CondorCORE/condorcore-keyring
CondorCORE/condorcore-keyring
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
f90e860d16
condorcore-keyring/keyringctl

1455 lines
50 KiB
Plaintext
Raw Normal View History

feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
#!/usr/bin/env python
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
#
# SPDX-License-Identifier: GPL-3.0-or-later
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
from argparse import ArgumentParser
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
from collections import defaultdict
chore(keyringctl): use python 3.9 iterable/iterator type imports
2021-10-20 13:16:33 -05:00
from collections.abc import Iterable
from collections.abc import Iterator
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
from contextlib import contextmanager
fix(keyringctl): prioritize latest certification per issuer When importing a non reduced keyring the certifications were not deterministic for keys that have multiple certifications per issuer. This was for example the case for self certifications to extend the expiry time. Before this commit a random certification could remain the final one which would lead to a non up to date keyring and a potentially expired key.
2021-10-23 19:16:25 -05:00
from datetime import datetime
from functools import reduce
feature(keyringctl): support importing multiple paths Lets pass in a list of path's and reduce them to one set of path iterables. This allows us to specify multiple source files/directories
2021-10-20 13:15:42 -05:00
from itertools import chain
isort: Configure to use single lines pyproject.toml: Configure isort to use single lines (one line for each import) to ease merge conflicts. keyringctl: Reformat using new isort settings.
2021-10-18 05:58:23 -05:00
from logging import DEBUG
from logging import basicConfig
from logging import debug
from os import chdir
from os import getcwd
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
from pathlib import Path
isort: Configure to use single lines pyproject.toml: Configure isort to use single lines (one line for each import) to ease merge conflicts. keyringctl: Reformat using new isort settings.
2021-10-18 05:58:23 -05:00
from re import escape
feature(keyringctl): support passing fingerprint as source This helps make the CLI more useful by listing, exporting or inspecting a specific fingerprint.
2021-10-22 20:01:06 -05:00
from re import match
isort: Configure to use single lines pyproject.toml: Configure isort to use single lines (one line for each import) to ease merge conflicts. keyringctl: Reformat using new isort settings.
2021-10-18 05:58:23 -05:00
from re import split
from re import sub
keyringctl: Copy files instead of moving them keyringctl: Change `__main__` to create the `target_dir` before calling any further function that relies on it. Change `convert()` to require the `target_dir` to be not None and to create all username based target directories before using `shutil.copytree()` to copy all sources to their respective target directories when iterating over the paths to persist. This has the upside, that updates to a target directory structure can be done on the fly (overwriting existing data), which is not possible with `shutil.move()`.
2021-10-04 12:25:24 -05:00
from shutil import copytree
isort: Configure to use single lines pyproject.toml: Configure isort to use single lines (one line for each import) to ease merge conflicts. keyringctl: Reformat using new isort settings.
2021-10-18 05:58:23 -05:00
from subprocess import PIPE
from subprocess import CalledProcessError
from subprocess import check_output
from sys import exit
from sys import stderr
from tempfile import TemporaryDirectory
from tempfile import mkdtemp
feature(keyringctl): add inspect command to pretty print certificates This command prints a new and pretty representation of the certificate data to visualize the keyring and its signatures.
2021-10-21 14:51:02 -05:00
from tempfile import mkstemp
feature(keyringctl): print a stack trace in case a system cmd fails
2021-10-21 13:18:21 -05:00
from traceback import print_stack
isort: Configure to use single lines pyproject.toml: Configure isort to use single lines (one line for each import) to ease merge conflicts. keyringctl: Reformat using new isort settings.
2021-10-18 05:58:23 -05:00
from typing import Dict
from typing import List
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
from typing import NewType
isort: Configure to use single lines pyproject.toml: Configure isort to use single lines (one line for each import) to ease merge conflicts. keyringctl: Reformat using new isort settings.
2021-10-18 05:58:23 -05:00
from typing import Optional
from typing import Set
from typing import Tuple
from typing import Union
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
chore(keyringctl): apply black formatter
2021-10-19 14:11:37 -05:00
Fingerprint = NewType("Fingerprint", str)
Uid = NewType("Uid", str)
Username = NewType("Username", str)
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
@contextmanager
chore(keyringctl): declare missing type hinting for cwd
2021-10-12 12:35:18 -05:00
def cwd(new_dir: Path) -> Iterator[None]:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Change to a new current working directory in a context and go back to the previous dir after the context is done
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
new_dir: A path to change to
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
previous_dir = getcwd()
chdir(new_dir)
try:
yield
finally:
chdir(previous_dir)
def natural_sort_path(_list: Iterable[Path]) -> Iterable[Path]:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Sort an Iterable of Paths naturally
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
_list: An iterable containing paths to be sorted
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
Return
------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
An Iterable of paths that are naturally sorted
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""
chore(keyringctl): avoid shadowing convert function
2021-10-19 11:23:08 -05:00
def convert_text_chunk(text: str) -> Union[int, str]:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Convert input text to int or str
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
text: An input string
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
Returns
-------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
Either an integer if text is a digit, else text in lower-case representation
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
return int(text) if text.isdigit() else text.lower()
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
def alphanum_key(key: Path) -> List[Union[int, str]]:
"""Retrieve an alphanumeric key from a Path, that can be used in sorted()
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
key: A path for which to create a key
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
Returns
-------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
A list of either int or str objects that may serve as 'key' argument for sorted()
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""
chore(keyringctl): avoid shadowing convert function
2021-10-19 11:23:08 -05:00
return [convert_text_chunk(c) for c in split("([0-9]+)", str(key.name))]
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
return sorted(_list, key=alphanum_key)
chore(keyringctl): throw exception instead of exit on failed system calls
2021-10-21 14:05:03 -05:00
def system(cmd: List[str], exit_on_error: bool = False) -> str:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Execute a command using check_output
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
cmd: A list of strings to be fed to check_output
exit_on_error: Whether to exit the script when encountering an error (defaults to False)
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
Raises
------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
CalledProcessError: If not exit_on_error and `check_output()` encounters an error
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
Returns
-------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
The output of cmd
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
try:
return check_output(cmd, stderr=PIPE).decode()
except CalledProcessError as e:
stderr.buffer.write(e.stderr)
feature(keyringctl): print a stack trace in case a system cmd fails
2021-10-21 13:18:21 -05:00
print_stack()
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
if exit_on_error:
exit(e.returncode)
raise e
feature(keyringctl): support passing fingerprint as source This helps make the CLI more useful by listing, exporting or inspecting a specific fingerprint.
2021-10-22 20:01:06 -05:00
def is_pgp_fingerprint(string: str) -> bool:
"""Returns whether the passed string looks like a PGP (long) fingerprint
Parameters
----------
string: Input to consider as a fingerprint
Returns
-------
RWhether string is a fingerprint
"""
if len(string) not in [16, 40]:
return False
return match("^[A-F0-9]+$", string) is not None
chore(keyringctl): move cert depth first search to own function This way we can reuse the functionality which will allow to simplify a lot of places that have multiple layers of inflexible nested loops.
2021-10-22 13:17:50 -05:00
def get_cert_paths(paths: Iterable[Path]) -> Set[Path]:
"""Walks a list of paths and resolves all discovered certificate paths
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
paths: A list of paths to walk and resolve to certificate paths.
chore(keyringctl): move cert depth first search to own function This way we can reuse the functionality which will allow to simplify a lot of places that have multiple layers of inflexible nested loops.
2021-10-22 13:17:50 -05:00
Returns
-------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
The list of paths to certificates
chore(keyringctl): move cert depth first search to own function This way we can reuse the functionality which will allow to simplify a lot of places that have multiple layers of inflexible nested loops.
2021-10-22 13:17:50 -05:00
"""
# depth first search certificate paths
cert_paths: Set[Path] = set()
visit: List[Path] = list(paths)
while visit:
path = visit.pop()
fix(keyringctl): avoid walking non existing paths to resolve certs
2021-10-23 09:40:32 -05:00
if not path.exists():
continue
chore(keyringctl): move cert depth first search to own function This way we can reuse the functionality which will allow to simplify a lot of places that have multiple layers of inflexible nested loops.
2021-10-22 13:17:50 -05:00
# this level contains a certificate, abort depth search
if list(path.glob("*.asc")):
cert_paths.add(path)
continue
visit.extend([path for path in path.iterdir() if path.is_dir()])
return cert_paths
chore(keyringctl): de-duplicate username/fprint transform code We duplicated resolving usernames and fingerprints to actual keyring paths in multiple places. De-duplicate the code by using dedicated functions to do this job.
2021-10-23 10:13:46 -05:00
def transform_username_to_keyring_path(keyring_dir: Path, paths: List[Path]) -> None:
"""Mutates the input sources by transforming passed usernames to keyring paths
Parameters
----------
keyring_dir: The directory underneath the username needs to exist
paths: A list of paths to mutate and replace usernames to keyring paths
"""
for index, source in enumerate(paths):
if source.exists():
continue
packager_source = keyring_dir / source.name
if not packager_source.exists():
continue
paths[index] = packager_source
def transform_fingerprint_to_keyring_path(keyring_root: Path, paths: List[Path]) -> None:
"""Mutates the input sources by transforming passed fingerprints to keyring paths
Parameters
----------
keyring_root: The keyring root directory to look up fingerprints in
paths: A list of paths to mutate and replace fingerprints to keyring paths
"""
for index, source in enumerate(paths):
if source.exists():
continue
if not is_pgp_fingerprint(source.name):
continue
fingerprint_paths = list(keyring_root.glob(f"*/*/*{source.name}"))
if not fingerprint_paths:
continue
paths[index] = fingerprint_paths[0].parent
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
# TODO: simplify to lower complexity
def convert_certificate( # noqa: ignore=C901
working_dir: Path,
certificate: Path,
feature(keyringctl): avoid splitting a certificate multiple times Move the name cascade to derive the username into the `convert_certificate` function which allows to use the certificate_fingerprint directly instead of trying to find it by splitting the certificate one more time before converting.
2021-10-19 12:10:51 -05:00
keyring_dir: Path,
feature(keyringctl): introduce Username type instead of plain str
2021-10-19 14:03:53 -05:00
name_override: Optional[Username] = None,
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
fingerprint_filter: Optional[Set[Fingerprint]] = None,
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
) -> Path:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Convert a single file public key certificate into a decomposed directory structure of multiple PGP packets
feature(keyringctl): avoid splitting a certificate multiple times Move the name cascade to derive the username into the `convert_certificate` function which allows to use the certificate_fingerprint directly instead of trying to find it by splitting the certificate one more time before converting.
2021-10-19 12:10:51 -05:00
The output directory structure is created per user. The username is derived from the certificate via
`derive_username_from_fingerprint` or overridden via `name_override`.
chore(keyringctl): fix typo in docstring for convert_certificate
2021-10-19 11:41:58 -05:00
Below the username directory a directory tree describes the public keys components split up into certifications
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
and revocations, as well as per subkey and per uid certifications and revocations.
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
working_dir: The path of the working directory below which to create split certificates
certificate: The path to a public key certificate
keyring_dir: The path of the keyring used to try to derive the username from the public key fingerprint
name_override: An optional string to override the username in the to be created output directory structure
fingerprint_filter: Optional list of fingerprints of PGP public keys that all certifications will be filtered with
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
Raises
------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
Exception: If required PGP packets are not found
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
Returns
-------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
The path of the user_dir (which is located below working_dir)
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
# root packets
certificate_fingerprint: Optional[Fingerprint] = None
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
pubkey: Optional[Path] = None
fix(keyringctl): prioritize latest certification per issuer When importing a non reduced keyring the certifications were not deterministic for keys that have multiple certifications per issuer. This was for example the case for self certifications to extend the expiry time. Before this commit a random certification could remain the final one which would lead to a non up to date keyring and a potentially expired key.
