X-Git-Url: http://git.sthu.org/?a=blobdiff_plain;f=caff%2Fcaff;h=a0a0ed64c270b2268b1430b044b39cab8e3c2a31;hb=a9630bdc99fdda11f2d20409730e777b300fabe9;hp=b946a9ab41267a81fc6382f81a368ddb393984f7;hpb=1ba34687113927410a498e2c79d6460a86207398;p=pgp-tools.git diff --git a/caff/caff b/caff/caff index b946a9a..a0a0ed6 100755 --- a/caff/caff +++ b/caff/caff @@ -56,14 +56,22 @@ sigs and sigs done by you. =over -=item B<-e>, B<--export>, B<-E>, B<--no-export> +=item B<-e>, B<--export-old> -Export/do not export old signatures. Default is to ask the user for each old +Export old signatures. Default is to ask the user for each old signature. + +=item B<-E>, B<--no-export-old> + +Do not export old signatures. Default is to ask the user for each old signature. -=item B<-m>, B<--mail>, B<-M>, B<--no-mail> +=item B<-m>, B<--mail> + +Send mail after signing. Default is to ask the user for each uid. + +=item B<-M>, B<--no-mail> -Send/do not send mail after signing. Default is to ask the user for each uid. +Do not send mail after signing. Default is to ask the user for each uid. =item B<-R>, B<--no-download> @@ -77,6 +85,10 @@ Do not sign the keys. Select the key that is used for signing, in case you have more than one key. +=item B<--key-file> I + +Import keys from file. Can be supplied more than once. + =back =head1 FILES @@ -85,11 +97,20 @@ Select the key that is used for signing, in case you have more than one key. =item $HOME/.caffrc - configuration file +=item $HOME/.caff/keys/yyyy-mm-dd/ - processed keys + +=item $HOME/.caff/gnupghome/ - caff's working dir for gpg + +=item $HOME/.caff/gnupghome/gpg.conf - gpg configuration + +useful options include use-agent, default-cert-level, etc. + =back =head1 CONFIGURATION FILE OPTIONS The configuration file is a perl script that sets values in the hash B<%CONFIG>. +The file is generated when it does not exist. Example: @@ -148,7 +169,7 @@ An additional keyid to encrypt messages to. Default: none. =item B [string] -Additional arguments to pass to gpg. Default: none. +Additional arguments to pass to gpg. Default: none. =head2 Keyserver settings @@ -161,12 +182,21 @@ Keyserver to download keys from. Default: B. If true, then skip the step of fetching keys from the keyserver. Default: B<0>. +=item B [list of files] + +A list of files containing keys to be imported. + =head2 Signing settings =item B [boolean] If true, then skip the signing step. Default: B<0>. +=item B [boolean] + +If true, then pause before continuing to the signing step. +This is useful for offline signing. Default: B<0>. + =item B [seconds] Don't export UIDs by default, on which your latest signature is older @@ -205,6 +235,10 @@ The UIDs for which signatures are included in the mail. =back +=item B [string] + +Add a Reply-To: header to messages sent. Default: none. + =item B [string] Address to send blind carbon copies to when sending mail. @@ -226,6 +260,10 @@ Default: none. http://pgp-tools.alioth.debian.org/ +=head1 SEE ALSO + +gpg(1), pgp-clean(1), /usr/share/doc/signing-party/examples/caffrc.sample. + =cut use strict; @@ -245,20 +283,118 @@ my $REVISION = '$Rev$'; my ($REVISION_NUMER) = $REVISION =~ /(\d+)/; my $VERSION = "0.0.0.