CondorCORE/condorcore-keyring
CondorCORE/condorcore-keyring
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
deaa312b7d
condorcore-keyring/keyringctl

1245 lines
43 KiB
Plaintext
Raw Normal View History

feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
#!/usr/bin/env python
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
#
# SPDX-License-Identifier: GPL-3.0-or-later
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
from argparse import ArgumentParser
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
from collections import defaultdict
chore(keyringctl): use python 3.9 iterable/iterator type imports
2021-10-20 13:16:33 -05:00
from collections.abc import Iterable
from collections.abc import Iterator
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
from contextlib import contextmanager
feature(keyringctl): support importing multiple paths Lets pass in a list of path's and reduce them to one set of path iterables. This allows us to specify multiple source files/directories
2021-10-20 13:15:42 -05:00
from itertools import chain
isort: Configure to use single lines pyproject.toml: Configure isort to use single lines (one line for each import) to ease merge conflicts. keyringctl: Reformat using new isort settings.
2021-10-18 05:58:23 -05:00
from logging import DEBUG
from logging import basicConfig
from logging import debug
from logging import error
from os import chdir
from os import getcwd
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
from pathlib import Path
isort: Configure to use single lines pyproject.toml: Configure isort to use single lines (one line for each import) to ease merge conflicts. keyringctl: Reformat using new isort settings.
2021-10-18 05:58:23 -05:00
from re import escape
from re import split
from re import sub
keyringctl: Copy files instead of moving them keyringctl: Change `__main__` to create the `target_dir` before calling any further function that relies on it. Change `convert()` to require the `target_dir` to be not None and to create all username based target directories before using `shutil.copytree()` to copy all sources to their respective target directories when iterating over the paths to persist. This has the upside, that updates to a target directory structure can be done on the fly (overwriting existing data), which is not possible with `shutil.move()`.
2021-10-04 12:25:24 -05:00
from shutil import copytree
isort: Configure to use single lines pyproject.toml: Configure isort to use single lines (one line for each import) to ease merge conflicts. keyringctl: Reformat using new isort settings.
2021-10-18 05:58:23 -05:00
from subprocess import PIPE
from subprocess import CalledProcessError
from subprocess import check_output
from sys import exit
from sys import stderr
from tempfile import TemporaryDirectory
from tempfile import mkdtemp
feature(keyringctl): print a stack trace in case a system cmd fails
2021-10-21 13:18:21 -05:00
from traceback import print_stack
isort: Configure to use single lines pyproject.toml: Configure isort to use single lines (one line for each import) to ease merge conflicts. keyringctl: Reformat using new isort settings.
2021-10-18 05:58:23 -05:00
from typing import Dict
from typing import List
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
from typing import NewType
isort: Configure to use single lines pyproject.toml: Configure isort to use single lines (one line for each import) to ease merge conflicts. keyringctl: Reformat using new isort settings.
2021-10-18 05:58:23 -05:00
from typing import Optional
from typing import Set
from typing import Tuple
from typing import Union
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
chore(keyringctl): apply black formatter
2021-10-19 14:11:37 -05:00
Fingerprint = NewType("Fingerprint", str)
Uid = NewType("Uid", str)
Username = NewType("Username", str)
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
@contextmanager
chore(keyringctl): declare missing type hinting for cwd
2021-10-12 12:35:18 -05:00
def cwd(new_dir: Path) -> Iterator[None]:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Change to a new current working directory in a context and go back to the previous dir after the context is done
Parameters
----------
new_dir: Path
A path to change to
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
previous_dir = getcwd()
chdir(new_dir)
try:
yield
finally:
chdir(previous_dir)
def natural_sort_path(_list: Iterable[Path]) -> Iterable[Path]:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Sort an Iterable of Paths naturally
Parameters
----------
_list: Iterable[Path]
An iterable containing paths to be sorted
Return
------
Iterable[Path]
An Iterable of paths that are naturally sorted
"""
chore(keyringctl): avoid shadowing convert function
2021-10-19 11:23:08 -05:00
def convert_text_chunk(text: str) -> Union[int, str]:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Convert input text to int or str
Parameters
----------
text: str
An input string
Returns
-------
Union[int, str]
Either an integer if text is a digit, else text in lower-case representation
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
return int(text) if text.isdigit() else text.lower()
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
def alphanum_key(key: Path) -> List[Union[int, str]]:
"""Retrieve an alphanumeric key from a Path, that can be used in sorted()
Parameters
----------
key: Path
A path for which to create a key
Returns
-------
List[Union[int, str]]
A list of either int or str objects that may serve as 'key' argument for sorted()
"""
chore(keyringctl): avoid shadowing convert function
2021-10-19 11:23:08 -05:00
return [convert_text_chunk(c) for c in split("([0-9]+)", str(key.name))]
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
return sorted(_list, key=alphanum_key)
def system(cmd: List[str], exit_on_error: bool = True) -> str:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Execute a command using check_output
Parameters
----------
cmd: List[str]
A list of strings to be fed to check_output
exit_on_error: bool
Whether to exit the script when encountering an error (defaults to True)
Raises
------
CalledProcessError
If not exit_on_error and `check_output()` encounters an error
Returns
-------
str
The output of cmd
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
try:
return check_output(cmd, stderr=PIPE).decode()
except CalledProcessError as e:
stderr.buffer.write(e.stderr)
feature(keyringctl): print a stack trace in case a system cmd fails
2021-10-21 13:18:21 -05:00
print_stack()
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
if exit_on_error:
exit(e.returncode)
raise e
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
# TODO: simplify to lower complexity
def convert_certificate( # noqa: ignore=C901
working_dir: Path,
certificate: Path,
feature(keyringctl): avoid splitting a certificate multiple times Move the name cascade to derive the username into the `convert_certificate` function which allows to use the certificate_fingerprint directly instead of trying to find it by splitting the certificate one more time before converting.
2021-10-19 12:10:51 -05:00
keyring_dir: Path,
feature(keyringctl): introduce Username type instead of plain str
2021-10-19 14:03:53 -05:00
name_override: Optional[Username] = None,
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
fingerprint_filter: Optional[Set[Fingerprint]] = None,
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
) -> Path:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Convert a single file public key certificate into a decomposed directory structure of multiple PGP packets
feature(keyringctl): avoid splitting a certificate multiple times Move the name cascade to derive the username into the `convert_certificate` function which allows to use the certificate_fingerprint directly instead of trying to find it by splitting the certificate one more time before converting.
2021-10-19 12:10:51 -05:00
The output directory structure is created per user. The username is derived from the certificate via
`derive_username_from_fingerprint` or overridden via `name_override`.
chore(keyringctl): fix typo in docstring for convert_certificate
2021-10-19 11:41:58 -05:00
Below the username directory a directory tree describes the public keys components split up into certifications
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
and revocations, as well as per subkey and per uid certifications and revocations.
Parameters
----------
working_dir: Path
The path of the working directory below which to create split certificates
certificate: Path
The path to a public key certificate
feature(keyringctl): avoid splitting a certificate multiple times Move the name cascade to derive the username into the `convert_certificate` function which allows to use the certificate_fingerprint directly instead of trying to find it by splitting the certificate one more time before converting.