2021-10-23 19:16:25 -05:00
# TODO: direct key certifications are not yet selecting the latest sig, owner may have multiple
# TODO: direct key certifications are not yet single packet per file
feature(keyringctl): add type hinting direct sigs/revocations
2021-10-19 13:08:32 -05:00
direct_sigs: Dict[Fingerprint, List[Path]] = defaultdict(list)
direct_revocations: Dict[Fingerprint, List[Path]] = defaultdict(list)
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
# subkey packets
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
subkeys: Dict[Fingerprint, Path] = {}
fix(keyringctl): prioritize latest certification per issuer When importing a non reduced keyring the certifications were not deterministic for keys that have multiple certifications per issuer. This was for example the case for self certifications to extend the expiry time. Before this commit a random certification could remain the final one which would lead to a non up to date keyring and a potentially expired key.
2021-10-23 19:16:25 -05:00
subkey_bindings: Dict[Fingerprint, List[Path]] = defaultdict(list)
subkey_revocations: Dict[Fingerprint, List[Path]] = defaultdict(list)
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
# uid packets
uids: Dict[Uid, Path] = {}
fix(keyringctl): prioritize latest certification per issuer When importing a non reduced keyring the certifications were not deterministic for keys that have multiple certifications per issuer. This was for example the case for self certifications to extend the expiry time. Before this commit a random certification could remain the final one which would lead to a non up to date keyring and a potentially expired key.
2021-10-23 19:16:25 -05:00
certifications: Dict[Uid, Dict[Fingerprint, List[Path]]] = defaultdict(lambda: defaultdict(list))
revocations: Dict[Uid, Dict[Fingerprint, List[Path]]] = defaultdict(lambda: defaultdict(list))
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
# intermediate variables
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
current_packet_mode: Optional[str] = None
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
current_packet_fingerprint: Optional[Fingerprint] = None
current_packet_uid: Optional[Uid] = None
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
# XXX: PrimaryKeyBinding
# TODO: remove 3rd party direct key signatures, seems to be leaked by export-clean
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
debug(f"Processing certificate {certificate}")
keyringctl: Add handling of KeyRevocations keyringctl: Change `persist_direct_sigs()` to track a sig_type parameter in its signature so that the output directory of the direct signatures can be altered. Change `convert_certificate()` to set a `direct_revocations` variable, that is used to track KeyRevocations for root keys. Extend the logic to make use of `add_packet_to_direct_sigs()` to set a list of KeyRevocations for a given root key. Eventually call `persist_direct_sigs()` with `direct_revocations` and a custom `sig_type` to persist the revocation certificates.
2021-10-03 13:05:11 -05:00
keyringctl: Deal with multi-certificate per user files keyringctl: Add `sanitize_certificate_file()` to potentially split per-user input files that contain more than one certificate. Change `packet_split()` to add documentation and rename the key parameter to certificate, as it is more generic. Change `convert_certificate()` to use named parameters when calling `packet_split()`. Change `convert()` to call `convert_certificate()` on a list of sanitized certificates (generated using `sanitized_certificate_file()`) to be able to deal with multi-certificate files per user.
2021-10-04 15:12:33 -05:00
for packet in packet_split(working_dir=working_dir, certificate=certificate):
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
debug(f"Processing packet {packet.name}")
if packet.name.endswith("--PublicKey"):
current_packet_mode = "pubkey"
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
current_packet_fingerprint = Fingerprint(packet_dump_field(packet, "Fingerprint"))
current_packet_uid = None
certificate_fingerprint = current_packet_fingerprint
pubkey = packet
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
elif packet.name.endswith("--UserID"):
current_packet_mode = "uid"
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
current_packet_fingerprint = None
current_packet_uid = simplify_user_id(Uid(packet_dump_field(packet, "Value")))
uids[current_packet_uid] = packet
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
elif packet.name.endswith("--PublicSubkey"):
current_packet_mode = "subkey"
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
current_packet_fingerprint = Fingerprint(packet_dump_field(packet, "Fingerprint"))
current_packet_uid = None
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
subkeys[current_packet_fingerprint] = packet
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
elif packet.name.endswith("--Signature"):
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
if not certificate_fingerprint:
raise Exception('missing certificate fingerprint for "{packet.name}"')
feature(keyringctl): add type hinting direct sigs/revocations
2021-10-19 13:08:32 -05:00
issuer: Fingerprint = Fingerprint(packet_dump_field(packet, "Issuer"))
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
signature_type = packet_dump_field(packet, "Type")
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
if current_packet_mode == "pubkey":
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
if not current_packet_fingerprint:
raise Exception('missing current packet fingerprint for "{packet.name}"')
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
if signature_type == "KeyRevocation" and certificate_fingerprint.endswith(issuer):
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
direct_revocations[issuer].append(packet)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
elif signature_type in ["DirectKey", "GenericCertification"]:
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
direct_sigs[issuer].append(packet)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
else:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
raise Exception(f"unknown signature type: {signature_type}")
elif current_packet_mode == "uid":
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
if not current_packet_uid:
raise Exception('missing current packet uid for "{packet.name}"')
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
if signature_type == "CertificationRevocation":
fix(keyringctl): prioritize latest certification per issuer When importing a non reduced keyring the certifications were not deterministic for keys that have multiple certifications per issuer. This was for example the case for self certifications to extend the expiry time. Before this commit a random certification could remain the final one which would lead to a non up to date keyring and a potentially expired key.
2021-10-23 19:16:25 -05:00
revocations[current_packet_uid][issuer].append(packet)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
elif signature_type.endswith("Certification"):
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
if fingerprint_filter is not None and any([fp.endswith(issuer) for fp in fingerprint_filter]):
debug(f"The certification by issuer {issuer} is appended as it is found in the filter.")
fix(keyringctl): prioritize latest certification per issuer When importing a non reduced keyring the certifications were not deterministic for keys that have multiple certifications per issuer. This was for example the case for self certifications to extend the expiry time. Before this commit a random certification could remain the final one which would lead to a non up to date keyring and a potentially expired key.
2021-10-23 19:16:25 -05:00
certifications[current_packet_uid][issuer].append(packet)
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
else:
debug(f"The certification by issuer {issuer} is not appended because it is not in the filter")
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
else:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
raise Exception(f"unknown signature type: {signature_type}")
elif current_packet_mode == "subkey":
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
if not current_packet_fingerprint:
raise Exception('missing current packet fingerprint for "{packet.name}"')
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
if signature_type == "SubkeyBinding":
fix(keyringctl): prioritize latest certification per issuer When importing a non reduced keyring the certifications were not deterministic for keys that have multiple certifications per issuer. This was for example the case for self certifications to extend the expiry time. Before this commit a random certification could remain the final one which would lead to a non up to date keyring and a potentially expired key.
2021-10-23 19:16:25 -05:00
subkey_bindings[current_packet_fingerprint].append(packet)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
elif signature_type == "SubkeyRevocation":
fix(keyringctl): prioritize latest certification per issuer When importing a non reduced keyring the certifications were not deterministic for keys that have multiple certifications per issuer. This was for example the case for self certifications to extend the expiry time. Before this commit a random certification could remain the final one which would lead to a non up to date keyring and a potentially expired key.
2021-10-23 19:16:25 -05:00
subkey_revocations[certificate_fingerprint].append(packet)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
else:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
raise Exception(f"unknown signature type: {signature_type}")
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
else:
raise Exception(f'unknown signature root for "{packet.name}"')
else:
raise Exception(f'unknown packet type "{packet.name}"')
if not certificate_fingerprint:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
raise Exception("missing certificate fingerprint")
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
if not pubkey:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
raise Exception("missing certificate public-key")
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
chore(keyringctl): apply black formatter
2021-10-19 14:11:37 -05:00
name_override = (
name_override
or derive_username_from_fingerprint(keyring_dir=keyring_dir, certificate_fingerprint=certificate_fingerprint)
or Username(certificate.stem)
)
feature(keyringctl): avoid splitting a certificate multiple times Move the name cascade to derive the username into the `convert_certificate` function which allows to use the certificate_fingerprint directly instead of trying to find it by splitting the certificate one more time before converting.
2021-10-19 12:10:51 -05:00
user_dir = working_dir / name_override
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
key_dir = user_dir / certificate_fingerprint
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
key_dir.mkdir(parents=True, exist_ok=True)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
persist_public_key(
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
certificate_fingerprint=certificate_fingerprint,
pubkey=pubkey,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir=key_dir,
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
)
feature(keyringctl): avoid storing pubkey and uids in certifications We do not need to duplicates packages in certifications and revocations. Store the packets separated from their parent as those are already persisted.
2021-10-23 08:49:11 -05:00
persist_direct_key_certifications(
direct_key_certifications=direct_sigs,
key_dir=key_dir,
)
persist_direct_key_revocations(
direct_key_revocations=direct_revocations,
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
key_dir=key_dir,
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
)
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
persist_subkeys(
key_dir=key_dir,
subkeys=subkeys,
fix(keyringctl): deterministic assembling order with single packet files Fix the assembling of a certificate by joining the packets in the correct order and splitting combined files into individual single packets per file.
2021-10-23 15:08:04 -05:00
)
persist_subkey_bindings(
key_dir=key_dir,
subkey_bindings=subkey_bindings,
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
)
persist_subkey_revocations(
key_dir=key_dir,
subkey_revocations=subkey_revocations,
)
feature(keyringctl): avoid storing pubkey and uids in certifications We do not need to duplicates packages in certifications and revocations. Store the packets separated from their parent as those are already persisted.
2021-10-23 08:49:11 -05:00
persist_uids(
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir=key_dir,
feature(keyringctl): avoid storing pubkey and uids in certifications We do not need to duplicates packages in certifications and revocations. Store the packets separated from their parent as those are already persisted.
2021-10-23 08:49:11 -05:00
uids=uids,
keyringctl: Add handling of KeyRevocations keyringctl: Change `persist_direct_sigs()` to track a sig_type parameter in its signature so that the output directory of the direct signatures can be altered. Change `convert_certificate()` to set a `direct_revocations` variable, that is used to track KeyRevocations for root keys. Extend the logic to make use of `add_packet_to_direct_sigs()` to set a list of KeyRevocations for a given root key. Eventually call `persist_direct_sigs()` with `direct_revocations` and a custom `sig_type` to persist the revocation certificates.
2021-10-03 13:05:11 -05:00
)
feature(keyringctl): avoid storing pubkey and uids in certifications We do not need to duplicates packages in certifications and revocations. Store the packets separated from their parent as those are already persisted.
2021-10-23 08:49:11 -05:00
persist_uid_certifications(
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
certifications=certifications,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir=key_dir,
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
)
feature(keyringctl): avoid storing pubkey and uids in certifications We do not need to duplicates packages in certifications and revocations. Store the packets separated from their parent as those are already persisted.
2021-10-23 08:49:11 -05:00
persist_uid_revocations(
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
revocations=revocations,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir=key_dir,
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
)
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
return user_dir
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
def persist_public_key(
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
certificate_fingerprint: Fingerprint,
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
pubkey: Path,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir: Path,
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
) -> None:
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
"""Persist the Public-Key packet
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
certificate_fingerprint: The unique fingerprint of the public key
pubkey: The path to the public key of the root key
key_dir: The root directory below which the basic key material is persisted
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
packets: List[Path] = [pubkey]
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
output_file = key_dir / f"{certificate_fingerprint}.asc"
chore(keyringctl): uniformly use path builder via operator Instead of partially dealing with strings that contain slashes lets just use the path builder interface by using the operator for every sub path layer in a uniform way.
2021-10-12 17:09:58 -05:00
output_file.parent.mkdir(parents=True, exist_ok=True)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
debug(f"Writing file {output_file} from {[str(packet) for packet in packets]}")
fix(keyringctl): force overwrite packets when persisting When we import new packet data, always allow overwrites of the final packet files. This may happen when importing from multiple files that provide the same packets, which is fine as they should still yield to the same results.
