From a96625fb216143164f12191526939f4c0afcd5a9 Mon Sep 17 00:00:00 2001
From: mike castleman <m@mlcastle.net>
Date: Sat, 15 Nov 2008 18:23:14 -0500
Subject: rename

---
 website/bugs/useful-information.mdwn | 10 ----------
 website/bugs/useful_information.mdwn | 10 ++++++++++
 2 files changed, 10 insertions(+), 10 deletions(-)
 delete mode 100644 website/bugs/useful-information.mdwn
 create mode 100644 website/bugs/useful_information.mdwn

diff --git a/website/bugs/useful-information.mdwn b/website/bugs/useful-information.mdwn
deleted file mode 100644
index 0750354..0000000
--- a/website/bugs/useful-information.mdwn
+++ /dev/null
@@ -1,10 +0,0 @@
-I would like to know, at INFO (default) log level, when the 
-monkeyspehere makes a "real" modification to my known_hosts file; that 
-is, when it adds or deletes a key.
-
-Apparently this is hard because monkeysphere is currently configured to 
-delete all keys and then add good keys, so a key added for the first 
-time seems to the monkeysphere very similar to a key re-added ten 
-seconds after last login.
-
-Still, from a UI perspective, I want to know what monkeysphere is doing.
diff --git a/website/bugs/useful_information.mdwn b/website/bugs/useful_information.mdwn
new file mode 100644
index 0000000..0750354
--- /dev/null
+++ b/website/bugs/useful_information.mdwn
@@ -0,0 +1,10 @@
+I would like to know, at INFO (default) log level, when the 
+monkeyspehere makes a "real" modification to my known_hosts file; that 
+is, when it adds or deletes a key.
+
+Apparently this is hard because monkeysphere is currently configured to 
+delete all keys and then add good keys, so a key added for the first 
+time seems to the monkeysphere very similar to a key re-added ten 
+seconds after last login.
+
+Still, from a UI perspective, I want to know what monkeysphere is doing.
-- 
cgit v1.2.3


From 2459fa3ea277d7b9289945748619eab1e3441e5c Mon Sep 17 00:00:00 2001
From: Jameson Graef Rollins <jrollins@finestructure.net>
Date: Sat, 15 Nov 2008 20:49:27 -0500
Subject: Added info log output when a new key is added to known_hosts file.

---
 packaging/debian/changelog |  7 +++++++
 src/common                 | 11 +++++++++--
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/packaging/debian/changelog b/packaging/debian/changelog
index 62f021e..f1db037 100644
--- a/packaging/debian/changelog
+++ b/packaging/debian/changelog
@@ -1,3 +1,10 @@
+monkeysphere (0.22-1) UNRELEASED; urgency=low
+
+  * New upstream release:
+    - Added info log output when a new key is added to known_hosts file.
+
+ -- Jameson Graef Rollins <jrollins@finestructure.net>  Sat, 15 Nov 2008 20:49:13 -0500
+
 monkeysphere (0.21-2) unstable; urgency=low
 
   * actually rmdir /var/lib/monkeysphere-* during prerm if possible.
diff --git a/src/common b/src/common
index 297e7f3..efee9bd 100644
--- a/src/common
+++ b/src/common
@@ -742,6 +742,7 @@ process_user_id() {
 process_host_known_hosts() {
     local host
     local userID
+    local noKey=
     local nKeys
     local nKeysOK
     local ok
@@ -768,8 +769,9 @@ process_host_known_hosts() {
             continue
         fi
 
-	# remove the old host key line, and note if removed
-	remove_line "$KNOWN_HOSTS" "$sshKey"
+	# remove any old host key line, and note if removed nothing is
+	# removed
+	remove_line "$KNOWN_HOSTS" "$sshKey" || noKey=true
 
 	# if key OK, add new host line
 	if [ "$ok" -eq '0' ] ; then
@@ -788,6 +790,11 @@ process_host_known_hosts() {
 	    else
 		ssh2known_hosts "$host" "$sshKey" >> "$KNOWN_HOSTS"
 	    fi
+
+	    # log if this is a new key to the known_hosts file
+	    if [ "$noKey" ] ; then
+		log info "* new key for $host added to known_hosts file."
+	    fi
 	fi
     done
 
-- 
cgit v1.2.3


From d068b7c722211adf7d830b1c1b4ce9693eafbe4f Mon Sep 17 00:00:00 2001
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Date: Sun, 16 Nov 2008 00:57:27 -0500
Subject: m-s s: avoid failures when $TMPDIR has a space in it. (output might
 still be a bit garbled)

---
 src/monkeysphere-server | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/monkeysphere-server b/src/monkeysphere-server
index 5edaa4f..665d916 100755
--- a/src/monkeysphere-server
+++ b/src/monkeysphere-server
@@ -137,7 +137,7 @@ show_server_key() {
     tmpkey=$(mktemp ${TMPDIR:-/tmp}/tmp.XXXXXXXXXX) || failure "Could not create temporary directory!"
     gpg_authentication "--export $fingerprint" | openpgp2ssh "$fingerprint" 2>/dev/null > "$tmpkey"
     echo -n "ssh fingerprint: "
-    ssh-keygen -l -f $tmpkey | awk '{ print $1, $2, $4 }'
+    ssh-keygen -l -f "$tmpkey" | awk '{ print $1, $2, $4 }'
     rm -rf "$tmpkey"
     echo -n "OpenPGP fingerprint: "
     echo "$fingerprint"
-- 
cgit v1.2.3


From 9eed0790573d3f1f21707151ede87f8339dbecc0 Mon Sep 17 00:00:00 2001
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Date: Sun, 16 Nov 2008 01:28:19 -0500
Subject: exporting SSH host public key (two variants: one traditional ssh, the
 other OpenPGP) during m-s gen-key

---
 src/monkeysphere-server | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/monkeysphere-server b/src/monkeysphere-server
index 665d916..bb26c04 100755
--- a/src/monkeysphere-server
+++ b/src/monkeysphere-server
@@ -399,7 +399,11 @@ EOF
     (umask 077 && \
 	gpg_host --export-secret-key "$fingerprint" | \
 	openpgp2ssh "$fingerprint" > "${SYSDATADIR}/ssh_host_rsa_key")
-    log info "private SSH host key output to file: ${SYSDATADIR}/ssh_host_rsa_key"
+    log info "SSH host private key output to file: ${SYSDATADIR}/ssh_host_rsa_key"
+    ssh-keygen -y -f "${SYSDATADIR}/ssh_host_rsa_key" > "${SYSDATADIR}/ssh_host_rsa_key.pub"
+    log info "SSH host public key output to file: ${SYSDATADIR}/ssh_host_rsa_key.pub"
+    gpg_authentication --export-options export-minimal --export "0x${fingerprint}!" > "${SYSDATADIR}/ssh_host_rsa_key.pub.gpg"
+    log info "SSH host public key in OpenPGP form: ${SYSDATADIR}/ssh_host_rsa_key.pub.gpg"
 }
 
 # extend the lifetime of a host key:
-- 
cgit v1.2.3


From c9efd3d44010262946d518dc712edba733697b34 Mon Sep 17 00:00:00 2001
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Date: Sun, 16 Nov 2008 02:04:56 -0500
Subject: update debian/changelog.

---
 packaging/debian/changelog | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/packaging/debian/changelog b/packaging/debian/changelog
index f1db037..c2c4241 100644
--- a/packaging/debian/changelog
+++ b/packaging/debian/changelog
@@ -1,8 +1,16 @@
 monkeysphere (0.22-1) UNRELEASED; urgency=low
 
   * New upstream release:
+  [ Jameson Rollins ]
+
     - Added info log output when a new key is added to known_hosts file.
 
