X-Git-Url: https://git.sthu.org/?a=blobdiff_plain;f=caff%2Fcaff;h=9378562164c4c916d1a46e72119ce6372d183a1c;hb=11424d9131e1302b38486addd352a06e4be973fe;hp=8ebf8662479caa466944ae55b58023626e672fa2;hpb=96a8e13f3407f0ca4ba776e92a0f6ab9403418fe;p=pgp-tools.git diff --git a/caff/caff b/caff/caff index 8ebf866..9378562 100755 --- a/caff/caff +++ b/caff/caff @@ -82,7 +82,9 @@ Do not sign the keys. =item B<-u> I, B<--local-user> I Select the key that is used for signing, in case you have more than one key. -To sign with multiple keys at once, separate multiple keyids by comma. +To sign with multiple keys at once, separate multiple keyids by comma. This +option requires the key(s) to be defined through the keyid variable in the +configuration file. =item B<--key-file> I @@ -135,14 +137,22 @@ A list of your keys. This is used to determine which signatures to keep in the pruning step. If you select a key using B<-u> it has to be in this list. B. +=back + =head2 General settings +=over + =item B [string] Base directory for the files caff stores. Default: B<$HOME/.caff/>. +=back + =head2 GnuPG settings +=over + =item B [string] Path to the GnuPG binary. Default: B. @@ -171,11 +181,15 @@ Additional keyids to encrypt messages to. Default: none. Additional commands to pass to gpg after the "sign" command. Default: none. +=back + =head2 Keyserver settings +=over + =item B [string] -Keyserver to download keys from. Default: B. +Keyserver to download keys from. Default: B. =item B [boolean] @@ -186,8 +200,12 @@ Default: B<0>. A list of files containing keys to be imported. +=back + =head2 Signing settings +=over + =item B [boolean] If true, then skip the signing step. Default: B<0>. @@ -207,8 +225,12 @@ than this age. Default: B<24*60*60> (i.e. one day). Select the key that is used for signing, in case you have more than one key. With multiple keyids, sign with each key in turn. +=back + =head2 Mail settings +=over + =item B [boolean] Whether to send mails. This is a quad-option, with which you can set the @@ -306,6 +328,17 @@ my ($REVISION_NUMER) = $REVISION =~ /(\d+)/; my $VERSION = "0.0.0.$REVISION_NUMER"; +## +# Display an error message on STDERR and then exit. +# +# @param $exitcode exit code status to use to end the program +# @param $line error message to display on STDERR +# +sub myerror($$) { + my ($exitcode, $line) = @_; + print "[ERROR] $line\n"; + exit $exitcode; +}; sub mywarn($) { my ($line) = @_; @@ -456,7 +489,7 @@ sub load_config() { }; @{$CONFIG{'keyid'}} = map { uc } @{$CONFIG{'keyid'}}; $CONFIG{'export-sig-age'}= 24*60*60 unless defined $CONFIG{'export-sig-age'}; - $CONFIG{'keyserver'} = 'subkeys.pgp.net' unless defined $CONFIG{'keyserver'}; + $CONFIG{'keyserver'} = 'pool.sks-keyservers.net' unless defined $CONFIG{'keyserver'}; $CONFIG{'gpg'} = 'gpg' unless defined $CONFIG{'gpg'}; $CONFIG{'gpg-sign'} = $CONFIG{'gpg'} unless defined $CONFIG{'gpg-sign'}; $CONFIG{'gpg-delsig'} = $CONFIG{'gpg'} unless defined $CONFIG{'gpg-delsig'}; @@ -810,6 +843,7 @@ sub send_mail($$$@) { $message_entity->head->add("Subject", "Your signed PGP key 0x$key_id"); $message_entity->head->add("To", $address); $message_entity->head->add("From", '"'.Encode::encode('MIME-Q', $CONFIG{'owner'}).'" <'.$CONFIG{'email'}.'>'); + $message_entity->head->add("Sender", '"'.Encode::encode('MIME-Q', $CONFIG{'owner'}).'" <'.$CONFIG{'email'}.'>'); $message_entity->head->add("Reply-To", $CONFIG{'reply-to'}) if defined $CONFIG{'reply-to'}; $message_entity->head->add("Bcc", $CONFIG{'bcc'}) if defined $CONFIG{'bcc'}; $message_entity->head->add("User-Agent", $USER_AGENT); @@ -869,6 +903,63 @@ sub delete_signatures($$$$$$) { return $signed_by_me; }; +## +# Check the local user keys. +# +# This function checks if the keyids defined through the --local-user +# command line option or set in .caffrc are valid and known to be one of the +# keyids listed in ./caffrc. The last check ensure we have those keyids +# available in the caff's gnupghome directory. +# +# @return an array containing the local user keys\n +# (undef) if no key has been specified +# +sub get_local_user_keys() +{ + my @local_user = (); + my @key_list; + + # No user-defined key id has been specified by the user, no need for + # further checks + if (!