2021-10-21 16:49:40 -05:00
packet_join(packets, output_file, force=True)
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
def persist_uids(
key_dir: Path,
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
uids: Dict[Uid, Path],
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
) -> None:
"""Persist the User IDs that belong to a PublicKey
fix(keyringctl): deterministic assembling order with single packet files Fix the assembling of a certificate by joining the packets in the correct order and splitting combined files into individual single packets per file.
2021-10-23 15:08:04 -05:00
The User ID material consists of a single User ID Packet.
chore(keyringctl): use singular folder names for all sub-folders
2021-10-12 16:57:20 -05:00
The files are written to a UID specific directory and file below key_dir/uid.
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
key_dir: The root directory below which the basic key material is persisted
uids: The User IDs of a Public-Key (the root key)
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
"""
fix(keyringctl): deterministic assembling order with single packet files Fix the assembling of a certificate by joining the packets in the correct order and splitting combined files into individual single packets per file.
2021-10-23 15:08:04 -05:00
for uid, uid_packet in uids.items():
output_file = key_dir / "uid" / uid / f"{uid}.asc"
chore(keyringctl): uniformly use path builder via operator Instead of partially dealing with strings that contain slashes lets just use the path builder interface by using the operator for every sub path layer in a uniform way.
2021-10-12 17:09:58 -05:00
output_file.parent.mkdir(parents=True, exist_ok=True)
fix(keyringctl): deterministic assembling order with single packet files Fix the assembling of a certificate by joining the packets in the correct order and splitting combined files into individual single packets per file.
2021-10-23 15:08:04 -05:00
debug(f"Writing file {output_file} from {uid_packet}")
packet_join(packets=[uid_packet], output=output_file, force=True)
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
def persist_subkeys(
key_dir: Path,
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
subkeys: Dict[Fingerprint, Path],
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
) -> None:
fix(keyringctl): deterministic assembling order with single packet files Fix the assembling of a certificate by joining the packets in the correct order and splitting combined files into individual single packets per file.
2021-10-23 15:08:04 -05:00
"""Persist all Public-Subkeys of a root key file to file(s)
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
key_dir: The root directory below which the basic key material is persisted
subkeys: The PublicSubkeys of a key
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
"""
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
for fingerprint, subkey in subkeys.items():
output_file = key_dir / "subkey" / fingerprint / f"{fingerprint}.asc"
output_file.parent.mkdir(parents=True, exist_ok=True)
fix(keyringctl): deterministic assembling order with single packet files Fix the assembling of a certificate by joining the packets in the correct order and splitting combined files into individual single packets per file.
2021-10-23 15:08:04 -05:00
debug(f"Writing file {output_file} from {str(subkey)}")
packet_join(packets=[subkey], output=output_file, force=True)
def persist_subkey_bindings(
key_dir: Path,
fix(keyringctl): prioritize latest certification per issuer When importing a non reduced keyring the certifications were not deterministic for keys that have multiple certifications per issuer. This was for example the case for self certifications to extend the expiry time. Before this commit a random certification could remain the final one which would lead to a non up to date keyring and a potentially expired key.
2021-10-23 19:16:25 -05:00
subkey_bindings: Dict[Fingerprint, List[Path]],
fix(keyringctl): deterministic assembling order with single packet files Fix the assembling of a certificate by joining the packets in the correct order and splitting combined files into individual single packets per file.
2021-10-23 15:08:04 -05:00
) -> None:
"""Persist all SubkeyBinding of a root key file to file(s)
Parameters
----------
key_dir: The root directory below which the basic key material is persisted
subkey_bindings: The SubkeyBinding signatures of a Public-Subkey
"""
fix(keyringctl): prioritize latest certification per issuer When importing a non reduced keyring the certifications were not deterministic for keys that have multiple certifications per issuer. This was for example the case for self certifications to extend the expiry time. Before this commit a random certification could remain the final one which would lead to a non up to date keyring and a potentially expired key.
2021-10-23 19:16:25 -05:00
for fingerprint, bindings in subkey_bindings.items():
subkey_binding = latest_certification(bindings)
fix(keyringctl): deterministic assembling order with single packet files Fix the assembling of a certificate by joining the packets in the correct order and splitting combined files into individual single packets per file.
2021-10-23 15:08:04 -05:00
issuer = packet_dump_field(subkey_binding, "Issuer")
output_file = key_dir / "subkey" / fingerprint / "certification" / f"{issuer}.asc"
output_file.parent.mkdir(parents=True, exist_ok=True)
debug(f"Writing file {output_file} from {str(subkey_binding)}")
packet_join(packets=[subkey_binding], output=output_file, force=True)
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
def persist_subkey_revocations(
key_dir: Path,
fix(keyringctl): prioritize latest certification per issuer When importing a non reduced keyring the certifications were not deterministic for keys that have multiple certifications per issuer. This was for example the case for self certifications to extend the expiry time. Before this commit a random certification could remain the final one which would lead to a non up to date keyring and a potentially expired key.
2021-10-23 19:16:25 -05:00
subkey_revocations: Dict[Fingerprint, List[Path]],
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
) -> None:
"""Persist the SubkeyRevocations of all Public-Subkeys of a root key to file(s)
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
key_dir: The root directory below which the basic key material is persisted
subkey_revocations: The SubkeyRevocations of PublicSubkeys of a key
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
"""
fix(keyringctl): prioritize latest certification per issuer When importing a non reduced keyring the certifications were not deterministic for keys that have multiple certifications per issuer. This was for example the case for self certifications to extend the expiry time. Before this commit a random certification could remain the final one which would lead to a non up to date keyring and a potentially expired key.
2021-10-23 19:16:25 -05:00
for fingerprint, revocations in subkey_revocations.items():
revocation = latest_certification(revocations)
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
issuer = packet_dump_field(revocation, "Issuer")
output_file = key_dir / "subkey" / fingerprint / "revocation" / f"{issuer}.asc"
output_file.parent.mkdir(parents=True, exist_ok=True)
debug(f"Writing file {output_file} from {revocation}")
fix(keyringctl): force overwrite packets when persisting When we import new packet data, always allow overwrites of the final packet files. This may happen when importing from multiple files that provide the same packets, which is fine as they should still yield to the same results.
2021-10-21 16:49:40 -05:00
packet_join(packets=[revocation], output=output_file, force=True)
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
feature(keyringctl): avoid storing pubkey and uids in certifications We do not need to duplicates packages in certifications and revocations. Store the packets separated from their parent as those are already persisted.
2021-10-23 08:49:11 -05:00
def persist_direct_key_certifications(
direct_key_certifications: Dict[Fingerprint, List[Path]],
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir: Path,
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
) -> None:
keyringctl: Persist direct signatures generically keyringctl: Rename `persist_direct_keys()` to `persist_direct_sigs()` as it is now not only handling the persistence of DirectKeys but also *Certifications directly on a root key (those without an explicit User ID). Add inline function `add_packet_to_direct_sigs()` to `convert_certificate()` to generically add direct signatures on a root key, grouped by issuer. Change `convert_certificate()` to add Certifications on a root key (without a specified User ID) to the list of direct_sigs, so that they are persisted alongside any existing DirectKeys. Remove breakpoints from `persist_certifications()` as they are no longer reached. The function is now solely used for Certifications on User IDs.
2021-10-03 12:24:49 -05:00
"""Persist the signatures directly on a root key (such as DirectKeys or *Certifications without a User ID) to
file(s)
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
Parameters
----------
feature(keyringctl): avoid storing pubkey and uids in certifications We do not need to duplicates packages in certifications and revocations. Store the packets separated from their parent as those are already persisted.
2021-10-23 08:49:11 -05:00
direct_key_certifications: The direct key certifications to write to file
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
key_dir: The root directory below which the Directkeys are persisted
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
"""
feature(keyringctl): avoid storing pubkey and uids in certifications We do not need to duplicates packages in certifications and revocations. Store the packets separated from their parent as those are already persisted.
2021-10-23 08:49:11 -05:00
for issuer, certifications in direct_key_certifications.items():
output_file = key_dir / "certification" / f"{issuer}.asc"
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
output_file.parent.mkdir(parents=True, exist_ok=True)
debug(f"Writing file {output_file} from {[str(cert) for cert in certifications]}")
feature(keyringctl): avoid storing pubkey and uids in certifications We do not need to duplicates packages in certifications and revocations. Store the packets separated from their parent as those are already persisted.
2021-10-23 08:49:11 -05:00
packet_join(packets=certifications, output=output_file, force=True)
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
feature(keyringctl): avoid storing pubkey and uids in certifications We do not need to duplicates packages in certifications and revocations. Store the packets separated from their parent as those are already persisted.
2021-10-23 08:49:11 -05:00
def persist_direct_key_revocations(
direct_key_revocations: Dict[Fingerprint, List[Path]],
key_dir: Path,
) -> None:
"""Persist the revocations directly on a root key (such as KeyRevocation) to file(s)
Parameters
----------
direct_key_revocations: The direct key revocations to write to file
key_dir: The root directory below which the Directkeys are persisted
"""
for issuer, certifications in direct_key_revocations.items():
output_file = key_dir / "revocation" / f"{issuer}.asc"
output_file.parent.mkdir(parents=True, exist_ok=True)
debug(f"Writing file {output_file} from {[str(cert) for cert in certifications]}")
packet_join(packets=certifications, output=output_file, force=True)
def persist_uid_certifications(
fix(keyringctl): prioritize latest certification per issuer When importing a non reduced keyring the certifications were not deterministic for keys that have multiple certifications per issuer. This was for example the case for self certifications to extend the expiry time. Before this commit a random certification could remain the final one which would lead to a non up to date keyring and a potentially expired key.
2021-10-23 19:16:25 -05:00
certifications: Dict[Uid, Dict[Fingerprint, List[Path]]],
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir: Path,
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
) -> None:
"""Persist the certifications of a root key to file(s)
The certifications include all CasualCertifications, GenericCertifications, PersonaCertifications and
PositiveCertifications for all User IDs of the given root key.
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
All certifications are persisted in per User ID certification directories below key_dir.
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
certifications: The certifications to write to file
key_dir: The root directory below which certifications are persisted
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
fix(keyringctl): prioritize latest certification per issuer When importing a non reduced keyring the certifications were not deterministic for keys that have multiple certifications per issuer. This was for example the case for self certifications to extend the expiry time. Before this commit a random certification could remain the final one which would lead to a non up to date keyring and a potentially expired key.
2021-10-23 19:16:25 -05:00
for uid, uid_certifications in certifications.items():
for issuer, issuer_certifications in uid_certifications.items():
certification_dir = key_dir / "uid" / uid / "certification"
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
certification_dir.mkdir(parents=True, exist_ok=True)
fix(keyringctl): prioritize latest certification per issuer When importing a non reduced keyring the certifications were not deterministic for keys that have multiple certifications per issuer. This was for example the case for self certifications to extend the expiry time. Before this commit a random certification could remain the final one which would lead to a non up to date keyring and a potentially expired key.
2021-10-23 19:16:25 -05:00
certification = latest_certification(issuer_certifications)
feature(keyringctl): avoid storing pubkey and uids in certifications We do not need to duplicates packages in certifications and revocations. Store the packets separated from their parent as those are already persisted.
2021-10-23 08:49:11 -05:00
output_file = certification_dir / f"{issuer}.asc"
debug(f"Writing file {output_file} from {certification}")
packet_join(packets=[certification], output=output_file, force=True)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
feature(keyringctl): avoid storing pubkey and uids in certifications We do not need to duplicates packages in certifications and revocations. Store the packets separated from their parent as those are already persisted.
2021-10-23 08:49:11 -05:00
def persist_uid_revocations(
fix(keyringctl): prioritize latest certification per issuer When importing a non reduced keyring the certifications were not deterministic for keys that have multiple certifications per issuer. This was for example the case for self certifications to extend the expiry time. Before this commit a random certification could remain the final one which would lead to a non up to date keyring and a potentially expired key.
