27 files changed, 108 insertions, 82 deletions
diff --git a/Makefile b/Makefile
index 6acb3f4..59b8887 100755
--- a/Makefile
+++ b/Makefile
@@ -29,7 +29,7 @@ tarball: clean
 
 debian-package: tarball
 	tar xzf monkeysphere_$(MONKEYSPHERE_VERSION).orig.tar.gz
-	sed -i "s|__VERSION__|$(MONKEYSPHERE_VERSION)|g" monkeysphere-$(MONKEYSPHERE_VERSION)/src/common
+	sed -i "s|__VERSION__|$(MONKEYSPHERE_VERSION)|g" monkeysphere-$(MONKEYSPHERE_VERSION)/src/share/common
 	cp -a packaging/debian monkeysphere-$(MONKEYSPHERE_VERSION)
 	(cd monkeysphere-$(MONKEYSPHERE_VERSION) && debuild -uc -us)
 	rm -rf monkeysphere-$(MONKEYSPHERE_VERSION)
@@ -53,10 +53,10 @@ install: all installman
 	mkdir -p $(DESTDIR)$(PREFIX)/share/doc/monkeysphere
 	install src/monkeysphere src/keytrans/openpgp2ssh src/keytrans/pem2openpgp $(DESTDIR)$(PREFIX)/bin
 	install src/monkeysphere-host src/monkeysphere-authentication $(DESTDIR)$(PREFIX)/sbin
-	install -m 0644 src/common $(DESTDIR)$(PREFIX)/share/monkeysphere
-	install -m 0644 src/subcommands/m/* $(DESTDIR)$(PREFIX)/share/monkeysphere/m
-	install -m 0644 src/subcommands/mh/* $(DESTDIR)$(PREFIX)/share/monkeysphere/mh
-	install -m 0644 src/subcommands/ma/* $(DESTDIR)$(PREFIX)/share/monkeysphere/ma
+	install -m 0644 src/share/common $(DESTDIR)$(PREFIX)/share/monkeysphere
+	install -m 0644 src/share/m/* $(DESTDIR)$(PREFIX)/share/monkeysphere/m
+	install -m 0644 src/share/mh/* $(DESTDIR)$(PREFIX)/share/monkeysphere/mh
+	install -m 0644 src/share/ma/* $(DESTDIR)$(PREFIX)/share/monkeysphere/ma
 	install doc/* $(DESTDIR)$(PREFIX)/share/doc/monkeysphere
 	install -m 0644 etc/monkeysphere.conf $(DESTDIR)$(ETCPREFIX)/etc/monkeysphere/monkeysphere.conf$(ETCSUFFIX)
 	install -m 0644 etc/monkeysphere-host.conf $(DESTDIR)$(ETCPREFIX)/etc/monkeysphere/monkeysphere-host.conf$(ETCSUFFIX)
diff --git a/man/man1/pem2openpgp.1 b/man/man1/pem2openpgp.1
new file mode 100644
index 0000000..8ac230b
--- /dev/null
+++ b/man/man1/pem2openpgp.1
@@ -0,0 +1,27 @@
+.\"  -*- nroff -*-
+.Dd $Mdocdate: January 25, 2009 $
+.Dt PEM2OPENPGP 1
+.Os
+.Sh NAME
+pem2openpgp
+.Nd translate PEM encoded keys to OpenPGP keys
+.Sh SYNOPSIS
+.Nm pem2openpgp $USERID < mykey.pem 
+.Pp
+.Nm ??? gpg --export $KEYID | openpgp2ssh $KEYID
+.Pp
+.Nm ????gpg --export-secret-key $KEYID | openpgp2ssh $KEYID
+.Sh DESCRIPTION
+.Nm
+WRITE ME!!!
+.Sh AUTHOR
+.Nm
+and this man page were written by Daniel Kahn Gillmor
+<dkg@fifthhorseman.net>.
+.Sh BUGS
+.Sh SEE ALSO
+.Xr openpgp2ssh 1,
+.Xr monkeysphere 1 ,
+.Xr monkeysphere 7 ,
+.Xr ssh 1 ,
+.Xr monkeysphere-server 8
diff --git a/packaging/debian/monkeysphere.preinst b/packaging/debian/monkeysphere.preinst
index 73c4169..fd22f6f 100755
--- a/packaging/debian/monkeysphere.preinst
+++ b/packaging/debian/monkeysphere.preinst
@@ -5,6 +5,18 @@
 # Author: Jameson Rollins <jrollins@finestructure.net>
 # Copyright 2008-2009
 