+  [ Daniel Kahn Gillmor ]
+
+    - automatically output two copies of the host's public key: one
+    standard ssh public key file, and the other a minimal OpenPGP key with
+    just the latest valid self-sig.
+
  -- Jameson Graef Rollins <jrollins@finestructure.net>  Sat, 15 Nov 2008 20:49:13 -0500
 
 monkeysphere (0.21-2) unstable; urgency=low
-- 
cgit v1.2.3


From 11e3f75a105d37cc113abe8f19e29ed1d9d90155 Mon Sep 17 00:00:00 2001
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Date: Sun, 16 Nov 2008 02:33:42 -0500
Subject: making the "upstream version" end in ~pre so that test packages
 created before the release will upgrade properly when the official 0.22 gets
 released.

---
 packaging/debian/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packaging/debian/changelog b/packaging/debian/changelog
index c2c4241..1aee7d1 100644
--- a/packaging/debian/changelog
+++ b/packaging/debian/changelog
@@ -1,4 +1,4 @@
-monkeysphere (0.22-1) UNRELEASED; urgency=low
+monkeysphere (0.22~pre-1) UNRELEASED; urgency=low
 
   * New upstream release:
   [ Jameson Rollins ]
-- 
cgit v1.2.3


From d056cc64effacd7936fddb6e696957868fff7eed Mon Sep 17 00:00:00 2001
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Date: Sun, 16 Nov 2008 02:39:51 -0500
Subject: feedback on useful-information bug.

---
 website/bugs/useful-information.mdwn | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/website/bugs/useful-information.mdwn b/website/bugs/useful-information.mdwn
index 0750354..62094bb 100644
--- a/website/bugs/useful-information.mdwn
+++ b/website/bugs/useful-information.mdwn
@@ -8,3 +8,17 @@ time seems to the monkeysphere very similar to a key re-added ten
 seconds after last login.
 
 Still, from a UI perspective, I want to know what monkeysphere is doing.
+
+------
+
+It looks like jrollins committed a change for reporting at INFO level
+when a host key gets added by the monkeysphere:
+2459fa3ea277d7b9289945748619eab1e3441e5c
+
+When i connect to a host whose key is not already present in my
+known_hosts file, i get the following to stderr:
+
+    ms: * new key for squeak.fifthhorseman.net added to known_hosts file.
+
+This doesn't fully close this bug, because we aren't notifying on key
+deletion, afaict.
-- 
cgit v1.2.3


From dd002c89fc4dccabc16d488a15a40cc88383605f Mon Sep 17 00:00:00 2001
From: Jameson Graef Rollins <jrollins@finestructure.net>
Date: Sun, 16 Nov 2008 03:17:36 -0500
Subject: added some useful output to the ssh-proxycommand for "marginal" cases
 where keys are found for host but do not have full validity.  this uses
 ssh-keyscan to pull the key for the host in question, check this key against
 the keys against those found via gpg, and output some useful information
 about the one that matches.

---
 changelog                         |  2 +-
 packaging/debian/changelog        |  6 ++-
 src/monkeysphere-server           |  2 +-
 src/monkeysphere-ssh-proxycommand | 98 ++++++++++++++++++++++++++++++++++++++-
 4 files changed, 102 insertions(+), 6 deletions(-)

diff --git a/changelog b/changelog
index b9a9e21..4264fa4 120000
--- a/changelog
+++ b/changelog
@@ -1 +1 @@
-website/changelog
\ No newline at end of file
+packaging/debian/changelog
\ No newline at end of file
diff --git a/packaging/debian/changelog b/packaging/debian/changelog
index f1db037..e8ea1a9 100644
--- a/packaging/debian/changelog
+++ b/packaging/debian/changelog
@@ -1,9 +1,11 @@
 monkeysphere (0.22-1) UNRELEASED; urgency=low
 
   * New upstream release:
-    - Added info log output when a new key is added to known_hosts file.
+    - added info log output when a new key is added to known_hosts file.
+    - added some useful output to the ssh-proxycommand for "marginal"
+      cases where keys are found for host but do not have full validity.
 
- -- Jameson Graef Rollins <jrollins@finestructure.net>  Sat, 15 Nov 2008 20:49:13 -0500
+ -- Jameson Graef Rollins <jrollins@finestructure.net>  Sun, 16 Nov 2008 03:17:16 -0500
 
 monkeysphere (0.21-2) unstable; urgency=low
 
diff --git a/src/monkeysphere-server b/src/monkeysphere-server
index 5edaa4f..665d916 100755
--- a/src/monkeysphere-server
+++ b/src/monkeysphere-server
@@ -137,7 +137,7 @@ show_server_key() {
     tmpkey=$(mktemp ${TMPDIR:-/tmp}/tmp.XXXXXXXXXX) || failure "Could not create temporary directory!"
     gpg_authentication "--export $fingerprint" | openpgp2ssh "$fingerprint" 2>/dev/null > "$tmpkey"
     echo -n "ssh fingerprint: "
-    ssh-keygen -l -f $tmpkey | awk '{ print $1, $2, $4 }'
+    ssh-keygen -l -f "$tmpkey" | awk '{ print $1, $2, $4 }'
     rm -rf "$tmpkey"
     echo -n "OpenPGP fingerprint: "
     echo "$fingerprint"
diff --git a/src/monkeysphere-ssh-proxycommand b/src/monkeysphere-ssh-proxycommand
index 6276092..b039844 100755
--- a/src/monkeysphere-ssh-proxycommand
+++ b/src/monkeysphere-ssh-proxycommand
@@ -13,14 +13,84 @@
 # established.  Can be added to ~/.ssh/config as follows:
 #  ProxyCommand monkeysphere-ssh-proxycommand %h %p
 
+########################################################################
+PGRM=$(basename $0)
+
+SYSSHAREDIR=${MONKEYSPHERE_SYSSHAREDIR:-"/usr/share/monkeysphere"}
+export SYSSHAREDIR
+. "${SYSSHAREDIR}/common" || exit 1
+
+########################################################################
+# FUNCTIONS
 ########################################################################
 
 usage() {
-cat <<EOF >&2
+    cat <<EOF >&2
 usage: ssh -o ProxyCommand="$(basename $0) %h %p" ...
 EOF
 }
 
+log() {
+    echo "$@" >&2
+}
+
+output_no_valid_key() {
+    local sshKeyOffered
+    local userID
+    local type
+    local validity
+    local keyid
+    local uidfpr
+    local usage
+    local sshKeyGPG
+    local sshFingerprint
+
+    log "OpenPGP keys with*out* full validity found for this host:"
+    log
+
+    # retrieve the actual ssh key
+    sshKeyOffered=$(ssh-keyscan -t rsa -p "$PORT" "$HOST" 2>/dev/null | awk '{ print $2, $3 }')
+
+    userID="ssh://${HOSTP}"
+
+    # output gpg info for (exact) userid and store
+    gpgOut=$(gpg --list-key --fixed-list-mode --with-colon \
+	--with-fingerprint --with-fingerprint \
+	="$userID" 2>/dev/null)
+
+    # loop over all lines in the gpg output and process.
+    echo "$gpgOut" | cut -d: -f1,2,5,10,12 | \
+    while IFS=: read -r type validity keyid uidfpr usage ; do
+	case $type in
+	    'pub'|'sub')
+		# get the ssh key of the gpg key
+		sshKeyGPG=$(gpg2ssh "$keyid")
+
+		# if one of keys found matches the one offered by the
+		# host, then output info
+		if [ "$sshKeyGPG" = "$sshKeyOffered" ] ; then
+
+		    # get the fingerprint of the ssh key
+		    tmpkey=$(mktemp ${TMPDIR:-/tmp}/tmp.XXXXXXXXXX)
+		    echo "$sshKeyGPG" > "$tmpkey"
+		    sshFingerprint=$(ssh-keygen -l -f "$tmpkey" | awk '{ print $2 }')
+		    rm -rf "$tmpkey"
+
+		    # output gpg info
+		    gpg --check-sigs \
+			--list-options show-uid-validity \
+			"$keyid" >&2
+
+		    # output ssh fingerprint
+		    log "RSA key fingerprint is ${sshFingerprint}."
+		    log "Falling through to standard ssh host checking."
+		    log
+		fi
+		;;
+	esac
+    done
+}
+
 ########################################################################
 