2021-10-23 19:16:25 -05:00
revocations: Dict[Uid, Dict[Fingerprint, List[Path]]],
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir: Path,
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
) -> None:
"""Persist the revocations of a root key to file(s)
The revocations include all CertificationRevocations for all User IDs of the given root key.
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
All revocations are persisted in per User ID 'revocation' directories below key_dir.
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
revocations: The revocations to write to file
key_dir: The root directory below which revocations will be persisted
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
"""
fix(keyringctl): prioritize latest certification per issuer When importing a non reduced keyring the certifications were not deterministic for keys that have multiple certifications per issuer. This was for example the case for self certifications to extend the expiry time. Before this commit a random certification could remain the final one which would lead to a non up to date keyring and a potentially expired key.
2021-10-23 19:16:25 -05:00
for uid, uid_revocations in revocations.items():
for issuer, issuer_revocations in uid_revocations.items():
revocation_dir = key_dir / "uid" / uid / "revocation"
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
revocation_dir.mkdir(parents=True, exist_ok=True)
fix(keyringctl): prioritize latest certification per issuer When importing a non reduced keyring the certifications were not deterministic for keys that have multiple certifications per issuer. This was for example the case for self certifications to extend the expiry time. Before this commit a random certification could remain the final one which would lead to a non up to date keyring and a potentially expired key.
2021-10-23 19:16:25 -05:00
revocation = latest_certification(issuer_revocations)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
output_file = revocation_dir / f"{issuer}.asc"
debug(f"Writing file {output_file} from {revocation}")
feature(keyringctl): avoid storing pubkey and uids in certifications We do not need to duplicates packages in certifications and revocations. Store the packets separated from their parent as those are already persisted.
2021-10-23 08:49:11 -05:00
packet_join(packets=[revocation], output=output_file, force=True)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
def packet_dump(packet: Path) -> str:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Dump a PGP packet to string
The `sq packet dump` command is used to retrieve a dump of information from a PGP packet
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
packet: The path to the PGP packet to retrieve the value from
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
Returns
-------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
The contents of the packet dump
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
return system(["sq", "packet", "dump", str(packet)])
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
def packet_dump_field(packet: Path, field: str) -> str:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Retrieve the value of a field from a PGP packet
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
packet: The path to the PGP packet to retrieve the value from
field: The name of the field
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
Raises
------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
Exception: If the field is not found in the PGP packet
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
Returns
-------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
The value of the field found in packet
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
dump = packet_dump(packet)
lines = [line.strip() for line in dump.splitlines()]
fix(keyringctl): prioritize latest certification per issuer When importing a non reduced keyring the certifications were not deterministic for keys that have multiple certifications per issuer. This was for example the case for self certifications to extend the expiry time. Before this commit a random certification could remain the final one which would lead to a non up to date keyring and a potentially expired key.
2021-10-23 19:16:25 -05:00
lines = list(filter(lambda line: line.strip().startswith(f"{field}: "), lines))
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
if not lines:
raise Exception(f'Packet has no field "{field}"')
fix(keyringctl): prioritize latest certification per issuer When importing a non reduced keyring the certifications were not deterministic for keys that have multiple certifications per issuer. This was for example the case for self certifications to extend the expiry time. Before this commit a random certification could remain the final one which would lead to a non up to date keyring and a potentially expired key.
2021-10-23 19:16:25 -05:00
return lines[0].split(sep=": ", maxsplit=1)[1]
def packet_signature_creation_time(packet: Path) -> datetime:
"""Retrieve the signature creation time field as datetime
Parameters
----------
packet: The path to the PGP packet to retrieve the value from
Returns
-------
The signature creation time as datetime
"""
return datetime.strptime(packet_dump_field(packet, "Signature creation time"), "%Y-%m-%d %H:%M:%S %Z")
def latest_certification(certifications: Iterable[Path]) -> Path:
"""Returns the latest certification based on the signature creation time from a list of packets.
Parameters
----------
certifications: List of certification from which to choose the latest from
Returns
-------
The latest certification from a list of packets
"""
return reduce(
lambda a, b: a if packet_signature_creation_time(a) > packet_signature_creation_time(b) else b,
certifications,
)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
fix(keyringctl): preserve keyring split filenames in separated dirs This aids initial imports of keyrings that contain multiple certificates by allowing keyring_split to enforce preserving the filenames. This is achieved by moving each split keyring into unique sub directories where the original input filename remains unique.
2021-10-21 17:58:52 -05:00
def keyring_split(working_dir: Path, keyring: Path, preserve_filename: bool = False) -> Iterable[Path]:
feature(keyringctl): use sq to split a keyring into individual certificates Lets use sequoia as well to split an input into individual certificates instead of creating a custom made function for this job. Pass down the name of the original input file to `convert_certificate` in case no override has been defined.
2021-10-12 12:20:33 -05:00
"""Split a file containing a PGP keyring into separate certificate files
keyringctl: Deal with multi-certificate per user files keyringctl: Add `sanitize_certificate_file()` to potentially split per-user input files that contain more than one certificate. Change `packet_split()` to add documentation and rename the key parameter to certificate, as it is more generic. Change `convert_certificate()` to use named parameters when calling `packet_split()`. Change `convert()` to call `convert_certificate()` on a list of sanitized certificates (generated using `sanitized_certificate_file()`) to be able to deal with multi-certificate files per user.
2021-10-04 15:12:33 -05:00
feature(keyringctl): keep filename if keyring split yields one keyring Instead of always returning an artificial name try to preserve the keyring filename if the split only yields a single certificate.
2021-10-19 19:16:10 -05:00
The original keyring filename is preserved if the split only yields a single certificate.
fix(keyringctl): preserve keyring split filenames in separated dirs This aids initial imports of keyrings that contain multiple certificates by allowing keyring_split to enforce preserving the filenames. This is achieved by moving each split keyring into unique sub directories where the original input filename remains unique.
2021-10-21 17:58:52 -05:00
If preserve_filename is True, all keyrings are placed into separate directories while preserving
the filename.
feature(keyringctl): keep filename if keyring split yields one keyring Instead of always returning an artificial name try to preserve the keyring filename if the split only yields a single certificate.
2021-10-19 19:16:10 -05:00
The file is split using sq.
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
keyringctl: Deal with multi-certificate per user files keyringctl: Add `sanitize_certificate_file()` to potentially split per-user input files that contain more than one certificate. Change `packet_split()` to add documentation and rename the key parameter to certificate, as it is more generic. Change `convert_certificate()` to use named parameters when calling `packet_split()`. Change `convert()` to call `convert_certificate()` on a list of sanitized certificates (generated using `sanitized_certificate_file()`) to be able to deal with multi-certificate files per user.
2021-10-04 15:12:33 -05:00
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
working_dir: The path of the working directory below which to create the output files
keyring: The path of a file containing a PGP keyring
preserve_filename: If True, all keyrings are placed into separate directories while preserving the filename
keyringctl: Deal with multi-certificate per user files keyringctl: Add `sanitize_certificate_file()` to potentially split per-user input files that contain more than one certificate. Change `packet_split()` to add documentation and rename the key parameter to certificate, as it is more generic. Change `convert_certificate()` to use named parameters when calling `packet_split()`. Change `convert()` to call `convert_certificate()` on a list of sanitized certificates (generated using `sanitized_certificate_file()`) to be able to deal with multi-certificate files per user.
2021-10-04 15:12:33 -05:00
Returns
-------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
An iterable over the naturally sorted list of certificate files derived from a keyring
keyringctl: Deal with multi-certificate per user files keyringctl: Add `sanitize_certificate_file()` to potentially split per-user input files that contain more than one certificate. Change `packet_split()` to add documentation and rename the key parameter to certificate, as it is more generic. Change `convert_certificate()` to use named parameters when calling `packet_split()`. Change `convert()` to call `convert_certificate()` on a list of sanitized certificates (generated using `sanitized_certificate_file()`) to be able to deal with multi-certificate files per user.
2021-10-04 15:12:33 -05:00
"""
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
keyring_dir = Path(mkdtemp(dir=working_dir, prefix="keyring-")).absolute()
feature(keyringctl): use sq to split a keyring into individual certificates Lets use sequoia as well to split an input into individual certificates instead of creating a custom made function for this job. Pass down the name of the original input file to `convert_certificate` in case no override has been defined.
2021-10-12 12:20:33 -05:00
with cwd(keyring_dir):
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
system(["sq", "keyring", "split", "--prefix", "", str(keyring)])
feature(keyringctl): keep filename if keyring split yields one keyring Instead of always returning an artificial name try to preserve the keyring filename if the split only yields a single certificate.
2021-10-19 19:16:10 -05:00
keyrings: List[Path] = list(natural_sort_path(keyring_dir.iterdir()))
fix(keyringctl): preserve keyring split filenames in separated dirs This aids initial imports of keyrings that contain multiple certificates by allowing keyring_split to enforce preserving the filenames. This is achieved by moving each split keyring into unique sub directories where the original input filename remains unique.
2021-10-21 17:58:52 -05:00
if 1 == len(keyrings) or preserve_filename:
for index, key in enumerate(keyrings):
keyring_sub_dir = Path(mkdtemp(dir=keyring_dir, prefix=f"{keyring.name}-")).absolute()
keyrings[index] = key.rename(keyring_sub_dir / keyring.name)
feature(keyringctl): keep filename if keyring split yields one keyring Instead of always returning an artificial name try to preserve the keyring filename if the split only yields a single certificate.
2021-10-19 19:16:10 -05:00
return keyrings
keyringctl: Deal with multi-certificate per user files keyringctl: Add `sanitize_certificate_file()` to potentially split per-user input files that contain more than one certificate. Change `packet_split()` to add documentation and rename the key parameter to certificate, as it is more generic. Change `convert_certificate()` to use named parameters when calling `packet_split()`. Change `convert()` to call `convert_certificate()` on a list of sanitized certificates (generated using `sanitized_certificate_file()`) to be able to deal with multi-certificate files per user.
2021-10-04 15:12:33 -05:00
feature(keyringctl): add force parameter to keyring_merge
2021-10-21 14:03:02 -05:00
def keyring_merge(certificates: List[Path], output: Optional[Path] = None, force: bool = False) -> str:
feature(keyringctl): add dedicated keyring_merge function
2021-10-21 13:34:07 -05:00
"""Merge multiple certificates into a keyring
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
certificates: List of paths to certificates to merge into a keyring
output: Path to a file which the keyring is written, return the result instead if None
force: Whether to force overwriting existing files (defaults to False)
feature(keyringctl): add dedicated keyring_merge function
2021-10-21 13:34:07 -05:00
Returns
-------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
The result if no output file has been used
feature(keyringctl): add dedicated keyring_merge function
2021-10-21 13:34:07 -05:00
"""
cmd = ["sq", "keyring", "merge"]
feature(keyringctl): add force parameter to keyring_merge
2021-10-21 14:03:02 -05:00
if force:
cmd.insert(1, "--force")
feature(keyringctl): add dedicated keyring_merge function
2021-10-21 13:34:07 -05:00
if output:
cmd += ["--output", str(output)]
cmd += [str(cert) for cert in sorted(certificates)]
chore(keyringctl): throw exception instead of exit on failed system calls
2021-10-21 14:05:03 -05:00
return system(cmd)
feature(keyringctl): add dedicated keyring_merge function
2021-10-21 13:34:07 -05:00
keyringctl: Deal with multi-certificate per user files keyringctl: Add `sanitize_certificate_file()` to potentially split per-user input files that contain more than one certificate. Change `packet_split()` to add documentation and rename the key parameter to certificate, as it is more generic. Change `convert_certificate()` to use named parameters when calling `packet_split()`. Change `convert()` to call `convert_certificate()` on a list of sanitized certificates (generated using `sanitized_certificate_file()`) to be able to deal with multi-certificate files per user.
