X-Git-Url: https://git.sthu.org/?a=blobdiff_plain;f=caff%2Fcaff;h=8cc36d7d841af4b28855fcd841ed999bed19bd46;hb=90c46f4fe6123e53366f974242ed5086ba036763;hp=799485865463966fa9e61c6690137b26c769dfdd;hpb=25959bbd9e216a97e6ebc86b851abf905b9b2244;p=pgp-tools.git diff --git a/caff/caff b/caff/caff index 7994858..8cc36d7 100755 --- a/caff/caff +++ b/caff/caff @@ -3,7 +3,7 @@ # caff -- CA - Fire and Forget # $Id$ # -# Copyright (c) 2004, 2005 Peter Palfrader +# Copyright (c) 2004, 2005, 2006 Peter Palfrader # Copyright (c) 2005, 2006 Christoph Berg # # All rights reserved. @@ -40,7 +40,7 @@ caff -- CA - Fire and Forget =over -=item B [-eEmMRS] [-u I] I [I ..] +=item B [-eERS] [-m I] [-u I] I [I ..] =back @@ -66,13 +66,10 @@ Export old signatures. Default is to ask the user for each old signature. Do not export old signatures. Default is to ask the user for each old signature. -=item B<-m>, B<--mail> +=item B<-m>, B<--mail> I -Send mail after signing. Default is to ask the user for each uid. - -=item B<-M>, B<--no-mail> - -Do not send mail after signing. Default is to ask the user for each uid. +Whether to send mail after signing. Default is to ask, for each uid, +with a default value of yes. =item B<-R>, B<--no-download> @@ -85,7 +82,9 @@ Do not sign the keys. =item B<-u> I, B<--local-user> I Select the key that is used for signing, in case you have more than one key. -To sign with multiple keys at once, separate multiple keyids by comma. +To sign with multiple keys at once, separate multiple keyids by comma. This +option requires the key(s) to be defined through the keyid variable in the +configuration file. =item B<--key-file> I @@ -105,7 +104,7 @@ Import keys from file. Can be supplied more than once. =item $HOME/.caff/gnupghome/gpg.conf - gpg configuration -useful options include use-agent, default-cert-level, etc. +useful options include use-agent, keyserver-options, default-cert-level, etc. =back @@ -116,9 +115,9 @@ The file is generated when it does not exist. Example: - $CONFIG{owner} = q{Peter Palfrader}; - $CONFIG{email} = q{peter@palfrader.org}; - $CONFIG{keyid} = [ qw{DE7AAF6E94C09C7F 62AF4031C82E0039} ]; + $CONFIG{'owner'} = q{Peter Palfrader}; + $CONFIG{'email'} = q{peter@palfrader.org}; + $CONFIG{'keyid'} = [ qw{DE7AAF6E94C09C7F 62AF4031C82E0039} ]; =head2 Required basic settings @@ -138,14 +137,22 @@ A list of your keys. This is used to determine which signatures to keep in the pruning step. If you select a key using B<-u> it has to be in this list. B. +=back + =head2 General settings +=over + =item B [string] Base directory for the files caff stores. Default: B<$HOME/.caff/>. +=back + =head2 GnuPG settings +=over + =item B [string] Path to the GnuPG binary. Default: B. @@ -171,10 +178,15 @@ Additional keyids to encrypt messages to. Default: none. =item B [string] -Additional arguments to pass to gpg. Default: none. +Additional commands to pass to gpg after the "sign" command. +Default: none. + +=back =head2 Keyserver settings +=over + =item B [string] Keyserver to download keys from. Default: B. @@ -188,8 +200,12 @@ Default: B<0>. A list of files containing keys to be imported. +=back + =head2 Signing settings +=over + =item