$CONFIG{'local-user'}) { + return (undef); + } + + # Parse the list of keys + if (ref($CONFIG{'local-user'})) { + @key_list = @{$CONFIG{'local-user'}}; + } + else { + @key_list = split /\s*,\s*/, $CONFIG{'local-user'}; + } + + # Check every key defined by the user... + for my $user_key (@key_list) { + + $user_key =~ s/^0x//i; + $user_key = uc($user_key); + + unless ($user_key =~ m/^([A-F0-9]{8}|[A-F0-9]{16}|[A-F0-9]{40})$/) { + mywarn "Local-user $user_key is not a valid keyid."; + next; + } + + unless (grep (/$user_key$/, @{$CONFIG{'keyid'}})) { + mywarn "Local-user $user_key is not defined as one of your keyid in ./caffrc (it will not be used)."; + next; + } + + push (@local_user, $user_key); + } + + # If no local-user key are valid, there is no need to go further + unless (defined $local_user[0]) { + myerror (1, "None of the local-user keys seem to be known as a keyid listed in ./caffrc."); + } + + return @local_user; +} + ################### # argument handling @@ -913,19 +1004,18 @@ $CONFIG{'local-user'} = $params->{'local-user'} if defined $params->{'local-us $CONFIG{'no-download'} = $params->{'no-download'} if defined $params->{'no-download'}; $CONFIG{'no-sign'} = $params->{'no-sign'} if defined $params->{'no-sign'}; +$CONFIG{'no-mail'} = $params->{'no-mail'} if defined $params->{'no-mail'}; +$CONFIG{'mail'} = $params->{'mail'} if defined $params->{'mail'}; + # If old 'no-mail' parameter, or if the 'mail' parameter is set to 'no' -if ( $CONFIG{'no-mail'} || defined $params->{'no-mail'} || - ( defined $params->{'mail'} && $params->{'mail'} eq 'no' ) ) { +if ( defined $CONFIG{'no-mail'} || + ( defined $CONFIG{'mail'} && $CONFIG{'mail'} eq 'no' ) ) { $CONFIG{'mail'} = 'no'; -} elsif ( defined $params->{'mail'} ) { - $CONFIG{'mail'} = $params->{'mail'}; -} else { + +} elsif ( !defined $CONFIG{'mail'} ) { $CONFIG{'mail'} = 'ask-yes'; } -$CONFIG{'no-mail'} = $params->{'no-mail'} if defined $params->{'no-mail'}; -$CONFIG{'mail'} = $params->{'mail'} if defined $params->{'mail'}; - push @{$CONFIG{'key-files'}}, @{$params->{'key-files'}} if defined $params->{'key-files'}; for my $keyid (map { split /\n/ } @ARGV) { # caff "`cat txt`" is a single argument @@ -1053,25 +1143,9 @@ if ($CONFIG{'ask-sign'} && ! $CONFIG{'no-sign'}) { $CONFIG{'no-sign'} = ! ask("Continue with signing?", 1); } -unless ($CONFIG{'no-sign'}) { - my @local_user; - if ($CONFIG{'local-user'}) { - if (ref($CONFIG{'local-user'})) { - @local_user = @{$CONFIG{'local-user'}}; - } else { - @local_user = split /\s*,\s*/, $CONFIG{'local-user'}; - }; - foreach (@local_user) { - s/^0x//i; - unless (/^([A-F0-9]{8}|[A-F0-9]{16}|[A-F0-9]{40})$/i) { - print STDERR "Local-user $_ is not a keyid.\n"; - usage(\*STDERR, 1); - }; - $_ = uc($_); - }; - } else { - @local_user = (undef); - }; +unless ($CONFIG{'no-sign'}) +{ + my @local_user = &get_local_user_keys(); info("Sign the following keys according to your policy, then exit gpg with 'save' after signing each key"); for my $keyid (@keyids_ok) { @@ -1346,7 +1420,7 @@ the signatures by running each through `gpg --import`. Note that I did not upload your key to any keyservers. If you want this new signature to be available to others, please upload it yourself. With GnuPG this can be done using - gpg --keyserver subkeys.pgp.net --send-key {$key} + gpg --keyserver pool.sks-keyservers.net --send-key {$key} If you have any questions, don't hesitate to ask.