- # get key id from user id
- #KEYID=$(gpguser2key "$USERID")
- KEYID="$USERID"
-
- echo "Receiving keys for: $USERID ($KEYID)..."
-
- # is primary key revoked && kill
- # for all associated keys (primary and sub)
- # - type "A"
- # - not revoked
- # - signed by trusted user
- # output ssh key
-
- # Receive keys into key ring
- if gpg --recv-keys --keyserver "$KEYSERVER" "$KEYID" ; then
- # convert pgp key to ssh key, and write to cache file
- KEYFILE="$AUTH_KEYS_DIR"/keys/"$USERID_HASH"
- gpgkey2ssh "$KEYID" | sed -e "s/COMMENT/$USERID/" > "$KEYFILE"
+ KEYFILE="$AUTH_KEYS_DIR"/"$USERID_HASH"
+
+ # search for key on keyserver
+ echo -n "ms: finding key for '$USERID'..."
+ RETURN=$(echo 1 | gpg --quiet --batch --command-fd 0 --with-colons --keyserver "$KEYSERVER" --search ="$USERID" 2> /dev/null)
+
+ # if the key was found...
+ if [ "$RETURN" ] ; then
+ echo " found."
+
+ # checking key attributes
+ # see /usr/share/doc/gnupg/DETAILS.gz:
+
+ PUB_INFO=$(gpg --fixed-list-mode --with-colons --list-keys --with-fingerprint ="$USERID" | grep '^pub:')
+
+ echo -n "ms: "
+
+# # if not an authorization key exit
+# if echo "$PUB_INFO" | cut -d: -f12 | grep -v -q '[aA]' ; then
+# echo "not an authorization key --> SKIPPING"
+# continue
+# fi
+
+ # if key is not fully trusted exit
+ # (this includes not revoked or expired)
+ # determine trust
+ TRUST=$(echo "$PUB_INFO" | cut -d: -f2)
+ case "$TRUST" in
+ 'i')
+ echo -n "invalid" ;;
+ 'r')
+ echo -n "revoked" ;;
+ 'e')
+ echo -n "expired" ;;
+ '-'|'q'|'n'|'m')
+ echo -n "unacceptable trust" ;;
+ 'f'|'u')
+ echo -n "fully trusted"
+ # convert pgp key to ssh key, and write to cache file
+ echo " -> generating ssh key..."
+ gpgkey2ssh "$KEYID" | sed -e "s/COMMENT/$USERID/" > "$KEYFILE"
+ continue
+ ;;
+ *)
+ echo -n "unknown trust" ;;
+ esac
+ echo " -> SKIPPING"