some small tweaks, and one tiny syntax bug fix, to ma/setup, and some

[monkeysphere.git] / src / share / ma / setup

diff --git a/src/share/ma/setup b/src/share/ma/setup
index a829a9845294dce1a614cc1707486f4ec3a0fad9..abce3af4e45dd0f5b819ed763be6b6bf9d9206d9 100644 (file)
--- a/src/share/ma/setup
+++ b/src/share/ma/setup
@@ -13,13 +13,13 @@
 
 setup() {
     # make the core and the sphere:
 
 setup() {
     # make the core and the sphere:

-    mkdir -p ${SYSDATADIR}/authentication
-    mkdir -p ${GNUPGHOME_SPHERE}
-    mkdir -p ${GNUPGHOME_CORE}
+    mkdir -p "${SYSDATADIR}"/authentication
+    mkdir -p "${GNUPGHOME_SPHERE}"
+    mkdir -p "${GNUPGHOME_CORE}"

 
     # deliberately replace the config files via truncation
     # FIXME: should we be dumping to tmp files and then moving atomically?
 
     # deliberately replace the config files via truncation
     # FIXME: should we be dumping to tmp files and then moving atomically?

-    cat >${GNUPGHOME_CORE}/gpg.conf <<EOF
+    cat >"${GNUPGHOME_CORE}"/gpg.conf <<EOF

 # Monkeysphere trust core GnuPG configuration
 # This file is maintained by the Monkeysphere software.
 # Edits will be overwritten.
 # Monkeysphere trust core GnuPG configuration
 # This file is maintained by the Monkeysphere software.
 # Edits will be overwritten.


@@ -27,7 +27,7 @@ no-greeting
 list-options show-uid-validity
 EOF
     
 list-options show-uid-validity
 EOF
     

-    cat >${GNUPGHOME_SPHERE}/gpg.conf <<EOF
+    cat >"${GNUPGHOME_SPHERE}"/gpg.conf <<EOF

 # Monkeysphere trust sphere GnuPG configuration
 # This file is maintained by the Monkeysphere software.
 # Edits will be overwritten.
 # Monkeysphere trust sphere GnuPG configuration
 # This file is maintained by the Monkeysphere software.
 # Edits will be overwritten.


@@ -38,28 +38,24 @@ keyring ${GNUPGHOME_CORE}/pubring.gpg
 list-options show-uid-validity
 EOF
 
 list-options show-uid-validity
 EOF
 

+    # fingerprint of core key.  this should be empty on unconfigured systems.

     local CORE_FPR=$(gpg_core --with-colons --fixed-list-mode --fingerprint --list-secret-key | grep ^fpr: | cut -f10 -d: )
 
     if [ -z "$CORE_FPR" ] ; then
        log info "Setting up Monkeysphere authentication trust core"
 
     local CORE_FPR=$(gpg_core --with-colons --fixed-list-mode --fingerprint --list-secret-key | grep ^fpr: | cut -f10 -d: )
 
     if [ -z "$CORE_FPR" ] ; then
        log info "Setting up Monkeysphere authentication trust core"
 

-       local CORE_UID=$(printf "Monkeysphere authentication trust core UID (random string: %s)" $(head -c21 | base64))
+       local CORE_UID=$(printf "Monkeysphere authentication trust core UID (random string: %s)" $(head -c21 </dev/urandom | base64))

     
     

-       if gpg_core --gen-key --batch <<EOF
-Key-Type: RSA
-Key-Length: 4096
-Key-Usage: certify
-Name-Real: $CORE_UID
+       local TMPLOC=$(mktemp -d ${MATMPDIR}/tmp.XXXXXXXXXX) || failure "Could not create temporary directory!"
+       ssh-keygen -q -b 2048 -t rsa -N'' "${TMPLOC}/authkey" || failure "Could not generate new key for Monkeysphere authentication trust core"

 
 

-%commit
-%echo done
-EOF
-       then
-           CORE_FPR=$(gpg_core --with-colons --fixed-list-mode --fingerprint --list-secret-key | grep ^fpr: | cut -f10 -d: )
-           if [ -z "$CORE_FPR" ] ; then
-               failure "Failed to find fingerprint of Monkeysphere authentication trust core!"
-           fi
-       else
+       # FIXME: pem2openpgp currently sets the A flag and a short
+       # expiration date.  We should set the C flag and no expiration
+       # date.
+       < "${TMPLOC}/authkey" pem2openpgp "$CORE_UID" | gpg --import || failure "Could not import new key for Monkeysphere authentication trust core"
+
+       CORE_FPR=$(gpg_core --with-colons --fixed-list-mode --fingerprint --list-secret-key | grep ^fpr: | cut -f10 -d: )
+       if [ -z "$CORE_FPR" ] ; then

            failure "Failed to create Monkeysphere authentication trust core!"
        fi
        
            failure "Failed to create Monkeysphere authentication trust core!"
        fi
        


@@ -72,11 +68,11 @@ EOF
     printf "%s:6:\n" "$CORE_FPR" | gpg_sphere --import-ownertrust
     local ORIG_TRUST
     if ORIG_TRUST=$(gpg_sphere --export-ownertrust | grep '^[^#]') ; then
     printf "%s:6:\n" "$CORE_FPR" | gpg_sphere --import-ownertrust
     local ORIG_TRUST
     if ORIG_TRUST=$(gpg_sphere --export-ownertrust | grep '^[^#]') ; then

-       if [ "$CORE_FPR:6:" != "$ORIG_TRUST" ] ; then
+       if [ "${CORE_FPR}:6:" != "$ORIG_TRUST" ] ; then

            failure "Monkeysphere authentication trust sphere should explicitly trust the core.  It does not have proper ownertrust settings."
        fi
     else
            failure "Monkeysphere authentication trust sphere should explicitly trust the core.  It does not have proper ownertrust settings."
        fi
     else

-       failure "Could not get monkeysphere-authentication trust guidleines."
+       failure "Could not get monkeysphere-authentication trust guidelines."

     fi
 
     # ensure that we're using the extended trust model (1), and that
     fi
 
     # ensure that we're using the extended trust model (1), and that