From 348d18f9d16478fd3a11cd59caa152cc367c08c5 Mon Sep 17 00:00:00 2001
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Date: Fri, 20 Feb 2009 13:19:46 -0500
Subject: tuning some diagnostic text.

---
 src/share/ma/diagnostics | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/share/ma')

diff --git a/src/share/ma/diagnostics b/src/share/ma/diagnostics
index ce463b2..8fc4b31 100644
--- a/src/share/ma/diagnostics
+++ b/src/share/ma/diagnostics
@@ -105,7 +105,7 @@ echo
 echo "Checking for Identity Certifiers..."
 if ! monkeysphere-authentication list-identity-certifiers | egrep -q '^[A-F0-9]{40}:' then
     echo "! No Identity Certifiers found!"
-    echo " - Recommendation: once you know who should be able to certify identities for 
+    echo " - Recommendation: once you know who should be able to certify the identities of 
      connecting users, you should add their key, with: 
       monkeysphere-authentication add-identity-certifier"
     problemsfound=$(($problemsfound+1))
-- 
cgit v1.2.3


From cd4c36070c85283086ed914d8fd6ac77884173bb Mon Sep 17 00:00:00 2001
From: Jameson Graef Rollins <jrollins@finestructure.net>
Date: Fri, 20 Feb 2009 14:26:15 -0500
Subject: tweak/cleanup some of the prompts.

---
 src/share/ma/add_certifier    |  4 ++--
 src/share/ma/remove_certifier |  2 +-
 src/share/mh/add_hostname     |  6 ++++--
 src/share/mh/add_revoker      |  4 ++--
 src/share/mh/import_key       | 15 +++++++++++++++
 src/share/mh/revoke_hostname  |  8 +++++---
 6 files changed, 29 insertions(+), 10 deletions(-)

(limited to 'src/share/ma')

diff --git a/src/share/ma/add_certifier b/src/share/ma/add_certifier
index f2cadf2..a48db64 100644
--- a/src/share/ma/add_certifier
+++ b/src/share/ma/add_certifier
@@ -126,8 +126,8 @@ else
     gpg_sphere "--fingerprint 0x${fingerprint}!"
 
     if [ "$PROMPT" = "true" ] ; then
-	echo "Are you sure you want to add the above key as a"
-	read -p "certifier of users on this system? (Y/n) " OK; OK=${OK:-Y}
+	echo "Are you sure you want to add the above key as a certifier"
+	read -p "of users on this system? (Y/n) " OK; OK=${OK:-Y}
 	if [ "${OK/y/Y}" != 'Y' ] ; then
 	    failure "Identity certifier not added."
 	fi
diff --git a/src/share/ma/remove_certifier b/src/share/ma/remove_certifier
index a9a1451..6c90358 100644
--- a/src/share/ma/remove_certifier
+++ b/src/share/ma/remove_certifier
@@ -27,7 +27,7 @@ fi
 gpg_core --list-key --fingerprint "0x${keyID}!" || failure
 
 if [ "$PROMPT" = "true" ] ; then
-    read -p "Really remove the identity certifier above? (Y/n) " OK; OK=${OK:-Y}
+    read -p "Really remove the above listed identity certifier? (Y/n) " OK; OK=${OK:-Y}
     if [ "${OK/y/Y}" != 'Y' ] ; then
 	failure "Identity certifier not removed."
     fi
diff --git a/src/share/mh/add_hostname b/src/share/mh/add_hostname
index 0da6a06..ec741ee 100644
--- a/src/share/mh/add_hostname
+++ b/src/share/mh/add_hostname
@@ -32,8 +32,10 @@ find_host_userid > /dev/null && \
     failure "Host userID '$userID' already exists."
 
 if [ "$PROMPT" = "true" ] ; then
-    echo "The following user ID will be added to the host key:"
-    echo "  $userID"
+    cat <<EOF
+The following user ID will be added to the host key:
+  $userID
+EOF
     read -p "Are you sure you would like to add this user ID? (Y/n) " OK; OK=${OK:=Y}
     if [ "${OK/y/Y}" != 'Y' ] ; then
 	failure "User ID not added."
diff --git a/src/share/mh/add_revoker b/src/share/mh/add_revoker
index 428b958..18ad2b7 100644
--- a/src/share/mh/add_revoker
+++ b/src/share/mh/add_revoker
@@ -80,8 +80,8 @@ else
     su_monkeysphere_user "GNUPGHOME=$tmpDir gpg --fingerprint 0x${fingerprint}!"
 
