=item B<-u> I<yourkeyid>, B<--local-user> I<yourkeyid>
Select the key that is used for signing, in case you have more than one key.
-To sign with multiple keys at once, separate multiple keyids by comma.
+To sign with multiple keys at once, separate multiple keyids by comma. This
+option requires the key(s) to be defined through the keyid variable in the
+configuration file.
=item B<--key-file> I<file>
in the pruning step. If you select a key using B<-u> it has to be in
this list. B<REQUIRED>.
+=back
+
=head2 General settings
+=over
+
=item B<caffhome> [string]
Base directory for the files caff stores. Default: B<$HOME/.caff/>.
+=back
+
=head2 GnuPG settings
+=over
+
=item B<gpg> [string]
Path to the GnuPG binary. Default: B<gpg>.
Additional commands to pass to gpg after the "sign" command.
Default: none.
+=back
+
=head2 Keyserver settings
+=over
+
=item B<keyserver> [string]
-Keyserver to download keys from. Default: B<subkeys.pgp.net>.
+Keyserver to download keys from. Default: B<pool.sks-keyservers.net>.
=item B<no-download> [boolean]
A list of files containing keys to be imported.
+=back
+
=head2 Signing settings
+=over
+
=item B<no-sign> [boolean]
If true, then skip the signing step. Default: B<0>.
Select the key that is used for signing, in case you have more than one key.
With multiple keyids, sign with each key in turn.
+=back
+
=head2 Mail settings
+=over
+
=item B<mail> [boolean]
Whether to send mails. This is a quad-option, with which you can set the
my $VERSION = "0.0.0.$REVISION_NUMER";
+##
+# Display an error message on STDERR and then exit.
+#
+# @param $exitcode exit code status to use to end the program
+# @param $line error message to display on STDERR
+#
+sub myerror($$) {
+ my ($exitcode, $line) = @_;
+ print "[ERROR] $line\n";
+ exit $exitcode;
+};
sub mywarn($) {
my ($line) = @_;
};
@{$CONFIG{'keyid'}} = map { uc } @{$CONFIG{'keyid'}};
$CONFIG{'export-sig-age'}= 24*60*60 unless defined $CONFIG{'export-sig-age'};
- $CONFIG{'keyserver'} = 'subkeys.pgp.net' unless defined $CONFIG{'keyserver'};
+ $CONFIG{'keyserver'} = 'pool.sks-keyservers.net' unless defined $CONFIG{'keyserver'};
$CONFIG{'gpg'} = 'gpg' unless defined $CONFIG{'gpg'};
$CONFIG{'gpg-sign'} = $CONFIG{'gpg'} unless defined $CONFIG{'gpg-sign'};
$CONFIG{'gpg-delsig'} = $CONFIG{'gpg'} unless defined $CONFIG{'gpg-delsig'};
return $signed_by_me;
};
+##
+# Check the local user keys.
+#
+# This function checks if the keyids defined through the --local-user
+# command line option or set in .caffrc are valid and known to be one of the
+# keyids listed in ./caffrc. The last check ensure we have those keyids
+# available in the caff's gnupghome directory.
+#
+# @return an array containing the local user keys\n
+# (undef) if no key has been specified
+#
+sub get_local_user_keys()
+{
+ my @local_user = ();
+ my @key_list;
+
+ # No user-defined key id has been specified by the user, no need for
+ # further checks
+ if (!$CONFIG{'local-user'}) {
+ return (undef);
+ }
+
+ # Parse the list of keys
+ if (ref($CONFIG{'local-user'})) {
+ @key_list = @{$CONFIG{'local-user'}};
+ }
+ else {
+ @key_list = split /\s*,\s*/, $CONFIG{'local-user'};
+ }
+
+ # Check every key defined by the user...