+ETC="/etc/monkeysphere"
+
+# move the old server conf file to be the authentication conf file
+if [ -f "$ETC"/monkeysphere-server.conf -a \
+    ! -f "$ETC"/monkeysphere-authentication.conf ] ; then
+    mv "$ETC"/monkeysphere-server.conf "$ETC"/monkeysphere-authentication.conf
+fi
+
+# remove the old gpg-*.conf files
+rm -f "$ETC"/gpg-host.conf
+rm -f "$ETC"/gpg-authentication.conf
+
 # dh_installdeb will replace this with shell code automatically
 # generated by other debhelper scripts.
 
diff --git a/src/monkeysphere b/src/monkeysphere
index bce0072..8b7bfee 100755
--- a/src/monkeysphere
+++ b/src/monkeysphere
@@ -167,12 +167,12 @@ case $COMMAND in
 	;;
 
     'import-subkey'|'i')
-	source "${MSHAREDIR}/import-key"
-	import_key "$@"
+	source "${MSHAREDIR}/import_subkey"
+	import_subkey "$@"
 	;;
 
     'gen-subkey'|'g')
-	source "${MSHAREDIR}/import_key"
+	source "${MSHAREDIR}/gen_subkey"
 	gen_subkey "$@"
 	;;
 
@@ -182,6 +182,7 @@ case $COMMAND in
 	;;
 
     'subkey-to-ssh-agent'|'s')
+	source "${MSHAREDIR}/subkey_to_ssh_agent"
 	subkey_to_ssh_agent "$@"
 	;;
 
diff --git a/src/monkeysphere-authentication b/src/monkeysphere-authentication
index 56a8877..a8f17f9 100755
--- a/src/monkeysphere-authentication
+++ b/src/monkeysphere-authentication
@@ -12,8 +12,6 @@
 # version 3 or later.
 
 ########################################################################
-set -e
-
 PGRM=$(basename $0)
 
 SYSSHAREDIR=${MONKEYSPHERE_SYSSHAREDIR:-"/usr/share/monkeysphere"}
@@ -57,9 +55,8 @@ subcommands:
  remove-id-certifier (c-) KEYID      remove a certification key
  list-id-certifiers (c)              list certification keys
 
- expert
-  diagnostics (d)                    monkeysphere authentication status
-  gpg-cmd CMD                        execute gpg command
+ expert <expert-subcommand>          run expert command
+ expert help                         expert command help
 
  version (v)                         show version number
  help (h,?)                          this help
@@ -182,6 +179,17 @@ case $COMMAND in
 	SUBCOMMAND="$1"
 	shift
 	case "$SUBCOMMAND" in
+	    'help'|'h'|'?')
+		cat <<EOF
+usage: $PGRM expert <subcommand> [options] [args]
+
+expert subcommands:
+ diagnostics (d)                     monkeysphere authentication status
+ gpg-cmd CMD                         execute gpg command
+
+EOF
+		;;
+
 	    'diagnostics'|'d')
 		source "${MASHAREDIR}/diagnostics"
 		diagnostics
diff --git a/src/monkeysphere-host b/src/monkeysphere-host
index 32e2293..0b37ba9 100755
--- a/src/monkeysphere-host
+++ b/src/monkeysphere-host
@@ -3,12 +3,13 @@
 # monkeysphere-host: Monkeysphere host admin tool
 #
 # The monkeysphere scripts are written by:
-# Jameson Rollins <jrollins@fifthhorseman.net>
+# Jameson Rollins <jrollins@finestructure.net>
 # Jamie McClelland <jm@mayfirst.org>
 # Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+# Micah Anderson <micah@riseup.net>
 #
-# They are Copyright 2008, and are all released under the GPL, version 3
-# or later.
+# They are Copyright 2008-2009, and are all released under the GPL,
+# version 3 or later.
 
