summaryrefslogtreecommitdiff
path: root/src/share
diff options
context:
space:
mode:
Diffstat (limited to 'src/share')
-rw-r--r--src/share/m/subkey_to_ssh_agent55
1 files changed, 36 insertions, 19 deletions
diff --git a/src/share/m/subkey_to_ssh_agent b/src/share/m/subkey_to_ssh_agent
index ec596bd..aa647a6 100644
--- a/src/share/m/subkey_to_ssh_agent
+++ b/src/share/m/subkey_to_ssh_agent
@@ -37,26 +37,34 @@ subkey_to_ssh_agent() {
if [ "$sshaddresponse" = "2" ]; then
failure "Could not connect to ssh-agent"
fi
-
- # get list of secret keys (to work around bug
- # https://bugs.g10code.com/gnupg/issue945):
- secretkeys=$(gpg_user --list-secret-keys --with-colons --fixed-list-mode \
- --fingerprint | \
- grep '^fpr:' | cut -f10 -d: | awk '{ print "0x" $1 "!" }')
-
- if [ -z "$secretkeys" ]; then
- failure "You have no secret keys in your keyring!
+
+ # if the MONKEYSPHERE_SUBKEYS_FOR_AGENT variable is set, use the
+ # keys specified there
+ if [ "$MONKEYSPHERE_SUBKEYS_FOR_AGENT" ] ; then
+ authsubkeys="$MONKEYSPHERE_SUBKEYS_FOR_AGENT"
+
+ # otherwise find all authentication-capable subkeys and use those
+ else
+ # get list of secret keys
+ # (to work around bug https://bugs.g10code.com/gnupg/issue945):
+ secretkeys=$(gpg_user --list-secret-keys --with-colons --fixed-list-mode \
+ --fingerprint | \
+ grep '^fpr:' | cut -f10 -d: | awk '{ print "0x" $1 "!" }')
+
+ if [ -z "$secretkeys" ]; then
+ failure "You have no secret keys in your keyring!
You might want to run 'gpg --gen-key'."
- fi
+ fi
- authsubkeys=$(gpg_user --list-secret-keys --with-colons --fixed-list-mode \
- --fingerprint --fingerprint $secretkeys | \
- cut -f1,5,10,12 -d: | grep -A1 '^ssb:[^:]*::[^:]*a[^:]*$' | \
- grep '^fpr::' | cut -f3 -d: | sort -u)
-
- if [ -z "$authsubkeys" ]; then
- failure "no authentication-capable subkeys available.
-You might want to 'monkeysphere gen-subkey'"
+ authsubkeys=$(gpg_user --list-secret-keys --with-colons --fixed-list-mode \
+ --fingerprint --fingerprint $secretkeys | \
+ cut -f1,5,10,12 -d: | grep -A1 '^ssb:[^:]*::[^:]*a[^:]*$' | \
+ grep '^fpr::' | cut -f3 -d: | sort -u)
+
+ if [ -z "$authsubkeys" ]; then
+ failure "no authentication-capable subkeys available.
+You might want to run 'monkeysphere gen-subkey'."
+ fi
fi
workingdir=$(msmktempdir)
@@ -68,7 +76,16 @@ You might want to 'monkeysphere gen-subkey'"
# through to ssh-add. should we limit it to known ones? For
# example: -d or -c and/or -t <lifetime>
- for subkey in $authsubkeys; do
+ for subkey in $authsubkeys; do
+ # test that the subkey has proper capability
+ capability=$(gpg_user --list-secret-keys --with-colons --fixed-list-mode \
+ --fingerprint --fingerprint "0x${subkey}!" \
+ | egrep -B 1 "^fpr:::::::::${subkey}:$" | grep "^ssb:" | cut -d: -f12)
+ if ! check_capability "$capability" 'a' ; then
+ log error "Did not find authentication-capable subkey with key ID '$subkey'."
+ continue
+ fi
+
# choose a label by which this key will be known in the agent:
# we are labelling the key by User ID instead of by
# fingerprint, but filtering out all / characters to make sure