$REVISION_NUMER"; + + +sub notice($) { + my ($line) = @_; + print "[NOTICE] $line\n"; +}; +sub info($) { + my ($line) = @_; + print "[INFO] $line\n"; +}; +sub debug($) { + my ($line) = @_; + #print "[DEBUG] $line\n"; +}; +sub trace($) { + my ($line) = @_; + #print "[trace] $line\n"; +}; +sub trace2($) { + my ($line) = @_; + #print "[trace2] $line\n"; +}; + + +sub generate_config() { + notice("Error: \$LOGNAME is not set.\n") unless defined $ENV{'LOGNAME'}; + my $gecos = defined $ENV{'LOGNAME'} ? (getpwnam($ENV{LOGNAME}))[6] : undef; + my $email; + my @keys; + my $hostname = `hostname -f`; + chomp $hostname; + my ($Cgecos,$Cemail,$Ckeys) = ('','',''); + if (defined $gecos) { + $gecos =~ s/,.*//; + + my $gpg = GnuPG::Interface->new(); + $gpg->call( 'gpg' ); + $gpg->options->hash_init( + 'extra_args' => [ qw{ --no-auto-check-trustdb --trust-model=always --with-colons --fixed-list-mode } ] ); + $gpg->options->meta_interactive( 0 ); + my ($inputfd, $stdoutfd, $stderrfd, $statusfd, $handles) = make_gpg_fds(); + my $pid = $gpg->list_public_keys(handles => $handles, command_args => [ $gecos ]); + my ($stdout, $stderr, $status) = readwrite_gpg('', $inputfd, $stdoutfd, $stderrfd, $statusfd); + waitpid $pid, 0; + + if ($stdout eq '') { + warn ("No data from gpg for list-key\n"); # There should be at least 'tru:' everywhere. + }; + + @keys = ($stdout =~ /^pub:[^r:]*:(?:[^:]*:){2,2}([^:]+):/mg); + unless (scalar @keys) { + info("Error: No keys were found using \"gpg --list-public-keys '$gecos'\"."); + @keys = qw{0123456789abcdef 89abcdef76543210}; + $Ckeys = '#'; + } + ($email) = ($stdout =~ /^uid:.*<(.+?@.+?)>.*:/m); + unless (defined $email) { + info("Error: No email address was found using \"gpg --list-public-keys '$gecos'\"."); + $email = $ENV{'LOGNAME'}.'@'.$hostname; + $Cemail = '#'; + } + } else { + $gecos = 'Unknown Caff User'; + $email = $ENV{'LOGNAME'}.'@'.$hostname; + @keys = qw{0123456789abcdef 89abcdef76543210}; + ($Cgecos,$Cemail,$Ckeys) = ('#','#','#'); + }; + + return < +# +# if you have a v4 key, it will simply be the last 16 digits of +# your fingerprint. +# +# Example: +# \$CONFIG{'keyid'} = [ qw{FEDCBA9876543210} ]; +# or, if you have more than one key: +# \$CONFIG{'keyid'} = [ qw{0123456789ABCDEF 89ABCDEF76543210} ]; + +$Ckeys\$CONFIG{'keyid'} = [ qw{@keys} ]; +EOT +}; + sub load_config() { my $config = $ENV{'HOME'} . '/.caffrc'; - -f $config or die "No file $config present. See caff(1).\n"; + unless (-f $config) { + print "No configfile $config present, I will use this template:\n"; + my $template = generate_config(); + print "$template\nPlease edit $config and run caff again.\n"; + open F, ">$config" or die "$config: $!"; + print F $template; + close F; + exit(1); + } unless (scalar eval `cat $config`) { die "Couldn't parse $config: $EVAL_ERROR\n" if $EVAL_ERROR; }; $CONFIG{'caffhome'}=$ENV{'HOME'}.'/.caff' unless defined $CONFIG{'caffhome'}; - die ("owner is not defined.\n") unless defined $CONFIG{'owner'}; - die ("email is not defined.\n") unless defined $CONFIG{'email'}; - die ("keyid is not defined.\n") unless defined $CONFIG{'keyid'}; - die ("keyid is not an array ref\n") unless (ref $CONFIG{'keyid'} eq 'ARRAY'); + die ("$PROGRAM_NAME: owner is not defined in $config.\n") unless defined $CONFIG{'owner'}; + die ("$PROGRAM_NAME: email is not defined in $config.