# caff -- CA - Fire and Forget
# $Id$
#
-# Copyright (c) 2004 Peter Palfrader <peter@palfrader.org>
+# Copyright (c) 2004
, 2005 Peter Palfrader <peter@palfrader.org>
#
# All rights reserved.
#
=over
-=item B<caff> [-u I<yourkeyid>] I<keyid> [I<keyid> ..]
+=item B<caff> [-mMR] [-u I<yourkeyid>] I<keyid> [I<keyid> ..]
=back
=over
+=item B<-m> B<-M>
+
+Send/do not send mail after signing. Default is to ask the user for each uid.
+
+=item B<-R>
+
+Do not retrieve the key to be signed from a keyserver.
+
=item B<-u> I<yourkeyid>
Select the key that is used for signing, in case you have more than one key.
Example:
- $CONFIG{'owner'} = 'Peter Palfrader';
- $CONFIG{'email'} = 'peter@palfrader.org';
+ $CONFIG{owner} = q{Peter Palfrader};
+ $CONFIG{email} = q{peter@palfrader.org};
+ $CONFIG{keyid} = [ qw{DE7AAF6E94C09C7F 62AF4031C82E0039} ];
=head2 Valid keys
=item B<gpg-delsig> [string]
-Path to the GnuPG binary which is used to split off signatures. This is
-needed while the upstream GnuPG is not fixed (there are 2 bugs in the
-Debian Bug Tracking System). Default: what B<gpg> is set to.
+Path to the GnuPG binary which is used to split off signatures. This was
+needed while the upstream GnuPG was not fixed. Default: what B<gpg>
+is set to.
=item B<secret-keyring> [string]
Peter Palfrader <peter@palfrader.org>
+=head1 WEBSITE
+
+http://pgp-tools.alioth.debian.org/
+
=cut
use strict;
use MIME::Entity;
use Fcntl;
use IO::Select;
+use Getopt::Std;
use GnuPG::Interface;
my %CONFIG;
sub load_config() {
my $config = $ENV{'HOME'} . '/.caffrc';
- -f $config or die "No file $config present. See caffrc(5).\n";
+ -f $config or die "No file $config present. See caff(1).\n";
unless (scalar eval `cat $config`) {
die "Couldn't parse $config: $EVAL_ERROR\n" if $EVAL_ERROR;
};
trace("Entering readwrite_gpg.");
- my ($first_line, $dummy) = split /\n/, $in;
+ my ($first_line, undef) = split /\n/, $in;
debug("readwrite_gpg sends ".(defined $first_line ? $first_line : "<nothing>"));
local $INPUT_RECORD_SEPARATOR = undef;
my $KEYEDIT_DELSUBKEY_PROMPT = '^\[GNUPG:\] GET_BOOL keyedit.remove.subkey';
load_config;
-my $USER_AGENT = "caff $VERSION - (c) 2004 Peter Palfrader";
+my $USER_AGENT = "caff $VERSION - (c) 2004, 2005 Peter Palfrader";
my $KEYSBASE = $CONFIG{'caffhome'}.'/keys';
my $GNUPGHOME = $CONFIG{'caffhome'}.'/gnupghome';
sub usage() {
- print STDERR "caff $VERSION - (c) 2004 Peter Palfrader\n";
- print STDERR "Usage: $PROGRAM_NAME [-u <yourkeyid] <keyid> [<keyid> ...]\n";
+ print STDERR "caff $VERSION - (c) 2004, 2005 Peter Palfrader\n";
+ print STDERR "Usage: $PROGRAM_NAME [-mMR] [-u <yourkeyid>] <keyid> [<keyid> ...]\n";
exit 1;
};
my $USER;
my @KEYIDS;
+my %opt;
+
+getopts('mMRu:', \%opt);
usage() unless scalar @ARGV >= 1;
-if ($ARGV[0] eq '-u') {
- usage() unless scalar @ARGV >= 3;
- shift @ARGV;
- $USER = shift @ARGV;
+if ($opt{u}) {
+ $USER = $opt{u};
+ $USER =~ s/^0x//i;
unless ($USER =~ /^[A-Za-z0-9]{8,8}([A-Za-z0-9]{8})?$/) {
print STDERR "-u $USER is not a keyid.\n";
usage();
$USER = uc($USER);
};
for my $keyid (@ARGV) {
- unless ($keyid =~ /^[A-Za-z0-9]{8}([A-Za-z0-9]{8})?$/) {
+ $keyid =~ s/^0x//i;
+ unless ($keyid =~ /^[A-Za-z0-9]{8}([A-Za-z0-9]{8}|[A-Za-z0-9]{32})?$/) {
