CondorCORE/condorcore-keyring
CondorCORE/condorcore-keyring
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
fc9ad848ab
condorcore-keyring/keyringctl

1419 lines
48 KiB
Plaintext
Raw Normal View History

feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
#!/usr/bin/env python
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
#
# SPDX-License-Identifier: GPL-3.0-or-later
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
from argparse import ArgumentParser
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
from collections import defaultdict
chore(keyringctl): use python 3.9 iterable/iterator type imports
2021-10-20 13:16:33 -05:00
from collections.abc import Iterable
from collections.abc import Iterator
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
from contextlib import contextmanager
feature(keyringctl): support importing multiple paths Lets pass in a list of path's and reduce them to one set of path iterables. This allows us to specify multiple source files/directories
2021-10-20 13:15:42 -05:00
from itertools import chain
isort: Configure to use single lines pyproject.toml: Configure isort to use single lines (one line for each import) to ease merge conflicts. keyringctl: Reformat using new isort settings.
2021-10-18 05:58:23 -05:00
from logging import DEBUG
from logging import basicConfig
from logging import debug
from logging import error
from os import chdir
from os import getcwd
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
from pathlib import Path
isort: Configure to use single lines pyproject.toml: Configure isort to use single lines (one line for each import) to ease merge conflicts. keyringctl: Reformat using new isort settings.
2021-10-18 05:58:23 -05:00
from re import escape
from re import split
from re import sub
keyringctl: Copy files instead of moving them keyringctl: Change `__main__` to create the `target_dir` before calling any further function that relies on it. Change `convert()` to require the `target_dir` to be not None and to create all username based target directories before using `shutil.copytree()` to copy all sources to their respective target directories when iterating over the paths to persist. This has the upside, that updates to a target directory structure can be done on the fly (overwriting existing data), which is not possible with `shutil.move()`.
2021-10-04 12:25:24 -05:00
from shutil import copytree
isort: Configure to use single lines pyproject.toml: Configure isort to use single lines (one line for each import) to ease merge conflicts. keyringctl: Reformat using new isort settings.
2021-10-18 05:58:23 -05:00
from subprocess import PIPE
from subprocess import CalledProcessError
from subprocess import check_output
from sys import exit
from sys import stderr
from tempfile import TemporaryDirectory
from tempfile import mkdtemp
feature(keyringctl): add inspect command to pretty print certificates This command prints a new and pretty representation of the certificate data to visualize the keyring and its signatures.
2021-10-21 14:51:02 -05:00
from tempfile import mkstemp
feature(keyringctl): print a stack trace in case a system cmd fails
2021-10-21 13:18:21 -05:00
from traceback import print_stack
isort: Configure to use single lines pyproject.toml: Configure isort to use single lines (one line for each import) to ease merge conflicts. keyringctl: Reformat using new isort settings.
2021-10-18 05:58:23 -05:00
from typing import Dict
from typing import List
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
from typing import NewType
isort: Configure to use single lines pyproject.toml: Configure isort to use single lines (one line for each import) to ease merge conflicts. keyringctl: Reformat using new isort settings.
2021-10-18 05:58:23 -05:00
from typing import Optional
from typing import Set
from typing import Tuple
from typing import Union
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
chore(keyringctl): apply black formatter
2021-10-19 14:11:37 -05:00
Fingerprint = NewType("Fingerprint", str)
Uid = NewType("Uid", str)
Username = NewType("Username", str)
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
@contextmanager
chore(keyringctl): declare missing type hinting for cwd
2021-10-12 12:35:18 -05:00
def cwd(new_dir: Path) -> Iterator[None]:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Change to a new current working directory in a context and go back to the previous dir after the context is done
Parameters
----------
new_dir: Path
A path to change to
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
previous_dir = getcwd()
chdir(new_dir)
try:
yield
finally:
chdir(previous_dir)
def natural_sort_path(_list: Iterable[Path]) -> Iterable[Path]:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Sort an Iterable of Paths naturally
Parameters
----------
_list: Iterable[Path]
An iterable containing paths to be sorted
Return
------
Iterable[Path]
An Iterable of paths that are naturally sorted
"""
chore(keyringctl): avoid shadowing convert function
2021-10-19 11:23:08 -05:00
def convert_text_chunk(text: str) -> Union[int, str]:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Convert input text to int or str
Parameters
----------
text: str
An input string
Returns
-------
Union[int, str]
Either an integer if text is a digit, else text in lower-case representation
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
return int(text) if text.isdigit() else text.lower()
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
def alphanum_key(key: Path) -> List[Union[int, str]]:
"""Retrieve an alphanumeric key from a Path, that can be used in sorted()
Parameters
----------
key: Path
A path for which to create a key
Returns
-------
List[Union[int, str]]
A list of either int or str objects that may serve as 'key' argument for sorted()
"""
chore(keyringctl): avoid shadowing convert function
2021-10-19 11:23:08 -05:00
return [convert_text_chunk(c) for c in split("([0-9]+)", str(key.name))]
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
return sorted(_list, key=alphanum_key)
chore(keyringctl): throw exception instead of exit on failed system calls
2021-10-21 14:05:03 -05:00
def system(cmd: List[str], exit_on_error: bool = False) -> str:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Execute a command using check_output
Parameters
----------
cmd: List[str]
A list of strings to be fed to check_output
exit_on_error: bool
chore(keyringctl): throw exception instead of exit on failed system calls
2021-10-21 14:05:03 -05:00
Whether to exit the script when encountering an error (defaults to False)
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
Raises
------
CalledProcessError
If not exit_on_error and `check_output()` encounters an error
Returns
-------
str
The output of cmd
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
try:
return check_output(cmd, stderr=PIPE).decode()
except CalledProcessError as e:
stderr.buffer.write(e.stderr)
feature(keyringctl): print a stack trace in case a system cmd fails
2021-10-21 13:18:21 -05:00
print_stack()
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
if exit_on_error:
exit(e.returncode)
raise e
chore(keyringctl): move cert depth first search to own function This way we can reuse the functionality which will allow to simplify a lot of places that have multiple layers of inflexible nested loops.