2021-10-19 12:10:51 -05:00
keyring_dir: Path
The path of the keyring used to try to derive the username from the public key fingerprint
feature(keyringctl): introduce Username type instead of plain str
2021-10-19 14:03:53 -05:00
name_override: Optional[Username]
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
An optional string to override the username in the to be created output directory structure
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
fingerprint_filter: Optional[Set[Fingerprint]]
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
An optional list of strings defining fingerprints of PGP public keys that all certificates will be filtered
with
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
Raises
------
Exception
If required PGP packets are not found
Returns
-------
Path
The path of the user_dir (which is located below working_dir)
"""
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
# root packets
certificate_fingerprint: Optional[Fingerprint] = None
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
pubkey: Optional[Path] = None
feature(keyringctl): add type hinting direct sigs/revocations
2021-10-19 13:08:32 -05:00
direct_sigs: Dict[Fingerprint, List[Path]] = defaultdict(list)
direct_revocations: Dict[Fingerprint, List[Path]] = defaultdict(list)
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
# subkey packets
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
subkeys: Dict[Fingerprint, Path] = {}
subkey_binding_sigs: Dict[Fingerprint, Path] = {}
subkey_revocations: Dict[Fingerprint, Path] = {}
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
# uid packets
uids: Dict[Uid, Path] = {}
uid_binding_sigs: Dict[Uid, Path] = {}
certifications: Dict[Uid, List[Path]] = defaultdict(list)
revocations: Dict[Uid, List[Path]] = defaultdict(list)
# intermediate variables
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
current_packet_mode: Optional[str] = None
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
current_packet_fingerprint: Optional[Fingerprint] = None
current_packet_uid: Optional[Uid] = None
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
# XXX: PrimaryKeyBinding
# TODO: remove 3rd party direct key signatures, seems to be leaked by export-clean
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
debug(f"Processing certificate {certificate}")
keyringctl: Add handling of KeyRevocations keyringctl: Change `persist_direct_sigs()` to track a sig_type parameter in its signature so that the output directory of the direct signatures can be altered. Change `convert_certificate()` to set a `direct_revocations` variable, that is used to track KeyRevocations for root keys. Extend the logic to make use of `add_packet_to_direct_sigs()` to set a list of KeyRevocations for a given root key. Eventually call `persist_direct_sigs()` with `direct_revocations` and a custom `sig_type` to persist the revocation certificates.
2021-10-03 13:05:11 -05:00
keyringctl: Deal with multi-certificate per user files keyringctl: Add `sanitize_certificate_file()` to potentially split per-user input files that contain more than one certificate. Change `packet_split()` to add documentation and rename the key parameter to certificate, as it is more generic. Change `convert_certificate()` to use named parameters when calling `packet_split()`. Change `convert()` to call `convert_certificate()` on a list of sanitized certificates (generated using `sanitized_certificate_file()`) to be able to deal with multi-certificate files per user.
2021-10-04 15:12:33 -05:00
for packet in packet_split(working_dir=working_dir, certificate=certificate):
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
debug(f"Processing packet {packet.name}")
if packet.name.endswith("--PublicKey"):
current_packet_mode = "pubkey"
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
current_packet_fingerprint = Fingerprint(packet_dump_field(packet, "Fingerprint"))
current_packet_uid = None
certificate_fingerprint = current_packet_fingerprint
pubkey = packet
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
elif packet.name.endswith("--UserID"):
current_packet_mode = "uid"
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
current_packet_fingerprint = None
current_packet_uid = simplify_user_id(Uid(packet_dump_field(packet, "Value")))
uids[current_packet_uid] = packet
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
elif packet.name.endswith("--PublicSubkey"):
current_packet_mode = "subkey"
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
current_packet_fingerprint = Fingerprint(packet_dump_field(packet, "Fingerprint"))
current_packet_uid = None
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
subkeys[current_packet_fingerprint] = packet
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
elif packet.name.endswith("--Signature"):
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
if not certificate_fingerprint:
raise Exception('missing certificate fingerprint for "{packet.name}"')
feature(keyringctl): add type hinting direct sigs/revocations
2021-10-19 13:08:32 -05:00
issuer: Fingerprint = Fingerprint(packet_dump_field(packet, "Issuer"))
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
signature_type = packet_dump_field(packet, "Type")
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
if current_packet_mode == "pubkey":
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
if not current_packet_fingerprint:
raise Exception('missing current packet fingerprint for "{packet.name}"')
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
if signature_type == "KeyRevocation" and certificate_fingerprint.endswith(issuer):
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
direct_revocations[issuer].append(packet)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
elif signature_type in ["DirectKey", "GenericCertification"]:
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
direct_sigs[issuer].append(packet)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
else:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
raise Exception(f"unknown signature type: {signature_type}")
elif current_packet_mode == "uid":
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
if not current_packet_uid:
raise Exception('missing current packet uid for "{packet.name}"')
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
if signature_type == "CertificationRevocation":
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
revocations[current_packet_uid].append(packet)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
elif signature_type == "PositiveCertification" and certificate_fingerprint.endswith(issuer):
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
uid_binding_sigs[current_packet_uid] = packet
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
elif signature_type.endswith("Certification"):
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
if fingerprint_filter is not None and any([fp.endswith(issuer) for fp in fingerprint_filter]):
debug(f"The certification by issuer {issuer} is appended as it is found in the filter.")
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
certifications[current_packet_uid].append(packet)
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
else:
debug(f"The certification by issuer {issuer} is not appended because it is not in the filter")
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
else:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
raise Exception(f"unknown signature type: {signature_type}")
elif current_packet_mode == "subkey":
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
if not current_packet_fingerprint:
raise Exception('missing current packet fingerprint for "{packet.name}"')
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
if signature_type == "SubkeyBinding":
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
subkey_binding_sigs[current_packet_fingerprint] = packet
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
elif signature_type == "SubkeyRevocation":
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
subkey_revocations[certificate_fingerprint] = packet
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
else:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
raise Exception(f"unknown signature type: {signature_type}")
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
else:
raise Exception(f'unknown signature root for "{packet.name}"')
else:
raise Exception(f'unknown packet type "{packet.name}"')
if not certificate_fingerprint:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
raise Exception("missing certificate fingerprint")
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
if not pubkey:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
raise Exception("missing certificate public-key")
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
chore(keyringctl): apply black formatter
2021-10-19 14:11:37 -05:00
name_override = (
name_override
or derive_username_from_fingerprint(keyring_dir=keyring_dir, certificate_fingerprint=certificate_fingerprint)
or Username(certificate.stem)
)
feature(keyringctl): avoid splitting a certificate multiple times Move the name cascade to derive the username into the `convert_certificate` function which allows to use the certificate_fingerprint directly instead of trying to find it by splitting the certificate one more time before converting.
2021-10-19 12:10:51 -05:00
user_dir = working_dir / name_override
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
key_dir = user_dir / certificate_fingerprint
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
key_dir.mkdir(parents=True, exist_ok=True)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
persist_public_key(
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
certificate_fingerprint=certificate_fingerprint,
pubkey=pubkey,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir=key_dir,
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
)
persist_uids(
key_dir=key_dir,
uid_binding_sigs=uid_binding_sigs,
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
uids=uids,
)
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
persist_subkeys(
key_dir=key_dir,
subkeys=subkeys,
subkey_binding_sigs=subkey_binding_sigs,
)
persist_subkey_revocations(
key_dir=key_dir,
subkey_revocations=subkey_revocations,
)
keyringctl: Persist direct signatures generically keyringctl: Rename `persist_direct_keys()` to `persist_direct_sigs()` as it is now not only handling the persistence of DirectKeys but also *Certifications directly on a root key (those without an explicit User ID). Add inline function `add_packet_to_direct_sigs()` to `convert_certificate()` to generically add direct signatures on a root key, grouped by issuer. Change `convert_certificate()` to add Certifications on a root key (without a specified User ID) to the list of direct_sigs, so that they are persisted alongside any existing DirectKeys. Remove breakpoints from `persist_certifications()` as they are no longer reached. The function is now solely used for Certifications on User IDs.
2021-10-03 12:24:49 -05:00
persist_direct_sigs(
direct_sigs=direct_sigs,
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
pubkey=pubkey,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir=key_dir,
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
)
keyringctl: Add handling of KeyRevocations keyringctl: Change `persist_direct_sigs()` to track a sig_type parameter in its signature so that the output directory of the direct signatures can be altered. Change `convert_certificate()` to set a `direct_revocations` variable, that is used to track KeyRevocations for root keys. Extend the logic to make use of `add_packet_to_direct_sigs()` to set a list of KeyRevocations for a given root key. Eventually call `persist_direct_sigs()` with `direct_revocations` and a custom `sig_type` to persist the revocation certificates.