 # export the monkeysphere log level
@@ -35,7 +105,7 @@ HOST="$1"
 PORT="$2"
 
 if [ -z "$HOST" ] ; then
-    echo "Host not specified." >&2
+    log "Host not specified."
     usage
     exit 255
 fi
@@ -88,6 +158,30 @@ export MONKEYSPHERE_CHECK_KEYSERVER
 # update the known_hosts file for the host
 monkeysphere update-known_hosts "$HOSTP"
 
+# output on depending on the return of the update-known_hosts
+# subcommand, which is (ultimately) the return code of the
+# update_known_hosts function in common
+case $? in
+    0)
+	# acceptable host key found so continue to ssh
+	true
+	;;
+    1)
+	# no hosts at all found so also continue (drop through to
+	# regular ssh host verification)
+	true
+	;;
+    2)
+	# at least one *bad* host key (and no good host keys) was
+	# found, so output some usefull information
+	output_no_valid_key
+	;;
+    *)
+	# anything else drop through
+	true
+	;;
+esac
+
 # exec a netcat passthrough to host for the ssh connection
 if [ -z "$NO_CONNECT" ] ; then
     if (which nc 2>/dev/null >/dev/null); then
-- 
cgit v1.2.3


From d91a9e05ef6c351f40d931d2f7d19e3a3979279c Mon Sep 17 00:00:00 2001
From: Jameson Graef Rollins <jrollins@finestructure.net>
Date: Sun, 16 Nov 2008 17:26:14 -0500
Subject: add some more informative debug output to key processing.

---
 src/common                        |  6 +++++-
 src/monkeysphere-ssh-proxycommand | 14 +++++++++-----
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/src/common b/src/common
index efee9bd..51b0470 100644
--- a/src/common
+++ b/src/common
@@ -639,7 +639,7 @@ process_user_id() {
 		;;
 	    'uid') # user ids
 		if [ "$lastKey" != pub ] ; then
-		    log verbose " - got a user ID after a sub key?!  user IDs should only follow primary keys!"
+		    log verbose " ! got a user ID after a sub key?!  user IDs should only follow primary keys!"
 		    continue
 		fi
 		# if an acceptable user ID was already found, skip
@@ -652,6 +652,8 @@ process_user_id() {
 		    if [ "$validity" = 'u' -o "$validity" = 'f' ] ; then
 			# mark user ID acceptable
 			uidOK=true
+		    else
+			log debug "  - unacceptable user ID validity ($validity)."
 		    fi
 		else
 		    continue
@@ -693,10 +695,12 @@ process_user_id() {
 		
 		# if sub key validity is not ok, skip
 		if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then
+		    log debug "  - unacceptable sub key validity ($validity)."
 		    continue
 		fi
 		# if sub key capability is not ok, skip
 		if ! check_capability "$usage" $requiredCapability ; then
+		    log debug "  - unacceptable sub key capability ($usage)."
 		    continue
 		fi
 
diff --git a/src/monkeysphere-ssh-proxycommand b/src/monkeysphere-ssh-proxycommand
index b039844..aeea30d 100755
--- a/src/monkeysphere-ssh-proxycommand
+++ b/src/monkeysphere-ssh-proxycommand
@@ -45,20 +45,24 @@ output_no_valid_key() {
     local sshKeyGPG
     local sshFingerprint
 
-    log "OpenPGP keys with*out* full validity found for this host:"
+    userID="ssh://${HOSTP}"
+
+    log "Monkeysphere found only OpenPGP keys for this host with*out* full validity."
+    log "host:                $userID"
     log
 
     # retrieve the actual ssh key
     sshKeyOffered=$(ssh-keyscan -t rsa -p "$PORT" "$HOST" 2>/dev/null | awk '{ print $2, $3 }')
+    # FIXME: should we do any checks for failed keyscans, eg host not
+    # found?
 
-    userID="ssh://${HOSTP}"
-
-    # output gpg info for (exact) userid and store
+    # output gpg info for userid and store
     gpgOut=$(gpg --list-key --fixed-list-mode --with-colon \
 	--with-fingerprint --with-fingerprint \
 	="$userID" 2>/dev/null)
 
-    # loop over all lines in the gpg output and process.
+    # find all 'pub' and 'sub' lines in the gpg output, which each
+    # represent a retrieved key for the user ID
     echo "$gpgOut" | cut -d: -f1,2,5,10,12 | \
     while IFS=: read -r type validity keyid uidfpr usage ; do
 	case $type in
-- 
cgit v1.2.3


From 864a89f60b05f0f32cf8ef2bb5677c2d50062749 Mon Sep 17 00:00:00 2001
From: Jameson Graef Rollins <jrollins@finestructure.net>
Date: Sun, 16 Nov 2008 19:10:03 -0500
Subject: fix quoting in output of ssh_host_rsa_key.pub.gpg.  remember, at the
 moment the gpg_authentication function can only accept a single argument, so
 the entire gpg command string needs to be in a single quoted string.

---
 src/monkeysphere-server | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/monkeysphere-server b/src/monkeysphere-server
index bb26c04..018a1ec 100755
--- a/src/monkeysphere-server
+++ b/src/monkeysphere-server
@@ -402,7 +402,7 @@ EOF
     log info "SSH host private key output to file: ${SYSDATADIR}/ssh_host_rsa_key"
     ssh-keygen -y -f "${SYSDATADIR}/ssh_host_rsa_key" > "${SYSDATADIR}/ssh_host_rsa_key.pub"
     log info "SSH host public key output to file: ${SYSDATADIR}/ssh_host_rsa_key.pub"
-    gpg_authentication --export-options export-minimal --export "0x${fingerprint}!" > "${SYSDATADIR}/ssh_host_rsa_key.pub.gpg"
+    gpg_authentication "--export-options export-minimal --export 0x${fingerprint}!" > "${SYSDATADIR}/ssh_host_rsa_key.pub.gpg"
     log info "SSH host public key in OpenPGP form: ${SYSDATADIR}/ssh_host_rsa_key.pub.gpg"
 }
 
-- 
cgit v1.2.3


From 11a42a66941cc1bb4c1268895ac4522ecb5fb6e6 Mon Sep 17 00:00:00 2001
From: Jameson Graef Rollins <jrollins@finestructure.net>
Date: Sun, 16 Nov 2008 19:32:58 -0500
Subject: really fix the ssh_host_rsa_key.pub.gpg output.

---
 src/monkeysphere-server | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/monkeysphere-server b/src/monkeysphere-server
index 018a1ec..34b06b7 100755
--- a/src/monkeysphere-server
+++ b/src/monkeysphere-server
@@ -402,7 +402,7 @@ EOF
     log info "SSH host private key output to file: ${SYSDATADIR}/ssh_host_rsa_key"
     ssh-keygen -y -f "${SYSDATADIR}/ssh_host_rsa_key" > "${SYSDATADIR}/ssh_host_rsa_key.pub"
     log info "SSH host public key output to file: ${SYSDATADIR}/ssh_host_rsa_key.pub"
-    gpg_authentication "--export-options export-minimal --export 0x${fingerprint}!" > "${SYSDATADIR}/ssh_host_rsa_key.pub.gpg"
+    gpg_authentication "--export-options export-minimal --armor --export 0x${fingerprint}\!" > "${SYSDATADIR}/ssh_host_rsa_key.pub.gpg"
     log info "SSH host public key in OpenPGP form: ${SYSDATADIR}/ssh_host_rsa_key.pub.gpg"
 }
 
-- 
cgit v1.2.3


From f7dfcead0281c9f6dd26908f76282efc843a7e52 Mon Sep 17 00:00:00 2001
From: Jameson Graef Rollins <jrollins@finestructure.net>
Date: Mon, 17 Nov 2008 01:14:20 -0500
Subject: More work on the marginal case output for the ssh-proxycommand.  For
 a key matching that offered by the host, now outputs just the information
 (including sigs) of the relevant user ID.  There is some other useful output
 for other cases as well. I also added a couple of FIXMEs for some other cases
 that I think we should think about and maybe tweak behavior for.

