From 9ea13e47f6d84b277eb819d41ece99c695aab407 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 10 Mar 2009 17:42:57 -0400 Subject: include changelog entry about mktemp portability update. --- packaging/debian/changelog | 2 ++ 1 file changed, 2 insertions(+) (limited to 'packaging') diff --git a/packaging/debian/changelog b/packaging/debian/changelog index 093c157..70fef9f 100644 --- a/packaging/debian/changelog +++ b/packaging/debian/changelog @@ -2,6 +2,8 @@ monkeysphere (0.25-1~pre) UNRELEASED; urgency=low * New upstream release: - fix the marginal ui output so that it's not prefixed by the LOG_PREFIX + - use msmktempdir everywhere (avoid unwrapped calls to mktemp for + portability) -- Jameson Graef Rollins Sat, 07 Mar 2009 12:28:13 -0500 -- cgit v1.2.3 From 3f71bfc52f158a76755a7b75362b449439819fa7 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Wed, 18 Mar 2009 12:01:02 -0400 Subject: modify the ssh_proxycommand marginal ui output so that it better handles the case where the host can not be contacted. the new system attempts to retrieve the host ssh key before any ui output is made. this should make things a little clearer in this corner case, and make things a little more flexible down the line. --- packaging/debian/changelog | 4 +- src/share/m/ssh_proxycommand | 137 +++++++++++++++++++++++-------------------- 2 files changed, 76 insertions(+), 65 deletions(-) (limited to 'packaging') diff --git a/packaging/debian/changelog b/packaging/debian/changelog index 70fef9f..16e7f21 100644 --- a/packaging/debian/changelog +++ b/packaging/debian/changelog @@ -1,11 +1,11 @@ monkeysphere (0.25-1~pre) UNRELEASED; urgency=low * New upstream release: - - fix the marginal ui output so that it's not prefixed by the LOG_PREFIX + - update/fix the marginal ui output - use msmktempdir everywhere (avoid unwrapped calls to mktemp for portability) - -- Jameson Graef Rollins Sat, 07 Mar 2009 12:28:13 -0500 + -- Jameson Graef Rollins Wed, 18 Mar 2009 11:46:44 -0400 monkeysphere (0.24-1) unstable; urgency=low diff --git a/src/share/m/ssh_proxycommand b/src/share/m/ssh_proxycommand index 7ab4bec..2078445 100644 --- a/src/share/m/ssh_proxycommand +++ b/src/share/m/ssh_proxycommand @@ -36,52 +36,55 @@ output_no_valid_key() { LOG_PREFIX= - cat </dev/null | awk '{ print $2, $3 }') - # FIXME: should we do any checks for failed keyscans, eg. host not - # found? + # retrieve the ssh key being offered by the host + sshKeyOffered=$(ssh-keyscan -t rsa -p "$PORT" "$HOST" 2>/dev/null \ + | awk '{ print $2, $3 }') # get the gpg info for userid gpgOut=$(gpg_user --list-key --fixed-list-mode --with-colon \ --with-fingerprint --with-fingerprint \ ="$userID" 2>/dev/null) - # find all 'pub' and 'sub' lines in the gpg output, which each - # represent a retrieved key for the user ID - echo "$gpgOut" | cut -d: -f1,2,5,10,12 | \ - while IFS=: read -r type validity keyid uidfpr usage ; do - case $type in - 'pub'|'sub') - # get the ssh key of the gpg key - sshKeyGPG=$(gpg2ssh "$keyid") - - # if one of keys found matches the one offered by the - # host, then output info - if [ "$sshKeyGPG" = "$sshKeyOffered" ] ; then - cat <"$sshKeyGPGFile" - sshFingerprint=$(ssh-keygen -l -f "$sshKeyGPGFile" | \ - awk '{ print $2 }') - rm -f "$sshKeyGPGFile" + sshKeyGPGFile=$(msmktempfile) + printf "%s" "$sshKeyGPG" >"$sshKeyGPGFile" + sshFingerprint=$(ssh-keygen -l -f "$sshKeyGPGFile" | \ + awk '{ print $2 }') + rm -f "$sshKeyGPGFile" - # get the sigs for the matching key - gpgSigOut=$(gpg_user --check-sigs \ - --list-options show-uid-validity \ - "$keyid") + # get the sigs for the matching key + gpgSigOut=$(gpg_user --check-sigs \ + --list-options show-uid-validity \ + "$keyid") - # output the sigs, but only those on the user ID - # we are looking for - echo "$gpgSigOut" | awk ' + # output the sigs, but only those on the user ID + # we are looking for + echo "$gpgSigOut" | awk ' { if (match($0,"^pub")) { print; } if (match($0,"^uid")) { ok=0; } @@ -89,50 +92,58 @@ if (match($0,"^uid.