X-Git-Url: https://codewiz.org/gitweb?a=blobdiff_plain;f=src%2Fcommon;h=d56028fa6e7b36d1d926b1c9366f50a45e3cc4e8;hb=6075397cffdceaf72dd3b430c9124c2ebb59ac65;hp=914c800a24d6d3471fc2f2eaaa477a47d085b5d2;hpb=35a6f7cf8c455318078c7f94951dbc964bb41006;p=monkeysphere.git

diff --git a/src/common b/src/common
old mode 100755
new mode 100644
index 914c800..d56028f
--- a/src/common
+++ b/src/common
@@ -23,14 +23,8 @@ failure() {
     exit ${2:-'1'}
 }
 
-# write output to stdout
-log() {
-    echo -n "ms: "
-    echo "$@"
-}
-
 # write output to stderr
-loge() {
+log() {
     echo -n "ms: " 1>&2
     echo "$@" 1>&2
 }
@@ -48,7 +42,7 @@ cutline() {
 # retrieve all keys with given user id from keyserver
 # FIXME: need to figure out how to retrieve all matching keys
 # (not just first 5)
-gpg_fetch_keys() {
+gpg_fetch_userid() {
     local id
     id="$1"
     echo 1,2,3,4,5 | \
@@ -75,6 +69,18 @@ check_capability() {
     return 0
 }
 
+# get the full fingerprint of a key ID
+get_key_fingerprint() {
+    local keyID
+
+    keyID="$1"
+
+    gpg --list-key --with-colons --fixed-list-mode \
+	--with-fingerprint "$keyID" | grep "$keyID" | \
+	grep '^fpr:' | cut -d: -f10
+}
+
+
 # convert escaped characters from gpg output back into original
 # character
 # FIXME: undo all escape character translation in with-colons gpg output
@@ -98,7 +104,7 @@ gpg2known_hosts() {
     echo -n "$host "
     gpg --export "$keyID" | \
 	openpgp2ssh "$keyID" | tr -d '\n'
-    echo "MonkeySphere${DATE}"
+    echo " MonkeySphere${DATE}"
 }
 
 # convert key from gpg to ssh authorized_keys format
@@ -109,9 +115,9 @@ gpg2authorized_keys() {
     keyID="$1"
     userID="$2"
 
-    echo -n "MonkeySphere${DATE}:${userID}"
     gpg --export "$keyID" | \
-	openpgp2ssh "$keyID"
+	openpgp2ssh "$keyID" | tr -d '\n'
+    echo " MonkeySphere${DATE}:${userID}"
 }
 
 # userid and key policy checking
@@ -145,7 +151,7 @@ process_user_id() {
     requiredPubCapability=$(echo "$REQUIRED_KEY_CAPABILITY" | tr "[:lower:]" "[:upper:]")
 
     # fetch keys from keyserver, return 1 if none found
-    gpg_fetch_keys "$userID" || return 1
+    gpg_fetch_userid "$userID" || return 1
 
     # output gpg info for (exact) userid and store
     gpgOut=$(gpg --fixed-list-mode --list-key --with-colons \
@@ -153,7 +159,7 @@ process_user_id() {
 
     # return 1 if there only "tru" lines are output from gpg
     if [ -z "$(echo "$gpgOut" | grep -v '^tru:')" ] ; then
-	loge "  key not found."
+	log "  key not found."
 	return 1
     fi
 
@@ -182,18 +188,18 @@ process_user_id() {
 
 		# check primary key validity
 		if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then
-		    loge "  unacceptable primary key validity ($validity)."
+		    log "  unacceptable primary key validity ($validity)."
 		    continue
 		fi
 		# check capability is not Disabled...
 		if check_capability "$capability" 'D' ; then
-		    loge "  key disabled."
+		    log "  key disabled."
 		    continue
 		fi
 		# check overall key capability
 		# must be Encryption and Authentication
 		if ! check_capability "$capability" $requiredPubCapability ; then
-		    loge "  unacceptable primary key capability ($capability)."
+		    log "  unacceptable primary key capability ($capability)."
 		    continue
 		fi
 
@@ -242,7 +248,7 @@ process_user_id() {
     # key cache file
     if [ "$keyOK" -a "$uidOK" -a "${keyIDs[*]}" ] ; then
 	for keyID in ${keyIDs[@]} ; do
-	    loge "  acceptable key/uid found."
+	    log "  acceptable key/uid found."
 