print STDERR "$keyid is not a keyid.\n";
usage();
};
+#################
+# import own keys
+#################
+ my $gpg = GnuPG::Interface->new();
+ $gpg->call( $CONFIG{'gpg'} );
+ $gpg->options->hash_init(
+ 'homedir' => $GNUPGHOME,
+ 'extra_args' => '--keyserver='.$CONFIG{'keyserver'} );
+ $gpg->options->meta_interactive( 0 );
+ my ($inputfd, $stdoutfd, $stderrfd, $statusfd, $handles) = make_gpg_fds();
+ $gpg->options->hash_init( 'extra_args' => [ '--with-colons', '--fixed-list-mode' ] );
+ my $pid = $gpg->list_public_keys(handles => $handles, command_args => $CONFIG{'keyid'});
+ my ($stdout, $stderr, $status) = readwrite_gpg('', $inputfd, $stdoutfd, $stderrfd, $statusfd);
+ waitpid $pid, 0;
+ if ($stdout eq '') {
+ warn ("No data from gpg for list-key\n");
+ next;
+ };
+ foreach my $keyid (@{$CONFIG{'keyid'}}) {
+ unless ($stdout =~ /^pub:(?:[^:]*:){3,3}$keyid:/m) {
+ info("Importing $keyid");
+ system "gpg --export $keyid | gpg --import --homedir $GNUPGHOME";
+ }
+ }
+
#############################
# receive keys from keyserver
#############################
my @keyids_ok;
my @keyids_failed;
-if ($CONFIG{'no-download'}) {
+if ($CONFIG{'no-download'} or $opt{R}) {
@keyids_ok = @KEYIDS;
} else {
my $gpg = GnuPG::Interface->new();
$gpg->options->meta_interactive( 0 );
my ($inputfd, $stdoutfd, $stderrfd, $statusfd, $handles) = make_gpg_fds();
- my $pid = $gpg->recv_keys(handles => $handles, command_args => [ @KEYIDS ]);
- my ($stdout, $stderr, $status) = readwrite_gpg('', $inputfd, $stdoutfd, $stderrfd, $statusfd);
- waitpid $pid, 0;
+ my @local_keyids = @KEYIDS;
+ for my $keyid (@local_keyids) {
+ info ("fetching $keyid...");
+ my $pid = $gpg->recv_keys(handles => $handles, command_args => [ $keyid ]);
+ my ($stdout, $stderr, $status) = readwrite_gpg('', $inputfd, $stdoutfd, $stderrfd, $statusfd);
+ waitpid $pid, 0;
# [GNUPG:] IMPORT_OK 0 5B00C96D5D54AEE1206BAF84DE7AAF6E94C09C7F
# [GNUPG:] NODATA 1
# [GNUPG:] NODATA 1
# [GNUPG:] IMPORT_OK 0 25FC1614B8F87B52FF2F99B962AF4031C82E0039
- for my $line (split /\n/, $status) {
- if ($line =~ /^\[GNUPG:\] IMPORT_OK/) {
- push @keyids_ok, shift @KEYIDS;
- } elsif ($line =~ /^\[GNUPG:\] NODATA/) {
- push @keyids_failed, shift @KEYIDS;
+ my $handled = 0;
+ for my $line (split /\n/, $status) {
+ if ($line =~ /^\[GNUPG:\] IMPORT_OK \d+ ([0-9A-F]{40})/) {
+ my $imported_key = $1;
+ if ($keyid ne $imported_key &&
+ $keyid ne substr($imported_key, -16) &&
+ $keyid ne substr($imported_key, -8)) {
+ warn("Imported unexpected key. expected: $keyid; got: $imported_key.\n");
+ next;
+ };
+ push @keyids_ok, $keyid;
+ shift @KEYIDS;
+ $handled = 1;
+ last;
+ } elsif ($line =~ /^\[GNUPG:\] NODATA/) {
+ push @keyids_failed, $keyid;
+ shift @KEYIDS;
+ $handled = 1;
+ last;
+ };
};
- }
+ unless ($handled) {
+ notice ("Huh, what's up with $keyid?");
+ push @keyids_failed, $keyid;
+ shift @KEYIDS;
+ };
+ };
die ("Still keys in \@KEYIDS. This should not happen.") if scalar @KEYIDS;
notice ("Import failed for: ". (join ' ', @keyids_failed).".") if scalar @keyids_failed;
};
# sign keys
###########
unless ($CONFIG{'no-sign'}) {
- info("Sign the following keys according to your policy...");