*'$userID'$")) { ok=1; print; } if (ok) { if (match($0,"^sig")) { print; } } } ' | log info - echo | log info + echo | log info - # output the other user IDs for reference - if (echo "$gpgSigOut" | grep "^uid" | grep -v -q "$userID") ; then - cat < Date: Sun, 22 Mar 2009 01:40:30 -0400 Subject: Start of macport packaging. --- packaging/macports/Portfile | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 packaging/macports/Portfile (limited to 'packaging') diff --git a/packaging/macports/Portfile b/packaging/macports/Portfile new file mode 100644 index 0000000..f9cf7a5 --- /dev/null +++ b/packaging/macports/Portfile @@ -0,0 +1,40 @@ +# -*- coding: utf-8; mode: tcl; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- vim:fenc=utf-8:ft=tcl:et:sw=4:ts=4:sts=4 +# $Id$ + +PortSystem 1.0 + +name monkeysphere +version 0.24 +categories net +maintainers nomaintainer +platforms darwin +description use the OpenPGP web of trust to verify ssh connections + +long_description SSH key-based authentication is tried-and-true, \ + but it lacks a true Public Key Infrastructure for \ + key certification, revocation and expiration. \ + Monkeysphere is a framework that uses the OpenPGP \ + web of trust for these PKI functions. It can be \ + used in both directions: for users to get \ + validated host keys, and for hosts to authenticate \ + users. + +homepage http://web.monkeysphere.info/ +master_sites ??? +distname ${name}_${version} +worksrcdir ${name}-${version} +checksums md5 8590532f4702fa44027a6a583657c9ef + +depends_run bin:ssh:openssh \ + port:gnupg \ + port:perl5.10 \ + port:p5-crypt-rsa \ + port:p5-digest-sha1 \ + port:procmail + +build.target build +destroot.args PREFIX=${destroot}${prefix} \ + CONFDIR=${destroot}${prefix}/etc/monkeysphere \ + DBDIR=${destroot}${prefix}/var/lib/monkeysphere \ + MANDIR=${destroot}${prefix}/share/man \ + DOCDIR=${destroot}${prefix}/share/doc/monkeysphere -- cgit v1.2.3 From 80fa48160844ace97727896131c67df78ea4bb61 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Sun, 22 Mar 2009 20:11:16 -0400 Subject: some more pruning of unnecessary usage of cat for the gnupg scripts. --- packaging/macports/Portfile | 2 +- src/share/ma/add_certifier | 8 +++----- src/share/mh/add_hostname | 8 +++----- src/share/mh/add_revoker | 8 +++----- src/share/mh/revoke_hostname | 8 +++----- 5 files changed, 13 insertions(+), 21 deletions(-) (limited to 'packaging') diff --git a/packaging/macports/Portfile b/packaging/macports/Portfile index f9cf7a5..99d0d69 100644 --- a/packaging/macports/Portfile +++ b/packaging/macports/Portfile @@ -20,7 +20,7 @@ long_description SSH key-based authentication is tried-and-true, \ users. homepage http://web.monkeysphere.info/ -master_sites ??? +master_sites http://archive.monkeysphere.info/debian/pool/monkeysphere/m/monkeysphere/ distname ${name}_${version} worksrcdir ${name}-${version} checksums md5 8590532f4702fa44027a6a583657c9ef diff --git a/src/share/ma/add_certifier b/src/share/ma/add_certifier index 544a3f0..402da08 100644 --- a/src/share/ma/add_certifier +++ b/src/share/ma/add_certifier @@ -153,16 +153,14 @@ gpg_sphere "--export 0x${fingerprint}!" | gpg_core --import # edit-key script to ltsign key # NOTE: *all* user IDs will be ltsigned -ltsignCommand=$(cat < Date: Mon, 23 Mar 2009 16:52:53 -0400 Subject: updating debian/changelog --- packaging/debian/changelog | 3 +++ 1 file changed, 3 insertions(+) (limited to 'packaging') diff --git a/packaging/debian/changelog b/packaging/debian/changelog index 16e7f21..82ef1ae 100644 --- a/packaging/debian/changelog +++ b/packaging/debian/changelog @@ -4,6 +4,9 @@ monkeysphere (0.25-1~pre) UNRELEASED; urgency=low - update/fix the marginal ui output - use msmktempdir everywhere (avoid unwrapped calls to mktemp for portability) + - clean out some redundant "cat"s + - fix monkeysphere update-known_hosts for sshd running on non-standard + ports -- Jameson Graef Rollins Wed, 18 Mar 2009 11:46:44 -0400 -- cgit v1.2.3