+ for my $user_key (@key_list) {
+
+ $user_key =~ s/^0x//i;
+ $user_key = uc($user_key);
+
+ unless ($user_key =~ m/^([A-F0-9]{8}|[A-F0-9]{16}|[A-F0-9]{40})$/) {
+ mywarn "Local-user $user_key is not a valid keyid.";
+ next;
+ }
+
+ unless (grep (/$user_key$/, @{$CONFIG{'keyid'}})) {
+ mywarn "Local-user $user_key is not defined as one of your keyid in ./caffrc (it will not be used).";
+ next;
+ }
+
+ push (@local_user, $user_key);
+ }
+
+ # If no local-user key are valid, there is no need to go further
+ unless (defined $local_user[0]) {
+ myerror (1, "None of the local-user keys seem to be known as a keyid listed in ./caffrc.");
+ }
+
+ return @local_user;
+}
+
###################
# argument handling
$CONFIG{'no-download'} = $params->{'no-download'} if defined $params->{'no-download'};
$CONFIG{'no-sign'} = $params->{'no-sign'} if defined $params->{'no-sign'};
+$CONFIG{'no-mail'} = $params->{'no-mail'} if defined $params->{'no-mail'};
+$CONFIG{'mail'} = $params->{'mail'} if defined $params->{'mail'};
+
# If old 'no-mail' parameter, or if the 'mail' parameter is set to 'no'
-if ( $CONFIG{'no-mail'} || defined $params->{'no-mail'} ||
- ( defined $params->{'mail'} && $params->{'mail'} eq 'no' ) ) {
+if ( defined $CONFIG{'no-mail'} ||
+ ( defined $CONFIG{'mail'} && $CONFIG{'mail'} eq 'no' ) ) {
$CONFIG{'mail'} = 'no';
-} elsif ( defined $params->{'mail'} ) {
- $CONFIG{'mail'} = $params->{'mail'};
-} else {
+
+} elsif ( !defined $CONFIG{'mail'} ) {
$CONFIG{'mail'} = 'ask-yes';
}
-$CONFIG{'no-mail'} = $params->{'no-mail'} if defined $params->{'no-mail'};
-$CONFIG{'mail'} = $params->{'mail'} if defined $params->{'mail'};
-
push @{$CONFIG{'key-files'}}, @{$params->{'key-files'}} if defined $params->{'key-files'};
for my $keyid (map { split /\n/ } @ARGV) { # caff "`cat txt`" is a single argument
# import own keys
#################
for my $keyid (@{$CONFIG{'keyid'}}) {
- my $gpg = GnuPG::Interface->new();
- $gpg->call( $CONFIG{'gpg'} );
- $gpg->options->hash_init(
- 'homedir' => $GNUPGHOME,
- 'extra_args' => [ qw{ --no-auto-check-trustdb --trust-model=always --with-colons --fixed-list-mode --fast-list-mode } ] );
- $gpg->options->meta_interactive( 0 );
- my ($inputfd, $stdoutfd, $stderrfd, $statusfd, $handles) = make_gpg_fds();
- my $pid = $gpg->list_public_keys(handles => $handles, command_args => $keyid);
- my ($stdout, $stderr, $status) = readwrite_gpg('', $inputfd, $stdoutfd, $stderrfd, $statusfd);
- waitpid $pid, 0;
-
- if ($stdout eq '') {
- warn ("No data from gpg for list-key\n"); # There should be at least 'tru:' everywhere.
- };
- unless ($stdout =~ /^pub:(?:[^:]*:){3,3}$keyid:/m) {
- info("Key $keyid not found in caff's home. Getting it from your normal GnuPGHome.");
+ info("Importing key $keyid from your normal GnuPGHome.");
my $key = export_key(undef, $keyid);
if (!defined $key || $key eq '') {
warn ("Did not get key $keyid from your normal GnuPGHome\n");
warn ("Could not import $keyid into caff's gnupghome.\n");
next;
};
- }
}
########################
$CONFIG{'no-sign'} = ! ask("Continue with signing?", 1);
}
-unless ($CONFIG{'no-sign'}) {
- my @local_user;
- if ($CONFIG{'local-user'}) {
- if (ref($CONFIG{'local-user'})) {
- @local_user = @{$CONFIG{'local-user'}};
- } else {
- @local_user = split /\s*,\s*/, $CONFIG{'local-user'};
- };
- foreach (@local_user) {
- s/^0x//i;
- unless (/^([A-F0-9]{8}|[A-F0-9]{16}|[A-F0-9]{40})$/i) {
- print STDERR "Local-user $_ is not a keyid.\n";
- usage(\*STDERR, 1);
- };
- $_ = uc($_);
- };
- } else {
- @local_user = (undef);
- };
+unless ($CONFIG{'no-sign'})
+{
+ my @local_user = &get_local_user_keys();
info("Sign the following keys according to your policy, then exit gpg with 'save' after signing each key");
for my $keyid (@keyids_ok) {
Note that I did not upload your key to any keyservers. If you want this
new signature to be available to others, please upload it yourself.
With GnuPG this can be done using
- gpg --keyserver subkeys.pgp.net --send-key {$key}
+ gpg --keyserver pool.sks-keyservers.net --send-key {$key}
If you have any questions, don't hesitate to ask.