2021-10-03 13:05:11 -05:00
persist_direct_sigs(
direct_sigs=direct_revocations,
pubkey=pubkey,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir=key_dir,
sig_type="revocation",
keyringctl: Add handling of KeyRevocations keyringctl: Change `persist_direct_sigs()` to track a sig_type parameter in its signature so that the output directory of the direct signatures can be altered. Change `convert_certificate()` to set a `direct_revocations` variable, that is used to track KeyRevocations for root keys. Extend the logic to make use of `add_packet_to_direct_sigs()` to set a list of KeyRevocations for a given root key. Eventually call `persist_direct_sigs()` with `direct_revocations` and a custom `sig_type` to persist the revocation certificates.
2021-10-03 13:05:11 -05:00
)
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
persist_certifications(
certifications=certifications,
pubkey=pubkey,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir=key_dir,
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
uid_binding_sig=uid_binding_sigs,
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
uids=uids,
)
persist_revocations(
pubkey=pubkey,
revocations=revocations,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir=key_dir,
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
uid_binding_sig=uid_binding_sigs,
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
uids=uids,
)
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
return user_dir
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
def persist_public_key(
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
certificate_fingerprint: Fingerprint,
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
pubkey: Path,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir: Path,
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
) -> None:
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
"""Persist the Public-Key packet
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
Parameters
----------
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
certificate_fingerprint: Fingerprint
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
The unique fingerprint of the public key
pubkey: Path
The path to the public key of the root key
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir: Path
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
The root directory below which the basic key material is persisted
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
packets: List[Path] = [pubkey]
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
output_file = key_dir / f"{certificate_fingerprint}.asc"
chore(keyringctl): uniformly use path builder via operator Instead of partially dealing with strings that contain slashes lets just use the path builder interface by using the operator for every sub path layer in a uniform way.
2021-10-12 17:09:58 -05:00
output_file.parent.mkdir(parents=True, exist_ok=True)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
debug(f"Writing file {output_file} from {[str(packet) for packet in packets]}")
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
packet_join(packets, output_file)
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
def persist_uids(
key_dir: Path,
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
uid_binding_sigs: Dict[Uid, Path],
uids: Dict[Uid, Path],
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
) -> None:
"""Persist the User IDs that belong to a PublicKey
The User ID material consists of PublicSubkeys and their SubkeyBindings.
chore(keyringctl): use singular folder names for all sub-folders
2021-10-12 16:57:20 -05:00
The files are written to a UID specific directory and file below key_dir/uid.
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
Parameters
----------
key_dir: Path
The root directory below which the basic key material is persisted
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
uid_binding_sigs: Dict[Uid, Path]
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
The PositiveCertifications of a User ID and Public-Key packet
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
uids: Dict[Uid, Path]
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
The User IDs of a Public-Key (the root key)
"""
for key in uid_binding_sigs.keys():
packets = [uids[key], uid_binding_sigs[key]]
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
output_file = key_dir / "uid" / key / f"{key}.asc"
chore(keyringctl): uniformly use path builder via operator Instead of partially dealing with strings that contain slashes lets just use the path builder interface by using the operator for every sub path layer in a uniform way.
2021-10-12 17:09:58 -05:00
output_file.parent.mkdir(parents=True, exist_ok=True)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
debug(f"Writing file {output_file} from {[str(packet) for packet in packets]}")
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
packet_join(packets, output_file)
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
def persist_subkeys(
key_dir: Path,
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
subkeys: Dict[Fingerprint, Path],
subkey_binding_sigs: Dict[Fingerprint, Path],
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
) -> None:
"""Persist all Public-Subkeys and their PublicSubkeyBinding of a root key file to file(s)
Parameters
----------
key_dir: Path
The root directory below which the basic key material is persisted
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
subkeys: Dict[Fingerprint, Path]
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
The PublicSubkeys of a key
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
subkey_binding_sigs: Dict[Fingerprint, Path]
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
The SubkeyBinding signatures of a Public-Key (the root key)
"""
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
for fingerprint, subkey in subkeys.items():
packets: List[Path] = []
packets.extend([subkey, subkey_binding_sigs[fingerprint]])
output_file = key_dir / "subkey" / fingerprint / f"{fingerprint}.asc"
output_file.parent.mkdir(parents=True, exist_ok=True)
debug(f"Writing file {output_file} from {[str(packet) for packet in packets]}")
packet_join(packets=packets, output=output_file)
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
def persist_subkey_revocations(
key_dir: Path,
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
subkey_revocations: Dict[Fingerprint, Path],
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
) -> None:
"""Persist the SubkeyRevocations of all Public-Subkeys of a root key to file(s)
Parameters
----------
key_dir: Path
The root directory below which the basic key material is persisted
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
subkey_revocations: Dict[Fingerprint, Path]
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
The SubkeyRevocations of PublicSubkeys of a key
"""
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
for fingerprint, revocation in subkey_revocations.items():
issuer = packet_dump_field(revocation, "Issuer")
output_file = key_dir / "subkey" / fingerprint / "revocation" / f"{issuer}.asc"
output_file.parent.mkdir(parents=True, exist_ok=True)
debug(f"Writing file {output_file} from {revocation}")
packet_join(packets=[revocation], output=output_file)
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
keyringctl: Persist direct signatures generically keyringctl: Rename `persist_direct_keys()` to `persist_direct_sigs()` as it is now not only handling the persistence of DirectKeys but also *Certifications directly on a root key (those without an explicit User ID). Add inline function `add_packet_to_direct_sigs()` to `convert_certificate()` to generically add direct signatures on a root key, grouped by issuer. Change `convert_certificate()` to add Certifications on a root key (without a specified User ID) to the list of direct_sigs, so that they are persisted alongside any existing DirectKeys. Remove breakpoints from `persist_certifications()` as they are no longer reached. The function is now solely used for Certifications on User IDs.
2021-10-03 12:24:49 -05:00
def persist_direct_sigs(
feature(keyringctl): add type hinting direct sigs/revocations
2021-10-19 13:08:32 -05:00
direct_sigs: Dict[Fingerprint, List[Path]],
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
pubkey: Path,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir: Path,
keyringctl: Add handling of KeyRevocations keyringctl: Change `persist_direct_sigs()` to track a sig_type parameter in its signature so that the output directory of the direct signatures can be altered. Change `convert_certificate()` to set a `direct_revocations` variable, that is used to track KeyRevocations for root keys. Extend the logic to make use of `add_packet_to_direct_sigs()` to set a list of KeyRevocations for a given root key. Eventually call `persist_direct_sigs()` with `direct_revocations` and a custom `sig_type` to persist the revocation certificates.
2021-10-03 13:05:11 -05:00
sig_type: str = "certification",
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
) -> None:
keyringctl: Persist direct signatures generically keyringctl: Rename `persist_direct_keys()` to `persist_direct_sigs()` as it is now not only handling the persistence of DirectKeys but also *Certifications directly on a root key (those without an explicit User ID). Add inline function `add_packet_to_direct_sigs()` to `convert_certificate()` to generically add direct signatures on a root key, grouped by issuer. Change `convert_certificate()` to add Certifications on a root key (without a specified User ID) to the list of direct_sigs, so that they are persisted alongside any existing DirectKeys. Remove breakpoints from `persist_certifications()` as they are no longer reached. The function is now solely used for Certifications on User IDs.
2021-10-03 12:24:49 -05:00
"""Persist the signatures directly on a root key (such as DirectKeys or *Certifications without a User ID) to
file(s)
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
Parameters
----------
feature(keyringctl): add type hinting direct sigs/revocations
2021-10-19 13:08:32 -05:00
direct_sigs: Dict[Fingerprint, List[Path]]
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
The direct sigs to write to file
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
pubkey: Path
The path to the public key of the root key
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir: Path
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
The root directory below which the Directkeys are persisted
keyringctl: Add handling of KeyRevocations keyringctl: Change `persist_direct_sigs()` to track a sig_type parameter in its signature so that the output directory of the direct signatures can be altered. Change `convert_certificate()` to set a `direct_revocations` variable, that is used to track KeyRevocations for root keys. Extend the logic to make use of `add_packet_to_direct_sigs()` to set a list of KeyRevocations for a given root key. Eventually call `persist_direct_sigs()` with `direct_revocations` and a custom `sig_type` to persist the revocation certificates.