 ########################################################################
 PGRM=$(basename $0)
@@ -50,14 +51,8 @@ subcommands:
  revoke-key (r)                      revoke host key
  publish-key (p)                     publish server host key to keyserver
 
- expert
-  import-key (i) [NAME[:PORT]]       import existing ssh key to gpg
-   --keyfile (-f) FILE                 key file to import
-   --expire (-e) EXPIRE                date to expire
-  gen-key (g) [NAME[:PORT]]          generate gpg key for the host
-   --length (-l) BITS                  key length in bits (2048)
-   --expire (-e) EXPIRE                date to expire
-  diagnostics (d)                    monkeysphere host status
+ expert <expert-subcommand>          run expert command
+ expert help                         expert command help
 
  version (v)                         show version number
  help (h,?)                          this help
@@ -112,18 +107,12 @@ check_host_keyring() {
 show_key() {
     local fingerprintPGP
     local fingerprintSSH
-    local ret=0
 
     # FIXME: you shouldn't have to be root to see the host key fingerprint
-    if is_root ; then
-	check_host_keyring
-	fingerprintPGP=$(fingerprint_server_key)
-	gpg_authentication "--fingerprint --list-key --list-options show-unusable-uids $fingerprintPGP" 2>/dev/null
-	echo "OpenPGP fingerprint: $fingerprintPGP"
-    else
-	log info "You must be root to see host OpenPGP fingerprint."
-	ret='1'
-    fi
+    check_host_keyring
+    fingerprintPGP=$(fingerprint_server_key)
+    gpg_host "--fingerprint --list-key --list-options show-unusable-uids $fingerprintPGP" 2>/dev/null
+    echo "OpenPGP fingerprint: $fingerprintPGP"
 
     if [ -f "${SYSDATADIR}/ssh_host_rsa_key.pub" ] ; then
 	fingerprintSSH=$(ssh-keygen -l -f "${SYSDATADIR}/ssh_host_rsa_key.pub" | \
@@ -131,10 +120,7 @@ show_key() {
 	echo "ssh fingerprint: $fingerprintSSH"
     else
 	log info "SSH host key not found."
-	ret='1'
     fi
-
-return $ret
 }
 
 ########################################################################
@@ -146,7 +132,7 @@ unset KEYSERVER
 unset MONKEYSPHERE_USER
 
 # load configuration file
-[ -e ${MONKEYSPHERE_HOST_CONFIG:="${SYSCONFIGDIR}/monkeysphere-host.conf"} ] && . "$MONKEYSPHERE_SERVER_CONFIG"
+[ -e ${MONKEYSPHERE_HOST_CONFIG:="${SYSCONFIGDIR}/monkeysphere-host.conf"} ] && . "$MONKEYSPHERE_HOST_CONFIG"
 
 # set empty config variable with ones from the environment, or with
 # defaults
@@ -220,6 +206,22 @@ case $COMMAND in
 	SUBCOMMAND="$1"
 	shift
 	case "$SUBCOMMAND" in
+	    'help'|'h'|'?')
+		cat <<EOF
+usage: $PGRM expert <subcommand> [options] [args]
+
+expert subcommands:
+ import-key (i) [NAME[:PORT]]        import existing ssh key to gpg
+   --keyfile (-f) FILE                 key file to import
+   --expire (-e) EXPIRE                date to expire
+ gen-key (g) [NAME[:PORT]]           generate gpg key for the host
+   --length (-l) BITS                  key length in bits (2048)
+   --expire (-e) EXPIRE                date to expire
+ diagnostics (d)                     monkeysphere host status
+
+EOF
+		;;
+
 	    'import-key'|'i')
 		source "${MHSHAREDIR}/import_key"
 		import_key "$@"
diff --git a/src/common b/src/share/common
index ef931ca..9adae05 100644
--- a/src/common
+++ b/src/share/common
@@ -533,12 +533,6 @@ gpg_fetch_userid() {
 	--search ="$userID" > /dev/null 2>&1
     returnCode="$?"
 
