# version 3 or later.
setup() {
- # make the core and the sphere:
- mkdir -p ${SYSDATADIR}/authentication
- mkdir -p ${GNUPGHOME_SPHERE}
- mkdir -p ${GNUPGHOME_CORE}
+ # make all needed directories
+ mkdir -p "${MADATADIR}"
+ mkdir -p "${MATMPDIR}"
+ mkdir -p "${GNUPGHOME_CORE}"
+ chmod 700 "${GNUPGHOME_CORE}"
+ mkdir -p "${GNUPGHOME_SPHERE}"
+ chmod 700 "${GNUPGHOME_SPHERE}"
+ mkdir -p "${MADATADIR}"/authorized_keys
# deliberately replace the config files via truncation
# FIXME: should we be dumping to tmp files and then moving atomically?
- cat >${GNUPGHOME_CORE}/gpg.conf <<EOF
+ cat >"${GNUPGHOME_CORE}"/gpg.conf <<EOF
# Monkeysphere trust core GnuPG configuration
# This file is maintained by the Monkeysphere software.
# Edits will be overwritten.
list-options show-uid-validity
EOF
- cat >${GNUPGHOME_SPHERE}/gpg.conf <<EOF
+ cat >"${GNUPGHOME_SPHERE}"/gpg.conf <<EOF
# Monkeysphere trust sphere GnuPG configuration
# This file is maintained by the Monkeysphere software.
# Edits will be overwritten.
no-greeting
primary-keyring ${GNUPGHOME_SPHERE}/pubring.gpg
-keyring ${GNUPGHOME_CORE}/pubring.gpg
-
list-options show-uid-validity
EOF
+ # make sure the monkeysphere user owns everything in th sphere
+ # gnupghome
+ chown -R "$MONKEYPSHER_USER" "${GNUPGHOME_SPHERE}"
+ chgrp -R "$MONKEYPSHER_USER" "${GNUPGHOME_SPHERE}"
+
+ # get fingerprint of core key. this should be empty on unconfigured systems.
local CORE_FPR=$(gpg_core --with-colons --fixed-list-mode --fingerprint --list-secret-key | grep ^fpr: | cut -f10 -d: )
if [ -z "$CORE_FPR" ] ; then
- log info "Setting up Monkeysphere authentication trust core"
+ log info "Setting up Monkeysphere authentication trust core..."
- local CORE_UID=$(printf "Monkeysphere authentication trust core UID (random string: %s)" $(head -c21 | base64))
+ local CORE_UID=$(printf "Monkeysphere authentication trust core UID (random string: %s)" $(head -c21 </dev/urandom | base64))
- if gpg_core --gen-key --batch <<EOF
-Key-Type: RSA
-Key-Length: 4096
-Key-Usage: certify
-Name-Real: $CORE_UID
+ log debug "generating monkeysphere authentication trust core key ($CORE_KEYLENGTH bits)..."
+ PEM2OPENPGP_USAGE_FLAGS=certify PEM2OPENPGP_NEWKEY=$CORE_KEYLENGTH pem2openpgp "$CORE_UID" | gpg_core --import || failure "Could not import new key for Monkeysphere authentication trust core"
-%commit
-%echo done
-EOF
- then
- CORE_FPR=$(gpg_core --with-colons --fixed-list-mode --fingerprint --list-secret-key | grep ^fpr: | cut -f10 -d: )
- if [ -z "$CORE_FPR" ] ; then
- failure "Failed to find fingerprint of Monkeysphere authentication trust core!"
- fi
- else
+ # get fingerprint of core key. should definitely not be empty at this point
+ log debug "get core key fingerprint..."
+ CORE_FPR=$(gpg_core --with-colons --fixed-list-mode --fingerprint --list-secret-key | grep ^fpr: | cut -f10 -d: )
+ if [ -z "$CORE_FPR" ] ; then
failure "Failed to create Monkeysphere authentication trust core!"
fi
else
- log verbose "This system has already set up the Monkeysphere authentication trust core"
+ log verbose "This system has already set up the Monkeysphere authentication trust core."
fi
# ensure that the authentication sphere checker has absolute ownertrust on the expected key.
+ log debug "set ultimate owner trust on core key in gpg_sphere..."
printf "%s:6:\n" "$CORE_FPR" | gpg_sphere --import-ownertrust
local ORIG_TRUST
+ log debug "check gpg_sphere owner trust set properly..."
if ORIG_TRUST=$(gpg_sphere --export-ownertrust | grep '^[^#]') ; then
- if [ "$CORE_FPR:6:" != "$ORIG_TRUST" ] ; then
+ if [ "${CORE_FPR}:6:" != "$ORIG_TRUST" ] ; then
failure "Monkeysphere authentication trust sphere should explicitly trust the core. It does not have proper ownertrust settings."
fi
else
- failure "Could not get monkeysphere-authentication trust guidleines."
+ failure "Could not get monkeysphere-authentication trust guidelines."
fi
# ensure that we're using the extended trust model (1), and that
# our preferences are reasonable (i.e. 3 marginal OR 1 fully
# trusted certifications are sufficient to grant full validity.
+ log debug "check trust level of core key..."
if [ "1:3:1" != $(gpg_sphere --with-colons --fixed-list-mode --list-keys | head -n1 | grep ^tru: cut -f3,6,7 -d:) ] ; then
- failure "monkeysphere-preference does not have the expected trust model settings"
+ failure "monkeysphere-authentication does not have the expected trust model settings."
fi
}