2021-10-03 13:05:11 -05:00
sig_type: str
The type of direct certification to persist (defaults to 'certification'). This influences the directory name
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
"""
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
for issuer, certifications in direct_sigs.items():
packets = [pubkey] + certifications
output_file = key_dir / sig_type / f"{issuer}.asc"
output_file.parent.mkdir(parents=True, exist_ok=True)
debug(f"Writing file {output_file} from {[str(cert) for cert in certifications]}")
packet_join(packets, output_file)
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
def persist_certifications(
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
certifications: Dict[Uid, List[Path]],
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
pubkey: Path,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir: Path,
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
uid_binding_sig: Dict[Uid, Path],
uids: Dict[Uid, Path],
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
) -> None:
"""Persist the certifications of a root key to file(s)
The certifications include all CasualCertifications, GenericCertifications, PersonaCertifications and
PositiveCertifications for all User IDs of the given root key.
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
All certifications are persisted in per User ID certification directories below key_dir.
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
Parameters
----------
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
certifications: Dict[Uid, List[Path]]
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
The certifications to write to file
pubkey: Path
The path to the public key of the root key
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir: Path
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
The root directory below which certifications are persisted
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
uid_binding_sig: Dict[Uid, Path]
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
The PositiveCertifications of a User ID and Public-Key packet
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
uids: Dict[Uid, Path]
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
The User IDs of a Public-Key (the root key)
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
for key, current_certifications in certifications.items():
for certification in current_certifications:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
certification_dir = key_dir / "uid" / key / "certification"
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
certification_dir.mkdir(parents=True, exist_ok=True)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
issuer = packet_dump_field(certification, "Issuer")
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
keyringctl: Do not persist unbound certifications keyringctl: Change `persist_certifications()` to not attempt to read UID binding signatures for a given UID, if it does not exist and instead output an error message.
2021-10-16 17:21:08 -05:00
if uids.get(key) and uid_binding_sig.get(key):
packets = [pubkey, uids[key], uid_binding_sig[key], certification]
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
output_file = certification_dir / f"{issuer}.asc"
debug(f"Writing file {output_file} from {certification}")
keyringctl: Do not persist unbound certifications keyringctl: Change `persist_certifications()` to not attempt to read UID binding signatures for a given UID, if it does not exist and instead output an error message.
2021-10-16 17:21:08 -05:00
packet_join(packets, output_file)
else:
error(
f"Public key '{pubkey}' does not provide "
f"{'the UID binding signature' if not uid_binding_sig.get(key) else ''} for UID '{key}', "
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
"so its certifications can not be used!"
)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
def persist_revocations(
pubkey: Path,
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
revocations: Dict[Uid, List[Path]],
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir: Path,
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
uid_binding_sig: Dict[Uid, Path],
uids: Dict[Uid, Path],
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
) -> None:
"""Persist the revocations of a root key to file(s)
The revocations include all CertificationRevocations for all User IDs of the given root key.
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
All revocations are persisted in per User ID 'revocation' directories below key_dir.
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
Parameters
----------
pubkey: Path
The path to the public key of the root key
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
revocations: Dict[Uid, List[Path]]
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
The revocations to write to file
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir: Path
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
The root directory below which revocations will be persisted
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
uid_binding_sig: Dict[Uid, Path]
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
The PositiveCertifications of a User ID and Public-Key packet
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
uids: Dict[Uid, Path]
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
The User IDs of a Public-Key (the root key)
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
for key, current_revocations in revocations.items():
for revocation in current_revocations:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
revocation_dir = key_dir / "uid" / key / "revocation"
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
revocation_dir.mkdir(parents=True, exist_ok=True)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
issuer = packet_dump_field(revocation, "Issuer")
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
packets = [pubkey, uids[key]]
# Binding sigs only exist for 3rd-party revocations
if key in uid_binding_sig:
packets.append(uid_binding_sig[key])
packets.append(revocation)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
output_file = revocation_dir / f"{issuer}.asc"
debug(f"Writing file {output_file} from {revocation}")
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
packet_join(packets, output_file)
def packet_dump(packet: Path) -> str:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Dump a PGP packet to string
The `sq packet dump` command is used to retrieve a dump of information from a PGP packet
Parameters
----------
packet: Path
The path to the PGP packet to retrieve the value from
Returns
-------
str
The contents of the packet dump
"""
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
return system(["sq", "packet", "dump", str(packet)])
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
def packet_dump_field(packet: Path, field: str) -> str:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Retrieve the value of a field from a PGP packet
Parameters
----------
packet: Path
The path to the PGP packet to retrieve the value from
field: str
The name of the field
Raises
------
Exception
If the field is not found in the PGP packet
Returns
-------
str
The value of the field found in packet
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
dump = packet_dump(packet)
lines = [line.strip() for line in dump.splitlines()]
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
lines = list(filter(lambda line: line.startswith(f"{field}: "), lines))
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
if not lines:
raise Exception(f'Packet has no field "{field}"')
return lines[0].split(maxsplit=1)[1]
feature(keyringctl): use sq to split a keyring into individual certificates Lets use sequoia as well to split an input into individual certificates instead of creating a custom made function for this job. Pass down the name of the original input file to `convert_certificate` in case no override has been defined.
2021-10-12 12:20:33 -05:00
def keyring_split(working_dir: Path, keyring: Path) -> Iterable[Path]:
"""Split a file containing a PGP keyring into separate certificate files
keyringctl: Deal with multi-certificate per user files keyringctl: Add `sanitize_certificate_file()` to potentially split per-user input files that contain more than one certificate. Change `packet_split()` to add documentation and rename the key parameter to certificate, as it is more generic. Change `convert_certificate()` to use named parameters when calling `packet_split()`. Change `convert()` to call `convert_certificate()` on a list of sanitized certificates (generated using `sanitized_certificate_file()`) to be able to deal with multi-certificate files per user.
2021-10-04 15:12:33 -05:00
feature(keyringctl): keep filename if keyring split yields one keyring Instead of always returning an artificial name try to preserve the keyring filename if the split only yields a single certificate.
2021-10-19 19:16:10 -05:00
The original keyring filename is preserved if the split only yields a single certificate.
The file is split using sq.
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
keyringctl: Deal with multi-certificate per user files keyringctl: Add `sanitize_certificate_file()` to potentially split per-user input files that contain more than one certificate. Change `packet_split()` to add documentation and rename the key parameter to certificate, as it is more generic. Change `convert_certificate()` to use named parameters when calling `packet_split()`. Change `convert()` to call `convert_certificate()` on a list of sanitized certificates (generated using `sanitized_certificate_file()`) to be able to deal with multi-certificate files per user.
2021-10-04 15:12:33 -05:00
Parameters
----------
working_dir: Path
feature(keyringctl): use sq to split a keyring into individual certificates Lets use sequoia as well to split an input into individual certificates instead of creating a custom made function for this job. Pass down the name of the original input file to `convert_certificate` in case no override has been defined.
2021-10-12 12:20:33 -05:00
The path of the working directory below which to create the output files
keyring: Path
The path of a file containing a PGP keyring
keyringctl: Deal with multi-certificate per user files keyringctl: Add `sanitize_certificate_file()` to potentially split per-user input files that contain more than one certificate. Change `packet_split()` to add documentation and rename the key parameter to certificate, as it is more generic. Change `convert_certificate()` to use named parameters when calling `packet_split()`. Change `convert()` to call `convert_certificate()` on a list of sanitized certificates (generated using `sanitized_certificate_file()`) to be able to deal with multi-certificate files per user.
2021-10-04 15:12:33 -05:00
Returns
-------
feature(keyringctl): use sq to split a keyring into individual certificates Lets use sequoia as well to split an input into individual certificates instead of creating a custom made function for this job. Pass down the name of the original input file to `convert_certificate` in case no override has been defined.
2021-10-12 12:20:33 -05:00
Iterable[Path]
An iterable over the naturally sorted list of certificate files derived from a keyring
keyringctl: Deal with multi-certificate per user files keyringctl: Add `sanitize_certificate_file()` to potentially split per-user input files that contain more than one certificate. Change `packet_split()` to add documentation and rename the key parameter to certificate, as it is more generic. Change `convert_certificate()` to use named parameters when calling `packet_split()`. Change `convert()` to call `convert_certificate()` on a list of sanitized certificates (generated using `sanitized_certificate_file()`) to be able to deal with multi-certificate files per user.