2021-10-04 15:12:33 -05:00
def packet_split(working_dir: Path, certificate: Path) -> Iterable[Path]:
"""Split a file containing a PGP certificate into separate packet files
The files are split using sq
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
working_dir: The path of the working directory below which to create the output files
certificate: The absolute path of a file containing one PGP certificate
keyringctl: Deal with multi-certificate per user files keyringctl: Add `sanitize_certificate_file()` to potentially split per-user input files that contain more than one certificate. Change `packet_split()` to add documentation and rename the key parameter to certificate, as it is more generic. Change `convert_certificate()` to use named parameters when calling `packet_split()`. Change `convert()` to call `convert_certificate()` on a list of sanitized certificates (generated using `sanitized_certificate_file()`) to be able to deal with multi-certificate files per user.
2021-10-04 15:12:33 -05:00
Returns
-------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
An iterable over the naturally sorted list of packet files derived from certificate
keyringctl: Deal with multi-certificate per user files keyringctl: Add `sanitize_certificate_file()` to potentially split per-user input files that contain more than one certificate. Change `packet_split()` to add documentation and rename the key parameter to certificate, as it is more generic. Change `convert_certificate()` to use named parameters when calling `packet_split()`. Change `convert()` to call `convert_certificate()` on a list of sanitized certificates (generated using `sanitized_certificate_file()`) to be able to deal with multi-certificate files per user.
2021-10-04 15:12:33 -05:00
"""
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
packet_dir = Path(mkdtemp(dir=working_dir, prefix="packet-")).absolute()
keyringctl: Deal with multi-certificate per user files keyringctl: Add `sanitize_certificate_file()` to potentially split per-user input files that contain more than one certificate. Change `packet_split()` to add documentation and rename the key parameter to certificate, as it is more generic. Change `convert_certificate()` to use named parameters when calling `packet_split()`. Change `convert()` to call `convert_certificate()` on a list of sanitized certificates (generated using `sanitized_certificate_file()`) to be able to deal with multi-certificate files per user.
2021-10-04 15:12:33 -05:00
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
with cwd(packet_dir):
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
system(["sq", "packet", "split", "--prefix", "", str(certificate)])
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
return natural_sort_path(packet_dir.iterdir())
feature(keyringctl): improve packet_join to optionally return the result
2021-10-21 13:19:33 -05:00
def packet_join(packets: List[Path], output: Optional[Path] = None, force: bool = False) -> str:
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
"""Join PGP packet data in files to a single output file
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
packets: A list of paths to files that contain PGP packet data
output: Path to a file to which all PGP packet data is written, return the result instead if None
force: Whether to force overwriting existing files (defaults to False)
feature(keyringctl): improve packet_join to optionally return the result
2021-10-21 13:19:33 -05:00
Returns
-------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
The result if no output file has been used
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
"""
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
cmd = ["sq", "packet", "join"]
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
if force:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
cmd.insert(1, "--force")
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
packets_str = list(map(lambda path: str(path), packets))
cmd.extend(packets_str)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
cmd.extend(["--output", str(output)])
chore(keyringctl): throw exception instead of exit on failed system calls
2021-10-21 14:05:03 -05:00
return system(cmd)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
def inspect(
packet: Path, certifications: bool = True, fingerprints: Optional[Dict[Fingerprint, Username]] = None
) -> str:
feature(keyringctl): add inspect command to pretty print certificates This command prints a new and pretty representation of the certificate data to visualize the keyring and its signatures.
2021-10-21 14:51:02 -05:00
"""Inspect PGP packet data and return the result
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
packet: Path to a file that contain PGP data
certifications: Whether to print third-party certifications
fingerprints: Optional dict of fingerprints to usernames to enrich the output with
feature(keyringctl): add inspect command to pretty print certificates This command prints a new and pretty representation of the certificate data to visualize the keyring and its signatures.
2021-10-21 14:51:02 -05:00
Returns
-------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
The result of the inspection
feature(keyringctl): add inspect command to pretty print certificates This command prints a new and pretty representation of the certificate data to visualize the keyring and its signatures.
2021-10-21 14:51:02 -05:00
"""
cmd = ["sq", "inspect"]
if certifications:
cmd.append("--certifications")
cmd.append(str(packet))
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
result: str = system(cmd)
if fingerprints:
for fingerprint, username in fingerprints.items():
result = sub(f"{fingerprint}", f"{fingerprint} {username}", result)
result = sub(f" {fingerprint[24:]}", f" {fingerprint[24:]} {username}", result)
return result
feature(keyringctl): add inspect command to pretty print certificates This command prints a new and pretty representation of the certificate data to visualize the keyring and its signatures.
2021-10-21 14:51:02 -05:00
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
def simplify_user_id(user_id: Uid) -> Uid:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Simplify the User ID string to contain more filesystem friendly characters
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
user_id: A User ID string (e.g. 'Foobar McFooface <foobar@foo.face>')
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
Returns
-------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
The simplified representation of user_id
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
user_id_str: str = user_id.replace("@", "_at_")
user_id_str = sub("[<>]", "", user_id_str)
user_id_str = sub("[" + escape(r" !@#$%^&*()_-+=[]{}\|;:,.<>/?") + "]", "_", user_id_str)
return Uid(user_id_str)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
feature(keyringctl): introduce Username type instead of plain str
2021-10-19 14:03:53 -05:00
def derive_username_from_fingerprint(keyring_dir: Path, certificate_fingerprint: Fingerprint) -> Optional[Username]:
feature(keyringctl): avoid splitting a certificate multiple times Move the name cascade to derive the username into the `convert_certificate` function which allows to use the certificate_fingerprint directly instead of trying to find it by splitting the certificate one more time before converting.
2021-10-19 12:10:51 -05:00
"""Attempt to derive the username of a public key fingerprint from a keyring directory
keyringctl: Derive username from target when importing existing key keyringctl: Add `derive_user_from_target()` to derive the username from an existing public key in the target directory when importing (updates to) an already known key. Change `convert()` to either use a custom name override (if provided), a username derived from target dir (if existing) or the file name of the to be imported file as username.
2021-10-17 05:58:19 -05:00
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
keyring_dir: The directory in which to look up a username
certificate_fingerprint: The public key fingerprint to derive the username from
keyringctl: Derive username from target when importing existing key keyringctl: Add `derive_user_from_target()` to derive the username from an existing public key in the target directory when importing (updates to) an already known key. Change `convert()` to either use a custom name override (if provided), a username derived from target dir (if existing) or the file name of the to be imported file as username.
2021-10-17 05:58:19 -05:00
Raises
------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
Exception: If more than one username is found (a public key can only belong to one individual)
keyringctl: Derive username from target when importing existing key keyringctl: Add `derive_user_from_target()` to derive the username from an existing public key in the target directory when importing (updates to) an already known key. Change `convert()` to either use a custom name override (if provided), a username derived from target dir (if existing) or the file name of the to be imported file as username.
2021-10-17 05:58:19 -05:00
Returns
-------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
A string representing the username a public key certificate belongs to, None otherwise
keyringctl: Derive username from target when importing existing key keyringctl: Add `derive_user_from_target()` to derive the username from an existing public key in the target directory when importing (updates to) an already known key. Change `convert()` to either use a custom name override (if provided), a username derived from target dir (if existing) or the file name of the to be imported file as username.
2021-10-17 05:58:19 -05:00
"""
feature(keyringctl): derive username from short key id fingerprints Allow short key id fingerprints to be used with the username derive function by adding a glob in front of the fingerprint component.
2021-10-19 12:12:48 -05:00
matches = list(keyring_dir.glob(f"*/*{certificate_fingerprint}"))
keyringctl: Derive username from target when importing existing key keyringctl: Add `derive_user_from_target()` to derive the username from an existing public key in the target directory when importing (updates to) an already known key. Change `convert()` to either use a custom name override (if provided), a username derived from target dir (if existing) or the file name of the to be imported file as username.
2021-10-17 05:58:19 -05:00
if len(matches) > 1:
raise Exception(
chore(keyringctl): apply black formatter
2021-10-19 14:11:37 -05:00
f"More than one username found in {keyring_dir} when probing for fingerprint '{certificate_fingerprint}': "
f"{matches}"
keyringctl: Derive username from target when importing existing key keyringctl: Add `derive_user_from_target()` to derive the username from an existing public key in the target directory when importing (updates to) an already known key. Change `convert()` to either use a custom name override (if provided), a username derived from target dir (if existing) or the file name of the to be imported file as username.
2021-10-17 05:58:19 -05:00
)
feature(keyringctl): avoid splitting a certificate multiple times Move the name cascade to derive the username into the `convert_certificate` function which allows to use the certificate_fingerprint directly instead of trying to find it by splitting the certificate one more time before converting.
2021-10-19 12:10:51 -05:00
elif not matches:
debug(f"Can not derive username from target directory for fingerprint {certificate_fingerprint}")
keyringctl: Derive username from target when importing existing key keyringctl: Add `derive_user_from_target()` to derive the username from an existing public key in the target directory when importing (updates to) an already known key. Change `convert()` to either use a custom name override (if provided), a username derived from target dir (if existing) or the file name of the to be imported file as username.
2021-10-17 05:58:19 -05:00
return None
else:
username = matches[0].parent.stem
chore(keyringctl): apply black formatter
2021-10-19 14:11:37 -05:00
debug(
f"Successfully derived username '{username}' from target directory for fingerprint "
f"{certificate_fingerprint}"
)
feature(keyringctl): introduce Username type instead of plain str
2021-10-19 14:03:53 -05:00
return Username(username)
keyringctl: Derive username from target when importing existing key keyringctl: Add `derive_user_from_target()` to derive the username from an existing public key in the target directory when importing (updates to) an already known key. Change `convert()` to either use a custom name override (if provided), a username derived from target dir (if existing) or the file name of the to be imported file as username.
2021-10-17 05:58:19 -05:00
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
def convert(
working_dir: Path,
chore(keyringctl): simplify convert usage by moving fingerprint filter
2021-10-22 14:34:53 -05:00
keyring_root: Path,
feature(keyringctl): support importing multiple paths Lets pass in a list of path's and reduce them to one set of path iterables. This allows us to specify multiple source files/directories
2021-10-20 13:15:42 -05:00
source: Iterable[Path],
keyringctl: Copy files instead of moving them keyringctl: Change `__main__` to create the `target_dir` before calling any further function that relies on it. Change `convert()` to require the `target_dir` to be not None and to create all username based target directories before using `shutil.copytree()` to copy all sources to their respective target directories when iterating over the paths to persist. This has the upside, that updates to a target directory structure can be done on the fly (overwriting existing data), which is not possible with `shutil.move()`.
2021-10-04 12:25:24 -05:00
target_dir: Path,
feature(keyringctl): introduce Username type instead of plain str
2021-10-19 14:03:53 -05:00
name_override: Optional[Username] = None,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
) -> Path:
feature(keyringctl): use sq to split a keyring into individual certificates Lets use sequoia as well to split an input into individual certificates instead of creating a custom made function for this job. Pass down the name of the original input file to `convert_certificate` in case no override has been defined.
2021-10-12 12:20:33 -05:00
"""Convert a path containing PGP certificate material to a decomposed directory structure
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
feature(keyringctl): use sq to split a keyring into individual certificates Lets use sequoia as well to split an input into individual certificates instead of creating a custom made function for this job. Pass down the name of the original input file to `convert_certificate` in case no override has been defined.
2021-10-12 12:20:33 -05:00
Any input is first split by `keyring_split()` into individual certificates.