---
 src/monkeysphere-ssh-proxycommand | 74 +++++++++++++++++++++++++++++++++------
 1 file changed, 63 insertions(+), 11 deletions(-)

diff --git a/src/monkeysphere-ssh-proxycommand b/src/monkeysphere-ssh-proxycommand
index aeea30d..b3dc562 100755
--- a/src/monkeysphere-ssh-proxycommand
+++ b/src/monkeysphere-ssh-proxycommand
@@ -43,20 +43,21 @@ output_no_valid_key() {
     local uidfpr
     local usage
     local sshKeyGPG
+    local tmpkey
     local sshFingerprint
+    local gpgSigOut
 
     userID="ssh://${HOSTP}"
 
-    log "Monkeysphere found only OpenPGP keys for this host with*out* full validity."
-    log "host:                $userID"
-    log
+    log "-------------------- Monkeysphere warning -------------------"
+    log "Monkeysphere found OpenPGP keys for this hostname, but none had full validity."
 
     # retrieve the actual ssh key
     sshKeyOffered=$(ssh-keyscan -t rsa -p "$PORT" "$HOST" 2>/dev/null | awk '{ print $2, $3 }')
-    # FIXME: should we do any checks for failed keyscans, eg host not
+    # FIXME: should we do any checks for failed keyscans, eg. host not
     # found?
 
-    # output gpg info for userid and store
+    # get the gpg info for userid
     gpgOut=$(gpg --list-key --fixed-list-mode --with-colon \
 	--with-fingerprint --with-fingerprint \
 	="$userID" 2>/dev/null)
@@ -73,26 +74,68 @@ output_no_valid_key() {
 		# if one of keys found matches the one offered by the
 		# host, then output info
 		if [ "$sshKeyGPG" = "$sshKeyOffered" ] ; then
+		    log "An OpenPGP key matching the ssh key offered by the host was found:"
+		    log
 
 		    # get the fingerprint of the ssh key
 		    tmpkey=$(mktemp ${TMPDIR:-/tmp}/tmp.XXXXXXXXXX)
 		    echo "$sshKeyGPG" > "$tmpkey"
-		    sshFingerprint=$(ssh-keygen -l -f "$tmpkey" | awk '{ print $2 }')
+		    sshFingerprint=$(ssh-keygen -l -f "$tmpkey" | \
+			awk '{ print $2 }')
 		    rm -rf "$tmpkey"
 
-		    # output gpg info
-		    gpg --check-sigs \
+		    # get the sigs for the matching key
+		    gpgSigOut=$(gpg --check-sigs \
 			--list-options show-uid-validity \
-			"$keyid" >&2
+			"$keyid")
+
+		    # output the sigs, but only those on the user ID
+		    # we are looking for
+		    echo "$gpgSigOut" | awk '
+{
+if (match($0,"^pub")) {	print; }
+if (match($0,"^uid")) { ok=0; }
+if (match($0,"^uid.*'$userID'$")) { ok=1; print; }
+if (ok) { if (match($0,"^sig")) { print; } }
+}
+' >&2
+		    log
+
+		    # output the other user IDs for reference
+		    if (echo "$gpgSigOut" | grep "^uid" | grep -v -q "$userID") ; then
+			log "Other user IDs on this key:"
+			echo "$gpgSigOut" | grep "^uid" | grep -v "$userID" >&2
+			log
+		    fi
 
 		    # output ssh fingerprint
 		    log "RSA key fingerprint is ${sshFingerprint}."
-		    log "Falling through to standard ssh host checking."
-		    log
+
+		    # this whole process is in a "while read"
+		    # subshell.  the only way to get information out
+		    # of the subshell is to change the return code.
+		    # therefore we return 1 here to indicate that a
+		    # matching gpg key was found for the ssh key
+		    # offered by the host
+		    return 1
 		fi
 		;;
 	esac
     done
+
+    # if no key match was made (and the "while read" subshell returned
+    # 1) output how many keys were found
+    if (($? != 1)) ; then
+	log "None of the found keys matched the key offered by the host."
+	log "Run the following command for more info about the found keys:"
+	log "gpg --check-sigs --list-options show-uid-validity =${userID}"
+	# FIXME: should we do anything extra here if the retrieved
+	# host key is actually in the known_hosts file and the ssh
+	# connection will succeed?  Should the user be warned?
+	# prompted?
+    fi
+
+    log "-------------------- ssh continues below --------------------"
 }
 
 ########################################################################
@@ -186,6 +229,15 @@ case $? in
 	;;
 esac
 
+# FIXME: what about the case where monkeysphere successfully finds a
+# valid key for the host and adds it to the known_hosts file, but a
+# different non-monkeysphere key for the host already exists in the
+# known_hosts, and it is this non-ms key that is offered by the host?
+# monkeysphere will succeed, and the ssh connection will succeed, and
+# the user will be left with the impression that they are dealing with
+# a OpenPGP/PKI host key when in fact they are not.  should we use
+# ssh-keyscan to compare the keys first?
+
 # exec a netcat passthrough to host for the ssh connection
 if [ -z "$NO_CONNECT" ] ; then
     if (which nc 2>/dev/null >/dev/null); then
-- 
cgit v1.2.3


From 9751169042746ae5208edfb5c40ea62b30504735 Mon Sep 17 00:00:00 2001
From: Jameson Graef Rollins <jrollins@finestructure.net>
Date: Mon, 17 Nov 2008 12:05:05 -0500
Subject: add comment to bug about notification of modifications to known_hosts
 file.

---
 website/bugs/useful_information.mdwn | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/website/bugs/useful_information.mdwn b/website/bugs/useful_information.mdwn
index 62094bb..dd0077a 100644
--- a/website/bugs/useful_information.mdwn
+++ b/website/bugs/useful_information.mdwn
@@ -1,5 +1,5 @@
 I would like to know, at INFO (default) log level, when the 
-monkeyspehere makes a "real" modification to my known_hosts file; that 
+monkeyspehere makes a "real" modification to my known\_hosts file; that 
 is, when it adds or deletes a key.
 
 Apparently this is hard because monkeysphere is currently configured to 
@@ -22,3 +22,19 @@ known_hosts file, i get the following to stderr:
 
 This doesn't fully close this bug, because we aren't notifying on key
 deletion, afaict.
+
+------
+
+So current log level DEBUG will output a message if the known host
+file has been modified.  If the issue is that you want to know at the
+default log level everytime the known\_hots file is modified, then we
+should just move this message to INFO instead of debug, and then maybe
+remove the message that I added above.  I was under the impression
+that the issue was more about notification that a *new* key was added
+to the known\_hosts file, and therefore the new INFO message above
+fixed that problem.  Should we do this instead?
+
+In general, more verbose log levels *do* tell the user what the
+monkeysphere is doing.  Moving to DEBUG log level will tell you pretty
+much everything that happens.  I do *not* think that this should be
+the default log level, though.
-- 
cgit v1.2.3


From efa094bae5f15055a22431cb20e79555144d6d33 Mon Sep 17 00:00:00 2001
From: Jameson Graef Rollins <jrollins@finestructure.net>
Date: Mon, 17 Nov 2008 14:56:38 -0500
Subject: Added new web page about server key signing.