2021-10-04 15:12:33 -05:00
"""
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
keyring_dir = Path(mkdtemp(dir=working_dir, prefix="keyring-")).absolute()
feature(keyringctl): use sq to split a keyring into individual certificates Lets use sequoia as well to split an input into individual certificates instead of creating a custom made function for this job. Pass down the name of the original input file to `convert_certificate` in case no override has been defined.
2021-10-12 12:20:33 -05:00
with cwd(keyring_dir):
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
system(["sq", "keyring", "split", "--prefix", "", str(keyring)])
feature(keyringctl): keep filename if keyring split yields one keyring Instead of always returning an artificial name try to preserve the keyring filename if the split only yields a single certificate.
2021-10-19 19:16:10 -05:00
keyrings: List[Path] = list(natural_sort_path(keyring_dir.iterdir()))
if 1 == len(keyrings):
keyrings[0] = keyrings[0].rename(keyrings[0].parent / keyring.name)
return keyrings
keyringctl: Deal with multi-certificate per user files keyringctl: Add `sanitize_certificate_file()` to potentially split per-user input files that contain more than one certificate. Change `packet_split()` to add documentation and rename the key parameter to certificate, as it is more generic. Change `convert_certificate()` to use named parameters when calling `packet_split()`. Change `convert()` to call `convert_certificate()` on a list of sanitized certificates (generated using `sanitized_certificate_file()`) to be able to deal with multi-certificate files per user.
2021-10-04 15:12:33 -05:00
def packet_split(working_dir: Path, certificate: Path) -> Iterable[Path]:
"""Split a file containing a PGP certificate into separate packet files
The files are split using sq
Parameters
----------
working_dir: Path
The path of the working directory below which to create the output files
certificate: Path
The absolute path of a file containing one PGP certificate
Returns
-------
Iterable[Path]
An iterable over the naturally sorted list of packet files derived from certificate
"""
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
packet_dir = Path(mkdtemp(dir=working_dir, prefix="packet-")).absolute()
keyringctl: Deal with multi-certificate per user files keyringctl: Add `sanitize_certificate_file()` to potentially split per-user input files that contain more than one certificate. Change `packet_split()` to add documentation and rename the key parameter to certificate, as it is more generic. Change `convert_certificate()` to use named parameters when calling `packet_split()`. Change `convert()` to call `convert_certificate()` on a list of sanitized certificates (generated using `sanitized_certificate_file()`) to be able to deal with multi-certificate files per user.
2021-10-04 15:12:33 -05:00
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
with cwd(packet_dir):
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
system(["sq", "packet", "split", "--prefix", "", str(certificate)])
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
return natural_sort_path(packet_dir.iterdir())
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
def packet_join(packets: List[Path], output: Path, force: bool = False) -> None:
"""Join PGP packet data in files to a single output file
Parameters
----------
packets: List[Path]
A list of paths to files that contain PGP packet data
output: Path
A file to which all PGP packet data is written
force: bool
Whether to force the execution of sq (defaults to False)
"""
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
cmd = ["sq", "packet", "join"]
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
if force:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
cmd.insert(1, "--force")
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
packets_str = list(map(lambda path: str(path), packets))
cmd.extend(packets_str)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
cmd.extend(["--output", str(output)])
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
system(cmd, exit_on_error=False)
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
def simplify_user_id(user_id: Uid) -> Uid:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Simplify the User ID string to contain more filesystem friendly characters
Parameters
----------
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
user_id: Uid
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
A User ID string (e.g. 'Foobar McFooface <foobar@foo.face>')
Returns
-------
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
Uid
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
The simplified representation of user_id
"""
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
user_id_str: str = user_id.replace("@", "_at_")
user_id_str = sub("[<>]", "", user_id_str)
user_id_str = sub("[" + escape(r" !@#$%^&*()_-+=[]{}\|;:,.<>/?") + "]", "_", user_id_str)
return Uid(user_id_str)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
feature(keyringctl): introduce Username type instead of plain str
2021-10-19 14:03:53 -05:00
def derive_username_from_fingerprint(keyring_dir: Path, certificate_fingerprint: Fingerprint) -> Optional[Username]:
feature(keyringctl): avoid splitting a certificate multiple times Move the name cascade to derive the username into the `convert_certificate` function which allows to use the certificate_fingerprint directly instead of trying to find it by splitting the certificate one more time before converting.
2021-10-19 12:10:51 -05:00
"""Attempt to derive the username of a public key fingerprint from a keyring directory
keyringctl: Derive username from target when importing existing key keyringctl: Add `derive_user_from_target()` to derive the username from an existing public key in the target directory when importing (updates to) an already known key. Change `convert()` to either use a custom name override (if provided), a username derived from target dir (if existing) or the file name of the to be imported file as username.
2021-10-17 05:58:19 -05:00
Parameters
----------
feature(keyringctl): avoid splitting a certificate multiple times Move the name cascade to derive the username into the `convert_certificate` function which allows to use the certificate_fingerprint directly instead of trying to find it by splitting the certificate one more time before converting.
2021-10-19 12:10:51 -05:00
keyring_dir: Path
keyringctl: Derive username from target when importing existing key keyringctl: Add `derive_user_from_target()` to derive the username from an existing public key in the target directory when importing (updates to) an already known key. Change `convert()` to either use a custom name override (if provided), a username derived from target dir (if existing) or the file name of the to be imported file as username.
2021-10-17 05:58:19 -05:00
The directory in which to look up a username
feature(keyringctl): avoid splitting a certificate multiple times Move the name cascade to derive the username into the `convert_certificate` function which allows to use the certificate_fingerprint directly instead of trying to find it by splitting the certificate one more time before converting.
2021-10-19 12:10:51 -05:00
certificate_fingerprint: Fingerprint
The public key fingerprint to derive the username from
keyringctl: Derive username from target when importing existing key keyringctl: Add `derive_user_from_target()` to derive the username from an existing public key in the target directory when importing (updates to) an already known key. Change `convert()` to either use a custom name override (if provided), a username derived from target dir (if existing) or the file name of the to be imported file as username.
2021-10-17 05:58:19 -05:00
Raises
------
Exception
If more than one username is found (a public key can only belong to one individual)
Returns
-------
feature(keyringctl): introduce Username type instead of plain str
2021-10-19 14:03:53 -05:00
Optional[Username]
keyringctl: Derive username from target when importing existing key keyringctl: Add `derive_user_from_target()` to derive the username from an existing public key in the target directory when importing (updates to) an already known key. Change `convert()` to either use a custom name override (if provided), a username derived from target dir (if existing) or the file name of the to be imported file as username.
2021-10-17 05:58:19 -05:00
A string representing the username a public key certificate belongs to, None otherwise
"""
feature(keyringctl): derive username from short key id fingerprints Allow short key id fingerprints to be used with the username derive function by adding a glob in front of the fingerprint component.
2021-10-19 12:12:48 -05:00
matches = list(keyring_dir.glob(f"*/*{certificate_fingerprint}"))
keyringctl: Derive username from target when importing existing key keyringctl: Add `derive_user_from_target()` to derive the username from an existing public key in the target directory when importing (updates to) an already known key. Change `convert()` to either use a custom name override (if provided), a username derived from target dir (if existing) or the file name of the to be imported file as username.
2021-10-17 05:58:19 -05:00
if len(matches) > 1:
raise Exception(
chore(keyringctl): apply black formatter
2021-10-19 14:11:37 -05:00
f"More than one username found in {keyring_dir} when probing for fingerprint '{certificate_fingerprint}': "
f"{matches}"
keyringctl: Derive username from target when importing existing key keyringctl: Add `derive_user_from_target()` to derive the username from an existing public key in the target directory when importing (updates to) an already known key. Change `convert()` to either use a custom name override (if provided), a username derived from target dir (if existing) or the file name of the to be imported file as username.
2021-10-17 05:58:19 -05:00
)
feature(keyringctl): avoid splitting a certificate multiple times Move the name cascade to derive the username into the `convert_certificate` function which allows to use the certificate_fingerprint directly instead of trying to find it by splitting the certificate one more time before converting.