\n") unless defined $CONFIG{'email'}; + die ("$PROGRAM_NAME: keyid is not defined in $config.\n") unless defined $CONFIG{'keyid'}; + die ("$PROGRAM_NAME: keyid is not an array ref in $config.\n") unless (ref $CONFIG{'keyid'} eq 'ARRAY'); for my $keyid (@{$CONFIG{'keyid'}}) { - $keyid =~ /^[A-Fa-z0-9]{16}$/ or die ("key $keyid is not a long (16 digit) keyid.\n"); + $keyid =~ /^[A-F0-9]{16}$/i or die ("$PROGRAM_NAME: key $keyid is not a long (16 digit) keyid in $config.\n"); }; @{$CONFIG{'keyid'}} = map { uc } @{$CONFIG{'keyid'}}; $CONFIG{'export-sig-age'}= 24*60*60 unless defined $CONFIG{'export-sig-age'}; @@ -269,6 +405,7 @@ sub load_config() { $CONFIG{'secret-keyring'} = $ENV{'HOME'}.'/.gnupg/secring.gpg' unless defined $CONFIG{'secret-keyring'}; $CONFIG{'no-download'} = 0 unless defined $CONFIG{'no-download'}; $CONFIG{'no-sign'} = 0 unless defined $CONFIG{'no-sign'}; + $CONFIG{'key-files'} = () unless defined $CONFIG{'key-files'}; $CONFIG{'mail-template'} = <<'EOM' unless defined $CONFIG{'mail-template'}; Hi, @@ -277,9 +414,13 @@ please find attached the user id{(scalar @uids >= 2 ? 's' : '')}. $OUT .= "\t".$uid."\n"; };} of your key {$key} signed by me. -Note that I did not upload your key to any keyservers. If you want this -new signature to be available to others, please upload it yourself. -With GnuPG this can be done using +Note that I did not upload your key to any keyservers. +If you have multiple user ids, I sent the signature for each user id +separately to that user id's associated email address. You can import +the signatures by running each through `gpg --import`. + +If you want this new signature to be available to others, please upload +it yourself. With GnuPG this can be done using gpg --keyserver subkeys.pgp.net --send-key {$key} If you have any questions, don't hesitate to ask. @@ -289,27 +430,6 @@ Regards, EOM }; -sub notice($) { - my ($line) = @_; - print "[NOTICE] $line\n"; -}; -sub info($) { - my ($line) = @_; - print "[INFO] $line\n"; -}; -sub debug($) { - my ($line) = @_; - #print "[DEBUG] $line\n"; -}; -sub trace($) { - my ($line) = @_; - #print "[trace] $line\n"; -}; -sub trace2($) { - my ($line) = @_; - #print "[trace2] $line\n"; -}; - sub make_gpg_fds() { my %fds = ( stdin => IO::Handle->new(), @@ -421,16 +541,35 @@ sub readwrite_gpg($$$$$%) { sub ask($$;$$) { my ($question, $default, $forceyes, $forceno) = @_; - return $default if $forceyes and $forceno; - return 1 if $forceyes; - return 0 if $forceno; my $answer; + my $yn = $default ? '[Y/n]' : '[y/N]'; while (1) { - print $question,' ',($default ? '[Y/n]' : '[y/N]'), ' '; + print $question,' ',$yn, ' '; + if ($forceyes && $forceno) { + print "$default (from config/command line)\n"; + return $default; + }; + if ($forceyes) { + print "YES (from config/command line)\n"; + return 1; + }; + if ($forceno) { + print "NO (from config/command line)\n"; + return 0; + }; + $answer = ; + if (!defined $answer) { + $OUTPUT_AUTOFLUSH = 1; + die "\n\n". + "End of STDIN reached. Are you using xargs? Caff wants to read from STDIN,\n". + "so you can't really use it with xargs. A patch against caff to read from\n". + "the terminal would be appreciated.\n". + "For now instead of cat keys | xargs caff do caff `cat keys`\n"; + }; chomp $answer; - last if ((defined $answer) && (length $answer <= 1)); - print "grrrrrr.