2021-10-22 13:17:50 -05:00
def get_cert_paths(paths: Iterable[Path]) -> Set[Path]:
"""Walks a list of paths and resolves all discovered certificate paths
Parameters
----------
paths: Iterable[Path]
A list of paths to walk and resolve to certificate paths.
Returns
-------
List[Path]
The list of paths to certificates
"""
# depth first search certificate paths
cert_paths: Set[Path] = set()
visit: List[Path] = list(paths)
while visit:
path = visit.pop()
# this level contains a certificate, abort depth search
if list(path.glob("*.asc")):
cert_paths.add(path)
continue
visit.extend([path for path in path.iterdir() if path.is_dir()])
return cert_paths
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
# TODO: simplify to lower complexity
def convert_certificate( # noqa: ignore=C901
working_dir: Path,
certificate: Path,
feature(keyringctl): avoid splitting a certificate multiple times Move the name cascade to derive the username into the `convert_certificate` function which allows to use the certificate_fingerprint directly instead of trying to find it by splitting the certificate one more time before converting.
2021-10-19 12:10:51 -05:00
keyring_dir: Path,
feature(keyringctl): introduce Username type instead of plain str
2021-10-19 14:03:53 -05:00
name_override: Optional[Username] = None,
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
fingerprint_filter: Optional[Set[Fingerprint]] = None,
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
) -> Path:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Convert a single file public key certificate into a decomposed directory structure of multiple PGP packets
feature(keyringctl): avoid splitting a certificate multiple times Move the name cascade to derive the username into the `convert_certificate` function which allows to use the certificate_fingerprint directly instead of trying to find it by splitting the certificate one more time before converting.
2021-10-19 12:10:51 -05:00
The output directory structure is created per user. The username is derived from the certificate via
`derive_username_from_fingerprint` or overridden via `name_override`.
chore(keyringctl): fix typo in docstring for convert_certificate
2021-10-19 11:41:58 -05:00
Below the username directory a directory tree describes the public keys components split up into certifications
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
and revocations, as well as per subkey and per uid certifications and revocations.
Parameters
----------
working_dir: Path
The path of the working directory below which to create split certificates
certificate: Path
The path to a public key certificate
feature(keyringctl): avoid splitting a certificate multiple times Move the name cascade to derive the username into the `convert_certificate` function which allows to use the certificate_fingerprint directly instead of trying to find it by splitting the certificate one more time before converting.
2021-10-19 12:10:51 -05:00
keyring_dir: Path
The path of the keyring used to try to derive the username from the public key fingerprint
feature(keyringctl): introduce Username type instead of plain str
2021-10-19 14:03:53 -05:00
name_override: Optional[Username]
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
An optional string to override the username in the to be created output directory structure
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
fingerprint_filter: Optional[Set[Fingerprint]]
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
An optional list of strings defining fingerprints of PGP public keys that all certificates will be filtered
with
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
Raises
------
Exception
If required PGP packets are not found
Returns
-------
Path
The path of the user_dir (which is located below working_dir)
"""
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
# root packets
certificate_fingerprint: Optional[Fingerprint] = None
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
pubkey: Optional[Path] = None
feature(keyringctl): add type hinting direct sigs/revocations
2021-10-19 13:08:32 -05:00
direct_sigs: Dict[Fingerprint, List[Path]] = defaultdict(list)
direct_revocations: Dict[Fingerprint, List[Path]] = defaultdict(list)
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
# subkey packets
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
subkeys: Dict[Fingerprint, Path] = {}
subkey_binding_sigs: Dict[Fingerprint, Path] = {}
subkey_revocations: Dict[Fingerprint, Path] = {}
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
# uid packets
uids: Dict[Uid, Path] = {}
uid_binding_sigs: Dict[Uid, Path] = {}
certifications: Dict[Uid, List[Path]] = defaultdict(list)
revocations: Dict[Uid, List[Path]] = defaultdict(list)
# intermediate variables
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
current_packet_mode: Optional[str] = None
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
current_packet_fingerprint: Optional[Fingerprint] = None
current_packet_uid: Optional[Uid] = None
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
# XXX: PrimaryKeyBinding
# TODO: remove 3rd party direct key signatures, seems to be leaked by export-clean
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
debug(f"Processing certificate {certificate}")
keyringctl: Add handling of KeyRevocations keyringctl: Change `persist_direct_sigs()` to track a sig_type parameter in its signature so that the output directory of the direct signatures can be altered. Change `convert_certificate()` to set a `direct_revocations` variable, that is used to track KeyRevocations for root keys. Extend the logic to make use of `add_packet_to_direct_sigs()` to set a list of KeyRevocations for a given root key. Eventually call `persist_direct_sigs()` with `direct_revocations` and a custom `sig_type` to persist the revocation certificates.