2021-10-19 12:10:51 -05:00
elif not matches:
debug(f"Can not derive username from target directory for fingerprint {certificate_fingerprint}")
keyringctl: Derive username from target when importing existing key keyringctl: Add `derive_user_from_target()` to derive the username from an existing public key in the target directory when importing (updates to) an already known key. Change `convert()` to either use a custom name override (if provided), a username derived from target dir (if existing) or the file name of the to be imported file as username.
2021-10-17 05:58:19 -05:00
return None
else:
username = matches[0].parent.stem
chore(keyringctl): apply black formatter
2021-10-19 14:11:37 -05:00
debug(
f"Successfully derived username '{username}' from target directory for fingerprint "
f"{certificate_fingerprint}"
)
feature(keyringctl): introduce Username type instead of plain str
2021-10-19 14:03:53 -05:00
return Username(username)
keyringctl: Derive username from target when importing existing key keyringctl: Add `derive_user_from_target()` to derive the username from an existing public key in the target directory when importing (updates to) an already known key. Change `convert()` to either use a custom name override (if provided), a username derived from target dir (if existing) or the file name of the to be imported file as username.
2021-10-17 05:58:19 -05:00
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
def convert(
working_dir: Path,
feature(keyringctl): support importing multiple paths Lets pass in a list of path's and reduce them to one set of path iterables. This allows us to specify multiple source files/directories
2021-10-20 13:15:42 -05:00
source: Iterable[Path],
keyringctl: Copy files instead of moving them keyringctl: Change `__main__` to create the `target_dir` before calling any further function that relies on it. Change `convert()` to require the `target_dir` to be not None and to create all username based target directories before using `shutil.copytree()` to copy all sources to their respective target directories when iterating over the paths to persist. This has the upside, that updates to a target directory structure can be done on the fly (overwriting existing data), which is not possible with `shutil.move()`.
2021-10-04 12:25:24 -05:00
target_dir: Path,
feature(keyringctl): introduce Username type instead of plain str
2021-10-19 14:03:53 -05:00
name_override: Optional[Username] = None,
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
fingerprint_filter: Optional[Set[Fingerprint]] = None,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
) -> Path:
feature(keyringctl): use sq to split a keyring into individual certificates Lets use sequoia as well to split an input into individual certificates instead of creating a custom made function for this job. Pass down the name of the original input file to `convert_certificate` in case no override has been defined.
2021-10-12 12:20:33 -05:00
"""Convert a path containing PGP certificate material to a decomposed directory structure
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
feature(keyringctl): use sq to split a keyring into individual certificates Lets use sequoia as well to split an input into individual certificates instead of creating a custom made function for this job. Pass down the name of the original input file to `convert_certificate` in case no override has been defined.
2021-10-12 12:20:33 -05:00
Any input is first split by `keyring_split()` into individual certificates.
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
Parameters
----------
working_dir: Path
A directory to use for temporary files
feature(keyringctl): support importing multiple paths Lets pass in a list of path's and reduce them to one set of path iterables. This allows us to specify multiple source files/directories
2021-10-20 13:15:42 -05:00
source: Iterable[Path]
chore(doc): extend source parameter description
2021-10-12 12:39:07 -05:00
A path to a file or directory to decompose
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
target_dir: Path
A directory path to write the new directory structure to
feature(keyringctl): introduce Username type instead of plain str
2021-10-19 14:03:53 -05:00
name_override: Optional[Username]
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
An optional username override for the call to `convert_certificate()`
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
fingerprint_filter: Optional[Set[Fingerprint]]
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
An optional set of strings defining fingerprints of PGP public keys that all certificates will be filtered with
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
Returns
-------
Path
The directory that contains the resulting directory structure (target_dir)
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
directories: List[Path] = []
feature(keyringctl): support importing multiple paths Lets pass in a list of path's and reduce them to one set of path iterables. This allows us to specify multiple source files/directories
2021-10-20 13:15:42 -05:00
keys: Iterable[Path] = set(chain.from_iterable(map(lambda s: s.iterdir() if s.is_dir() else [s], source)))
chore(keyringctl): deduplicate iteration and split code in convert()
2021-10-12 12:42:22 -05:00
for key in keys:
for cert in keyring_split(working_dir=working_dir, keyring=key):
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
directories.append(
convert_certificate(
working_dir=working_dir,
certificate=cert,
feature(keyringctl): avoid splitting a certificate multiple times Move the name cascade to derive the username into the `convert_certificate` function which allows to use the certificate_fingerprint directly instead of trying to find it by splitting the certificate one more time before converting.
2021-10-19 12:10:51 -05:00
keyring_dir=target_dir,
name_override=name_override,
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
fingerprint_filter=fingerprint_filter,
)
)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
for path in directories:
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
(target_dir / path.name).mkdir(parents=True, exist_ok=True)
keyringctl: Copy files instead of moving them keyringctl: Change `__main__` to create the `target_dir` before calling any further function that relies on it. Change `convert()` to require the `target_dir` to be not None and to create all username based target directories before using `shutil.copytree()` to copy all sources to their respective target directories when iterating over the paths to persist. This has the upside, that updates to a target directory structure can be done on the fly (overwriting existing data), which is not possible with `shutil.move()`.
2021-10-04 12:25:24 -05:00
copytree(src=path, dst=(target_dir / path.name), dirs_exist_ok=True)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
return target_dir
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
def temp_join_keys(sources: List[Path], temp_dir: Path, force: bool) -> List[Path]:
"""Temporarily join the key material of a given set of keys in a temporary location and return their paths
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
Parameters
----------
sources: List[Path]
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
A list of paths below which PGP packets are found
temp_dir: Path
The temporary directory below which to join PGP keys
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
force: bool
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
Whether to force the joining of files
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
"""
certs: List[Path] = []
for source_number, source in enumerate(sources):
if source.is_dir():
for user_number, user_dir in enumerate(sorted(source.iterdir())):
if user_dir.is_dir():
for user_cert_number, user_cert_dir in enumerate(sorted(user_dir.iterdir())):
if user_cert_dir.is_dir():
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
cert_path = temp_dir / (
f"{str(source_number).zfill(4)}"
f"-{str(user_number).zfill(4)}"
f"-{str(user_cert_number).zfill(4)}.asc"
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
)
debug(f"Joining {user_dir.name}/{user_cert_dir.name} in {cert_path}.")
packet_join(
packets=sorted(user_cert_dir.glob("**/*.asc")),
output=cert_path,
force=force,
)
certs.append(cert_path)
elif source.is_file() and not source.is_symlink():
certs.append(source)
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
return certs
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
def get_all_and_revoked_certs(certs: List[Path]) -> Tuple[List[Fingerprint], List[Fingerprint]]:
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
"""Get the fingerprints of all public keys and all fingerprints of all (self) revoked public keys in a directory
Parameters
----------
certs: List[Path]
The certificates to trust
Returns
-------
Tuple[List[str], List[str]]
A tuple with the first item containing the fingerprints of all public keys and the second item containing the
fingerprints of all self-revoked public keys
"""
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
all_fingerprints: List[Fingerprint] = []
revoked_fingerprints: List[Fingerprint] = []
# TODO: what about direct key revocations/signatures?
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
debug(f"Retrieving all and self-revoked certificates from {[str(cert_dir) for cert_dir in certs]}")
for cert_collection in certs:
if cert_collection.is_dir():
for user_dir in cert_collection.iterdir():
if user_dir.is_dir():
for cert_dir in user_dir.iterdir():
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
cert_fingerprint = Fingerprint(cert_dir.stem)
all_fingerprints.append(cert_fingerprint)
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
for revocation_cert in cert_dir.glob("revocation/*.asc"):
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
if cert_fingerprint.endswith(revocation_cert.stem):
debug(f"Revoking {cert_fingerprint} due to self-revocation")
revoked_fingerprints.append(cert_fingerprint)
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
return all_fingerprints, revoked_fingerprints
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
def export_ownertrust(certs: List[Path], output: Path) -> Tuple[List[Fingerprint], List[Fingerprint]]:
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
"""Export ownertrust from a set of keys
The output file format is compatible with `gpg --import-ownertrust` and lists the main fingerprint ID of all
non-revoked keys as fully trusted.