---
 website/doc.mdwn                   |   6 +-
 website/getting-started-admin.mdwn |   2 +
 website/getting-started-user.mdwn  |   7 +-
 website/signing-server-keys.mdwn   | 131 +++++++++++++++++++++++++++++++++++++
 4 files changed, 144 insertions(+), 2 deletions(-)
 create mode 100644 website/signing-server-keys.mdwn

diff --git a/website/doc.mdwn b/website/doc.mdwn
index b60cf28..02b4184 100644
--- a/website/doc.mdwn
+++ b/website/doc.mdwn
@@ -8,6 +8,10 @@
  * Getting started as a [user](/getting-started-user)
  * Getting started as a [server admin](/getting-started-admin)
 
+## Going further ##
+
+ * [Signing server keys](/signing-server-keys)
+
 ## Under the hood ##
 
  * [Developing the monkeysphere](/community)
@@ -15,7 +19,7 @@
 
 ## References ##
 
- * [Initial specifications at CMRG](http://cmrg.fifthhorseman.net/wiki/OpenPGPandSSH)
+ * [Initial Monkeysphere specifications at CMRG](http://cmrg.fifthhorseman.net/wiki/OpenPGPandSSH)
  * [OpenPGP (RFC 4880)](http://tools.ietf.org/html/rfc4880)
  * [Secure Shell Authentication Protocol (RFC 4252)](http://tools.ietf.org/html/rfc4252)
    * [URI scheme for SSH, RFC draft](http://tools.ietf.org/wg/secsh/draft-ietf-secsh-scp-sftp-ssh-uri/)
diff --git a/website/getting-started-admin.mdwn b/website/getting-started-admin.mdwn
index 6c8ad53..1c373ac 100644
--- a/website/getting-started-admin.mdwn
+++ b/website/getting-started-admin.mdwn
@@ -7,6 +7,7 @@ so that your users can have it automatically verified, and you can set
 up your machine to automatically identify connecting users by their
 presence in the OpenPGP web of trust.
 
+
 Server host key publication
 ---------------------------
 To generate and publish a server host key:
@@ -48,6 +49,7 @@ effect.  As with any change to `sshd_config`, be sure to retain an
 existing session to the machine while you test your changes so you
 don't get locked out.
 
+
 Monkeysphere authorized_keys maintenance
 ----------------------------------------
 
diff --git a/website/getting-started-user.mdwn b/website/getting-started-user.mdwn
index 5dcb0d6..9b04edc 100644
--- a/website/getting-started-user.mdwn
+++ b/website/getting-started-user.mdwn
@@ -20,6 +20,7 @@ done with a simple cronjob.  An example of crontab line to do this is:
 
 This would refresh your keychain every day at noon.
 
+
 Install the monkeysphere software on your system
 ------------------------------------------------
 
@@ -31,8 +32,9 @@ installed on your system. If you can't (or don't want to) upgrade to
 GnuTLS 2.6 or later, there are patches for GnuTLS 2.4 available in
 [the Monkeysphere git repo](/community).
 
+
 Keeping your `known_hosts` file in sync with your keyring
------------------------------------------------------------
+---------------------------------------------------------
 
 With your keyring updated, you want to make sure that OpenSSH can
 still see the most recent trusted information about who the various
@@ -47,6 +49,7 @@ key for that host to the `known_hosts` file if one is found.  This
 command could be added to a crontab as well, if desired.
 
 
+
 Using `monkeysphere-ssh-proxycommand`(1)
 ----------------------------------------
 
@@ -91,6 +94,7 @@ If you have more than one secret key, you'll need to specify the key
 you want to add the subkey to on the command line.
 
 
+
 Using your OpenPGP authentication key for SSH
 ---------------------------------------------
 
@@ -105,6 +109,7 @@ you can feed your authentication subkey to your ssh agent by running:
 
 FIXME: using the key with a single ssh connection?
 
+
 Establish trust
 ---------------
 
diff --git a/website/signing-server-keys.mdwn b/website/signing-server-keys.mdwn
new file mode 100644
index 0000000..151f975
--- /dev/null
+++ b/website/signing-server-keys.mdwn
@@ -0,0 +1,131 @@
+# Signing a server OpenPGP key #
+
+This page is meant to address the issue of signing server OpenPGP
+keys.  Server's are not people (or monkeys), obviously, so the
+circumstances under which one should sign a server key is a big
+different than those under which a person should sign another person's
+key.
+
+
+# Why are signatures on the server key important? #
+
+In order for users to connect to a server in a monkeysphere-enabled
+network, the server key must have *full* validity for the connecting
+user.  If the user has not themselves signed the server's key, then
+the server's key can only be valid if other people that the user
+trusts have signed the key.
+
+If only one person has signed the server's key, then the user must
+fully trust the single person who has signed the server key.  Full
+trust should be granted sparingly and with consideration, though, so
+unless the user knows the server admin very well, they will in general
+not have full trust of this person.
+
+However, full trust of the server key can also be achieved if the
+server key has been signed by three or more people that the user has
+ *marginal* trust of.  In other words, three or more *marginally*
+trusted signatures equals one *fully* trusted signature.  It is much
+more common for users to have marginal trust of other users in the Web
+of Trust.  For this reason, it is important to have as many people
+sign the server key as possible.
+
+
+## What information should you have before signing a server key? ##
+
+When signing the key of a person, you want to do two things:
+
+1. verify the identity of the person.
+2. verify that the person is actually in control of the key that you
+are signing.
+
+For a server, you want to do basically the same thing:
+
+1. verify the identity of the server.
+2. verify that the server is actually in control of the key that you
+are signing.
+
+However, with a server, verifying these things is a little trickier.
+
+Verifying that the server is in control of the key is, in principle,
+straightforward.  If you are logged on to the machine in question,
+then you can check directly that the key exists on the system.
+
+What is not so straightforward is what exactly it means to "verify the
+identity" of a remote server on the web?  The identity in this case is
+the fully qualified domain name (FQDN) of the host.  Verifying this
+identity amounts to being sure that the host in question really is
+located at that FQDN.
+
+
+## Signing the server key ##
+
+If you are the person (or persons) that actually setup the server and
+configured Monkeysphere and ssh on the server, then clearly you should
+definitely sign the server key right away.  When the server is first
+setup, the persons who set it up are the only ones who can actually
+vouch for the server key, so their signatures are necessary to get
+things going.  Their signatures are also necessary so that they can
+verify the host key themselves and log into the server via
+monkeysphere-enabled ssh in the future.
+
+If you did not set up the server initially, you do not have an
+accumulated full trust of the person(s) who did, and you do not
+necessarily have console access to the server directly, it's hard to
+confidently verify the server identity and key ownership.  You would
+like to be able to walk up to the server, log in at the console, and
+get the fingerprint of the ssh host key directly.  But this is usually
+untenable.
+
+However, it is still possible to verify the server identity *and*
+server ownership of the key, even in this case.
+
+
+## Remotely verifying server identify and key possession ##
+
+It is in fact possible to verify the identity and key ownership of a
+server in one fell swoop with monkeysphere-enabled ssh.  Here is the
+procedure:
+
+> **Attempt to make a monkeysphere-enabled ssh connection to the host in
+question.  Monkeysphere will check that the ssh host key offered by the
+host matches the OpenPGP key with the correct host FQDN user ID.  If
+the ssh host key and the OpenPGP key with the correct user ID match,
+then you will have effectively:**
+
+>**1. verified the host identity, because you actually connected to the
+host in question, which you know because you:**
+
+>**2. verified the host is in control of the key, because the ssh host
+key offered by the host matches the OpenPGP key with correct host FQDN
+user ID.**
+
+Here is an example:
+
+	servo:~ 0$ ssh zimmermann.mayfirst.org
+	-------------------- Monkeysphere warning -------------------
+	Monkeysphere found OpenPGP keys for this hostname, but none had full validity.
+	An OpenPGP key matching the ssh key offered by the host was found:
+	
+	pub   2048R/860E8F9C 2008-10-29 [expires: 2009-02-26]
+	uid       [marginal] ssh://zimmermann.mayfirst.org
+	sig!         76CC057D 2008-11-15  Jamie McClelland <jamie@mayfirst.org>
+	sig!3        860E8F9C 2008-10-29  ssh://zimmermann.mayfirst.org
+	sig!         D21739E9 2008-10-29  Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+	sig!         1CF2D62A 2008-11-16  Micah Anderson <micah@riseup.net>
+	
+	RSA key fingerprint is 81:96:13:3e:24:c9:3c:5b:3c:6d:55:ba:58:85:e9:9e.
+	-------------------- ssh continues below --------------------
+	The authenticity of host 'zimmermann.mayfirst.org (<no hostip for proxy command>)' can't be established.
+	RSA key fingerprint is 81:96:13:3e:24:c9:3c:5b:3c:6d:55:ba:58:85:e9:9e.
+	No matching host key fingerprint found in DNS.
+	Are you sure you want to continue connecting (yes/no)? no
+	Host key verification failed.
+	servo:~ 255$ 
+
+I have attempted to connect to the host zimmermann.mayfirst.org.
+zimmermann's host key has only *marginal* validity for the FQDN user
+ID in question, so I am not able to connect.  However, the
+monkeysphere has checked that the ssh host key actually does match the
+OpenPGP key with the correct user ID `ssh://zimmermann.mayfirst.org`.
+I have therefore verified the identity of zimmermann, and verified
+that zimmermann is in possession of the key in question.
-- 
cgit v1.2.3