2021-10-03 13:05:11 -05:00
keyringctl: Deal with multi-certificate per user files keyringctl: Add `sanitize_certificate_file()` to potentially split per-user input files that contain more than one certificate. Change `packet_split()` to add documentation and rename the key parameter to certificate, as it is more generic. Change `convert_certificate()` to use named parameters when calling `packet_split()`. Change `convert()` to call `convert_certificate()` on a list of sanitized certificates (generated using `sanitized_certificate_file()`) to be able to deal with multi-certificate files per user.
2021-10-04 15:12:33 -05:00
for packet in packet_split(working_dir=working_dir, certificate=certificate):
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
debug(f"Processing packet {packet.name}")
if packet.name.endswith("--PublicKey"):
current_packet_mode = "pubkey"
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
current_packet_fingerprint = Fingerprint(packet_dump_field(packet, "Fingerprint"))
current_packet_uid = None
certificate_fingerprint = current_packet_fingerprint
pubkey = packet
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
elif packet.name.endswith("--UserID"):
current_packet_mode = "uid"
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
current_packet_fingerprint = None
current_packet_uid = simplify_user_id(Uid(packet_dump_field(packet, "Value")))
uids[current_packet_uid] = packet
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
elif packet.name.endswith("--PublicSubkey"):
current_packet_mode = "subkey"
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
current_packet_fingerprint = Fingerprint(packet_dump_field(packet, "Fingerprint"))
current_packet_uid = None
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
subkeys[current_packet_fingerprint] = packet
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
elif packet.name.endswith("--Signature"):
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
if not certificate_fingerprint:
raise Exception('missing certificate fingerprint for "{packet.name}"')
feature(keyringctl): add type hinting direct sigs/revocations
2021-10-19 13:08:32 -05:00
issuer: Fingerprint = Fingerprint(packet_dump_field(packet, "Issuer"))
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
signature_type = packet_dump_field(packet, "Type")
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
if current_packet_mode == "pubkey":
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
if not current_packet_fingerprint:
raise Exception('missing current packet fingerprint for "{packet.name}"')
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
if signature_type == "KeyRevocation" and certificate_fingerprint.endswith(issuer):
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
direct_revocations[issuer].append(packet)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
elif signature_type in ["DirectKey", "GenericCertification"]:
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
direct_sigs[issuer].append(packet)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
else:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
raise Exception(f"unknown signature type: {signature_type}")
elif current_packet_mode == "uid":
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
if not current_packet_uid:
raise Exception('missing current packet uid for "{packet.name}"')
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
if signature_type == "CertificationRevocation":
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
revocations[current_packet_uid].append(packet)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
elif signature_type == "PositiveCertification" and certificate_fingerprint.endswith(issuer):
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
uid_binding_sigs[current_packet_uid] = packet
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
elif signature_type.endswith("Certification"):
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
if fingerprint_filter is not None and any([fp.endswith(issuer) for fp in fingerprint_filter]):
debug(f"The certification by issuer {issuer} is appended as it is found in the filter.")
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
certifications[current_packet_uid].append(packet)
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
else:
debug(f"The certification by issuer {issuer} is not appended because it is not in the filter")
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
else:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
raise Exception(f"unknown signature type: {signature_type}")
elif current_packet_mode == "subkey":
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
if not current_packet_fingerprint:
raise Exception('missing current packet fingerprint for "{packet.name}"')
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
if signature_type == "SubkeyBinding":
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
subkey_binding_sigs[current_packet_fingerprint] = packet
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
elif signature_type == "SubkeyRevocation":
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
subkey_revocations[certificate_fingerprint] = packet
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
else:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
raise Exception(f"unknown signature type: {signature_type}")
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
else:
raise Exception(f'unknown signature root for "{packet.name}"')
else:
raise Exception(f'unknown packet type "{packet.name}"')
if not certificate_fingerprint:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
raise Exception("missing certificate fingerprint")
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
if not pubkey:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
raise Exception("missing certificate public-key")
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
chore(keyringctl): apply black formatter
2021-10-19 14:11:37 -05:00
name_override = (
name_override
or derive_username_from_fingerprint(keyring_dir=keyring_dir, certificate_fingerprint=certificate_fingerprint)
or Username(certificate.stem)
)
feature(keyringctl): avoid splitting a certificate multiple times Move the name cascade to derive the username into the `convert_certificate` function which allows to use the certificate_fingerprint directly instead of trying to find it by splitting the certificate one more time before converting.