-    # if the user is the monkeysphere user, then update the
-    # monkeysphere user's trustdb
-    if [ $(id -un) = "$MONKEYSPHERE_USER" ] ; then
-	gpg_authentication "--check-trustdb" > /dev/null 2>&1
-    fi
-
     return "$returnCode"
 }
 
diff --git a/src/subcommands/m/gen_subkey b/src/share/m/gen_subkey
index cbefaa3..cbefaa3 100644
--- a/src/subcommands/m/gen_subkey
+++ b/src/share/m/gen_subkey
diff --git a/src/subcommands/m/import_subkey b/src/share/m/import_subkey
index aa89958..aa89958 100644
--- a/src/subcommands/m/import_subkey
+++ b/src/share/m/import_subkey
diff --git a/src/subcommands/m/ssh_proxycommand b/src/share/m/ssh_proxycommand
index 56a266e..7239c7a 100644
--- a/src/subcommands/m/ssh_proxycommand
+++ b/src/share/m/ssh_proxycommand
@@ -15,27 +15,10 @@
 # established.  Can be added to ~/.ssh/config as follows:
 #  ProxyCommand monkeysphere-ssh-proxycommand %h %p
 
-########################################################################
-PGRM=$(basename $0)
-
-SYSSHAREDIR=${MONKEYSPHERE_SYSSHAREDIR:-"/usr/share/monkeysphere"}
-export SYSSHAREDIR
-. "${SYSSHAREDIR}/common" || exit 1
-
-########################################################################
-# FUNCTIONS
-########################################################################
-
-usage() {
-    cat <<EOF >&2
-usage: ssh -o ProxyCommand="$(basename $0) %h %p" ...
-EOF
-}
-
-log() {
-    echo "$@" >&2
-}
+ssh_proxycommand() {
 
+# "marginal case" ouput in the case that there is not a full
+# validation path to the host
 output_no_valid_key() {
     local sshKeyOffered
     local userID
@@ -250,3 +233,5 @@ if [ -z "$NO_CONNECT" ] ; then
 	exit 255
     fi
 fi
+
+}
diff --git a/src/subcommands/m/subkey_to_ssh_agent b/src/share/m/subkey_to_ssh_agent
index 9bedb5e..012c95f 100644
--- a/src/subcommands/m/subkey_to_ssh_agent
+++ b/src/share/m/subkey_to_ssh_agent
@@ -44,7 +44,8 @@ For more details, see:
 	failure "Could not connect to ssh-agent"
     fi
     
-    # get list of secret keys (to work around https://bugs.g10code.com/gnupg/issue945):
+    # get list of secret keys (to work around bug
+    # https://bugs.g10code.com/gnupg/issue945):
     secretkeys=$(gpg --list-secret-keys --with-colons --fixed-list-mode --fingerprint | \
 	grep '^fpr:' | cut -f10 -d: | awk '{ print "0x" $1 "!" }')
 