The exported file is used by pacman-key when importing a keyring (see
https://man.archlinux.org/man/pacman-key.8#PROVIDING_A_KEYRING_FOR_IMPORT).
Parameters
----------
certs: List[Path]
The certificates to trust
output: Path
The file path to write to
"""
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
all_certs, revoked_certs = get_all_and_revoked_certs(certs=certs)
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
trusted_certs = [cert for cert in all_certs if cert not in revoked_certs]
with open(file=output, mode="w") as trusted_certs_file:
for cert in trusted_certs:
debug(f"Writing {cert} to {output}")
trusted_certs_file.write(f"{cert}:4:\n")
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
return trusted_certs, all_certs
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
def export_revoked(certs: List[Path], main_keys: List[Fingerprint], output: Path, min_revoker: int = 2) -> None:
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
"""Export the PGP revoked status from a set of keys
The output file contains the fingerprints of all self-revoked keys and all keys for which at least two revocations
by any main key exist.
The exported file is used by pacman-key when importing a keyring (see
https://man.archlinux.org/man/pacman-key.8#PROVIDING_A_KEYRING_FOR_IMPORT).
Parameters
----------
certs: List[Path]
A list of directories with keys to check for their revocation status
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
main_keys: List[Fingerprint]
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
A list of strings representing the fingerprints of (current and/or revoked) main keys
output: Path
The file path to write to
min_revoker: int
The minimum amount of revocation certificates on a User ID from any main key to deem a public key as revoked
(defaults to 2)
"""
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
all_certs, revoked_certs = get_all_and_revoked_certs(certs=certs)
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
debug(f"Retrieving certificates revoked by main keys from {[str(cert_dir) for cert_dir in certs]}")
foreign_revocations: Dict[str, List[str]] = {}
for cert_collection in certs:
if cert_collection.is_dir():
for user_dir in cert_collection.iterdir():
if user_dir.is_dir():
for cert_dir in user_dir.iterdir():
debug(f"Inspecting public key {cert_dir.name}")
foreign_revocations[cert_dir.stem] = []
chore(keyringctl): use singular folder names for all sub-folders
2021-10-12 16:57:20 -05:00
for revocation_cert in cert_dir.glob("uid/*/revocation/*.asc"):
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
foreign_revocations[cert_dir.stem] += [
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
revocation_cert.stem
for main_key in main_keys
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
if main_key.endswith(revocation_cert.stem)
]
# TODO: find a better (less naive) approach, as this would also match on public certificates,
# where some UIDs are signed and others are revoked
if len(set(foreign_revocations[cert_dir.stem])) >= min_revoker:
debug(
f"Revoking {cert_dir.name} due to {set(foreign_revocations[cert_dir.stem])} "
"being main key revocations"
)
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
revoked_certs.append(Fingerprint(cert_dir.stem))
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
with open(file=output, mode="w") as trusted_certs_file:
for cert in set(revoked_certs):
debug(f"Writing {cert} to {output}")
trusted_certs_file.write(f"{cert}\n")
feature(keyringctl): support importing multiple paths Lets pass in a list of path's and reduce them to one set of path iterables. This allows us to specify multiple source files/directories
2021-10-20 13:15:42 -05:00
def get_fingerprints_from_import_source(working_dir: Path, source: List[Path]) -> List[Fingerprint]:
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
"""Get all fingerprints of PGP public keys from import file(s)
Parameters
----------
working_dir: Path
A directory to use for temporary files
feature(keyringctl): support importing multiple paths Lets pass in a list of path's and reduce them to one set of path iterables. This allows us to specify multiple source files/directories
2021-10-20 13:15:42 -05:00
source: List[Path]
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
The path to a source file or directory
Returns
-------
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
List[Fingerprint]
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
A list of strings representing the fingerprints of PGP public keys found in source
"""
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
fingerprints: List[Fingerprint] = []
feature(keyringctl): support importing multiple paths Lets pass in a list of path's and reduce them to one set of path iterables. This allows us to specify multiple source files/directories
2021-10-20 13:15:42 -05:00
keys: Iterable[Path] = set(chain.from_iterable(map(lambda s: s.iterdir() if s.is_dir() else [s], source)))
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
for key in keys:
for certificate in keyring_split(working_dir=working_dir, keyring=key):
for packet in packet_split(working_dir=working_dir, certificate=certificate):
if packet.name.endswith("--PublicKey"):
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
fingerprints += [Fingerprint(packet_dump_field(packet, "Fingerprint"))]
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
debug(f"Fingerprints of PGP public keys in {source}: {fingerprints}")
return fingerprints
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
def get_fingerprints_from_decomposed_dir(path: Path) -> List[Fingerprint]:
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
"""Get all fingerprints of PGP public keys from a decomposed directory structure
Parameters
----------
path: Path
The path to a decomposed directory structure
Returns
-------
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
List[Fingerprint]
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
A list of strings representing all fingerprints of PGP public keys below path
"""
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
fingerprints = [Fingerprint(path.stem) for path in list(path.absolute().glob("*/*"))]
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
debug(f"Fingerprints of PGP public keys in {path}: {fingerprints}")
return fingerprints
chore(keyringctl): remove used input_path from get_fingerprints
2021-10-19 11:25:04 -05:00
def get_fingerprints(working_dir: Path, decomposed_paths: List[Path]) -> Set[Fingerprint]:
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
"""Get the fingerprints of PGP public keys from input paths and decomposed directory structures
Parameters
----------
working_dir: Path
A directory to use for temporary files
decomposed_paths: List[Path]
A list of paths that identify decomposed PGP data in directory structures
Returns
-------
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
Set[Fingerprint]
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
A set of strings describing fingerprints of PGP public keys
"""
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
fingerprints: Set[Fingerprint] = set()
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
fingerprints.update(
get_fingerprints_from_import_source(
working_dir=working_dir,
source=args.source,
)
)
for decomposed_path in decomposed_paths:
fingerprints.update(get_fingerprints_from_decomposed_dir(path=decomposed_path))
return fingerprints
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
def export_keyring(
working_dir: Path,
main: List[Path],
sources: List[Path],
output: Path,
force: bool,
pacman_integration: bool,
) -> None:
"""Export all provided PGP packet files to a single output file
If sources contains directories, any .asc files below them are considered.
Parameters
----------
working_dir: Path
A directory to use for temporary files
main: List[Path]
A list of directories or files from which to read PGP packet information, that is considered as public keys
that are used to sign those found in sources
sources: List[Path]
A list of directories or files from which to read PGP packet information
output: Path
An output file that all PGP packet data is written to
force: bool
Whether to force the execution of packet_join()
chore(keyringctl): add docstring for export_keyring() pacman_integration
2021-10-19 11:25:26 -05:00
pacman_integration: bool
Whether to write pacman compatible trust files
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
"""
main = [source.absolute() for source in main]
sources = [source.absolute() for source in sources]
output = output.absolute()
main_certs = temp_join_keys(sources=main, temp_dir=Path(mkdtemp(dir=working_dir)).absolute(), force=force)
sources_certs = temp_join_keys(sources=sources, temp_dir=Path(mkdtemp(dir=working_dir)).absolute(), force=force)
debug(
f"Creating keyring {output} from {[str(source_dir) for source_dir in main]} "
f"and {[str(source_dir) for source_dir in sources]}."
