diff options
| -rw-r--r-- | src/share/ma/add_certifier | 5 | ||||
| -rw-r--r-- | src/share/ma/list_certifiers | 15 | ||||
| -rw-r--r-- | src/share/ma/remove_certifier | 2 |
3 files changed, 16 insertions, 6 deletions
diff --git a/src/share/ma/add_certifier b/src/share/ma/add_certifier index 2e53455..28c229a 100644 --- a/src/share/ma/add_certifier +++ b/src/share/ma/add_certifier @@ -102,7 +102,7 @@ fi export keyID -# get the full fingerprint of a key ID +# get the full fingerprint of new certifier key log debug "getting fingerprint of certifier key..." fingerprint=$(gpg_sphere "--list-key --with-colons --with-fingerprint 0x${keyID}!" \ | grep '^fpr:' | grep "$keyID" | cut -d: -f10) @@ -126,6 +126,7 @@ fi # export the key to the core keyring so that the core can sign the # new certifier key +log debug "exporting retrieved certifier key to core keyring..." gpg_sphere "--export 0x${fingerprint}!" | gpg_core --import case "$trust" in @@ -154,6 +155,7 @@ EOF ) # core ltsigns the newly imported certifier key +log debug "executing core ltsign script..." if echo "$ltsignCommand" | \ gpg_core --quiet --command-fd 0 --edit-key "0x${fingerprint}!" ; then @@ -161,6 +163,7 @@ if echo "$ltsignCommand" | \ gpg_core_sphere_sig_transfer # update the sphere trustdb + log debug "updating sphere trustdb..." gpg_sphere "--check-trustdb" log info "Identity certifier added." diff --git a/src/share/ma/list_certifiers b/src/share/ma/list_certifiers index e37485e..d8b8f33 100644 --- a/src/share/ma/list_certifiers +++ b/src/share/ma/list_certifiers @@ -18,13 +18,20 @@ list_certifiers() { local keys local key -# find trusted keys in authentication keychain -keys=$(gpg_sphere "--no-options --list-options show-uid-validity --keyring ${GNUPGHOME_AUTHENTICATION}/pubring.gpg --list-keys --with-colons --fingerprint" | \ - grep ^pub: | cut -d: -f2,5 | egrep '^(u|f):' | cut -d: -f2) +# find trusted keys in sphere keychain +log debug "finding trusted keys..." + +# NOTE: looking for only 'f' keys here (used to be '(u|f)'), since the +# only key that should be 'u' is the core key, which is not +# technically a certifier in the sense we're worried about. Is this +# not correct? Should we be sorting out the certifier keys in a +# different way? +keys=$(gpg_sphere "--list-keys --with-colons --fingerprint" | \ + grep ^pub: | cut -d: -f2,5 | egrep '^f:' | cut -d: -f2) # output keys for key in $keys ; do - gpg_sphere "--no-options --list-options show-uid-validity --keyring ${GNUPGHOME_AUTHENTICATION}/pubring.gpg --list-key --fingerprint $key" + gpg_sphere "--list-key --fingerprint 0x${key}!" done } diff --git a/src/share/ma/remove_certifier b/src/share/ma/remove_certifier index c7aabea..4e56264 100644 --- a/src/share/ma/remove_certifier +++ b/src/share/ma/remove_certifier @@ -23,7 +23,7 @@ if [ -z "$keyID" ] ; then failure "You must specify the key ID of a key to remove." fi -if gpg_sphere "--no-options --list-options show-uid-validity --keyring ${GNUPGHOME_AUTHENTICATION}/pubring.gpg --list-key 0x${keyID}!" ; then +if gpg_sphere "--list-key --fingerprint 0x${keyID}!" ; then read -p "Really remove above listed identity certifier? (y/N) " OK; OK=${OK:-N} if [ "${OK/y/Y}" != 'Y' ] ; then failure "Identity certifier not removed." |