2021-10-19 12:10:51 -05:00
user_dir = working_dir / name_override
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
key_dir = user_dir / certificate_fingerprint
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
key_dir.mkdir(parents=True, exist_ok=True)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
persist_public_key(
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
certificate_fingerprint=certificate_fingerprint,
pubkey=pubkey,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir=key_dir,
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
)
persist_uids(
key_dir=key_dir,
uid_binding_sigs=uid_binding_sigs,
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
uids=uids,
)
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
persist_subkeys(
key_dir=key_dir,
subkeys=subkeys,
subkey_binding_sigs=subkey_binding_sigs,
)
persist_subkey_revocations(
key_dir=key_dir,
subkey_revocations=subkey_revocations,
)
keyringctl: Persist direct signatures generically keyringctl: Rename `persist_direct_keys()` to `persist_direct_sigs()` as it is now not only handling the persistence of DirectKeys but also *Certifications directly on a root key (those without an explicit User ID). Add inline function `add_packet_to_direct_sigs()` to `convert_certificate()` to generically add direct signatures on a root key, grouped by issuer. Change `convert_certificate()` to add Certifications on a root key (without a specified User ID) to the list of direct_sigs, so that they are persisted alongside any existing DirectKeys. Remove breakpoints from `persist_certifications()` as they are no longer reached. The function is now solely used for Certifications on User IDs.
2021-10-03 12:24:49 -05:00
persist_direct_sigs(
direct_sigs=direct_sigs,
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
pubkey=pubkey,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir=key_dir,
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
)
keyringctl: Add handling of KeyRevocations keyringctl: Change `persist_direct_sigs()` to track a sig_type parameter in its signature so that the output directory of the direct signatures can be altered. Change `convert_certificate()` to set a `direct_revocations` variable, that is used to track KeyRevocations for root keys. Extend the logic to make use of `add_packet_to_direct_sigs()` to set a list of KeyRevocations for a given root key. Eventually call `persist_direct_sigs()` with `direct_revocations` and a custom `sig_type` to persist the revocation certificates.
2021-10-03 13:05:11 -05:00
persist_direct_sigs(
direct_sigs=direct_revocations,
pubkey=pubkey,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir=key_dir,
sig_type="revocation",
keyringctl: Add handling of KeyRevocations keyringctl: Change `persist_direct_sigs()` to track a sig_type parameter in its signature so that the output directory of the direct signatures can be altered. Change `convert_certificate()` to set a `direct_revocations` variable, that is used to track KeyRevocations for root keys. Extend the logic to make use of `add_packet_to_direct_sigs()` to set a list of KeyRevocations for a given root key. Eventually call `persist_direct_sigs()` with `direct_revocations` and a custom `sig_type` to persist the revocation certificates.
2021-10-03 13:05:11 -05:00
)
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
persist_certifications(
certifications=certifications,
pubkey=pubkey,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir=key_dir,
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
uid_binding_sig=uid_binding_sigs,
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
uids=uids,
)
persist_revocations(
pubkey=pubkey,
revocations=revocations,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir=key_dir,
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
uid_binding_sig=uid_binding_sigs,
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
uids=uids,
)
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
return user_dir
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
def persist_public_key(
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
certificate_fingerprint: Fingerprint,
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
pubkey: Path,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir: Path,
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
) -> None:
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
"""Persist the Public-Key packet
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
Parameters
----------
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
certificate_fingerprint: Fingerprint
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
The unique fingerprint of the public key
pubkey: Path
The path to the public key of the root key
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir: Path
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
The root directory below which the basic key material is persisted
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
packets: List[Path] = [pubkey]
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
output_file = key_dir / f"{certificate_fingerprint}.asc"
chore(keyringctl): uniformly use path builder via operator Instead of partially dealing with strings that contain slashes lets just use the path builder interface by using the operator for every sub path layer in a uniform way.
2021-10-12 17:09:58 -05:00
output_file.parent.mkdir(parents=True, exist_ok=True)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
debug(f"Writing file {output_file} from {[str(packet) for packet in packets]}")
fix(keyringctl): force overwrite packets when persisting When we import new packet data, always allow overwrites of the final packet files. This may happen when importing from multiple files that provide the same packets, which is fine as they should still yield to the same results.
2021-10-21 16:49:40 -05:00
packet_join(packets, output_file, force=True)
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
def persist_uids(
key_dir: Path,
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
uid_binding_sigs: Dict[Uid, Path],
uids: Dict[Uid, Path],
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
) -> None:
"""Persist the User IDs that belong to a PublicKey
The User ID material consists of PublicSubkeys and their SubkeyBindings.
chore(keyringctl): use singular folder names for all sub-folders
2021-10-12 16:57:20 -05:00
The files are written to a UID specific directory and file below key_dir/uid.