     if [ "$PROMPT" = "true" ] ; then
-	echo "Are you sure you want to add the above key as a"
-	read -p "revoker of the host key? (Y/n) " OK; OK=${OK:-Y}
+	echo "Are you sure you want to add the above key as a revoker"
+	read -p "of the host key? (Y/n) " OK; OK=${OK:-Y}
 	if [ "${OK/y/Y}" != 'Y' ] ; then
 	    failure "revoker not added."
 	fi
diff --git a/src/share/mh/import_key b/src/share/mh/import_key
index 040b41c..7c11890 100644
--- a/src/share/mh/import_key
+++ b/src/share/mh/import_key
@@ -44,6 +44,21 @@ fi
 
 userID="ssh://${hostName}"
 
+if [ "$PROMPT" = "true" ] ; then
+    cat <<EOF
+The ssh key will be imported and an OpenPGP certificate for this host
+will be generated with the following user ID:
+  $userID
+EOF
+    read -p "Are you sure you would like to create certificate? [Y/n] " OK; OK=${OK:-Y}
+    if [ "${OK/y/Y}" != 'Y' ] ; then
+	failure "revoker not added."
+    fi
+else
+    log debug "importing key without prompting."
+fi
+
+
 # create host home
 mkdir -p "${MHDATADIR}"
 mkdir -p "${GNUPGHOME_HOST}"
diff --git a/src/share/mh/revoke_hostname b/src/share/mh/revoke_hostname
index 71b56ed..1215828 100644
--- a/src/share/mh/revoke_hostname
+++ b/src/share/mh/revoke_hostname
@@ -43,9 +43,11 @@ uidIndex=$(find_host_userid) || \
     failure "No non-revoked user ID found matching '$userID'."
 
 if [ "$PROMPT" = "true" ] ; then
-    echo "The following host key user ID will be revoked:"
-    echo "  $userID"
-    read -p "Are you sure you would like to revoke this user ID? (N/y) " OK; OK=${OK:=Y}
+    cat <<EOF
+The following host key user ID will be revoked:
+  $userID
+EOF
+    read -p "Are you sure you would like to revoke this user ID? (Y/n) " OK; OK=${OK:=Y}
     if [ "${OK/y/Y}" != 'Y' ] ; then
 	failure "User ID not revoked."
     fi
-- 
cgit v1.2.3


From ff8383ce9092335de6c00447bb45a2a7fbbf8685 Mon Sep 17 00:00:00 2001
From: Jameson Graef Rollins <jrollins@finestructure.net>
Date: Sat, 21 Feb 2009 14:57:41 -0500
Subject: make sure we're explicitly capturing return codes in places where
 they are tested, in case things are being run set -e

---
 src/monkeysphere                | 14 +++++---------
 src/share/common                | 17 ++++++++++-------
 src/share/m/ssh_proxycommand    | 10 ++++++----
 src/share/m/subkey_to_ssh_agent | 10 ++++------
 src/share/ma/update_users       |  5 +++--
 5 files changed, 28 insertions(+), 28 deletions(-)

(limited to 'src/share/ma')

diff --git a/src/monkeysphere b/src/monkeysphere
index a65cef6..b30453c 100755
--- a/src/monkeysphere
+++ b/src/monkeysphere
@@ -27,9 +27,6 @@ DATE=$(date -u '+%FT%T')
 # unset some environment variables that could screw things up
 unset GREP_OPTIONS
 
-# default return code
-RETURN=0
-
 # set the file creation mask to be only owner rw
 umask 077
 