+ info("Sign the following keys according to your policy, then exit gpg with 'save' after signing each key");
for my $keyid (@keyids_ok) {
my @command;
push @command, $CONFIG{'gpg-sign'};
push @command, '--local-user', $USER if (defined $USER);
push @command, "--homedir=$GNUPGHOME";
push @command, '--secret-keyring', $CONFIG{'secret-keyring'};
- push @command, '--sign-key', $keyid;
+ push @command, '--edit', $keyid;
+ push @command, 'sign';
print join(' ', @command),"\n";
system (@command);
};
warn ("No data from gpg for list-key $keyid\n");
next;
};
- my $keyinfo = $stdout;
my @publine = grep { /^pub/ } (split /\n/, $stdout);
- my ($dummy1, $dummy2, $dummy3, $dummy4, $longkeyid, $dummy6, $dummy7, $dummy8, $dummy9, $dummy10, $dummy11, $flags) = split /:/, pop @publine;
- my $can_encrypt = $flags =~ /E/;
+ my (undef, undef, undef, undef, $longkeyid, undef, undef, undef, undef, undef, undef, $flags) = split /:/, pop @publine;
+ if (scalar @publine > 0) {
+ warn ("More than one key matched $keyid. Try to specify the long keyid or fingerprint\n");
+ next;
+ };
unless (defined $longkeyid) {
- warn ("Didn't find public keyid in edit dialog of key $keyid.\n");
+ warn ("Didn't find public keyid in --list-key of key $keyid.\n");
next;
};
+ unless (defined $flags) {
+ warn ("Didn't find flags in --list-key of key $keyid.\n");
+ next;
+ };
+ my $can_encrypt = $flags =~ /E/;
# export the key
################
debug("Parsing stdout output.");
for my $line (split /\n/, $stdout) {
debug("Checking line $line");
- my ($type, $dummy2, $dummy3, $dummy4, $dummy5, $dummy6, $dummy7, $dummy8, $dummy9, $uidtext) = split /:/, $line;
+ my ($type, undef, undef, undef, undef, undef, undef, undef, undef, $uidtext) = split /:/, $line;
if ($type eq 'sub') {
$number_of_subkeys++;
};
my $answer = "no";
if (defined $line) { # only if we found a sig here - we never remove revocation packets for instance
debug("[sigremoval] doing line $line.");
- my ($dummy1, $dummy2, $dummy3, $dummy4, $signer, $created, $dummy7, $dummy8, $dummy9) = split /:/, $line;
+ my (undef, undef, undef, undef, $signer, $created, undef, undef, undef) = split /:/, $line;
if ($signer eq $longkeyid) {
debug("[sigremoval] selfsig ($signer).");
$answer = "no";
readwrite_gpg("save\n", $inputfd, $stdoutfd, $stderrfd, $statusfd);
waitpid $pid, 0;
- my $asciikey = export_key($tempdir, $longkeyid);
+ my $asciikey = export_key($tempdir, $keyid);
if ($asciikey eq '') {
- warn ("No data from gpg for export $longkeyid\n");
+ warn ("No data from gpg for export $keyid\n");
next;
};
if (scalar @UIDS == 0) {
info("found no signed uids for $keyid");
} else {
- my @attached ;
+ next if $opt{M}; # do not send mail
+
+ my @attached;
for my $uid (@UIDS) {
trace("UID: $uid->{'text'}\n");
unless ($uid->{'text'} =~ /@/) {
if ($uid->{'text'} =~ /@/) {
my $address = $uid->{'text'};
$address =~ s/.*<(.*)>.*/$1/;
- my $send = ask("Send mail to '$address' for $uid->{'text'}?", 1);
- if ($send) {
+ if ($opt{m} or ask("Send mail to '$address' for $uid->{'text'}?", 1)) {
my $mail = send_mail($address, $can_encrypt, $longkeyid, $uid, @attached);
my $keydir = "$KEYSBASE/$DATE_STRING";
projects / pgp-tools.git / blobdiff