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
Parameters
----------
key_dir: Path
The root directory below which the basic key material is persisted
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
uid_binding_sigs: Dict[Uid, Path]
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
The PositiveCertifications of a User ID and Public-Key packet
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
uids: Dict[Uid, Path]
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
The User IDs of a Public-Key (the root key)
"""
for key in uid_binding_sigs.keys():
packets = [uids[key], uid_binding_sigs[key]]
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
output_file = key_dir / "uid" / key / f"{key}.asc"
chore(keyringctl): uniformly use path builder via operator Instead of partially dealing with strings that contain slashes lets just use the path builder interface by using the operator for every sub path layer in a uniform way.
2021-10-12 17:09:58 -05:00
output_file.parent.mkdir(parents=True, exist_ok=True)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
debug(f"Writing file {output_file} from {[str(packet) for packet in packets]}")
fix(keyringctl): force overwrite packets when persisting When we import new packet data, always allow overwrites of the final packet files. This may happen when importing from multiple files that provide the same packets, which is fine as they should still yield to the same results.
2021-10-21 16:49:40 -05:00
packet_join(packets, output_file, force=True)
keyringctl: Write User IDs to separate files keyringctl: Add `persist_uids()` to write User ID related packets: User-ID and PositiveCertifications (UID binding signatures). Rename `persist_basic_key()` to `persist_public_key()` and change it to only persist the PublicKey packet. Change `persist_{certifications,revocations}()` to persist the certificates to a key-specific 'uids' subdirectory per PublicKey. Change `convert_certificate()` to rename `uid_binding_sig` to `uid_bind_sigs`. Simplify the logic for signature related data assignments.
2021-10-09 16:42:13 -05:00
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
def persist_subkeys(
key_dir: Path,
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
subkeys: Dict[Fingerprint, Path],
subkey_binding_sigs: Dict[Fingerprint, Path],
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
) -> None:
"""Persist all Public-Subkeys and their PublicSubkeyBinding of a root key file to file(s)
Parameters
----------
key_dir: Path
The root directory below which the basic key material is persisted
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
subkeys: Dict[Fingerprint, Path]
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
The PublicSubkeys of a key
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
subkey_binding_sigs: Dict[Fingerprint, Path]
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
The SubkeyBinding signatures of a Public-Key (the root key)
"""
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
for fingerprint, subkey in subkeys.items():
packets: List[Path] = []
packets.extend([subkey, subkey_binding_sigs[fingerprint]])
output_file = key_dir / "subkey" / fingerprint / f"{fingerprint}.asc"
output_file.parent.mkdir(parents=True, exist_ok=True)
debug(f"Writing file {output_file} from {[str(packet) for packet in packets]}")
fix(keyringctl): force overwrite packets when persisting When we import new packet data, always allow overwrites of the final packet files. This may happen when importing from multiple files that provide the same packets, which is fine as they should still yield to the same results.
2021-10-21 16:49:40 -05:00
packet_join(packets=packets, output=output_file, force=True)
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
def persist_subkey_revocations(
key_dir: Path,
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
subkey_revocations: Dict[Fingerprint, Path],
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
) -> None:
"""Persist the SubkeyRevocations of all Public-Subkeys of a root key to file(s)
Parameters
----------
key_dir: Path
The root directory below which the basic key material is persisted
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
subkey_revocations: Dict[Fingerprint, Path]
keyringctl: Split out subkeys to separate structure keyringctl: Add `persist_subkeys()` and `persist_subkey_revocations()` to persist the Public-Subkeys and the SubkeyRevocations of a root key out into a dedicated directory structure below the respective Public-Key. Change `persist_basic_key()` to not persist the Public-Subkeys and SubkeyRevocations of a root key anymore and to output debug information before writing to file. Change `convert_certificate()` to refer to Public-Subkeys and PublicSubkeyBinding as `subkeys` and `subkey_binding_sigs` (respectively) and to explicitly refer to the main certificate fingerprint when aggregating the data about them. Add `subkey_revocations` to track any SubkeyRevocations of a given Public-Subkey, so that it can be persisted to file.
2021-10-09 05:56:33 -05:00
The SubkeyRevocations of PublicSubkeys of a key
"""
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
for fingerprint, revocation in subkey_revocations.items():
issuer = packet_dump_field(revocation, "Issuer")
output_file = key_dir / "subkey" / fingerprint / "revocation" / f"{issuer}.asc"
output_file.parent.mkdir(parents=True, exist_ok=True)
debug(f"Writing file {output_file} from {revocation}")
fix(keyringctl): force overwrite packets when persisting When we import new packet data, always allow overwrites of the final packet files. This may happen when importing from multiple files that provide the same packets, which is fine as they should still yield to the same results.