From 6a43a89f5b2cd6ce91fa9c0bfddb5e2d44e77200 Mon Sep 17 00:00:00 2001
From: Jameson Graef Rollins <jrollins@finestructure.net>
Date: Mon, 17 Nov 2008 18:07:33 -0500
Subject: HA!  I figured out how to get ssh-keygen to read stdin by using the
 bash "Here Strings" redirection.  No more stupid tempfiles to get ssh key
 fingerprints.

---
 src/monkeysphere-server           | 12 ++++++------
 src/monkeysphere-ssh-proxycommand |  9 ++++-----
 2 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/src/monkeysphere-server b/src/monkeysphere-server
index 34b06b7..a1844ee 100755
--- a/src/monkeysphere-server
+++ b/src/monkeysphere-server
@@ -132,13 +132,13 @@ show_server_key() {
     fingerprint=$(fingerprint_server_key)
     gpg_authentication "--fingerprint --list-key --list-options show-unusable-uids $fingerprint"
 
-    # dumping to a file named ' ' so that the ssh-keygen output
-    # doesn't claim any potentially bogus hostname(s):
-    tmpkey=$(mktemp ${TMPDIR:-/tmp}/tmp.XXXXXXXXXX) || failure "Could not create temporary directory!"
-    gpg_authentication "--export $fingerprint" | openpgp2ssh "$fingerprint" 2>/dev/null > "$tmpkey"
+    # do some crazy "Here Strings" redirection to get the key to
+    # ssh-keygen, since it doesn't read from stdin cleanly
     echo -n "ssh fingerprint: "
-    ssh-keygen -l -f "$tmpkey" | awk '{ print $1, $2, $4 }'
-    rm -rf "$tmpkey"
+    ssh-keygen -l -f /dev/stdin \
+	<<<$(gpg_authentication "--export $fingerprint" | \
+	openpgp2ssh "$fingerprint" 2>/dev/null) | \
+	awk '{ print $1, $2, $4 }'
     echo -n "OpenPGP fingerprint: "
     echo "$fingerprint"
 }
diff --git a/src/monkeysphere-ssh-proxycommand b/src/monkeysphere-ssh-proxycommand
index b3dc562..a609199 100755
--- a/src/monkeysphere-ssh-proxycommand
+++ b/src/monkeysphere-ssh-proxycommand
@@ -77,12 +77,11 @@ output_no_valid_key() {
 		    log "An OpenPGP key matching the ssh key offered by the host was found:"
 		    log
 
-		    # get the fingerprint of the ssh key
-		    tmpkey=$(mktemp ${TMPDIR:-/tmp}/tmp.XXXXXXXXXX)
-		    echo "$sshKeyGPG" > "$tmpkey"
-		    sshFingerprint=$(ssh-keygen -l -f "$tmpkey" | \
+		    # do some crazy "Here Strings" redirection to get the key to
+		    # ssh-keygen, since it doesn't read from stdin cleanly
+		    sshFingerprint=$(ssh-keygen -l -f /dev/stdin \
+			<<<$(echo "$sshKeyGPG") | \
 			awk '{ print $2 }')
-		    rm -rf "$tmpkey"
 
 		    # get the sigs for the matching key
 		    gpgSigOut=$(gpg --check-sigs \
-- 
cgit v1.2.3


From 505ee50a409014b55afea3b04c097d976e8b3766 Mon Sep 17 00:00:00 2001
From: Jameson Graef Rollins <jrollins@finestructure.net>
Date: Mon, 17 Nov 2008 18:16:04 -0500
Subject: update changelog.

---
 packaging/debian/changelog | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/packaging/debian/changelog b/packaging/debian/changelog
index 3b7432b..39e4b33 100644
--- a/packaging/debian/changelog
+++ b/packaging/debian/changelog
@@ -6,6 +6,7 @@ monkeysphere (0.22~pre-1) UNRELEASED; urgency=low
     - added info log output when a new key is added to known_hosts file.
     - added some useful output to the ssh-proxycommand for "marginal"
       cases where keys are found for host but do not have full validity.
+    - force ssh-keygen to read from stdin to get ssh key fingerprint.
 
   [ Daniel Kahn Gillmor ]
 
@@ -13,7 +14,7 @@ monkeysphere (0.22~pre-1) UNRELEASED; urgency=low
     standard ssh public key file, and the other a minimal OpenPGP key with
     just the latest valid self-sig.
 
- -- Jameson Graef Rollins <jrollins@finestructure.net>  Sun, 16 Nov 2008 03:22:08 -0500
+ -- Jameson Graef Rollins <jrollins@finestructure.net>  Mon, 17 Nov 2008 18:15:43 -0500
 
 monkeysphere (0.21-2) unstable; urgency=low
 
-- 
cgit v1.2.3


From b8a60a2c3c6e66513c1e4b83b65a2f808c882843 Mon Sep 17 00:00:00 2001
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Date: Tue, 18 Nov 2008 00:48:47 -0500
Subject: further commentary on proxy_command logging.

---
 website/bugs/useful_information.mdwn | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/website/bugs/useful_information.mdwn b/website/bugs/useful_information.mdwn
index dd0077a..025d678 100644
--- a/website/bugs/useful_information.mdwn
+++ b/website/bugs/useful_information.mdwn
@@ -38,3 +38,13 @@ In general, more verbose log levels *do* tell the user what the
 monkeysphere is doing.  Moving to DEBUG log level will tell you pretty
 much everything that happens.  I do *not* think that this should be
 the default log level, though.
+
+------
+
+I wouldn't want to see an extremely verbose default log level.  But i
+do think that saying something like "key blah blah blah was stripped
+from your known\_hosts file because it was expired" (for example)
+would be useful.  I think this case would occur infrequently enough
+that it is worth reporting in the UI at the regular log level.
+
+  --dkg
-- 
cgit v1.2.3


From 888c5cf2555732bcdadb214d19b5603b8d5dabed Mon Sep 17 00:00:00 2001
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Date: Tue, 18 Nov 2008 01:29:34 -0500
Subject: minor grammar/vocabulary nitpicking.

