clean up option parsing and key checking in gen_key function,

including adding checking for validity of existing authentication
subkeys.

diff --git a/packaging/debian/changelog b/packaging/debian/changelog
index 45deaabebaf40064227984547eb6dc297d5e1083..a282c588b80c3b4c0eb3601f4b8d8c993b711c40 100644 (file)
--- a/packaging/debian/changelog
+++ b/packaging/debian/changelog
@@ -6,8 +6,10 @@ monkeysphere (0.23~pre-1) UNRELEASED; urgency=low
     - add checks for root users, for functions where it is required.
     - get rid of getopts.
     - added version output option
+    - check that existing authentication keys are valid in gen_key
+      function.
 
- -- Jameson Graef Rollins <jrollins@finestructure.net>  Sun, 28 Dec 2008 15:54:21 -0500
+ -- Jameson Graef Rollins <jrollins@finestructure.net>  Tue, 30 Dec 2008 20:21:16 -0500
 
 monkeysphere (0.22-1) unstable; urgency=low
 

diff --git a/src/monkeysphere b/src/monkeysphere
index 98531d20ef677e6e9efdda48aea04c07051b617c..5444cb012156adb91730046e9b1602153a99f549 100755 (executable)
--- a/src/monkeysphere
+++ b/src/monkeysphere
@@ -84,42 +84,59 @@ Type '$PGRM help' for usage."
        esac
     done
 
-    if [ -z "$1" ] ; then
-       # find all secret keys
-       keyID=$(gpg --with-colons --list-secret-keys | grep ^sec | cut -f5 -d: | sort -u)
-       # if multiple sec keys exist, fail
-       if (( $(echo "$keyID" | wc -l) > 1 )) ; then
-           echo "Multiple secret keys found:"
-           echo "$keyID"
+    case "$#" in
+       0)
+           gpgSecOut=$(gpg --quiet --fixed-list-mode --list-secret-keys --with-colons 2>/dev/null | egrep '^sec:')
+           ;;
+       1)
+           gpgSecOut=$(gpg --quiet --fixed-list-mode --list-secret-keys --with-colons "$1" | egrep '^sec:') || failure
+           ;;
+       *)
+           failure "You must specify only a single primary key ID."
+           ;;
+    esac
+
+    # check that only a single secret key was found
+    case $(echo "$gpgSecOut" | grep -c '^sec:') in
+       0)
+           failure "No secret keys found.  Create an OpenPGP key with the following command:
+ gpg --gen-key"
+           ;;
+       1)
+           keyID=$(echo "$gpgSecOut" | cut -d: -f5)
+           ;;
+       *)
+           echo "Multiple primary secret keys found:"
+           echo "$gpgSecOut" | cut -d: -f5
            failure "Please specify which primary key to use."
+           ;;
+    esac
+
+    # check that a valid authentication key does not already exist
+    IFS=$'\n'
+    for line in $(gpg --quiet --fixed-list-mode --list-keys --with-colons "$keyID") ; do
+       type=$(echo "$line" | cut -d: -f1)
+       validity=$(echo "$line" | cut -d: -f2)
+       usage=$(echo "$line" | cut -d: -f12)
+
+       # look at keys only
+       if [ "$type" != 'pub' -a "$type" != 'sub' ] ; then
+           continue
        fi
-    else
-       keyID="$1"
-    fi
-    if [ -z "$keyID" ] ; then
-       failure "You have no secret key available.  You should create an OpenPGP
-key before joining the monkeysphere. You can do this with:
-   gpg --gen-key"
-    fi
-
-    # get key output, and fail if not found
-    gpgOut=$(gpg --quiet --fixed-list-mode --list-secret-keys --with-colons \
-       "$keyID") || failure
-
-    # fail if multiple sec lines are returned, which means the id
-    # given is not unique
-    if [ $(echo "$gpgOut" | grep -c '^sec:') -gt '1' ] ; then
-       failure "Key ID '$keyID' is not unique."
-    fi
-
-    # prompt if an authentication subkey already exists
-    if echo "$gpgOut" | egrep "^(sec|ssb):" | cut -d: -f 12 | grep -q a ; then
-       echo "An authentication subkey already exists for key '$keyID'."
-       read -p "Are you sure you would like to generate another one? (y/N) " OK; OK=${OK:N}
-       if [ "${OK/y/Y}" != 'Y' ] ; then
-           failure "aborting."
+       # check for authentication capability
+       if ! check_capability "$usage" 'a' ; then
+           continue
        fi
-    fi
+       # if authentication key is valid, prompt to continue
+       if [ "$validity" = 'u' ] ; then
+           echo "A valid authentication key already exists for primary key '$keyID'."
+           read -p "Are you sure you would like to generate another one? (y/N) " OK; OK=${OK:N}
+           if [ "${OK/y/Y}" != 'Y' ] ; then
+               failure "aborting."
+           fi
+           break
+       fi
+    done
 
     # set subkey defaults
     # prompt about key expiration if not specified
@@ -144,6 +161,7 @@ EOF
     (umask 077 && mkfifo "$fifoDir/pass")
     echo "$editCommands" | gpg --passphrase-fd 3 3< "$fifoDir/pass" --expert --command-fd 0 --edit-key "$keyID" &
 
+    # FIXME: this needs to fail more gracefully if the passphrase is incorrect
     passphrase_prompt  "Please enter your passphrase for $keyID: " "$fifoDir/pass"
 
     rm -rf "$fifoDir"