diff --git a/src/subcommands/ma/add_certifier b/src/share/ma/add_certifier
index 0c3c647..0c3c647 100644
--- a/src/subcommands/ma/add_certifier
+++ b/src/share/ma/add_certifier
diff --git a/src/subcommands/ma/diagnostics b/src/share/ma/diagnostics
index 73e93a0..73e93a0 100644
--- a/src/subcommands/ma/diagnostics
+++ b/src/share/ma/diagnostics
diff --git a/src/subcommands/ma/list_certifiers b/src/share/ma/list_certifiers
index e37485e..e37485e 100644
--- a/src/subcommands/ma/list_certifiers
+++ b/src/share/ma/list_certifiers
diff --git a/src/subcommands/ma/remove_certifier b/src/share/ma/remove_certifier
index 560281d..560281d 100644
--- a/src/subcommands/ma/remove_certifier
+++ b/src/share/ma/remove_certifier
diff --git a/src/subcommands/ma/update_users b/src/share/ma/update_users
index 73685f6..73685f6 100644
--- a/src/subcommands/ma/update_users
+++ b/src/share/ma/update_users
diff --git a/src/subcommands/mh/add_hostname b/src/share/mh/add_hostname
index 10d5f58..10d5f58 100644
--- a/src/subcommands/mh/add_hostname
+++ b/src/share/mh/add_hostname
diff --git a/src/subcommands/mh/add_revoker b/src/share/mh/add_revoker
index f9d0bb6..f9d0bb6 100644
--- a/src/subcommands/mh/add_revoker
+++ b/src/share/mh/add_revoker
diff --git a/src/subcommands/mh/diagnostics b/src/share/mh/diagnostics
index 7e76da6..7e76da6 100644
--- a/src/subcommands/mh/diagnostics
+++ b/src/share/mh/diagnostics
diff --git a/src/subcommands/mh/extend_key b/src/share/mh/extend_key
index ccbaf0e..ccbaf0e 100644
--- a/src/subcommands/mh/extend_key
+++ b/src/share/mh/extend_key
diff --git a/src/subcommands/mh/gen_key b/src/share/mh/gen_key
index aad213a..162a64e 100644
--- a/src/subcommands/mh/gen_key
+++ b/src/share/mh/gen_key
@@ -85,10 +85,6 @@ echo "$keyParameters" | gpg_host --batch --gen-key
 # find the key fingerprint of the newly generated key
 fingerprint=$(fingerprint_server_key)
 
-# export host ownertrust to authentication keyring
-log verbose "setting ultimate owner trust for host key..."
-echo "${fingerprint}:6:" | gpg_authentication "--import-ownertrust"
-
 # translate the private key to ssh format, and export to a file
 # for sshs usage.
 # NOTE: assumes that the primary key is the proper key to use
@@ -98,7 +94,7 @@ echo "${fingerprint}:6:" | gpg_authentication "--import-ownertrust"
 log info "SSH host private key output to file: ${SYSDATADIR}/ssh_host_rsa_key"
 ssh-keygen -y -f "${SYSDATADIR}/ssh_host_rsa_key" > "${SYSDATADIR}/ssh_host_rsa_key.pub"
 log info "SSH host public key output to file: ${SYSDATADIR}/ssh_host_rsa_key.pub"
-gpg_authentication "--export-options export-minimal --armor --export 0x${fingerprint}\!" > "${SYSDATADIR}/ssh_host_rsa_key.pub.gpg"
+gpg_host "--export-options export-minimal --armor --export 0x${fingerprint}\!" > "${SYSDATADIR}/ssh_host_rsa_key.pub.gpg"
 log info "SSH host public key in OpenPGP form: ${SYSDATADIR}/ssh_host_rsa_key.pub.gpg"
 
 # show info about new key
diff --git a/src/subcommands/mh/import_key b/src/share/mh/import_key
index 386e02d..c0d5956 100644
--- a/src/subcommands/mh/import_key
+++ b/src/share/mh/import_key
@@ -77,10 +77,9 @@ fingerprint=$(fingerprint_server_key)
 # export host ownertrust to authentication keyring
 log verbose "setting ultimate owner trust for host key..."
 echo "${fingerprint}:6:" | gpg_host "--import-ownertrust"
-echo "${fingerprint}:6:" | gpg_authentication "--import-ownertrust"
 
 # export public key to file
-gpg_authentication "--export-options export-minimal --armor --export 0x${fingerprint}\!" > "${SYSDATADIR}/ssh_host_rsa_key.pub.gpg"
+gpg_host "--export-options export-minimal --armor --export 0x${fingerprint}\!" > "${SYSDATADIR}/ssh_host_rsa_key.pub.gpg"
 log info "SSH host public key in OpenPGP form: ${SYSDATADIR}/ssh_host_rsa_key.pub.gpg"
 