\n"; + last if ((length $answer == 0) || ($answer =~ m/^[yYnN]$/) ); + print "What about $yn is so hard to understand?\nAnswer with either 'n' or 'y' or just press enter for the default.\n"; sleep 1; }; my $result = $default; @@ -484,9 +623,16 @@ sub export_key($$) { my $gpg = GnuPG::Interface->new(); $gpg->call( $CONFIG{'gpg'} ); - $gpg->options->hash_init( - 'homedir' => $gnupghome, - 'armor' => 1 ); + if (defined $gnupghome) { + $gpg->options->hash_init( + 'homedir' => $gnupghome, + 'extra_args' => [ qw{ --no-auto-check-trustdb --trust-model=always } ], + 'armor' => 1 ); + } else { + $gpg->options->hash_init( + 'extra_args' => [ qw{ --no-auto-check-trustdb --trust-model=always } ], + 'armor' => 1 ); + }; $gpg->options->meta_interactive( 0 ); my ($inputfd, $stdoutfd, $stderrfd, $statusfd, $handles) = make_gpg_fds(); my $pid = $gpg->export_keys(handles => $handles, command_args => [ $keyid ]); @@ -504,7 +650,9 @@ sub import_key($$) { my $gpg = GnuPG::Interface->new(); $gpg->call( $CONFIG{'gpg'} ); - $gpg->options->hash_init( 'homedir' => $gnupghome ); + $gpg->options->hash_init( + 'homedir' => $gnupghome, + 'extra_args' => [ qw{ --no-auto-check-trustdb --trust-model=always } ] ); $gpg->options->meta_interactive( 0 ); my ($inputfd, $stdoutfd, $stderrfd, $statusfd, $handles) = make_gpg_fds(); my $pid = $gpg->import_keys(handles => $handles); @@ -552,9 +700,9 @@ sub send_mail($$$@) { Type => "application/pgp-keys", Disposition => 'attachment', Encoding => "7bit", - Description => "PGP Key 0x$key_id, uid ".($key->{'text'}).' ('.($key->{'serial'}).')', + Description => "PGP Key 0x$key_id, uid ".($key->{'text'}).' ('.($key->{'serial'}).'), signed by 0x'.$CONFIG{'keyid'}[0], Data => $key->{'key'}, - Filename => "0x$key_id.".$key->{'serial'}.".asc"); + Filename => "0x$key_id.".$key->{'serial'}.".signed-by-0x".$CONFIG{'keyid'}[0].".asc"); }; if ($can_encrypt) { @@ -563,7 +711,7 @@ sub send_mail($$$@) { my $gpg = GnuPG::Interface->new(); $gpg->call( $CONFIG{'gpg'} ); $gpg->options->hash_init( 'homedir' => $GNUPGHOME, - 'extra_args' => '--always-trust', + 'extra_args' => [ qw{ --no-auto-check-trustdb --trust-model=always } ], 'armor' => 1 ); $gpg->options->meta_interactive( 0 ); my ($inputfd, $stdoutfd, $stderrfd, $statusfd, $handles) = make_gpg_fds(); @@ -598,6 +746,7 @@ sub send_mail($$$@) { $message_entity->head->add("Subject", "Your signed PGP key 0x$key_id"); $message_entity->head->add("To", $address); $message_entity->head->add("From", '"'.$CONFIG{'owner'}.'" <'.$CONFIG{'email'}.'>'); + $message_entity->head->add("Reply-To", $CONFIG{'reply-to'}) if defined $CONFIG{'reply-to'}; $message_entity->head->add("Bcc", $CONFIG{'bcc'}) if defined $CONFIG{'bcc'}; $message_entity->head->add("User-Agent", $USER_AGENT); $message_entity->send(); @@ -669,10 +818,10 @@ if (!GetOptions ( '-V' => \$params->{'version'}, '-u=s' => \$params->{'local-user'}, '--local-user=s' => \$params->{'local-user'}, - '-e' => \$params->{'export'}, - '--export' => \$params->{'export'}, - '-E' => \$params->{'no-export'}, - '--no-export' => \$params->{'no-export'}, + '-e' => \$params->{'export-old'}, + '--export-old' => \$params->{'export-old'}, + '-E' => \$params->{'no-export-old'}, + '--no-export-old' => \$params->{'no-export-old'}, '-m' => \$params->{'mail'}, '--mail' => \$params->{'mail'}, '-M' => \$params->{'no-mail'}, @@ -681,6 +830,7 @@ if (!GetOptions ( '--no-download' => \$params->{'no-download'}, '-S' => \$params->{'no-sign'}, '--no-sign' => \$params->{'no-sign'}, + '--key-file=s@' => \$params->{'key-files'}, )) { usage(\*STDERR, 1); }; @@ -698,7 +848,7 @@ usage(\*STDERR, 1) unless scalar @ARGV >= 1; if ($params->{'local-user'}) { $USER = $params->{'local-user'}; $USER =~ s/^0x//i; - unless ($USER =~ /^([A-Z0-9]{8}|[A-Z0-9]{16}|[A-Z0-9]{32}|[A-Z0-9]{40})$/i) { + unless ($USER =~ /^([A-F0-9]{8}|[A-F0-9]{16}|[A-F0-9]{40})$/i) { print STDERR "-u $USER is not a keyid.\n"; usage(\*STDERR, 1); }; @@ -707,7 +857,11 @@ if ($params->{'local-user'}) { for my $keyid (@ARGV) { $keyid =~ s/^0x//i; - unless ($keyid =~ /^([A-Z0-9]{8}|[A-Z0-9]{16}|[A-Z0-9]{32}|[A-Z0-9]{40})$/i) { + unless ($keyid =~ /^([A-F0-9]{8}|[A-F0-9]{16}||[A-F0-9]{40})$/i) { + if ($keyid =~ /^[A-F0-9]{32}$/) { + info("Ignoring v3 fingerprint $keyid. v3 keys are obsolete."); + next; + }; print STDERR "$keyid is not a keyid.\n"; usage(\*STDERR, 1); }; @@ -718,32 +872,59 @@ $CONFIG{'no-download'} = $params->{'no-download'} if defined $params->{'no-downl $CONFIG{'no-mail'} = $params->{'no-mail'} if defined $params->{'no-mail'}; $CONFIG{'mail'} = $params->{'mail'} if defined $params->{'mail'}; $CONFIG{'no-sign'} = $params->{'no-sign'} if defined $params->{'no-sign'}; +push @{$CONFIG{'key-files'}}, @{$params->{'key-files'}} if defined $params->{'key-files'}; ################# # import own keys ################# +for my $keyid (@{$CONFIG{'keyid'}}) { my $gpg = GnuPG::Interface->new(); $gpg->call( $CONFIG{'gpg'} ); $gpg->options->hash_init( 'homedir' => $GNUPGHOME, - 'extra_args' => '--keyserver='.$CONFIG{'keyserver'} ); + 'extra_args' => [ qw{ --no-auto-check-trustdb --trust-model=always --with-colons --fixed-list-mode --fast-list-mode } ] ); $gpg->options->meta_interactive( 0 ); my ($inputfd, $stdoutfd, $stderrfd, $statusfd, $handles) = make_gpg_fds(); - $gpg->options->hash_init( 'extra_args' => [ '--with-colons', '--fixed-list-mode' ] ); - my $pid = $gpg->list_public_keys(handles => $handles, command_args => $CONFIG{'keyid'}); + my $pid = $gpg->list_public_keys(handles => $handles, command_args => $keyid); my ($stdout, $stderr, $status) = readwrite_gpg('', $inputfd, $stdoutfd, $stderrfd, $statusfd); waitpid $pid, 0; + if ($stdout eq '') { - warn ("No data from gpg for list-key\n"); - next; + warn ("No data from gpg for list-key\n"); # There should be at least 'tru:' everywhere. }; - foreach my $keyid (@{$CONFIG{'keyid'}}) { - unless ($stdout =~ /^pub:(?:[^:]*:){3,3}$keyid:/m) { - info("Importing $keyid"); - system "gpg --export $keyid | gpg --import --homedir $GNUPGHOME"; - } + unless ($stdout =~ /^pub:(?:[^:]*:){3,3}$keyid:/m) { + info("Key $keyid not found in caff's home. Getting it from your normal GnuPGHome."); + my $key = export_key(undef, $keyid); + if (!defined $key || $key eq '') { + warn ("Did not get key $keyid from your normal GnuPGHome\n"); + next; + }; + my $result = import_key($GNUPGHOME, $key); + unless ($result) { + warn ("Could not import $keyid into caff's gnupghome.