 	    if [ "$MODE" = 'known_hosts' ] ; then
 		# export the key
@@ -267,6 +273,36 @@ process_user_id() {
     echo "$cacheDir"/"$userIDHash"."$pubKeyID"
 }
 
+# update the cache for userid, and prompt to add file to
+# authorized_user_ids file if the userid is found in gpg
+# and not already in file.
+update_userid() {
+    local userID
+    local cacheDir
+    local userIDKeyCache
+
+    userID="$1"
+    cacheDir="$2"
+
+    log "processing userid: '$userID'"
+    userIDKeyCache=$(process_user_id "$userID" "$cacheDir")
+    if [ -z "$userIDKeyCache" ] ; then
+	return 1
+    fi
+    if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then
+	echo "the following userid is not in the authorized_user_ids file:"
+	echo "  $userID"
+	read -p "would you like to add it? [Y|n]: " OK; OK=${OK:=Y}
+	if [ ${OK/y/Y} = 'Y' ] ; then
+	    log -n "adding userid to authorized_user_ids file... "
+	    echo "$userID" >> "$AUTHORIZED_USER_IDS"
+	    echo "done."
+	else
+	    log "authorized_user_ids file untouched."
+	fi
+    fi
+}
+
 # process a host for addition to a known_host file
 process_host() {
     local host
@@ -298,11 +334,11 @@ process_known_hosts() {
     cacheDir="$2"
 
     # take all the hosts from the known_hosts file (first field),
-    # grep out all the hashed hosts (lines starting with '|')
+    # grep out all the hashed hosts (lines starting with '|')...
     cut -d ' ' -f 1 "$knownHosts" | \
     grep -v '^|.*$' | \
     while IFS=, read -r -a hosts ; do
-	# process each host
+	# ...and process each host
 	for host in ${hosts[*]} ; do
 	    process_host "$host" "$cacheDir"
 	done
@@ -398,42 +434,38 @@ process_userids_from_authorized_keys() {
     done
 }
 
-# update the cache for userid, and prompt to add file to
-# authorized_user_ids file if the userid is found in gpg
-# and not already in file.
-update_userid() {
-    local userID
-    local cacheDir
-    local userIDKeyCache
-
-    userID="$1"
-    cacheDir="$2"
-
-    log "processing userid: '$userID'"
-    userIDKeyCache=$(process_user_id "$userID" "$cacheDir")
-    if [ -z "$userIDKeyCache" ] ; then
-	return 1
-    fi
-    if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then
-	echo "the following userid is not in the authorized_user_ids file:"
-	echo "  $userID"
-	read -p "would you like to add? [Y|n]: " OK; OK=${OK:=Y}
-	if [ ${OK/y/Y} = 'Y' ] ; then
-	    log -n "  adding userid to authorized_user_ids file... "
-	    echo "$userID" >> "$AUTHORIZED_USER_IDS"
-	    echo "done."
-	fi
-    fi
-}
-
 # retrieve key from web of trust, and set owner trust to "full"
 # if key is found.
 trust_key() {
     # get the key from the key server
-    gpg --keyserver "$KEYSERVER" --recv-key "$keyID" || failure "could not retrieve key '$keyID'"
+    if ! gpg --keyserver "$KEYSERVER" --recv-key "$keyID" ; then
+	log "could not retrieve key '$keyID'"
+	return 1
+    fi
+
+    # get key fingerprint
+    fingerprint=$(get_key_fingerprint "$keyID")
+
+    # import "full" trust for fingerprint into gpg
+    echo ${fingerprint}:5: | gpg --import-ownertrust
+    if [ $? = 0 ] ; then
+	log "owner trust updated."
+    else
+	failure "there was a problem changing owner trust."
+    fi	
+}
+
+# publish server key to keyserver
+publish_server_key() {
+    read -p "really publish key to $KEYSERVER? [y|N]: " OK; OK=${OK:=N}
+    if [ ${OK/y/Y} != 'Y' ] ; then
+	failure "aborting."
+    fi
 
-    # edit the key to change trust
-    # FIXME: need to figure out how to automate this,
-    # in a batch mode or something.
-    gpg --edit-key "$keyID"
+    # publish host key
+    # FIXME: need to figure out better way to identify host key
+    # dummy command so as not to publish fakes keys during testing
+    # eventually:
+    #gpg --send-keys --keyserver "$KEYSERVER" $(hostname -f)
+    echo "NOT PUBLISHED: gpg --send-keys --keyserver $KEYSERVER $(hostname -f)"
 }