@@ -87,9 +84,11 @@ check_gpg_sec_key_id() {
 	    echo "$gpgSecOut" | cut -d: -f5
 	    ;;
 	*)
-	    echo "Multiple primary secret keys found:" | log error
-	    echo "$gpgSecOut" | cut -d: -f5 | log error
-	    echo "Please specify which primary key to use." | log error
+	    echo "Multiple primary secret keys found:"
+	    for key in $(echo "$gpgSecOut" | cut -d: -f5) ; do
+		echo "  $key"
+	    done
+	    echo "Please specify which primary key to use."
 	    failure
 	    ;;
     esac
@@ -203,13 +202,11 @@ case $COMMAND in
 	# those hosts
 	if [ "$1" ] ; then
 	    update_known_hosts "$@"
-	    RETURN="$?"
 
 	# otherwise, if no hosts are specified, process every host
 	# in the user's known_hosts file
 	else
 	    process_known_hosts
-	    RETURN="$?"
 	fi
 	;;
 
@@ -219,7 +216,6 @@ case $COMMAND in
 
 	# process authorized_user_ids file
 	process_authorized_user_ids "$AUTHORIZED_USER_IDS"
-	RETURN="$?"
 	;;
 
     'import-subkey'|'i')
diff --git a/src/share/common b/src/share/common
index 653d58b..5e0cb6a 100644
--- a/src/share/common
+++ b/src/share/common
@@ -586,8 +586,8 @@ gpg2authorized_keys() {
 # FIXME: need to figure out how to retrieve all matching keys
 # (not just first N (5 in this case))
 gpg_fetch_userid() {
+    local returnCode=0
     local userID
-    local returnCode
 
     if [ "$CHECK_KEYSERVER" != 'true' ] ; then
 	return 0
@@ -626,6 +626,7 @@ gpg_fetch_userid() {
 #
 # expects global variable: "MODE"
 process_user_id() {
+    local returnCode=0
     local userID
     local requiredCapability
     local requiredPubCapability
@@ -657,10 +658,10 @@ process_user_id() {
     # output gpg info for (exact) userid and store
     gpgOut=$(gpg --list-key --fixed-list-mode --with-colon \
 	--with-fingerprint --with-fingerprint \
-	="$userID" 2>/dev/null)
+	="$userID" 2>/dev/null) || returnCode="$?"
 
     # if the gpg query return code is not 0, return 1
-    if [ "$?" -ne 0 ] ; then
+    if [ "$returnCode" -ne 0 ] ; then
         log verbose " no primary keys found."
         return 1
     fi
@@ -890,6 +891,7 @@ process_host_known_hosts() {
 # update the known_hosts file for a set of hosts listed on command
 # line
 update_known_hosts() {
+    local returnCode=0
     local nHosts
     local nHostsOK
     local nHostsBAD
@@ -919,9 +921,9 @@ update_known_hosts() {
 
     for host ; do
 	# process the host
-	process_host_known_hosts "$host"
+	process_host_known_hosts "$host" || returnCode="$?"
 	# note the result
-	case "$?" in
+	case "$returnCode" in
 	    0)
 		nHostsOK=$((nHostsOK+1))
 		;;
@@ -1043,6 +1045,7 @@ process_uid_authorized_keys() {
 # update the authorized_keys files from a list of user IDs on command
 # line
 update_authorized_keys() {
+    local returnCode=0
     local userID
     local nIDs
     local nIDsOK
@@ -1072,10 +1075,10 @@ update_authorized_keys() {
     for userID ; do
 	# process the user ID, change return code if key not found for
 	# user ID
-	process_uid_authorized_keys "$userID"
+	process_uid_authorized_keys "$userID" || returnCode="$?"
 
 	# note the result
-	case "$?" in
+	case "$returnCode" in
 	    0)
 		nIDsOK=$((nIDsOK+1))
 		;;
diff --git a/src/share/m/ssh_proxycommand b/src/share/m/ssh_proxycommand
index bd09588..abe068d 100644
--- a/src/share/m/ssh_proxycommand
+++ b/src/share/m/ssh_proxycommand
@@ -18,6 +18,7 @@
 # "marginal case" ouput in the case that there is not a full
 # validation path to the host
 output_no_valid_key() {
+    local returnCode=0
     local sshKeyOffered
     local userID
     local type
@@ -112,11 +113,11 @@ EOF
 		fi
 		;;
 	esac
-    done
+    done || returnCode="$?"
 