2021-10-21 16:49:40 -05:00
packet_join(packets=[revocation], output=output_file, force=True)
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
keyringctl: Persist direct signatures generically keyringctl: Rename `persist_direct_keys()` to `persist_direct_sigs()` as it is now not only handling the persistence of DirectKeys but also *Certifications directly on a root key (those without an explicit User ID). Add inline function `add_packet_to_direct_sigs()` to `convert_certificate()` to generically add direct signatures on a root key, grouped by issuer. Change `convert_certificate()` to add Certifications on a root key (without a specified User ID) to the list of direct_sigs, so that they are persisted alongside any existing DirectKeys. Remove breakpoints from `persist_certifications()` as they are no longer reached. The function is now solely used for Certifications on User IDs.
2021-10-03 12:24:49 -05:00
def persist_direct_sigs(
feature(keyringctl): add type hinting direct sigs/revocations
2021-10-19 13:08:32 -05:00
direct_sigs: Dict[Fingerprint, List[Path]],
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
pubkey: Path,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir: Path,
keyringctl: Add handling of KeyRevocations keyringctl: Change `persist_direct_sigs()` to track a sig_type parameter in its signature so that the output directory of the direct signatures can be altered. Change `convert_certificate()` to set a `direct_revocations` variable, that is used to track KeyRevocations for root keys. Extend the logic to make use of `add_packet_to_direct_sigs()` to set a list of KeyRevocations for a given root key. Eventually call `persist_direct_sigs()` with `direct_revocations` and a custom `sig_type` to persist the revocation certificates.
2021-10-03 13:05:11 -05:00
sig_type: str = "certification",
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
) -> None:
keyringctl: Persist direct signatures generically keyringctl: Rename `persist_direct_keys()` to `persist_direct_sigs()` as it is now not only handling the persistence of DirectKeys but also *Certifications directly on a root key (those without an explicit User ID). Add inline function `add_packet_to_direct_sigs()` to `convert_certificate()` to generically add direct signatures on a root key, grouped by issuer. Change `convert_certificate()` to add Certifications on a root key (without a specified User ID) to the list of direct_sigs, so that they are persisted alongside any existing DirectKeys. Remove breakpoints from `persist_certifications()` as they are no longer reached. The function is now solely used for Certifications on User IDs.
2021-10-03 12:24:49 -05:00
"""Persist the signatures directly on a root key (such as DirectKeys or *Certifications without a User ID) to
file(s)
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
Parameters
----------
feature(keyringctl): add type hinting direct sigs/revocations
2021-10-19 13:08:32 -05:00
direct_sigs: Dict[Fingerprint, List[Path]]
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
The direct sigs to write to file
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
pubkey: Path
The path to the public key of the root key
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir: Path
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
The root directory below which the Directkeys are persisted
keyringctl: Add handling of KeyRevocations keyringctl: Change `persist_direct_sigs()` to track a sig_type parameter in its signature so that the output directory of the direct signatures can be altered. Change `convert_certificate()` to set a `direct_revocations` variable, that is used to track KeyRevocations for root keys. Extend the logic to make use of `add_packet_to_direct_sigs()` to set a list of KeyRevocations for a given root key. Eventually call `persist_direct_sigs()` with `direct_revocations` and a custom `sig_type` to persist the revocation certificates.
2021-10-03 13:05:11 -05:00
sig_type: str
The type of direct certification to persist (defaults to 'certification'). This influences the directory name
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
"""
feature(keyringctl): simplification by removing static data from types The certificate fingerprint in the convert function remains always the same as we only process a single certificate and loop outside over multiple keyrings. Therefor remove that layer from the data structures and implicitly simplify all the assignments and usages.
2021-10-19 11:26:50 -05:00
for issuer, certifications in direct_sigs.items():
packets = [pubkey] + certifications
output_file = key_dir / sig_type / f"{issuer}.asc"
output_file.parent.mkdir(parents=True, exist_ok=True)
debug(f"Writing file {output_file} from {[str(cert) for cert in certifications]}")
fix(keyringctl): force overwrite packets when persisting When we import new packet data, always allow overwrites of the final packet files. This may happen when importing from multiple files that provide the same packets, which is fine as they should still yield to the same results.
2021-10-21 16:49:40 -05:00
packet_join(packets, output_file, force=True)
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
def persist_certifications(
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
certifications: Dict[Uid, List[Path]],
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
pubkey: Path,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir: Path,
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
uid_binding_sig: Dict[Uid, Path],
uids: Dict[Uid, Path],
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
) -> None:
"""Persist the certifications of a root key to file(s)
The certifications include all CasualCertifications, GenericCertifications, PersonaCertifications and
PositiveCertifications for all User IDs of the given root key.
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
All certifications are persisted in per User ID certification directories below key_dir.