---
 website/signing-server-keys.mdwn | 29 +++++++++++++----------------
 1 file changed, 13 insertions(+), 16 deletions(-)

diff --git a/website/signing-server-keys.mdwn b/website/signing-server-keys.mdwn
index 151f975..e0d26a7 100644
--- a/website/signing-server-keys.mdwn
+++ b/website/signing-server-keys.mdwn
@@ -1,19 +1,17 @@
 # Signing a server OpenPGP key #
 
 This page is meant to address the issue of signing server OpenPGP
-keys.  Server's are not people (or monkeys), obviously, so the
-circumstances under which one should sign a server key is a big
-different than those under which a person should sign another person's
-key.
-
+keys.  Servers are not people, so the circumstances under which one
+should sign a server key are different from those under which one
+should sign another person's key.
 
 # Why are signatures on the server key important? #
 
 In order for users to connect to a server in a monkeysphere-enabled
-network, the server key must have *full* validity for the connecting
-user.  If the user has not themselves signed the server's key, then
-the server's key can only be valid if other people that the user
-trusts have signed the key.
+network, the server key must have *full* calculated validity from the
+perspective of the connecting user.  If the user has not themselves
+signed the server's key, then the server's key can only be valid if
+other people that the user trusts have signed the key.
 
 If only one person has signed the server's key, then the user must
 fully trust the single person who has signed the server key.  Full
@@ -26,13 +24,12 @@ server key has been signed by three or more people that the user has
  *marginal* trust of.  In other words, three or more *marginally*
 trusted signatures equals one *fully* trusted signature.  It is much
 more common for users to have marginal trust of other users in the Web
-of Trust.  For this reason, it is important to have as many people
+of Trust.  For this reason, it is advisable to have as many people
 sign the server key as possible.
 
-
 ## What information should you have before signing a server key? ##
 
-When signing the key of a person, you want to do two things:
+Before signing the key of a person, you want to do two things:
 
 1. verify the identity of the person.
 2. verify that the person is actually in control of the key that you
@@ -51,10 +48,10 @@ straightforward.  If you are logged on to the machine in question,
 then you can check directly that the key exists on the system.
 
 What is not so straightforward is what exactly it means to "verify the
-identity" of a remote server on the web?  The identity in this case is
-the fully qualified domain name (FQDN) of the host.  Verifying this
-identity amounts to being sure that the host in question really is
-located at that FQDN.
+identity" of a remote server on the internet?  The identity in this
+case is the fully qualified domain name (FQDN) of the host.  Verifying
+this identity amounts to being sure that the host in question really
+is located at that FQDN.
 
 
 ## Signing the server key ##
-- 
cgit v1.2.3


From d89e9293654cfd6330e2aa398768eca0fc8fa621 Mon Sep 17 00:00:00 2001
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Date: Tue, 18 Nov 2008 01:30:32 -0500
Subject: renaming page about signing host keys.

---
 website/signing-host-keys.mdwn   | 128 +++++++++++++++++++++++++++++++++++++++
 website/signing-server-keys.mdwn | 128 ---------------------------------------
 2 files changed, 128 insertions(+), 128 deletions(-)
 create mode 100644 website/signing-host-keys.mdwn
 delete mode 100644 website/signing-server-keys.mdwn