 # show info about new key
diff --git a/src/subcommands/mh/publish_key b/src/share/mh/publish_key
index b7ab01d..b7ab01d 100644
--- a/src/subcommands/mh/publish_key
+++ b/src/share/mh/publish_key
diff --git a/src/subcommands/mh/revoke_hostname b/src/share/mh/revoke_hostname
index b519cf6..b519cf6 100644
--- a/src/subcommands/mh/revoke_hostname
+++ b/src/share/mh/revoke_hostname
diff --git a/src/subcommands/mh/revoke_key b/src/share/mh/revoke_key
index cccdc22..cccdc22 100644
--- a/src/subcommands/mh/revoke_key
+++ b/src/share/mh/revoke_key
diff --git a/tests/basic b/tests/basic
index 0d78053..5006f8f 100755
--- a/tests/basic
+++ b/tests/basic
@@ -123,7 +123,7 @@ export PATH="$TESTDIR"/../src:"$TESTDIR"/../src/keytrans:"$PATH"
 
 export MONKEYSPHERE_SYSDATADIR="$TEMPDIR"
 export MONKEYSPHERE_SYSCONFIGDIR="$TEMPDIR"
-export MONKEYSPHERE_SYSSHAREDIR="$TESTDIR"/../src
+export MONKEYSPHERE_SYSSHAREDIR="$TESTDIR"/../src/share
 export MONKEYSPHERE_MONKEYSPHERE_USER=$(whoami)
 export MONKEYSPHERE_CHECK_KEYSERVER=false
 export MONKEYSPHERE_LOG_LEVEL=DEBUG
@@ -168,14 +168,15 @@ HostKey ${MONKEYSPHERE_SYSDATADIR}/ssh_host_rsa_key
 AuthorizedKeysFile ${MONKEYSPHERE_SYSDATADIR}/authentication/authorized_keys/%u
 EOF
 
-# set up monkeysphere-server
-echo "### configuring monkeysphere..."
+# set up monkeysphere host
+echo "### configuring monkeysphere host..."
 mkdir -p -m 750 "$MONKEYSPHERE_SYSDATADIR"/host
-mkdir -p -m 700 "$MONKEYSPHERE_SYSDATADIR"/authentication
-mkdir -p -m 700 "$MONKEYSPHERE_SYSDATADIR"/authentication/authorized_keys
-mkdir -p -m 700 "$MONKEYSPHERE_SYSDATADIR"/tmp
-cp etc/monkeysphere/monkeysphere-server.conf "$TEMPDIR"/monkeysphere-server.conf
-cat <<EOF >> "$TEMPDIR"/monkeysphere-server.conf
+
+# set up monkeysphere authentication
+echo "### configuring monkeysphere authentication..."
+mkdir -p -m 700 "$MONKEYSPHERE_SYSDATADIR"/authentication/{authorized_keys,core,sphere,tmp}
+cp etc/monkeysphere/monkeysphere-authentication.conf "$TEMPDIR"/
+cat <<EOF >> "$TEMPDIR"/monkeysphere-authentication.conf
 AUTHORIZED_USER_IDS="$MONKEYSPHERE_HOME/authentication/authorized_user_ids"
 EOF
 cat <<EOF > "$MONKEYSPHERE_SYSDATADIR"/authentication/sphere/gpg.conf
@@ -189,10 +190,10 @@ EOF
 # create a new host key
 echo "### generating server key..."
 # add gpg.conf with quick-random
-get_gpg_prng_arg >> "$MONKEYSPHERE_SYSCONFIGDIR"/gnupg-host/gpg.conf
+get_gpg_prng_arg >> "$MONKEYSPHERE_SYSCONFIGDIR"/host/gpg.conf
 echo | monkeysphere-host expert gen-key --length 1024 --expire 0 testhost
 # remove the gpg.conf
-rm "$MONKEYSPHERE_SYSCONFIGDIR"/gnupg-host/gpg.conf
+rm "$MONKEYSPHERE_SYSCONFIGDIR"/host/gpg.conf
 
 HOSTKEYID=$( monkeysphere-host show-key | grep '^OpenPGP fingerprint: ' | cut -f3 -d\  )
 
diff --git a/tests/etc/monkeysphere/monkeysphere-server.conf b/tests/etc/monkeysphere/monkeysphere-authentication.conf
index 9cc396f..9cc396f 100644
--- a/tests/etc/monkeysphere/monkeysphere-server.conf
+++ b/tests/etc/monkeysphere/monkeysphere-authentication.conf