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
Parameters
----------
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
certifications: Dict[Uid, List[Path]]
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
The certifications to write to file
pubkey: Path
The path to the public key of the root key
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir: Path
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
The root directory below which certifications are persisted
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
uid_binding_sig: Dict[Uid, Path]
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
The PositiveCertifications of a User ID and Public-Key packet
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
uids: Dict[Uid, Path]
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
The User IDs of a Public-Key (the root key)
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
for key, current_certifications in certifications.items():
for certification in current_certifications:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
certification_dir = key_dir / "uid" / key / "certification"
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
certification_dir.mkdir(parents=True, exist_ok=True)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
issuer = packet_dump_field(certification, "Issuer")
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
keyringctl: Do not persist unbound certifications keyringctl: Change `persist_certifications()` to not attempt to read UID binding signatures for a given UID, if it does not exist and instead output an error message.
2021-10-16 17:21:08 -05:00
if uids.get(key) and uid_binding_sig.get(key):
packets = [pubkey, uids[key], uid_binding_sig[key], certification]
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
output_file = certification_dir / f"{issuer}.asc"
debug(f"Writing file {output_file} from {certification}")
fix(keyringctl): force overwrite packets when persisting When we import new packet data, always allow overwrites of the final packet files. This may happen when importing from multiple files that provide the same packets, which is fine as they should still yield to the same results.
2021-10-21 16:49:40 -05:00
packet_join(packets, output_file, force=True)
keyringctl: Do not persist unbound certifications keyringctl: Change `persist_certifications()` to not attempt to read UID binding signatures for a given UID, if it does not exist and instead output an error message.
2021-10-16 17:21:08 -05:00
else:
error(
f"Public key '{pubkey}' does not provide "
f"{'the UID binding signature' if not uid_binding_sig.get(key) else ''} for UID '{key}', "
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
"so its certifications can not be used!"
)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
def persist_revocations(
pubkey: Path,
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
revocations: Dict[Uid, List[Path]],
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir: Path,
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
uid_binding_sig: Dict[Uid, Path],
uids: Dict[Uid, Path],
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
) -> None:
"""Persist the revocations of a root key to file(s)
The revocations include all CertificationRevocations for all User IDs of the given root key.
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
All revocations are persisted in per User ID 'revocation' directories below key_dir.
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
Parameters
----------
pubkey: Path
The path to the public key of the root key
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
revocations: Dict[Uid, List[Path]]
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
The revocations to write to file
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
key_dir: Path
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
The root directory below which revocations will be persisted
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
uid_binding_sig: Dict[Uid, Path]
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
The PositiveCertifications of a User ID and Public-Key packet
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
uids: Dict[Uid, Path]
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
The User IDs of a Public-Key (the root key)
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
for key, current_revocations in revocations.items():
for revocation in current_revocations:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
revocation_dir = key_dir / "uid" / key / "revocation"
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
revocation_dir.mkdir(parents=True, exist_ok=True)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
issuer = packet_dump_field(revocation, "Issuer")
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
packets = [pubkey, uids[key]]
# Binding sigs only exist for 3rd-party revocations
if key in uid_binding_sig:
packets.append(uid_binding_sig[key])
packets.append(revocation)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
output_file = revocation_dir / f"{issuer}.asc"
debug(f"Writing file {output_file} from {revocation}")
fix(keyringctl): force overwrite packets when persisting When we import new packet data, always allow overwrites of the final packet files. This may happen when importing from multiple files that provide the same packets, which is fine as they should still yield to the same results.
2021-10-21 16:49:40 -05:00
packet_join(packets, output_file, force=True)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
def packet_dump(packet: Path) -> str:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Dump a PGP packet to string
The `sq packet dump` command is used to retrieve a dump of information from a PGP packet
Parameters
----------
packet: Path
The path to the PGP packet to retrieve the value from
Returns
-------
str
The contents of the packet dump
"""
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
return system(["sq", "packet", "dump", str(packet)])
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
def packet_dump_field(packet: Path, field: str) -> str:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Retrieve the value of a field from a PGP packet
Parameters
----------
packet: Path
The path to the PGP packet to retrieve the value from
field: str
The name of the field
Raises
------
Exception
If the field is not found in the PGP packet
Returns
-------
str
The value of the field found in packet
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
dump = packet_dump(packet)
lines = [line.strip() for line in dump.splitlines()]
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
lines = list(filter(lambda line: line.startswith(f"{field}: "), lines))
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
if not lines:
raise Exception(f'Packet has no field "{field}"')
return lines[0].split(maxsplit=1)[1]
fix(keyringctl): preserve keyring split filenames in separated dirs This aids initial imports of keyrings that contain multiple certificates by allowing keyring_split to enforce preserving the filenames. This is achieved by moving each split keyring into unique sub directories where the original input filename remains unique.
2021-10-21 17:58:52 -05:00
def keyring_split(working_dir: Path, keyring: Path, preserve_filename: bool = False) -> Iterable[Path]:
feature(keyringctl): use sq to split a keyring into individual certificates Lets use sequoia as well to split an input into individual certificates instead of creating a custom made function for this job. Pass down the name of the original input file to `convert_certificate` in case no override has been defined.