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
working_dir: A directory to use for temporary files
keyring_root: The keyring root directory to look up accepted fingerprints for certifications
source: A path to a file or directory to decompose
target_dir: A directory path to write the new directory structure to
name_override: An optional username override for the call to `convert_certificate()`
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
Returns
-------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
The directory that contains the resulting directory structure (target_dir)
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
directories: List[Path] = []
feature(keyringctl): support importing multiple paths Lets pass in a list of path's and reduce them to one set of path iterables. This allows us to specify multiple source files/directories
2021-10-20 13:15:42 -05:00
keys: Iterable[Path] = set(chain.from_iterable(map(lambda s: s.iterdir() if s.is_dir() else [s], source)))
chore(keyringctl): deduplicate iteration and split code in convert()
2021-10-12 12:42:22 -05:00
chore(keyringctl): simplify convert usage by moving fingerprint filter
2021-10-22 14:34:53 -05:00
fingerprint_filter = set(
get_fingerprints(
working_dir=working_dir,
sources=source,
paths=[keyring_root],
).keys()
)
chore(keyringctl): deduplicate iteration and split code in convert()
2021-10-12 12:42:22 -05:00
for key in keys:
fix(keyringctl): preserve keyring split filenames in separated dirs This aids initial imports of keyrings that contain multiple certificates by allowing keyring_split to enforce preserving the filenames. This is achieved by moving each split keyring into unique sub directories where the original input filename remains unique.
2021-10-21 17:58:52 -05:00
for cert in keyring_split(working_dir=working_dir, keyring=key, preserve_filename=True):
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
directories.append(
convert_certificate(
working_dir=working_dir,
certificate=cert,
feature(keyringctl): avoid splitting a certificate multiple times Move the name cascade to derive the username into the `convert_certificate` function which allows to use the certificate_fingerprint directly instead of trying to find it by splitting the certificate one more time before converting.
2021-10-19 12:10:51 -05:00
keyring_dir=target_dir,
name_override=name_override,
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
fingerprint_filter=fingerprint_filter,
)
)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
for path in directories:
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
(target_dir / path.name).mkdir(parents=True, exist_ok=True)
keyringctl: Copy files instead of moving them keyringctl: Change `__main__` to create the `target_dir` before calling any further function that relies on it. Change `convert()` to require the `target_dir` to be not None and to create all username based target directories before using `shutil.copytree()` to copy all sources to their respective target directories when iterating over the paths to persist. This has the upside, that updates to a target directory structure can be done on the fly (overwriting existing data), which is not possible with `shutil.move()`.
2021-10-04 12:25:24 -05:00
copytree(src=path, dst=(target_dir / path.name), dirs_exist_ok=True)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
return target_dir
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
def get_trusted_and_revoked_certs(certs: List[Path]) -> Tuple[List[Fingerprint], List[Fingerprint]]:
"""Get the fingerprints of all trusted and all self revoked public keys in a directory
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
certs: The certificates to trust
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
Returns
-------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
A tuple with the first item containing the fingerprints of all public keys and the second item containing the
fingerprints of all self-revoked public keys
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
"""
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
all_certs: List[Fingerprint] = []
revoked_certs: List[Fingerprint] = []
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
# TODO: what about direct key revocations/signatures?
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
debug(f"Retrieving trusted and self-revoked certificates from {[str(cert_dir) for cert_dir in certs]}")
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
for cert_dir in sorted(get_cert_paths(certs)):
cert_fingerprint = Fingerprint(cert_dir.stem)
all_certs.append(cert_fingerprint)
for revocation_cert in cert_dir.glob("revocation/*.asc"):
if cert_fingerprint.endswith(revocation_cert.stem):
debug(f"Revoking {cert_fingerprint} due to self-revocation")
revoked_certs.append(cert_fingerprint)
trusted_keys = [cert for cert in all_certs if cert not in revoked_certs]
return trusted_keys, revoked_certs
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
def export_ownertrust(certs: List[Path], output: Path) -> Tuple[List[Fingerprint], List[Fingerprint]]:
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
"""Export ownertrust from a set of keys and return the trusted and revoked fingerprints
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
The output file format is compatible with `gpg --import-ownertrust` and lists the main fingerprint ID of all
non-revoked keys as fully trusted.
The exported file is used by pacman-key when importing a keyring (see
https://man.archlinux.org/man/pacman-key.8#PROVIDING_A_KEYRING_FOR_IMPORT).
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
certs: The certificates to trust
output: The file path to write to
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
"""
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
trusted_certs, revoked_certs = get_trusted_and_revoked_certs(certs=certs)
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
with open(file=output, mode="w") as trusted_certs_file:
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
for cert in sorted(set(trusted_certs)):
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
debug(f"Writing {cert} to {output}")
trusted_certs_file.write(f"{cert}:4:\n")
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
return trusted_certs, revoked_certs
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
def export_revoked(certs: List[Path], main_keys: List[Fingerprint], output: Path, min_revoker: int = 2) -> None:
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
"""Export the PGP revoked status from a set of keys
The output file contains the fingerprints of all self-revoked keys and all keys for which at least two revocations
by any main key exist.
The exported file is used by pacman-key when importing a keyring (see
https://man.archlinux.org/man/pacman-key.8#PROVIDING_A_KEYRING_FOR_IMPORT).
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
certs: A list of directories with keys to check for their revocation status
main_keys: A list of strings representing the fingerprints of (current and/or revoked) main keys
output: The file path to write to
min_revoker: The minimum amount of revocation certificates on a User ID from any main key to deem a public key as
revoked
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
"""
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
trusted_certs, revoked_certs = get_trusted_and_revoked_certs(certs=certs)
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
debug(f"Retrieving certificates revoked by main keys from {[str(cert_dir) for cert_dir in certs]}")
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
foreign_revocations: Dict[Fingerprint, Set[Fingerprint]] = defaultdict(set)
for cert_dir in sorted(get_cert_paths(certs)):
fingerprint = Fingerprint(cert_dir.name)
debug(f"Inspecting public key {fingerprint}")
for revocation_cert in cert_dir.glob("uid/*/revocation/*.asc"):
revocation_fingerprint = Fingerprint(revocation_cert.stem)
foreign_revocations[fingerprint].update(
[revocation_fingerprint for main_key in main_keys if main_key.endswith(revocation_fingerprint)]
)
# TODO: find a better (less naive) approach, as this would also match on public certificates,
# where some UIDs are signed and others are revoked
if len(foreign_revocations[fingerprint]) >= min_revoker:
debug(
chore(keyringctl): simplify convert usage by moving fingerprint filter
2021-10-22 14:34:53 -05:00
f"Revoking {cert_dir.name} due to {set(foreign_revocations[fingerprint])} " "being main key revocations"
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
)
revoked_certs.append(fingerprint)
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
with open(file=output, mode="w") as trusted_certs_file:
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
for cert in sorted(set(revoked_certs)):
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
debug(f"Writing {cert} to {output}")
trusted_certs_file.write(f"{cert}\n")
chore(keyringctl): simplify convert usage by moving fingerprint filter
2021-10-22 14:34:53 -05:00
def get_fingerprints_from_keyring_files(working_dir: Path, source: Iterable[Path]) -> Dict[Fingerprint, Username]:
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
"""Get all fingerprints of PGP public keys from import file(s)
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
working_dir: A directory to use for temporary files
source: The path to a source file or directory containing keyrings
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
Returns
-------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
A dict of all fingerprints and their usernames of PGP public keys below path
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
"""
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
fingerprints: Dict[Fingerprint, Username] = {}
feature(keyringctl): support importing multiple paths Lets pass in a list of path's and reduce them to one set of path iterables. This allows us to specify multiple source files/directories
2021-10-20 13:15:42 -05:00
keys: Iterable[Path] = set(chain.from_iterable(map(lambda s: s.iterdir() if s.is_dir() else [s], source)))
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
for key in keys:
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
for certificate in keyring_split(working_dir=working_dir, keyring=key, preserve_filename=True):
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
for packet in packet_split(working_dir=working_dir, certificate=certificate):
if packet.name.endswith("--PublicKey"):
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
fingerprints[Fingerprint(packet_dump_field(packet, "Fingerprint"))] = Username(certificate.stem)
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
debug(f"Fingerprints of PGP public keys in {source}: {fingerprints}")
return fingerprints
feature(keyringctl): enrich inspect to show explicit label for main keys This helps to identify if a certification issuer comes from a main key or not.
2021-10-23 10:35:42 -05:00
def get_fingerprints_from_certificate_directory(
paths: List[Path], prefix: str = "", postfix: str = ""
) -> Dict[Fingerprint, Username]:
chore(keyringctl): simplify convert usage by moving fingerprint filter
2021-10-22 14:34:53 -05:00
"""Get all fingerprints of PGP public keys from decomposed directory structures
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
paths: The path to a decomposed directory structure
feature(keyringctl): enrich inspect to show explicit label for main keys This helps to identify if a certification issuer comes from a main key or not.
2021-10-23 10:35:42 -05:00
prefix: Prefix to add to each username
postfix: Postfix to add to each username
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
Returns
-------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
A dict of all fingerprints and their usernames of PGP public keys below path
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
"""
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
fingerprints: Dict[Fingerprint, Username] = {}
chore(keyringctl): simplify convert usage by moving fingerprint filter
2021-10-22 14:34:53 -05:00
for cert in sorted(get_cert_paths(paths)):
feature(keyringctl): enrich inspect to show explicit label for main keys This helps to identify if a certification issuer comes from a main key or not.
2021-10-23 10:35:42 -05:00
fingerprints[Fingerprint(cert.name)] = Username(f"{prefix}{cert.parent.name}{postfix}")
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
chore(keyringctl): simplify convert usage by moving fingerprint filter
2021-10-22 14:34:53 -05:00
debug(f"Fingerprints of PGP public keys in {paths}: {fingerprints}")
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
return fingerprints
chore(keyringctl): simplify convert usage by moving fingerprint filter
2021-10-22 14:34:53 -05:00
def get_fingerprints(working_dir: Path, sources: Iterable[Path], paths: List[Path]) -> Dict[Fingerprint, Username]:
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
"""Get the fingerprints of PGP public keys from input paths and decomposed directory structures
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
working_dir: A directory to use for temporary files
sources: A list of directories or files from which to read PGP keyring information
paths: A list of paths that identify decomposed PGP data in directory structures
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
Returns
-------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
A dict of all fingerprints and their usernames of PGP public keys below path
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
"""
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
fingerprints: Dict[Fingerprint, Username] = {}
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
fingerprints.update(
chore(keyringctl): simplify convert usage by moving fingerprint filter
2021-10-22 14:34:53 -05:00
get_fingerprints_from_keyring_files(
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
working_dir=working_dir,
chore(keyringctl): simplify convert usage by moving fingerprint filter
2021-10-22 14:34:53 -05:00
source=sources,
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
)
)
chore(keyringctl): simplify convert usage by moving fingerprint filter
2021-10-22 14:34:53 -05:00
fingerprints.update(get_fingerprints_from_certificate_directory(paths=paths))
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
return fingerprints
fix(keyringctl): deterministic assembling order with single packet files Fix the assembling of a certificate by joining the packets in the correct order and splitting combined files into individual single packets per file.
2021-10-23 15:08:04 -05:00
def get_packets_from_path(path: Path) -> List[Path]:
"""Collects packets from one level by appending the root, certifications and revocations.
Parameters
----------
path: Filesystem path used to collect the packets from
Returns
-------
A list of packets ordered by root, certification, revocation
"""
if not path.exists():
return []
packets: List[Path] = []
packets += sorted(path.glob("*.asc"))
certifications = path / "certification"
if certifications.exists():
packets += sorted(certifications.glob("*.asc"))
revocations = path / "revocation"
if revocations.exists():
packets += sorted(revocations.glob("*.asc"))
return packets
def get_packets_from_listing(path: Path) -> List[Path]:
"""Collects packets from a listing of directories holding one level each by calling `get_get_packets_from_path`.
Parameters
----------
path: Filesystem path used as listing to collect the packets from
Returns
-------
A list of packets ordered by root, certification, revocation for each level
"""
if not path.exists():
return []
packets: List[Path] = []
for sub_path in sorted(path.iterdir()):
packets += get_packets_from_path(sub_path)
return packets
feature(keyringctl): use the export command purely to export keyrings This gives more control over the export command that may be useful to export a single packager to import it into gpg. This will also give more flexibility to chain this function to the future verify stage. By default the command exports the whole keyring directory.
