108
108
PUBKEYFILE="$KEYDIR/pubkey.txt"
110
110
# Check for some invalid values
111
if [ -d "$KEYDIR" ]; then :; else
111
if [ ! -d "$KEYDIR" ]; then
112
112
echo "$KEYDIR not a directory" >&2
115
if [ -w "$KEYDIR" ]; then :; else
116
echo "Directory $KEYDIR not writeable" >&2
120
if [ "$mode" = password -a -e "$KEYDIR/trustdb.gpg.lock" ]; then
121
echo "Key directory has locked trustdb; aborting." >&2
115
if [ ! -r "$KEYDIR" ]; then
116
echo "Directory $KEYDIR not readable" >&2
125
120
if [ "$mode" = keygen ]; then
121
if [ ! -w "$KEYDIR" ]; then
122
echo "Directory $KEYDIR not writeable" >&2
126
125
if [ -z "$KEYTYPE" ]; then
127
126
echo "Empty key type" >&2
166
165
# Create temporary gpg batch file
167
BATCHFILE="`mktemp -t mandos-gpg-batch.XXXXXXXXXX`"
166
BATCHFILE="`mktemp -t mandos-keygen-batch.XXXXXXXXXX`"
170
169
if [ "$mode" = password ]; then
171
170
# Create temporary encrypted password file
172
SECFILE="`mktemp -t mandos-gpg-secfile.XXXXXXXXXX`"
175
# Create temporary key rings
176
SECRING="`mktemp -t mandos-gpg-secring.XXXXXXXXXX`"
177
PUBRING="`mktemp -t mandos-gpg-pubring.XXXXXXXXXX`"
179
if [ "$mode" = password ]; then
180
# If a trustdb.gpg file does not already exist, schedule it for
181
# deletion when we are done.
182
if ! [ -e "$KEYDIR/trustdb.gpg" ]; then
183
TRUSTDB="$KEYDIR/trustdb.gpg"
171
SECFILE="`mktemp -t mandos-keygen-secfile.XXXXXXXXXX`"
174
# Create temporary key ring directory
175
RINGDIR="`mktemp -d -t mandos-keygen-keyrings.XXXXXXXXXX`"
187
177
# Remove temporary files on exit
190
rm --force $PUBRING ${PUBRING}~ $BATCHFILE $TRUSTDB; \
191
shred --remove $SECRING $SECFILE; \
180
test -n \"$SECFILE\" && shred --remove \"$SECFILE\"; \
181
shred --remove \"$RINGDIR\"/sec*;
182
test -n \"$BATCHFILE\" && rm --force \"$BATCHFILE\"; \
183
rm --recursive --force \"$RINGDIR\";
197
189
if [ "$mode" = keygen ]; then
198
190
# Create batch file for GnuPG
209
201
Expire-Date: $KEYEXPIRE
210
202
#Preferences: <string>
211
203
#Handle: <no-spaces>
204
#%pubring pubring.gpg
205
#%secring secring.gpg
217
209
# Generate a new key in the key rings
218
gpg --no-random-seed-file --quiet --batch --no-tty \
219
--no-default-keyring --no-options --enable-dsa2 \
220
--secret-keyring "$SECRING" --keyring "$PUBRING" \
210
gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
211
--homedir "$RINGDIR" --trust-model always \
221
212
--gen-key "$BATCHFILE"
222
213
rm --force "$BATCHFILE"
224
215
# Backup any old key files
225
216
if cp --backup=numbered --force "$SECKEYFILE" "$SECKEYFILE" \
226
217
2>/dev/null; then
243
234
# Export keys from key rings to key files
244
gpg --no-random-seed-file --quiet --batch --no-tty --armor \
245
--no-default-keyring --no-options --enable-dsa2 \
246
--secret-keyring "$SECRING" --keyring "$PUBRING" \
247
--export-options export-minimal --comment "$FILECOMMENT" \
248
--output "$SECKEYFILE" --export-secret-keys
249
gpg --no-random-seed-file --quiet --batch --no-tty --armor \
250
--no-default-keyring --no-options --enable-dsa2 \
251
--secret-keyring "$SECRING" --keyring "$PUBRING" \
252
--export-options export-minimal --comment "$FILECOMMENT" \
253
--output "$PUBKEYFILE" --export
235
gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
236
--homedir "$RINGDIR" --armor --export-options export-minimal \
237
--comment "$FILECOMMENT" --output "$SECKEYFILE" \
239
gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
240
--homedir "$RINGDIR" --armor --export-options export-minimal \
241
--comment "$FILECOMMENT" --output "$PUBKEYFILE" --export
256
244
if [ "$mode" = password ]; then
257
245
# Import keys into temporary key rings
258
gpg --no-random-seed-file --quiet --batch --no-tty --armor \
259
--no-default-keyring --no-options --enable-dsa2 \
260
--homedir "$KEYDIR" --no-permission-warning \
261
--secret-keyring "$SECRING" --keyring "$PUBRING" \
262
--trust-model always --import "$SECKEYFILE"
263
gpg --no-random-seed-file --quiet --batch --no-tty --armor \
264
--no-default-keyring --no-options --enable-dsa2 \
265
--homedir "$KEYDIR" --no-permission-warning \
266
--secret-keyring "$SECRING" --keyring "$PUBRING" \
267
--trust-model always --import "$PUBKEYFILE"
246
gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
247
--homedir "$RINGDIR" --trust-model always --armor \
248
--import "$SECKEYFILE"
249
gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
250
--homedir "$RINGDIR" --trust-model always --armor \
251
--import "$PUBKEYFILE"
269
253
# Get fingerprint of key
270
FINGERPRINT="`gpg --no-random-seed-file --quiet --batch --no-tty \
271
--armor --no-default-keyring --no-options --enable-dsa2 \
272
--homedir \"$KEYDIR\" --no-permission-warning \
273
--secret-keyring \"$SECRING\" --keyring \"$PUBRING\" \
274
--trust-model always --fingerprint --with-colons \
254
FINGERPRINT="`gpg --quiet --batch --no-tty --no-options \
255
--enable-dsa2 --homedir \"$RINGDIR\" --trust-model always \
256
--fingerprint --with-colons \
275
257
| sed -n -e '/^fpr:/{s/^fpr:.*:\\([0-9A-Z]*\\):\$/\\1/p;q}'`"
277
259
test -n "$FINGERPRINT"
282
264
echo -n "Enter passphrase: " >&2
284
| gpg --no-random-seed-file --batch --no-tty --armor \
285
--no-default-keyring --no-options --enable-dsa2 \
286
--homedir "$KEYDIR" --no-permission-warning \
287
--secret-keyring "$SECRING" --keyring "$PUBRING" \
288
--trust-model always --encrypt --recipient "$FINGERPRINT" \
289
--comment "$FILECOMMENT" \
266
| gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
267
--homedir "$RINGDIR" --trust-model always --armor --encrypt \
268
--recipient "$FINGERPRINT" --comment "$FILECOMMENT" \
316
295
shred --remove "$SECFILE"
318
297
# Remove the key rings
319
shred --remove "$SECRING"
320
rm --force "$PUBRING" "${PUBRING}~"
321
# Remove the trustdb, if one did not exist when we started
322
if [ -n "$TRUSTDB" ]; then
323
rm --force "$TRUSTDB"
298
shred --remove "$RINGDIR"/sec*
299
rm --recursive --force "$RINGDIR"
added
removed
mandos-keygen
