summaryrefslogtreecommitdiff
path: root/src/share/ma
diff options
context:
space:
mode:
authorJameson Graef Rollins <jrollins@finestructure.net>2009-02-12 18:19:35 -0500
committerJameson Graef Rollins <jrollins@finestructure.net>2009-02-12 18:19:35 -0500
commitf54abea9da2be063b0d0ed974f6130b303b2a1c7 (patch)
tree5ced9d699fafe2959561bb53e3674b8c45d283f6 /src/share/ma
parent07316c65eb5302a1d5385301876be7971e26fd1f (diff)
Fix the ma/setup function:
- fix reference to MONKEYSPHERE_USER for GNUPGHOME_SPHERE - break out core_fingerprint function - export core key to sphere keyring (necessary) - fix some logging (add more debug) and formatting
Diffstat (limited to 'src/share/ma')
-rw-r--r--src/share/ma/setup35
1 files changed, 24 insertions, 11 deletions
diff --git a/src/share/ma/setup b/src/share/ma/setup
index 0cd92e0..5960ab4 100644
--- a/src/share/ma/setup
+++ b/src/share/ma/setup
@@ -23,6 +23,7 @@ setup() {
# deliberately replace the config files via truncation
# FIXME: should we be dumping to tmp files and then moving atomically?
+ log debug "write core gpg.conf..."
cat >"${GNUPGHOME_CORE}"/gpg.conf <<EOF
# Monkeysphere trust core GnuPG configuration
# This file is maintained by the Monkeysphere software.
@@ -30,7 +31,8 @@ setup() {
no-greeting
list-options show-uid-validity
EOF
-
+
+ log debug "write sphere gpg.conf..."
cat >"${GNUPGHOME_SPHERE}"/gpg.conf <<EOF
# Monkeysphere trust sphere GnuPG configuration
# This file is maintained by the Monkeysphere software.
@@ -42,23 +44,28 @@ EOF
# make sure the monkeysphere user owns everything in the sphere
# gnupghome
- chown -R "$MONKEYPSHERE_USER" "${GNUPGHOME_SPHERE}"
- chgrp -R "$MONKEYPSHERE_USER" "${GNUPGHOME_SPHERE}"
+ log debuf "fix sphere gnupg home ownership..."
+ chown -R "$MONKEYSPHERE_USER" "${GNUPGHOME_SPHERE}"
+ chgrp -R "$MONKEYSPHERE_USER" "${GNUPGHOME_SPHERE}"
# get fingerprint of core key. this should be empty on unconfigured systems.
- local CORE_FPR=$(gpg_core --with-colons --fixed-list-mode --fingerprint --list-secret-key | grep ^fpr: | cut -f10 -d: )
+ local CORE_FPR=$(core_fingerprint)
+ log debug "core fingerprint: $CORE_FPR"
if [ -z "$CORE_FPR" ] ; then
- log info "Setting up Monkeysphere authentication trust core..."
+ log info "setting up Monkeysphere authentication trust core..."
local CORE_UID=$(printf "Monkeysphere authentication trust core UID (random string: %s)" $(head -c21 </dev/urandom | base64))
log debug "generating monkeysphere authentication trust core key ($CORE_KEYLENGTH bits)..."
- PEM2OPENPGP_USAGE_FLAGS=certify PEM2OPENPGP_NEWKEY=$CORE_KEYLENGTH pem2openpgp "$CORE_UID" | gpg_core --import || failure "Could not import new key for Monkeysphere authentication trust core"
+ PEM2OPENPGP_USAGE_FLAGS=certify \
+ PEM2OPENPGP_NEWKEY=$CORE_KEYLENGTH pem2openpgp "$CORE_UID" \
+ | gpg_core --import \
+ || failure "Could not import new key for Monkeysphere authentication trust core"
# get fingerprint of core key. should definitely not be empty at this point
- log debug "get core key fingerprint..."
- CORE_FPR=$(gpg_core --with-colons --fixed-list-mode --fingerprint --list-secret-key | grep ^fpr: | cut -f10 -d: )
+ CORE_FPR=$(core_fingerprint)
+ log debug "core fingerprint: $CORE_FPR"
if [ -z "$CORE_FPR" ] ; then
failure "Failed to create Monkeysphere authentication trust core!"
fi
@@ -67,12 +74,18 @@ EOF
log verbose "This system has already set up the Monkeysphere authentication trust core."
fi
+ # export the core key to the sphere keyring
+ log debug "export core pub key to sphere keyring..."
+ gpg_core --export | gpg_sphere --import
# ensure that the authentication sphere checker has absolute ownertrust on the expected key.
log debug "set ultimate owner trust on core key in gpg_sphere..."
printf "%s:6:\n" "$CORE_FPR" | gpg_sphere --import-ownertrust
- local ORIG_TRUST
+ gpg_sphere --export-ownertrust | log debug
+
+ # check the owner trust
log debug "check gpg_sphere owner trust set properly..."
+ local ORIG_TRUST
if ORIG_TRUST=$(gpg_sphere --export-ownertrust | grep '^[^#]') ; then
if [ "${CORE_FPR}:6:" != "$ORIG_TRUST" ] ; then
failure "Monkeysphere authentication trust sphere should explicitly trust the core. It does not have proper ownertrust settings."
@@ -84,10 +97,10 @@ EOF
# ensure that we're using the extended trust model (1), and that
# our preferences are reasonable (i.e. 3 marginal OR 1 fully
# trusted certifications are sufficient to grant full validity.
- log debug "check trust level of core key..."
+ log debug "checking trust level of core key..."
local TRUST_LEVEL=$(gpg_sphere --with-colons --fixed-list-mode --list-keys \
| head -n1 | grep "^tru:" | cut -d: -f3,6,7)
- log debug "trust level: $TRUST_LEVEL"
+ log debug "sphere trust level of core: $TRUST_LEVEL"
if [ "$TRUST_LEVEL" != '1:3:1' ] ; then
failure "monkeysphere-authentication does not have the expected trust model settings."
fi