2021-10-21 13:34:48 -05:00
def export(
working_dir: Path,
keyring_root: Path,
sources: Optional[List[Path]] = None,
output: Optional[Path] = None,
) -> str:
"""Export all provided PGP packet files to a single output file
If sources contains directories, any .asc files below them are considered.
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
working_dir: A directory to use for temporary files
keyring_root: The keyring root directory to look up username shorthand sources
feature(keyringctl): support passing fingerprint as source This helps make the CLI more useful by listing, exporting or inspecting a specific fingerprint.
2021-10-22 20:01:06 -05:00
sources: A list of username, fingerprint or directories from which to read PGP packet information
(defaults to `keyring_root`)
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
output: An output file that all PGP packet data is written to, return the result instead if None
feature(keyringctl): use the export command purely to export keyrings This gives more control over the export command that may be useful to export a single packager to import it into gpg. This will also give more flexibility to chain this function to the future verify stage. By default the command exports the whole keyring directory.
2021-10-21 13:34:48 -05:00
Returns
-------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
The result if no output file has been used
feature(keyringctl): use the export command purely to export keyrings This gives more control over the export command that may be useful to export a single packager to import it into gpg. This will also give more flexibility to chain this function to the future verify stage. By default the command exports the whole keyring directory.
2021-10-21 13:34:48 -05:00
"""
if not sources:
sources = [keyring_root]
chore(keyringctl): de-duplicate username/fprint transform code We duplicated resolving usernames and fingerprints to actual keyring paths in multiple places. De-duplicate the code by using dedicated functions to do this job.
2021-10-23 10:13:46 -05:00
# transform shorthand paths to actual keyring paths
transform_username_to_keyring_path(keyring_dir=keyring_root / "packager", paths=sources)
transform_fingerprint_to_keyring_path(keyring_root=keyring_root, paths=sources)
feature(keyringctl): use the export command purely to export keyrings This gives more control over the export command that may be useful to export a single packager to import it into gpg. This will also give more flexibility to chain this function to the future verify stage. By default the command exports the whole keyring directory.
2021-10-21 13:34:48 -05:00
temp_dir = Path(mkdtemp(dir=working_dir, prefix="arch-keyringctl-export-join-")).absolute()
chore(keyringctl): move cert depth first search to own function This way we can reuse the functionality which will allow to simplify a lot of places that have multiple layers of inflexible nested loops.
2021-10-22 13:17:50 -05:00
cert_paths: Set[Path] = get_cert_paths(sources)
certificates: List[Path] = []
feature(keyringctl): use the export command purely to export keyrings This gives more control over the export command that may be useful to export a single packager to import it into gpg. This will also give more flexibility to chain this function to the future verify stage. By default the command exports the whole keyring directory.
2021-10-21 13:34:48 -05:00
chore(keyringctl): move cert depth first search to own function This way we can reuse the functionality which will allow to simplify a lot of places that have multiple layers of inflexible nested loops.
2021-10-22 13:17:50 -05:00
for cert_dir in sorted(cert_paths):
fix(keyringctl): deterministic assembling order with single packet files Fix the assembling of a certificate by joining the packets in the correct order and splitting combined files into individual single packets per file.
2021-10-23 15:08:04 -05:00
packets: List[Path] = []
packets += get_packets_from_path(cert_dir)
packets += get_packets_from_listing(cert_dir / "subkey")
packets += get_packets_from_listing(cert_dir / "uid")
output_path = temp_dir / f"{cert_dir.name}.asc"
debug(f"Joining {cert_dir} in {output_path}")
feature(keyringctl): use the export command purely to export keyrings This gives more control over the export command that may be useful to export a single packager to import it into gpg. This will also give more flexibility to chain this function to the future verify stage. By default the command exports the whole keyring directory.
2021-10-21 13:34:48 -05:00
packet_join(
fix(keyringctl): deterministic assembling order with single packet files Fix the assembling of a certificate by joining the packets in the correct order and splitting combined files into individual single packets per file.
2021-10-23 15:08:04 -05:00
packets=packets,
output=output_path,
feature(keyringctl): use the export command purely to export keyrings This gives more control over the export command that may be useful to export a single packager to import it into gpg. This will also give more flexibility to chain this function to the future verify stage. By default the command exports the whole keyring directory.
2021-10-21 13:34:48 -05:00
force=True,
)
fix(keyringctl): deterministic assembling order with single packet files Fix the assembling of a certificate by joining the packets in the correct order and splitting combined files into individual single packets per file.
2021-10-23 15:08:04 -05:00
certificates.append(output_path)
feature(keyringctl): use the export command purely to export keyrings This gives more control over the export command that may be useful to export a single packager to import it into gpg. This will also give more flexibility to chain this function to the future verify stage. By default the command exports the whole keyring directory.
2021-10-21 13:34:48 -05:00
feature(keyringctl): use build command to create final artifacts This allows an easy to use cli which invokes the export function to get the keyring and uses the ownertrust and revoke functions to write all artifacts into a target directory.
2021-10-21 14:04:16 -05:00
return keyring_merge(certificates, output, force=True)
feature(keyringctl): use the export command purely to export keyrings This gives more control over the export command that may be useful to export a single packager to import it into gpg. This will also give more flexibility to chain this function to the future verify stage. By default the command exports the whole keyring directory.
2021-10-21 13:34:48 -05:00
feature(keyringctl): use build command to create final artifacts This allows an easy to use cli which invokes the export function to get the keyring and uses the ownertrust and revoke functions to write all artifacts into a target directory.
2021-10-21 14:04:16 -05:00
def build(
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
working_dir: Path,
feature(keyringctl): use build command to create final artifacts This allows an easy to use cli which invokes the export function to get the keyring and uses the ownertrust and revoke functions to write all artifacts into a target directory.
2021-10-21 14:04:16 -05:00
keyring_root: Path,
target_dir: Path,
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
) -> None:
feature(keyringctl): use build command to create final artifacts This allows an easy to use cli which invokes the export function to get the keyring and uses the ownertrust and revoke functions to write all artifacts into a target directory.
2021-10-21 14:04:16 -05:00
"""Build keyring PGP artifacts alongside ownertrust and revoked status files
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
working_dir: A directory to use for temporary files
keyring_root: The keyring root directory to build the artifacts from
target_dir: Output directory that all artifacts are written to
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
"""
feature(keyringctl): use build command to create final artifacts This allows an easy to use cli which invokes the export function to get the keyring and uses the ownertrust and revoke functions to write all artifacts into a target directory.
2021-10-21 14:04:16 -05:00
target_dir.mkdir(parents=True, exist_ok=True)
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
feature(keyringctl): use build command to create final artifacts This allows an easy to use cli which invokes the export function to get the keyring and uses the ownertrust and revoke functions to write all artifacts into a target directory.
2021-10-21 14:04:16 -05:00
keyring: Path = target_dir / Path("archlinux.gpg")
export(working_dir=working_dir, keyring_root=keyring_root, output=keyring)
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
[trusted_main_keys, revoked_main_keys] = export_ownertrust(
feature(keyringctl): use build command to create final artifacts This allows an easy to use cli which invokes the export function to get the keyring and uses the ownertrust and revoke functions to write all artifacts into a target directory.
2021-10-21 14:04:16 -05:00
certs=[keyring_root / "main"],
output=target_dir / "archlinux-trusted",
)
export_revoked(
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
certs=[keyring_root],
main_keys=trusted_main_keys + revoked_main_keys,
feature(keyringctl): use build command to create final artifacts This allows an easy to use cli which invokes the export function to get the keyring and uses the ownertrust and revoke functions to write all artifacts into a target directory.
2021-10-21 14:04:16 -05:00
output=target_dir / "archlinux-revoked",
)
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
feature(keyringctl): add simple command to list all certificates
2021-10-21 14:13:35 -05:00
def list_keyring(keyring_root: Path, sources: Optional[List[Path]] = None, main_keys: bool = False) -> None:
"""List certificates in the keyring
If sources contains directories, all certificate below them are considered.
Parameters
----------
chore(keyringctl): de-duplicate username/fprint transform code We duplicated resolving usernames and fingerprints to actual keyring paths in multiple places. De-duplicate the code by using dedicated functions to do this job.
2021-10-23 10:13:46 -05:00
keyring_root: The keyring root directory to look up username shorthand sources
feature(keyringctl): support passing fingerprint as source This helps make the CLI more useful by listing, exporting or inspecting a specific fingerprint.
2021-10-22 20:01:06 -05:00
sources: A list of username, fingerprint or directories from which to read PGP packet information
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
(defaults to `keyring_root`)
main_keys: List main keys instead of packager keys (defaults to False)
feature(keyringctl): add simple command to list all certificates
2021-10-21 14:13:35 -05:00
"""
keyring_dir = keyring_root / ("main" if main_keys else "packager")
if not sources:
feature(keyringctl): sort list command for alphabetical listing Only do so when listing all keys, when a filter is provided, like usernames or fingerprints, keep the order to allow a 1:1 mapping.
2021-10-23 09:07:34 -05:00
sources = list(sorted(keyring_dir.iterdir(), key=lambda path: path.name.casefold()))
feature(keyringctl): add simple command to list all certificates
2021-10-21 14:13:35 -05:00
chore(keyringctl): de-duplicate username/fprint transform code We duplicated resolving usernames and fingerprints to actual keyring paths in multiple places. De-duplicate the code by using dedicated functions to do this job.
2021-10-23 10:13:46 -05:00
# transform shorthand paths to actual keyring paths
transform_username_to_keyring_path(keyring_dir=keyring_dir, paths=sources)
transform_fingerprint_to_keyring_path(keyring_root=keyring_root, paths=sources)
feature(keyringctl): add simple command to list all certificates
2021-10-21 14:13:35 -05:00
username_length = max([len(source.name) for source in sources])
chore(keyringctl): de-duplicate username/fprint transform code We duplicated resolving usernames and fingerprints to actual keyring paths in multiple places. De-duplicate the code by using dedicated functions to do this job.
2021-10-23 10:13:46 -05:00
for user_path in sources:
if is_pgp_fingerprint(user_path.name):
user_path = user_path.parent
certificates = [cert.name for cert in user_path.iterdir()]
print(f"{user_path.name:<{username_length}} {' '.join(certificates)}")
feature(keyringctl): add simple command to list all certificates
2021-10-21 14:13:35 -05:00
feature(keyringctl): add inspect command to pretty print certificates This command prints a new and pretty representation of the certificate data to visualize the keyring and its signatures.
2021-10-21 14:51:02 -05:00
def inspect_keyring(working_dir: Path, keyring_root: Path, sources: Optional[List[Path]]) -> str:
"""Inspect certificates in the keyring and pretty print the data
If sources contains directories, all certificate below them are considered.
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
working_dir: A directory to use for temporary files
keyring_root: The keyring root directory to look up username shorthand sources
feature(keyringctl): support passing fingerprint as source This helps make the CLI more useful by listing, exporting or inspecting a specific fingerprint.
2021-10-22 20:01:06 -05:00
sources: A list of username, fingerprint or directories from which to read PGP packet information
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
(defaults to `keyring_root`)
feature(keyringctl): add inspect command to pretty print certificates This command prints a new and pretty representation of the certificate data to visualize the keyring and its signatures.
2021-10-21 14:51:02 -05:00
Returns
-------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
The result of the inspect
feature(keyringctl): add inspect command to pretty print certificates This command prints a new and pretty representation of the certificate data to visualize the keyring and its signatures.
2021-10-21 14:51:02 -05:00
"""
if not sources:
sources = [keyring_root]
chore(keyringctl): de-duplicate username/fprint transform code We duplicated resolving usernames and fingerprints to actual keyring paths in multiple places. De-duplicate the code by using dedicated functions to do this job.
2021-10-23 10:13:46 -05:00
# transform shorthand paths to actual keyring paths
transform_username_to_keyring_path(keyring_dir=keyring_root / "packager", paths=sources)
transform_fingerprint_to_keyring_path(keyring_root=keyring_root, paths=sources)
feature(keyringctl): add inspect command to pretty print certificates This command prints a new and pretty representation of the certificate data to visualize the keyring and its signatures.