     # if no key match was made (and the "while read" subshell returned
     # 1) output how many keys were found
-    if (($? != 1)) ; then
+    if (( returnCode != 1 )) ; then
 	cat <<EOF | log info
 None of the found keys matched the key offered by the host.
 Run the following command for more info about the found keys:
@@ -200,12 +201,13 @@ fi
 CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:=$CHECK_KEYSERVER}
 
 # update the known_hosts file for the host
-update_known_hosts "$HOSTP"
+local returnCode=0
+update_known_hosts "$HOSTP" || returnCode="$?"
 
 # output on depending on the return of the update-known_hosts
 # subcommand, which is (ultimately) the return code of the
 # update_known_hosts function in common
-case $? in
+case "$returnCode" in
     0)
 	# acceptable host key found so continue to ssh
 	true
diff --git a/src/share/m/subkey_to_ssh_agent b/src/share/m/subkey_to_ssh_agent
index 818f4f7..a2cf9a0 100644
--- a/src/share/m/subkey_to_ssh_agent
+++ b/src/share/m/subkey_to_ssh_agent
@@ -14,11 +14,11 @@
 # try to add all authentication subkeys to the agent
 
 subkey_to_ssh_agent() {
-    local sshaddresponse
+    local sshaddresponse=0
     local secretkeys
     local authsubkeys
     local workingdir
-    local keysuccess
+    local keysuccess=0
     local subkey
     local publine
     local kname
@@ -38,8 +38,7 @@ For more details, see:
 
     # and if it looks like it's running, but we can't actually talk to
     # it, bail out:
-    ssh-add -l >/dev/null
-    sshaddresponse="$?"
+    ssh-add -l >/dev/null || sshaddresponse="$?"
     if [ "$sshaddresponse" = "2" ]; then
 	failure "Could not connect to ssh-agent"
     fi
@@ -100,8 +99,7 @@ You might want to 'monkeysphere gen-subkey'"
 
 	    passphrase_prompt "Enter passphrase for key $kname: " "$workingdir/passphrase"
 	    wait %2
-	fi
-	keysuccess="$?"
+	fi || keysuccess="$?"
 
 	rm -f "$workingdir/$kname"
     done
diff --git a/src/share/ma/update_users b/src/share/ma/update_users
index 092d108..bfefc31 100644
--- a/src/share/ma/update_users
+++ b/src/share/ma/update_users
@@ -93,8 +93,8 @@ for uname in $unames ; do
 
 	    # process authorized_user_ids file, as monkeysphere user
 	    su_monkeysphere_user \
-		". ${SYSSHAREDIR}/common; process_authorized_user_ids $TMP_AUTHORIZED_USER_IDS"
-	    RETURN="$?"
+		". ${SYSSHAREDIR}/common; process_authorized_user_ids $TMP_AUTHORIZED_USER_IDS" \
+		|| RETURN="$?"
 	else
 	    log debug "not processing authorized_user_ids."
 	fi
@@ -154,4 +154,5 @@ for uname in $unames ; do
     rm -rf "$TMPLOC"
 done
 
+return $RETURN
 }
-- 
cgit v1.2.3


From 6e371ad70b96003d50c769a2d2f6fd82c15d4bb5 Mon Sep 17 00:00:00 2001
From: Jameson Graef Rollins <jrollins@finestructure.net>
Date: Sat, 21 Feb 2009 16:16:58 -0500
Subject: add tests to add_revoker and add_certifier that more than one key was
 not found when adding by using key ID.