diff --git a/website/signing-host-keys.mdwn b/website/signing-host-keys.mdwn
new file mode 100644
index 0000000..e0d26a7
--- /dev/null
+++ b/website/signing-host-keys.mdwn
@@ -0,0 +1,128 @@
+# Signing a server OpenPGP key #
+
+This page is meant to address the issue of signing server OpenPGP
+keys.  Servers are not people, so the circumstances under which one
+should sign a server key are different from those under which one
+should sign another person's key.
+
+# Why are signatures on the server key important? #
+
+In order for users to connect to a server in a monkeysphere-enabled
+network, the server key must have *full* calculated validity from the
+perspective of the connecting user.  If the user has not themselves
+signed the server's key, then the server's key can only be valid if
+other people that the user trusts have signed the key.
+
+If only one person has signed the server's key, then the user must
+fully trust the single person who has signed the server key.  Full
+trust should be granted sparingly and with consideration, though, so
+unless the user knows the server admin very well, they will in general
+not have full trust of this person.
+
+However, full trust of the server key can also be achieved if the
+server key has been signed by three or more people that the user has
+ *marginal* trust of.  In other words, three or more *marginally*
+trusted signatures equals one *fully* trusted signature.  It is much
+more common for users to have marginal trust of other users in the Web
+of Trust.  For this reason, it is advisable to have as many people
+sign the server key as possible.
+
+## What information should you have before signing a server key? ##
+
+Before signing the key of a person, you want to do two things:
+
+1. verify the identity of the person.
+2. verify that the person is actually in control of the key that you
+are signing.
+
+For a server, you want to do basically the same thing:
+
+1. verify the identity of the server.
+2. verify that the server is actually in control of the key that you
+are signing.
+
+However, with a server, verifying these things is a little trickier.
+
+Verifying that the server is in control of the key is, in principle,
+straightforward.  If you are logged on to the machine in question,
+then you can check directly that the key exists on the system.
+
+What is not so straightforward is what exactly it means to "verify the
+identity" of a remote server on the internet?  The identity in this
+case is the fully qualified domain name (FQDN) of the host.  Verifying
+this identity amounts to being sure that the host in question really
+is located at that FQDN.
+
+
+## Signing the server key ##
+
+If you are the person (or persons) that actually setup the server and
+configured Monkeysphere and ssh on the server, then clearly you should
+definitely sign the server key right away.  When the server is first
+setup, the persons who set it up are the only ones who can actually
+vouch for the server key, so their signatures are necessary to get
+things going.  Their signatures are also necessary so that they can
+verify the host key themselves and log into the server via
+monkeysphere-enabled ssh in the future.
+
+If you did not set up the server initially, you do not have an
+accumulated full trust of the person(s) who did, and you do not
+necessarily have console access to the server directly, it's hard to
+confidently verify the server identity and key ownership.  You would
+like to be able to walk up to the server, log in at the console, and
+get the fingerprint of the ssh host key directly.  But this is usually
+untenable.
+
+However, it is still possible to verify the server identity *and*
+server ownership of the key, even in this case.
+
+
+## Remotely verifying server identify and key possession ##
+
+It is in fact possible to verify the identity and key ownership of a
+server in one fell swoop with monkeysphere-enabled ssh.  Here is the
+procedure:
+
+> **Attempt to make a monkeysphere-enabled ssh connection to the host in
+question.  Monkeysphere will check that the ssh host key offered by the
+host matches the OpenPGP key with the correct host FQDN user ID.  If
+the ssh host key and the OpenPGP key with the correct user ID match,
+then you will have effectively:**
+
+>**1. verified the host identity, because you actually connected to the
+host in question, which you know because you:**
+
+>**2. verified the host is in control of the key, because the ssh host
+key offered by the host matches the OpenPGP key with correct host FQDN
+user ID.**
+
+Here is an example:
+
+	servo:~ 0$ ssh zimmermann.mayfirst.org
+	-------------------- Monkeysphere warning -------------------
+	Monkeysphere found OpenPGP keys for this hostname, but none had full validity.
+	An OpenPGP key matching the ssh key offered by the host was found:
+	
+	pub   2048R/860E8F9C 2008-10-29 [expires: 2009-02-26]
+	uid       [marginal] ssh://zimmermann.mayfirst.org
+	sig!         76CC057D 2008-11-15  Jamie McClelland <jamie@mayfirst.org>
+	sig!3        860E8F9C 2008-10-29  ssh://zimmermann.mayfirst.org
+	sig!         D21739E9 2008-10-29  Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+	sig!         1CF2D62A 2008-11-16  Micah Anderson <micah@riseup.net>
+	
+	RSA key fingerprint is 81:96:13:3e:24:c9:3c:5b:3c:6d:55:ba:58:85:e9:9e.
+	-------------------- ssh continues below --------------------
+	The authenticity of host 'zimmermann.mayfirst.org (<no hostip for proxy command>)' can't be established.
+	RSA key fingerprint is 81:96:13:3e:24:c9:3c:5b:3c:6d:55:ba:58:85:e9:9e.
+	No matching host key fingerprint found in DNS.
+	Are you sure you want to continue connecting (yes/no)? no
+	Host key verification failed.
+	servo:~ 255$ 
+
+I have attempted to connect to the host zimmermann.mayfirst.org.
+zimmermann's host key has only *marginal* validity for the FQDN user
+ID in question, so I am not able to connect.  However, the
+monkeysphere has checked that the ssh host key actually does match the
+OpenPGP key with the correct user ID `ssh://zimmermann.mayfirst.org`.
+I have therefore verified the identity of zimmermann, and verified
+that zimmermann is in possession of the key in question.
diff --git a/website/signing-server-keys.mdwn b/website/signing-server-keys.mdwn
deleted file mode 100644
index e0d26a7..0000000
--- a/website/signing-server-keys.mdwn
+++ /dev/null
@@ -1,128 +0,0 @@
-# Signing a server OpenPGP key #
-
-This page is meant to address the issue of signing server OpenPGP
-keys.  Servers are not people, so the circumstances under which one
-should sign a server key are different from those under which one
-should sign another person's key.
-
-# Why are signatures on the server key important? #
-
-In order for users to connect to a server in a monkeysphere-enabled
-network, the server key must have *full* calculated validity from the
-perspective of the connecting user.  If the user has not themselves
-signed the server's key, then the server's key can only be valid if
-other people that the user trusts have signed the key.
-
-If only one person has signed the server's key, then the user must
-fully trust the single person who has signed the server key.  Full
-trust should be granted sparingly and with consideration, though, so
-unless the user knows the server admin very well, they will in general
-not have full trust of this person.
-
-However, full trust of the server key can also be achieved if the
-server key has been signed by three or more people that the user has
- *marginal* trust of.  In other words, three or more *marginally*
-trusted signatures equals one *fully* trusted signature.  It is much
-more common for users to have marginal trust of other users in the Web
-of Trust.  For this reason, it is advisable to have as many people
-sign the server key as possible.
-
-## What information should you have before signing a server key? ##
-
-Before signing the key of a person, you want to do two things:
-
-1. verify the identity of the person.
-2. verify that the person is actually in control of the key that you
-are signing.
-
-For a server, you want to do basically the same thing:
-
-1. verify the identity of the server.
-2. verify that the server is actually in control of the key that you
-are signing.
-
-However, with a server, verifying these things is a little trickier.
-
-Verifying that the server is in control of the key is, in principle,
-straightforward.  If you are logged on to the machine in question,
-then you can check directly that the key exists on the system.
-
-What is not so straightforward is what exactly it means to "verify the
-identity" of a remote server on the internet?  The identity in this
-case is the fully qualified domain name (FQDN) of the host.  Verifying
-this identity amounts to being sure that the host in question really
-is located at that FQDN.
-
-
-## Signing the server key ##
-
-If you are the person (or persons) that actually setup the server and
-configured Monkeysphere and ssh on the server, then clearly you should
-definitely sign the server key right away.  When the server is first
-setup, the persons who set it up are the only ones who can actually
-vouch for the server key, so their signatures are necessary to get
-things going.  Their signatures are also necessary so that they can
-verify the host key themselves and log into the server via
-monkeysphere-enabled ssh in the future.
-
-If you did not set up the server initially, you do not have an
-accumulated full trust of the person(s) who did, and you do not
-necessarily have console access to the server directly, it's hard to
-confidently verify the server identity and key ownership.  You would
-like to be able to walk up to the server, log in at the console, and
-get the fingerprint of the ssh host key directly.  But this is usually
-untenable.
-
-However, it is still possible to verify the server identity *and*
-server ownership of the key, even in this case.
-
-
-## Remotely verifying server identify and key possession ##
-
-It is in fact possible to verify the identity and key ownership of a
-server in one fell swoop with monkeysphere-enabled ssh.  Here is the
-procedure:
-
-> **Attempt to make a monkeysphere-enabled ssh connection to the host in
-question.  Monkeysphere will check that the ssh host key offered by the
-host matches the OpenPGP key with the correct host FQDN user ID.  If
-the ssh host key and the OpenPGP key with the correct user ID match,
-then you will have effectively:**
-
->**1. verified the host identity, because you actually connected to the
-host in question, which you know because you:**
-
->**2. verified the host is in control of the key, because the ssh host
-key offered by the host matches the OpenPGP key with correct host FQDN
-user ID.**
-
-Here is an example:
-
-	servo:~ 0$ ssh zimmermann.mayfirst.org
-	-------------------- Monkeysphere warning -------------------
-	Monkeysphere found OpenPGP keys for this hostname, but none had full validity.
-	An OpenPGP key matching the ssh key offered by the host was found:
-	
-	pub   2048R/860E8F9C 2008-10-29 [expires: 2009-02-26]
-	uid       [marginal] ssh://zimmermann.mayfirst.org
-	sig!         76CC057D 2008-11-15  Jamie McClelland <jamie@mayfirst.org>
-	sig!3        860E8F9C 2008-10-29  ssh://zimmermann.mayfirst.org
-	sig!         D21739E9 2008-10-29  Daniel Kahn Gillmor <dkg@fifthhorseman.net>
-	sig!         1CF2D62A 2008-11-16  Micah Anderson <micah@riseup.net>
-	
-	RSA key fingerprint is 81:96:13:3e:24:c9:3c:5b:3c:6d:55:ba:58:85:e9:9e.
-	-------------------- ssh continues below --------------------
-	The authenticity of host 'zimmermann.mayfirst.org (<no hostip for proxy command>)' can't be established.
-	RSA key fingerprint is 81:96:13:3e:24:c9:3c:5b:3c:6d:55:ba:58:85:e9:9e.
-	No matching host key fingerprint found in DNS.
-	Are you sure you want to continue connecting (yes/no)? no
-	Host key verification failed.
-	servo:~ 255$ 
-
-I have attempted to connect to the host zimmermann.mayfirst.org.
-zimmermann's host key has only *marginal* validity for the FQDN user
-ID in question, so I am not able to connect.  However, the
-monkeysphere has checked that the ssh host key actually does match the
-OpenPGP key with the correct user ID `ssh://zimmermann.mayfirst.org`.
-I have therefore verified the identity of zimmermann, and verified
-that zimmermann is in possession of the key in question.
-- 
cgit v1.2.3


From d8d26503748dc78a843ad35a2e12cdae277f1415 Mon Sep 17 00:00:00 2001
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Date: Tue, 18 Nov 2008 01:33:44 -0500
Subject: really fixing utils/build-releasenote after the packaging
 reorganization.

---
 utils/build-releasenote | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/utils/build-releasenote b/utils/build-releasenote
index 522917c..b25a87c 100755
--- a/utils/build-releasenote
+++ b/utils/build-releasenote
@@ -4,7 +4,7 @@ VERSION=`head -n1 packaging/debian/changelog | sed 's/.*(\([^)]*\)).*/\1/'`
 
 { 
     sed "s/__VERSION__/$VERSION/g" < utils/releasenote.header
-    head -n$(( $(grep -n '^ --' debian/changelog  | head -n1 | cut -f1 -d:) - 2 )) debian/changelog | tail -n+3
+    head -n$(( $(grep -n '^ --' packaging/debian/changelog  | head -n1 | cut -f1 -d:) - 2 )) packaging/debian/changelog | tail -n+3
     sed "s/__VERSION__/$VERSION/g" < utils/releasenote.footer
 } > "website/news/release-$VERSION.mdwn"
 
-- 
cgit v1.2.3