2021-10-21 14:51:02 -05:00
keyring = Path(mkstemp(dir=working_dir, prefix="packet-", suffix=".asc")[1]).absolute()
export(working_dir=working_dir, keyring_root=keyring_root, sources=sources, output=keyring)
feature(keyringctl): enrich inspect to show explicit label for main keys This helps to identify if a certification issuer comes from a main key or not.
2021-10-23 10:35:42 -05:00
fingerprints: Dict[Fingerprint, Username] = get_fingerprints_from_certificate_directory(
paths=[keyring_root / "packager"]
) | get_fingerprints_from_certificate_directory(paths=[keyring_root / "main"], postfix=" (main)")
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
return inspect(
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
packet=keyring,
certifications=True,
feature(keyringctl): enrich inspect to show explicit label for main keys This helps to identify if a certification issuer comes from a main key or not.
2021-10-23 10:35:42 -05:00
fingerprints=fingerprints,
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
)
feature(keyringctl): add inspect command to pretty print certificates This command prints a new and pretty representation of the certificate data to visualize the keyring and its signatures.
2021-10-21 14:51:02 -05:00
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
def absolute_path(path: str) -> Path:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Return the absolute path of a given str
Parameters
----------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
path: A string representing a path
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
Returns
-------
chore(keyringctl): remove docstring types as the signatures cover them All modern tooling already reads type hinting from the signatures instead of the docstring and supports annotating the parameter accordingly. Remove the duplicated data to avoid out of sync documentation.
2021-10-22 15:08:11 -05:00
The absolute path representation of path
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
return Path(path).absolute()
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
if __name__ == "__main__":
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
parser = ArgumentParser()
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
parser.add_argument(
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
"-v", "--verbose", action="store_true", help="Causes to print debugging messages about the progress"
)
parser.add_argument("--wait", action="store_true", help="Block before cleaning up the temp directory")
parser.add_argument(
"-f",
"--force",
action="store_true",
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
default=False,
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
help="force the execution of subcommands (e.g. overwriting of files)",
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
subcommands = parser.add_subparsers(dest="subcommand")
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
convert_parser = subcommands.add_parser(
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
"convert",
feature(keyringctl): unify import subcommand for condensed api Both commands are basically doing the same with the same params except the target directory differs. Lets condense this behavior by using a single subcommand with a boolean options.
2021-10-20 13:02:08 -05:00
help="convert one or multiple PGP public keys to a decomposed directory structure",
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
)
feature(keyringctl): support importing multiple paths Lets pass in a list of path's and reduce them to one set of path iterables. This allows us to specify multiple source files/directories
2021-10-20 13:15:42 -05:00
convert_parser.add_argument("source", type=absolute_path, nargs="+", help="Files or directorie to convert")
fix(keyringctl): restore --target option for convert command
2021-10-20 13:08:26 -05:00
convert_parser.add_argument("--target", type=absolute_path, help="Target directory instead of a random tmpdir")
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
convert_parser.add_argument(
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
"--name",
feature(keyringctl): introduce Username type instead of plain str
2021-10-19 14:03:53 -05:00
type=Username,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
default=None,
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
help="override the username to use (only useful when using a single file as source)",
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
feature(keyringctl): unify import subcommand for condensed api Both commands are basically doing the same with the same params except the target directory differs. Lets condense this behavior by using a single subcommand with a boolean options.
2021-10-20 13:02:08 -05:00
import_parser = subcommands.add_parser(
"import",
help="import one or several PGP keys to the keyring directory structure",
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
)
feature(keyringctl): support importing multiple paths Lets pass in a list of path's and reduce them to one set of path iterables. This allows us to specify multiple source files/directories
2021-10-20 13:15:42 -05:00
import_parser.add_argument("source", type=absolute_path, nargs="+", help="Files or directories to import")
feature(keyringctl): unify import subcommand for condensed api Both commands are basically doing the same with the same params except the target directory differs. Lets condense this behavior by using a single subcommand with a boolean options.
2021-10-20 13:02:08 -05:00
import_parser.add_argument(
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
"--name",
feature(keyringctl): introduce Username type instead of plain str
2021-10-19 14:03:53 -05:00
type=Username,
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
default=None,
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
help="override the username to use (only useful when using a single file as source)",
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
)
feature(keyringctl): unify import subcommand for condensed api Both commands are basically doing the same with the same params except the target directory differs. Lets condense this behavior by using a single subcommand with a boolean options.
2021-10-20 13:02:08 -05:00
import_parser.add_argument("--main", action="store_true", help="Import a main signing key into the keyring")
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
export_parser = subcommands.add_parser(
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
"export",
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
help="export a directory structure of PGP packet data to a combined file",
)
feature(keyringctl): use the export command purely to export keyrings This gives more control over the export command that may be useful to export a single packager to import it into gpg. This will also give more flexibility to chain this function to the future verify stage. By default the command exports the whole keyring directory.
2021-10-21 13:34:48 -05:00
export_parser.add_argument("-o", "--output", type=absolute_path, help="file to write PGP packet data to")
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
export_parser.add_argument(
feature(keyringctl): use the export command purely to export keyrings This gives more control over the export command that may be useful to export a single packager to import it into gpg. This will also give more flexibility to chain this function to the future verify stage. By default the command exports the whole keyring directory.
2021-10-21 13:34:48 -05:00
"source",
nargs="*",
feature(keyringctl): support passing fingerprint as source This helps make the CLI more useful by listing, exporting or inspecting a specific fingerprint.
2021-10-22 20:01:06 -05:00
help="username, fingerprint or directories containing certificates",
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
type=absolute_path,
)
feature(keyringctl): use build command to create final artifacts This allows an easy to use cli which invokes the export function to get the keyring and uses the ownertrust and revoke functions to write all artifacts into a target directory.
2021-10-21 14:04:16 -05:00
build_parser = subcommands.add_parser(
"build",
help="build keyring PGP artifacts alongside ownertrust and revoked status files",
)
feature(keyringctl): add simple command to list all certificates
2021-10-21 14:13:35 -05:00
list_parser = subcommands.add_parser(
"list",
help="list the certificates in the keyring",
)
list_parser.add_argument("--main", action="store_true", help="List main signing keys instead of packager keys")
list_parser.add_argument(
"source",
nargs="*",
feature(keyringctl): support passing fingerprint as source This helps make the CLI more useful by listing, exporting or inspecting a specific fingerprint.
2021-10-22 20:01:06 -05:00
help="username, fingerprint or directories containing certificates",
feature(keyringctl): add simple command to list all certificates
2021-10-21 14:13:35 -05:00
type=absolute_path,
)
feature(keyringctl): add inspect command to pretty print certificates This command prints a new and pretty representation of the certificate data to visualize the keyring and its signatures.
2021-10-21 14:51:02 -05:00
inspect_parser = subcommands.add_parser(
"inspect",
help="inspect certificates in the keyring and pretty print the data",
)
inspect_parser.add_argument(
"source",
nargs="*",
feature(keyringctl): support passing fingerprint as source This helps make the CLI more useful by listing, exporting or inspecting a specific fingerprint.
2021-10-22 20:01:06 -05:00
help="username, fingerprint or directories containing certificates",
feature(keyringctl): add inspect command to pretty print certificates This command prints a new and pretty representation of the certificate data to visualize the keyring and its signatures.
2021-10-21 14:51:02 -05:00
type=absolute_path,
)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
args = parser.parse_args()
if args.verbose:
basicConfig(level=DEBUG)
# temporary working directory that gets auto cleaned
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
with TemporaryDirectory(prefix="arch-keyringctl-") as tempdir:
feature(keyringctl): move main/packager folders to isolated keyring dir This helps to structure the layout of the repository better by having one root folder that contains the actual decomposed keyring structure.
2021-10-19 18:41:04 -05:00
keyring_root = Path("keyring").absolute()
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
working_dir = Path(tempdir)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
debug(f"Working directory: {working_dir}")
fix(keyringctl): restore cwd before deleting the temporary working dir This avoids potential issues with wrapped runtime like ipython or pdb that try to invoke functions at exit and access the current working directory, which will ultimately lead to an error in case we deleted it before changing the current working directory.
2021-10-12 12:22:30 -05:00
with cwd(working_dir):
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
if "convert" == args.subcommand:
fix(keyringctl): restore --target option for convert command
2021-10-20 13:08:26 -05:00
target_dir = args.target or Path(mkdtemp(prefix="arch-keyringctl-")).absolute()
chore(keyringctl): simplify convert usage by moving fingerprint filter
2021-10-22 14:34:53 -05:00
print(
convert(
working_dir=working_dir,
keyring_root=keyring_root,
source=args.source,
target_dir=target_dir,
name_override=args.name,
)
)
feature(keyringctl): unify import subcommand for condensed api Both commands are basically doing the same with the same params except the target directory differs. Lets condense this behavior by using a single subcommand with a boolean options.
2021-10-20 13:02:08 -05:00
elif "import" == args.subcommand:
target_dir = "main" if args.main else "packager"
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
print(
convert(
working_dir=working_dir,
chore(keyringctl): simplify convert usage by moving fingerprint filter
2021-10-22 14:34:53 -05:00
keyring_root=keyring_root,
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
source=args.source,
feature(keyringctl): unify import subcommand for condensed api Both commands are basically doing the same with the same params except the target directory differs. Lets condense this behavior by using a single subcommand with a boolean options.
2021-10-20 13:02:08 -05:00
target_dir=keyring_root / target_dir,
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
name_override=args.name,
)
)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
elif "export" == args.subcommand:
feature(keyringctl): use the export command purely to export keyrings This gives more control over the export command that may be useful to export a single packager to import it into gpg. This will also give more flexibility to chain this function to the future verify stage. By default the command exports the whole keyring directory.
2021-10-21 13:34:48 -05:00
print(
export(
working_dir=working_dir,
keyring_root=keyring_root,
sources=args.source,
output=args.output,
),
end="",
fix(keyringctl): restore cwd before deleting the temporary working dir This avoids potential issues with wrapped runtime like ipython or pdb that try to invoke functions at exit and access the current working directory, which will ultimately lead to an error in case we deleted it before changing the current working directory.
2021-10-12 12:22:30 -05:00
)
feature(keyringctl): use build command to create final artifacts This allows an easy to use cli which invokes the export function to get the keyring and uses the ownertrust and revoke functions to write all artifacts into a target directory.
2021-10-21 14:04:16 -05:00
elif "build" == args.subcommand:
build(
working_dir=working_dir,
keyring_root=keyring_root,
target_dir=keyring_root.parent / "build",
)
feature(keyringctl): add simple command to list all certificates
2021-10-21 14:13:35 -05:00
elif "list" == args.subcommand:
list_keyring(
keyring_root=keyring_root,
sources=args.source,
main_keys=args.main,
)
feature(keyringctl): add inspect command to pretty print certificates This command prints a new and pretty representation of the certificate data to visualize the keyring and its signatures.
2021-10-21 14:51:02 -05:00
elif "inspect" == args.subcommand:
print(
inspect_keyring(
working_dir=working_dir,
keyring_root=keyring_root,
sources=args.source,
),
end="",
)
feature(keyringctl): print help if invoked without any subcommand
2021-10-20 13:04:02 -05:00
else:
parser.print_help()
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
fix(keyringctl): restore cwd before deleting the temporary working dir This avoids potential issues with wrapped runtime like ipython or pdb that try to invoke functions at exit and access the current working directory, which will ultimately lead to an error in case we deleted it before changing the current working directory.
2021-10-12 12:22:30 -05:00
if args.wait:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
print("Press [ENTER] to continue")
fix(keyringctl): restore cwd before deleting the temporary working dir This avoids potential issues with wrapped runtime like ipython or pdb that try to invoke functions at exit and access the current working directory, which will ultimately lead to an error in case we deleted it before changing the current working directory.
2021-10-12 12:22:30 -05:00
input()
Reference in New Issue Copy Permalink