ # find all 'pub' and 'sub' lines in the gpg output, which each
+ # represent a retrieved key for the user ID
+ echo "$gpgOut" | cut -d: -f1,2,5,10,12 | \
+ while IFS=: read -r type validity keyid uidfpr usage ; do
+ case $type in
+ 'pub'|'sub')
+ # get the ssh key of the gpg key
+ sshKeyGPG=$(gpg2ssh "$keyid")
+
+ # if one of keys found matches the one offered by the
+ # host, then output info
+ if [ "$sshKeyGPG" = "$sshKeyOffered" ] ; then
+ log info <<EOF
+An OpenPGP key matching the ssh key offered by the host was found:
+
+EOF
+
+ sshKeyGPGFile=$(msmktempfile)
+ printf "%s" "$sshKeyGPG" >"$sshKeyGPGFile"
+ sshFingerprint=$(ssh-keygen -l -f "$sshKeyGPGFile" | \
+ awk '{ print $2 }')
+ rm -f "$sshKeyGPGFile"
+
+ # get the sigs for the matching key
+ gpgSigOut=$(gpg_user --check-sigs \
+ --list-options show-uid-validity \
+ "$keyid")
+
+ # output the sigs, but only those on the user ID
+ # we are looking for
+ echo "$gpgSigOut" | awk '