\n"); + next; + }; } +} + +######################## +# import keys from files +######################## +foreach my $keyfile (@{$CONFIG{'key-files'}}) { + my $gpg = GnuPG::Interface->new(); + $gpg->call( $CONFIG{'gpg'} ); + $gpg->options->hash_init('homedir' => $GNUPGHOME); + $gpg->options->meta_interactive( 0 ); + my ($inputfd, $stdoutfd, $stderrfd, $statusfd, $handles) = make_gpg_fds(); + my $pid = $gpg->import_keys(handles => $handles, command_args => $keyfile); + my ($stdout, $stderr, $status) = readwrite_gpg('', $inputfd, $stdoutfd, $stderrfd, $statusfd); + info ("Importing keys from $keyfile"); + waitpid $pid, 0; + if ($status !~ /^\[GNUPG:\] IMPORT_OK/m) { + warn $stderr; + } +} ############################# # receive keys from keyserver @@ -753,15 +934,12 @@ if ($CONFIG{'no-download'}) { @keyids_ok = @KEYIDS; } else { info ("fetching keys, this will take a while..."); - if (grep { /^[A-Z0-9]{32}$/ } @KEYIDS) { - info ("found v3 key fingerprints in argument list - note that HKP keyservers do not support retrieving v3 keys by fingerprint"); - } my $gpg = GnuPG::Interface->new(); $gpg->call( $CONFIG{'gpg'} ); $gpg->options->hash_init( 'homedir' => $GNUPGHOME, - 'extra_args' => '--keyserver='.$CONFIG{'keyserver'} ); + 'extra_args' => [ qw{ --no-auto-check-trustdb --trust-model=always }, '--keyserver='.$CONFIG{'keyserver'} ] ); $gpg->options->meta_interactive( 0 ); my ($inputfd, $stdoutfd, $stderrfd, $statusfd, $handles) = make_gpg_fds(); my $pid = $gpg->recv_keys(handles => $handles, command_args => [ @KEYIDS ]); @@ -773,27 +951,35 @@ if ($CONFIG{'no-download'}) { # [GNUPG:] NODATA 1 # [GNUPG:] IMPORT_OK 0 25FC1614B8F87B52FF2F99B962AF4031C82E0039 my %local_keyids = map { $_ => 1 } @KEYIDS; + my $had_v3_keys = 0; for my $line (split /\n/, $status) { - if ($line =~ /^\[GNUPG:\] IMPORT_OK \d+ ([0-9A-F]{8})([0-9A-F]{16})([0-9A-F]{8})([0-9A-F]{0,8})/) { - my $imported_key; - $imported_key = $1.$2.$3 if $local_keyids{$1.$2.$3}; # v3 key - $imported_key = $1.$2.$3.$4 if $local_keyids{$1.$2.$3.$4}; - $imported_key = $3.$4 if $local_keyids{ $3.$4}; - $imported_key = $4 if $local_keyids{ $4}; - unless ($imported_key) { - notice ("Imported unexpected key; got: $1$2$3$4. (This is normal for v3 keys.)\n"); + if ($line =~ /^\[GNUPG:\] IMPORT_OK \d+ ([0-9A-F]{40})/) { + my $imported_key = $1; + my $whole_fpr = $imported_key; + my $long_keyid = substr($imported_key, -16); + my $short_keyid = substr($imported_key, -8); + my $speced_key; + for my $spec (($whole_fpr, $long_keyid, $short_keyid)) { + $speced_key = $spec if $local_keyids{$spec}; + }; + unless ($speced_key) { + notice ("Imported unexpected key; got: $imported_key\n"); next; }; - debug ("Imported $imported_key"); - delete $local_keyids{$imported_key}; + debug ("Imported $imported_key for $speced_key"); + delete $local_keyids{$speced_key}; unshift @keyids_ok, $imported_key; } elsif ($line =~ /^\[GNUPG:\] (NODATA|IMPORT_RES|IMPORTED) /) { + } elsif ($line =~ /^\[GNUPG:\] IMPORT_OK \d+ ([0-9A-F]{32})/) { + my $imported_key = $1; + notice ("Imported key $1 is a version 3 key. Version 3 keys are obsolete, should not be used, and are not and will not be properly supported."); + $had_v3_keys = 1; } else { notice ("got unknown reply from gpg: $line"); } }; if (scalar %local_keyids) { - notice ("Import failed for: ". (join ' ', keys %local_keyids)."