---
 src/share/ma/add_certifier | 12 +++++++++++-
 src/share/mh/add_revoker   | 12 +++++++++++-
 2 files changed, 22 insertions(+), 2 deletions(-)

(limited to 'src/share/ma')

diff --git a/src/share/ma/add_certifier b/src/share/ma/add_certifier
index a48db64..eba6893 100644
--- a/src/share/ma/add_certifier
+++ b/src/share/ma/add_certifier
@@ -120,7 +120,17 @@ else
     # get the full fingerprint of new certifier key
     log debug "getting fingerprint of certifier key..."
     fingerprint=$(gpg_sphere "--list-key --with-colons --with-fingerprint 0x${keyID}!" \
-	| grep '^fpr:' | grep "$keyID" | cut -d: -f10)
+	| grep '^fpr:' | cut -d: -f10)
+
+    # test that there is only a single fingerprint
+    if (( $(echo "$fingerprint" | wc -l) != 1 )) ; then
+	cat <<EOF
+More than one fingerprint found:
+  echo $fingerprint
+Please use a more specific key ID.
+EOF
+	failure
+    fi
 
     log info "key found:"
     gpg_sphere "--fingerprint 0x${fingerprint}!"
diff --git a/src/share/mh/add_revoker b/src/share/mh/add_revoker
index 18ad2b7..50e8c67 100644
--- a/src/share/mh/add_revoker
+++ b/src/share/mh/add_revoker
@@ -74,7 +74,17 @@ else
     # get the full fingerprint of new revoker key
     log debug "getting fingerprint of revoker key..."
     fingerprint=$(su_monkeysphere_user "GNUPGHOME=$tmpDir gpg --list-key --with-colons --with-fingerprint 0x${keyID}!" \
-	| grep '^fpr:' | grep "$keyID" | cut -d: -f10)
+	| grep '^fpr:' | cut -d: -f10)
+
+    # test that there is only a single fingerprint
+    if (( $(echo "$fingerprint" | wc -l) != 1 )) ; then
+	cat <<EOF
+More than one fingerprint found:
+  echo $fingerprint
+Please use a more specific key ID.
+EOF
+	failure
+    fi
 
     log info "key found:"
     su_monkeysphere_user "GNUPGHOME=$tmpDir gpg --fingerprint 0x${fingerprint}!"
-- 
cgit v1.2.3


From 3c73575de77e8d4d211258641179c71080b56856 Mon Sep 17 00:00:00 2001
From: Jameson Graef Rollins <jrollins@finestructure.net>
Date: Sat, 21 Feb 2009 16:29:35 -0500
Subject: fix output formatting for cases where multiple fingerprints are
 found, in functions that are doing that sort of thing

---
 src/monkeysphere           | 4 +---
 src/share/ma/add_certifier | 2 +-
 src/share/mh/add_revoker   | 2 +-
 3 files changed, 3 insertions(+), 5 deletions(-)

(limited to 'src/share/ma')

diff --git a/src/monkeysphere b/src/monkeysphere
index 0d8f4ff..fd96f45 100755
--- a/src/monkeysphere
+++ b/src/monkeysphere
@@ -87,9 +87,7 @@ check_gpg_sec_key_id() {
 	    ;;
 	*)
 	    echo "Multiple primary secret keys found:"
-	    for key in $(echo "$gpgSecOut" | cut -d: -f5) ; do
-		echo "  $key"
-	    done
+	    echo "$gpgSecOut" | cut -d: -f5
 	    echo "Please specify which primary key to use."
 	    failure
 	    ;;
diff --git a/src/share/ma/add_certifier b/src/share/ma/add_certifier
index eba6893..6f85ecf 100644
--- a/src/share/ma/add_certifier
+++ b/src/share/ma/add_certifier
@@ -126,7 +126,7 @@ else
     if (( $(echo "$fingerprint" | wc -l) != 1 )) ; then
 	cat <<EOF
 More than one fingerprint found:
-  echo $fingerprint
+$fingerprint
 Please use a more specific key ID.
 EOF
 	failure
diff --git a/src/share/mh/add_revoker b/src/share/mh/add_revoker
index 50e8c67..2ae531e 100644
--- a/src/share/mh/add_revoker
+++ b/src/share/mh/add_revoker
@@ -80,7 +80,7 @@ else
     if (( $(echo "$fingerprint" | wc -l) != 1 )) ; then
 	cat <<EOF
 More than one fingerprint found:
-  echo $fingerprint
+$fingerprint
 Please use a more specific key ID.
 EOF
 	failure
-- 
cgit v1.2.3