)
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
output.parent.mkdir(parents=True, exist_ok=True)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
cmd = ["sq", "keyring", "merge", "-o", str(output)]
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
if force:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
cmd.insert(1, "--force")
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
cmd += [str(cert) for cert in sorted(main_certs)]
cmd += [str(cert) for cert in sorted(sources_certs)]
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
system(cmd, exit_on_error=False)
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
if pacman_integration:
[trusted_main_keys, all_main_keys] = export_ownertrust(
certs=main,
output=Path(f"{str(output).split('.gpg')[0]}-trusted"),
)
export_revoked(
certs=main + sources,
main_keys=all_main_keys,
output=Path(f"{str(output).split('.gpg')[0]}-revoked"),
)
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
def absolute_path(path: str) -> Path:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Return the absolute path of a given str
Parameters
----------
path: str
A string representing a path
Returns
-------
Path
The absolute path representation of path
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
return Path(path).absolute()
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
if __name__ == "__main__":
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
parser = ArgumentParser()
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
parser.add_argument(
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
"-v", "--verbose", action="store_true", help="Causes to print debugging messages about the progress"
)
parser.add_argument("--wait", action="store_true", help="Block before cleaning up the temp directory")
parser.add_argument(
"-f",
"--force",
action="store_true",
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
default=False,
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
help="force the execution of subcommands (e.g. overwriting of files)",
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
subcommands = parser.add_subparsers(dest="subcommand")
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
convert_parser = subcommands.add_parser(
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
"convert",
feature(keyringctl): unify import subcommand for condensed api Both commands are basically doing the same with the same params except the target directory differs. Lets condense this behavior by using a single subcommand with a boolean options.
2021-10-20 13:02:08 -05:00
help="convert one or multiple PGP public keys to a decomposed directory structure",
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
)
feature(keyringctl): support importing multiple paths Lets pass in a list of path's and reduce them to one set of path iterables. This allows us to specify multiple source files/directories
2021-10-20 13:15:42 -05:00
convert_parser.add_argument("source", type=absolute_path, nargs="+", help="Files or directorie to convert")
fix(keyringctl): restore --target option for convert command
2021-10-20 13:08:26 -05:00
convert_parser.add_argument("--target", type=absolute_path, help="Target directory instead of a random tmpdir")
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
convert_parser.add_argument(
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
"--name",
feature(keyringctl): introduce Username type instead of plain str
2021-10-19 14:03:53 -05:00
type=Username,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
default=None,
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
help="override the username to use (only useful when using a single file as source)",
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
feature(keyringctl): unify import subcommand for condensed api Both commands are basically doing the same with the same params except the target directory differs. Lets condense this behavior by using a single subcommand with a boolean options.
2021-10-20 13:02:08 -05:00
import_parser = subcommands.add_parser(
"import",
help="import one or several PGP keys to the keyring directory structure",
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
)
feature(keyringctl): support importing multiple paths Lets pass in a list of path's and reduce them to one set of path iterables. This allows us to specify multiple source files/directories
2021-10-20 13:15:42 -05:00
import_parser.add_argument("source", type=absolute_path, nargs="+", help="Files or directories to import")
feature(keyringctl): unify import subcommand for condensed api Both commands are basically doing the same with the same params except the target directory differs. Lets condense this behavior by using a single subcommand with a boolean options.
2021-10-20 13:02:08 -05:00
import_parser.add_argument(
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
"--name",
feature(keyringctl): introduce Username type instead of plain str
2021-10-19 14:03:53 -05:00
type=Username,
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
default=None,
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
help="override the username to use (only useful when using a single file as source)",
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
)
feature(keyringctl): unify import subcommand for condensed api Both commands are basically doing the same with the same params except the target directory differs. Lets condense this behavior by using a single subcommand with a boolean options.
2021-10-20 13:02:08 -05:00
import_parser.add_argument("--main", action="store_true", help="Import a main signing key into the keyring")
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
export_keyring_parser = subcommands.add_parser(
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
"export-keyring",
chore(keyringctl): use singular for packager directory as well So far we have used singular for all directories, lets keep that for the packager directory as well.
2021-10-19 18:34:44 -05:00
help="export PGP packet data below main/ and packager/ to output/archlinux.gpg alongside pacman integration",
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
export_parser = subcommands.add_parser(
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
"export",
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
help="export a directory structure of PGP packet data to a combined file",
)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
export_parser.add_argument("output", type=absolute_path, help="file to write PGP packet data to")
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
export_parser.add_argument(
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
"-m",
"--main",
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
action="append",
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
help="files or directories containing PGP packet data that is trusted (can be provided multiple times)",
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
required=True,
type=absolute_path,
)
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
export_parser.add_argument(
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
"-s",
"--source",
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
action="append",
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
help="files or directories containing PGP packet data (can be provided multiple times)",
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
required=True,
type=absolute_path,
)
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
export_parser.add_argument(
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
"-p",
"--pacman-integration",
action="store_true",
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
default=False,
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
help="export trusted and revoked files (used by pacman) alongside the keyring",
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
)
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
args = parser.parse_args()
if args.verbose:
basicConfig(level=DEBUG)
# temporary working directory that gets auto cleaned
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
with TemporaryDirectory(prefix="arch-keyringctl-") as tempdir:
feature(keyringctl): move main/packager folders to isolated keyring dir This helps to structure the layout of the repository better by having one root folder that contains the actual decomposed keyring structure.
2021-10-19 18:41:04 -05:00
keyring_root = Path("keyring").absolute()
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
working_dir = Path(tempdir)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
debug(f"Working directory: {working_dir}")
fix(keyringctl): restore cwd before deleting the temporary working dir This avoids potential issues with wrapped runtime like ipython or pdb that try to invoke functions at exit and access the current working directory, which will ultimately lead to an error in case we deleted it before changing the current working directory.
2021-10-12 12:22:30 -05:00
with cwd(working_dir):
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
if "convert" == args.subcommand:
fix(keyringctl): restore --target option for convert command
2021-10-20 13:08:26 -05:00
target_dir = args.target or Path(mkdtemp(prefix="arch-keyringctl-")).absolute()
print(convert(working_dir, args.source, target_dir=target_dir))
feature(keyringctl): unify import subcommand for condensed api Both commands are basically doing the same with the same params except the target directory differs. Lets condense this behavior by using a single subcommand with a boolean options.
2021-10-20 13:02:08 -05:00
elif "import" == args.subcommand:
target_dir = "main" if args.main else "packager"
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
print(
convert(
working_dir=working_dir,
source=args.source,
feature(keyringctl): unify import subcommand for condensed api Both commands are basically doing the same with the same params except the target directory differs. Lets condense this behavior by using a single subcommand with a boolean options.
2021-10-20 13:02:08 -05:00
target_dir=keyring_root / target_dir,
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
name_override=args.name,
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
fingerprint_filter=get_fingerprints(
working_dir=working_dir,
chore(keyringctl): use singular for packager directory as well So far we have used singular for all directories, lets keep that for the packager directory as well.
2021-10-19 18:34:44 -05:00
decomposed_paths=[keyring_root / "main", keyring_root / "packager"],
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
),
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
)
)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
elif "export-keyring" == args.subcommand:
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
export_keyring(
working_dir=working_dir,
main=[keyring_root / "main"],
chore(keyringctl): use singular for packager directory as well So far we have used singular for all directories, lets keep that for the packager directory as well.
2021-10-19 18:34:44 -05:00
sources=[keyring_root / "packager"],
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
output=keyring_root / "output" / "archlinux.gpg",
force=True,
pacman_integration=True,
)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
elif "export" == args.subcommand:
fix(keyringctl): restore cwd before deleting the temporary working dir This avoids potential issues with wrapped runtime like ipython or pdb that try to invoke functions at exit and access the current working directory, which will ultimately lead to an error in case we deleted it before changing the current working directory.
2021-10-12 12:22:30 -05:00
export_keyring(
working_dir=working_dir,
main=args.main,
sources=args.source,
output=args.output,
force=args.force,
pacman_integration=args.pacman_integration,
)
feature(keyringctl): print help if invoked without any subcommand
2021-10-20 13:04:02 -05:00
else:
parser.print_help()
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
fix(keyringctl): restore cwd before deleting the temporary working dir This avoids potential issues with wrapped runtime like ipython or pdb that try to invoke functions at exit and access the current working directory, which will ultimately lead to an error in case we deleted it before changing the current working directory.
2021-10-12 12:22:30 -05:00
if args.wait:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
print("Press [ENTER] to continue")
fix(keyringctl): restore cwd before deleting the temporary working dir This avoids potential issues with wrapped runtime like ipython or pdb that try to invoke functions at exit and access the current working directory, which will ultimately lead to an error in case we deleted it before changing the current working directory.
2021-10-12 12:22:30 -05:00
input()
Reference in New Issue Copy Permalink