."); + notice ("Import failed for: ". (join ' ', keys %local_keyids)."." . ($had_v3_keys ? " (Or maybe it's one of those ugly v3 keys?)" : "")); exit 1 unless ask ("Some keys could not be imported - continue anyway?", 0); } }; @@ -806,6 +992,10 @@ unless (@keyids_ok) { ########### # sign keys ########### +if ($CONFIG{'ask-sign'} && ! $CONFIG{'no-sign'}) { + $CONFIG{'no-sign'} = ! ask("Continue with signing?", 1); +} + unless ($CONFIG{'no-sign'}) { info("Sign the following keys according to your policy, then exit gpg with 'save' after signing each key"); for my $keyid (@keyids_ok) { @@ -814,10 +1004,11 @@ unless ($CONFIG{'no-sign'}) { push @command, '--local-user', $USER if (defined $USER); push @command, "--homedir=$GNUPGHOME"; push @command, '--secret-keyring', $CONFIG{'secret-keyring'}; - push @command, split ' ', $CONFIG{'gpg-sign-args'} || ""; + push @command, '--no-auto-check-trustdb'; + push @command, '--trust-model=always'; push @command, '--edit', $keyid; push @command, 'sign'; - push @command, 'save'; + push @command, split ' ', $CONFIG{'gpg-sign-args'} || ""; print join(' ', @command),"\n"; system (@command); }; @@ -832,10 +1023,11 @@ for my $keyid (@keyids_ok) { ################# my $gpg = GnuPG::Interface->new(); $gpg->call( $CONFIG{'gpg'} ); - $gpg->options->hash_init( 'homedir' => $GNUPGHOME ); + $gpg->options->hash_init( + 'homedir' => $GNUPGHOME, + 'extra_args' => [ qw{ --no-auto-check-trustdb --trust-model=always --with-colons --fixed-list-mode } ] ); $gpg->options->meta_interactive( 0 ); my ($inputfd, $stdoutfd, $stderrfd, $statusfd, $handles) = make_gpg_fds(); - $gpg->options->hash_init( 'extra_args' => [ '--with-colons', '--fixed-list-mode' ] ); my $pid = $gpg->list_public_keys(handles => $handles, command_args => [ $keyid ]); my ($stdout, $stderr, $status) = readwrite_gpg('', $inputfd, $stdoutfd, $stderrfd, $statusfd); waitpid $pid, 0; @@ -893,7 +1085,7 @@ for my $keyid (@keyids_ok) { $gpg->call( $CONFIG{'gpg-delsig'} ); $gpg->options->hash_init( 'homedir' => $tempdir, - 'extra_args' => [ '--with-colons', '--fixed-list-mode', '--command-fd=0', '--no-tty' ] ); + 'extra_args' => [ qw{ --no-auto-check-trustdb --trust-model=always --with-colons --fixed-list-mode --command-fd=0 --no-tty } ] ); ($inputfd, $stdoutfd, $stderrfd, $statusfd, $handles) = make_gpg_fds(); $pid = $gpg->wrap_call( commands => [ '--edit' ], @@ -998,7 +1190,7 @@ for my $keyid (@keyids_ok) { if ($signed_by_me) { if ($NOW - $signed_by_me > $CONFIG{'export-sig-age'} ) { - my $write = ask("Signature on $this_uid_text is old. Export?", 0, $params->{export}, $params->{'no-export'}); + my $write = ask("Signature on $this_uid_text is old. Export?", 0, $params->{'export-old'}, $params->{'no-export-old'}); next unless $write; }; my $keydir = "$KEYSBASE/$DATE_STRING"; @@ -1039,7 +1231,7 @@ for my $keyid (@keyids_ok) { if (!$uid->{'is_uat'} && ($uid->{'text'} =~ /@/)) { my $address = $uid->{'text'}; $address =~ s/.*<(.*)>.*/$1/; - if (ask("Send mail to '$address' for $uid->{'text'}?", 1, $CONFIG{'mail'})) { + if (ask("Mail signature for $uid->{'text'} to '$address'?", 1, $CONFIG{'mail'})) { my $mail = send_mail($address, $can_encrypt, $longkeyid, $uid, @attached); my $keydir = "$KEYSBASE/$DATE_STRING";