B [boolean] If true, then skip the signing step. Default: B<0>. @@ -209,16 +225,19 @@ than this age. Default: B<24*60*60> (i.e. one day). Select the key that is used for signing, in case you have more than one key. With multiple keyids, sign with each key in turn. +=back + =head2 Mail settings -=item B [boolean] +=over -Do not prompt for sending mail, just do it. Default: B<0>. +=item B [boolean] -=item B [boolean] +Whether to send mails. This is a quad-option, with which you can set the +behaviour: yes always sends, no never sends; ask-yes and ask-no asks, for +each uid, with according defaults for the question. Default: B. -Do not prompt for sending mail. The messages are still written to -$CONFIG{caffhome}/keys/. Default: B<0>. +In any case, the messages are also written to $CONFIG{'caffhome'}/keys/ =item B [string] @@ -256,11 +275,11 @@ Default: none. Parameters to pass to Mail::Mailer. This could for example be - $CONFIG{mailer-send} = [ 'smtp', Server => 'mail.server', Auth => ['user', 'pass'] ] + $CONFIG{'mailer-send'} = [ 'smtp', Server => 'mail.server', Auth => ['user', 'pass'] ]; to use the perl SMTP client or - $CONFIG{mailer-send} = [ 'sendmail', '-o8' ] + $CONFIG{'mailer-send'} = [ 'sendmail', '-o8' ]; to pass arguments to the sendmail program. For more information run C<< perldoc Mail::Mailer >>. @@ -297,6 +316,7 @@ use File::Path; use File::Temp qw{tempdir}; use Text::Template; use MIME::Entity; +use Encode; use Fcntl; use IO::Select; use Getopt::Long; @@ -465,7 +485,8 @@ sub load_config() { check_executable("gpg", $CONFIG{'gpg'}); check_executable("gpg-sign", $CONFIG{'gpg-sign'}); check_executable("gpg-delsig", $CONFIG{'gpg-delsig'}); - $CONFIG{'secret-keyring'} = $ENV{'HOME'}.'/.gnupg/secring.gpg' unless defined $CONFIG{'secret-keyring'}; + $CONFIG{'secret-keyring'} = ($ENV{'GNUPGHOME'} || "$ENV{'HOME'}/.gnupg") . '/secring.gpg' + unless defined $CONFIG{'secret-keyring'}; $CONFIG{'no-download'} = 0 unless defined $CONFIG{'no-download'}; $CONFIG{'no-sign'} = 0 unless defined $CONFIG{'no-sign'}; $CONFIG{'key-files'} = () unless defined $CONFIG{'key-files'}; @@ -474,6 +495,9 @@ sub load_config() { unless (defined $CONFIG{'mail-template'}) { $CONFIG{'mail-template'} .= $_ foreach ; } + if ((defined $CONFIG{'also-encrypt-to'}) && ! (ref($CONFIG{'also-encrypt-to'}) eq 'ARRAY')) { + $CONFIG{'also-encrypt-to'} = [ $CONFIG{'also-encrypt-to'} ]; + }; }; sub make_gpg_fds() { @@ -656,7 +680,7 @@ sub version($) { sub usage($$) { my ($fd, $exitcode) = @_; version($fd); - print $fd "Usage: $PROGRAM_NAME [-eEmMRS] [-u ] [ ...]\n"; + print $fd "Usage: $PROGRAM_NAME [-eERS] [-m ] [-u ] [ ...]\n"; print $fd "Consult the manual page for more information.\n"; exit $exitcode; }; @@ -763,19 +787,26 @@ sub send_mail($$$@) { my ($inputfd, $stdoutfd, $stderrfd, $statusfd, $handles) = make_gpg_fds(); $gpg->options->push_recipients( $key_id ); if (defined $CONFIG{'also-encrypt-to'}) { - if (ref($CONFIG{'also-encrypt-to'})) { - $gpg->options->push_recipients($_) - foreach @{$CONFIG{'also-encrypt-to'}}; - } else { - $gpg->options->push_recipients($CONFIG{'also-encrypt-to'}); - } + $gpg->options->push_recipients($_) foreach @{$CONFIG{'also-encrypt-to'}}; } my $pid = $gpg->encrypt(handles => $handles); my ($stdout, $stderr, $status) = readwrite_gpg($message, $inputfd, $stdoutfd, $stderrfd, $statusfd); waitpid $pid, 0; if ($stdout eq '') { - warn ("No data from gpg for list-key $key_id\n"); - next; + if (($status =~ /^\[GNUPG:\] INV_RECP ([0-9]+) ([0-9A-F]+)/m) and + (defined $CONFIG{'also-encrypt-to'})) { + my $reason = $1; + my $keyid = $2; + if (grep { $_ eq $keyid } @{$CONFIG{'also-encrypt-to'}}) { + warn("Could not encrypt to $keyid, specified in CONFIG{'also-encrypt-to'}.\n". + "Try to update the key using gpg --homedir=$GNUPGHOME --import \n". + "or try the following if you are slightly more daring:\n". + " gpg --export $keyid | gpg --homedir=$GNUPGHOME --import\n"); + return; + }; + }; + warn ("No data from gpg for encrypting mail. STDERR was:\n$stderr\nstatus output was:\n$status\n"); + return; }; $message = $stdout; @@ -785,6 +816,7 @@ sub send_mail($$$@) { $message_entity->attach( Type => "application/pgp-encrypted", + Filename => "signedkey.msg", Disposition => 'attachment', Encoding => "7bit", Data => "Version: 1\n"); @@ -799,7 +831,7 @@ sub send_mail($$$@) { $message_entity->head->add("Subject", "Your signed PGP key 0x$key_id"); $message_entity->head->add("To", $address); - $message_entity->head->add("From", '"'.$CONFIG{'owner'}.'" <'.$CONFIG{'email'}.'>'); + $message_entity->head->add("From", '"'.Encode::encode('MIME-Q', $CONFIG{'owner'}).'" <'.$CONFIG{'email'}.'>'); $message_entity->head->add("Reply-To", $CONFIG{'reply-to'}) if defined $CONFIG{'reply-to'}; $message_entity->head->add("Bcc", $CONFIG{'bcc'}) if defined $CONFIG{'bcc'}; $message_entity->head->add("User-Agent", $USER_AGENT); @@ -878,8 +910,8 @@ if (!GetOptions ( '--export-old' => \$params->{'export-old'}, '-E' => \$params->{'no-export-old'}, '--no-export-old' => \$params->{'no-export-old'}, - '-m' => \$params->{'mail'}, - '--mail' => \$params->{'mail'}, + '-m:s' => \$params->{'mail'}, + '--mail:s' => \$params->{'mail'}, '-M' => \$params->{'no-mail'}, '--no-mail' => \$params->{'no-mail'}, '-R' => \$params->{'no-download'}, @@ -901,13 +933,25 @@ usage(\*STDERR, 1) unless scalar @ARGV >= 1; $CONFIG{'local-user'} = $params->{'local-user'} if defined $params->{'local-user'}; $CONFIG{'no-download'} = $params->{'no-download'} if defined $params->{'no-download'}; +$CONFIG{'no-sign'} = $params->{'no-sign'} if defined $params->{'no-sign'}; + $CONFIG{'no-mail'} = $params->{'no-mail'} if defined $params->{'no-mail'}; $CONFIG{'mail'} = $params->{'mail'} if defined $params->{'mail'}; -$CONFIG{'no-sign'} = $params->{'no-sign'} if defined $params->{'no-sign'}; + +# If old 'no-mail' parameter, or if the 'mail' parameter is set to 'no' +if ( defined $CONFIG{'no-mail'} || + ( defined $CONFIG{'mail'} && $CONFIG{'mail'} eq 'no' ) ) { + $CONFIG{'mail'} = 'no'; + +} elsif ( !defined $CONFIG{'mail'} ) { + $CONFIG{'mail'} = 'ask-yes'; +} + push @{$CONFIG{'key-files'}}, @{$params->{'key-files'}} if defined $params->{'key-files'}; -for my $keyid (@ARGV) { +for my $keyid (map { split /\n/ } @ARGV) { # caff "`cat txt`" is a single argument $keyid =~ s/^0x//i; + $keyid =~ s/ //g; # gpg --fingerprint includes spaces if ($keyid =~ /^[A-F0-9]{32}$/i) { info("Ignoring v3 fingerprint $keyid. v3 keys are obsolete."); next; @@ -923,22 +967,7 @@ for my $keyid (@ARGV) { # import own keys ################# for my $keyid (@{$CONFIG{'keyid'}}) { - my $gpg = GnuPG::Interface->new(); - $gpg->call( $CONFIG{'gpg'} ); - $gpg->options->hash_init( - 'homedir' => $GNUPGHOME, - 'extra_args' => [ qw{ --no-auto-check-trustdb --trust-model=always --with-colons --fixed-list-mode --fast-list-mode } ] ); - $gpg->options->meta_interactive( 0 ); - my ($inputfd, $stdoutfd, $stderrfd, $statusfd, $handles) = make_gpg_fds(); - my $pid = $gpg->list_public_keys(handles => $handles, command_args => $keyid); - my ($stdout, $stderr, $status) = readwrite_gpg('', $inputfd, $stdoutfd, $stderrfd, $statusfd); - waitpid $pid, 0; - - if ($stdout eq '') { - warn ("No data from gpg for list-key\n"); # There should be at least 'tru:' everywhere. - }; - unless ($stdout =~ /^pub:(?:[^:]*:){3,3}$keyid:/m) { - info("Key $keyid not found in caff's home. Getting it from your normal GnuPGHome."); + info("Importing key $keyid from your normal GnuPGHome."); my $key = export_key(undef, $keyid); if (!defined $key || $key eq '') { warn ("Did not get key $keyid from your normal GnuPGHome\n"); @@ -949,7 +978,6 @@ for my $keyid (@{$CONFIG{'keyid'}}) { warn ("Could not import $keyid into caff's gnupghome.\n"); next; }; - } } ######################## @@ -1025,7 +1053,7 @@ if ($CONFIG{'no-download'}) { if (scalar %local_keyids) { notice ("Import failed for: ". (join ' ', keys %local_keyids)."." . ($had_v3_keys ? " (Or maybe it's one of those ugly v3 keys?)" : "")); exit 1 unless ask ("Some keys could not be imported - continue anyway?", 0); - if (scalar %local_keyids == 1) { + if (scalar keys %local_keyids == 1) { mywarn("Assuming ". (join ' ', keys %local_keyids)." is a fine keyid."); } else { mywarn("Assuming ". (join ' ', keys %local_keyids)." are fine keyids."); @@ -1283,7 +1311,7 @@ for my $keyid (@keyids_ok) { if (scalar @UIDS == 0) { info("found no signed uids for $keyid"); } else { - next if $CONFIG{'no-mail'}; # do not send mail + next if ($CONFIG{'mail'} eq 'no'); # do not send mail my @attached; for my $uid (@UIDS) { @@ -1302,14 +1330,17 @@ for my $keyid (@keyids_ok) { if (!$uid->{'is_uat'} && ($uid->{'text'} =~ /@/)) { my $address = $uid->{'text'}; $address =~ s/.*<(.*)>.*/$1/; - if (ask("Mail signature for $uid->{'text'} to '$address'?", 1, $CONFIG{'mail'})) { + if (ask("Mail signature for $uid->{'text'} to '$address'?", $CONFIG{'mail'} ne 'ask-no', $CONFIG{'mail'} eq 'yes')) { my $mail = send_mail($address, $can_encrypt, $longkeyid, $uid, @attached); - - my $keydir = "$KEYSBASE/$DATE_STRING"; - my $mailfile = "$keydir/$longkeyid.mail.".$uid->{'serial'}.".".sanitize_uid($uid->{'text'}); - open (KEY, ">$mailfile") or die ("Cannot open $mailfile: $!\n"); - print KEY $mail; - close KEY; + if (defined $mail) { + my $keydir = "$KEYSBASE/$DATE_STRING"; + my $mailfile = "$keydir/$longkeyid.mail.".$uid->{'serial'}.".".sanitize_uid($uid->{'text'}); + open (KEY, ">$mailfile") or die ("Cannot open $mailfile: $!\n"); + print KEY $mail; + close KEY; + } else { + warn "Generating mail failed.\n"; + }; }; }; };