2021-10-12 12:20:33 -05:00
"""Split a file containing a PGP keyring into separate certificate files
keyringctl: Deal with multi-certificate per user files keyringctl: Add `sanitize_certificate_file()` to potentially split per-user input files that contain more than one certificate. Change `packet_split()` to add documentation and rename the key parameter to certificate, as it is more generic. Change `convert_certificate()` to use named parameters when calling `packet_split()`. Change `convert()` to call `convert_certificate()` on a list of sanitized certificates (generated using `sanitized_certificate_file()`) to be able to deal with multi-certificate files per user.
2021-10-04 15:12:33 -05:00
feature(keyringctl): keep filename if keyring split yields one keyring Instead of always returning an artificial name try to preserve the keyring filename if the split only yields a single certificate.
2021-10-19 19:16:10 -05:00
The original keyring filename is preserved if the split only yields a single certificate.
fix(keyringctl): preserve keyring split filenames in separated dirs This aids initial imports of keyrings that contain multiple certificates by allowing keyring_split to enforce preserving the filenames. This is achieved by moving each split keyring into unique sub directories where the original input filename remains unique.
2021-10-21 17:58:52 -05:00
If preserve_filename is True, all keyrings are placed into separate directories while preserving
the filename.
feature(keyringctl): keep filename if keyring split yields one keyring Instead of always returning an artificial name try to preserve the keyring filename if the split only yields a single certificate.
2021-10-19 19:16:10 -05:00
The file is split using sq.
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
keyringctl: Deal with multi-certificate per user files keyringctl: Add `sanitize_certificate_file()` to potentially split per-user input files that contain more than one certificate. Change `packet_split()` to add documentation and rename the key parameter to certificate, as it is more generic. Change `convert_certificate()` to use named parameters when calling `packet_split()`. Change `convert()` to call `convert_certificate()` on a list of sanitized certificates (generated using `sanitized_certificate_file()`) to be able to deal with multi-certificate files per user.
2021-10-04 15:12:33 -05:00
Parameters
----------
working_dir: Path
feature(keyringctl): use sq to split a keyring into individual certificates Lets use sequoia as well to split an input into individual certificates instead of creating a custom made function for this job. Pass down the name of the original input file to `convert_certificate` in case no override has been defined.
2021-10-12 12:20:33 -05:00
The path of the working directory below which to create the output files
keyring: Path
The path of a file containing a PGP keyring
fix(keyringctl): preserve keyring split filenames in separated dirs This aids initial imports of keyrings that contain multiple certificates by allowing keyring_split to enforce preserving the filenames. This is achieved by moving each split keyring into unique sub directories where the original input filename remains unique.
2021-10-21 17:58:52 -05:00
preserve_filename: bool
If True, all keyrings are placed into separate directories while preserving the filename
keyringctl: Deal with multi-certificate per user files keyringctl: Add `sanitize_certificate_file()` to potentially split per-user input files that contain more than one certificate. Change `packet_split()` to add documentation and rename the key parameter to certificate, as it is more generic. Change `convert_certificate()` to use named parameters when calling `packet_split()`. Change `convert()` to call `convert_certificate()` on a list of sanitized certificates (generated using `sanitized_certificate_file()`) to be able to deal with multi-certificate files per user.
2021-10-04 15:12:33 -05:00
Returns
-------
feature(keyringctl): use sq to split a keyring into individual certificates Lets use sequoia as well to split an input into individual certificates instead of creating a custom made function for this job. Pass down the name of the original input file to `convert_certificate` in case no override has been defined.
2021-10-12 12:20:33 -05:00
Iterable[Path]
An iterable over the naturally sorted list of certificate files derived from a keyring
keyringctl: Deal with multi-certificate per user files keyringctl: Add `sanitize_certificate_file()` to potentially split per-user input files that contain more than one certificate. Change `packet_split()` to add documentation and rename the key parameter to certificate, as it is more generic. Change `convert_certificate()` to use named parameters when calling `packet_split()`. Change `convert()` to call `convert_certificate()` on a list of sanitized certificates (generated using `sanitized_certificate_file()`) to be able to deal with multi-certificate files per user.
2021-10-04 15:12:33 -05:00
"""
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
keyring_dir = Path(mkdtemp(dir=working_dir, prefix="keyring-")).absolute()
feature(keyringctl): use sq to split a keyring into individual certificates Lets use sequoia as well to split an input into individual certificates instead of creating a custom made function for this job. Pass down the name of the original input file to `convert_certificate` in case no override has been defined.
2021-10-12 12:20:33 -05:00
with cwd(keyring_dir):
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
system(["sq", "keyring", "split", "--prefix", "", str(keyring)])
feature(keyringctl): keep filename if keyring split yields one keyring Instead of always returning an artificial name try to preserve the keyring filename if the split only yields a single certificate.
2021-10-19 19:16:10 -05:00
keyrings: List[Path] = list(natural_sort_path(keyring_dir.iterdir()))
fix(keyringctl): preserve keyring split filenames in separated dirs This aids initial imports of keyrings that contain multiple certificates by allowing keyring_split to enforce preserving the filenames. This is achieved by moving each split keyring into unique sub directories where the original input filename remains unique.
2021-10-21 17:58:52 -05:00
if 1 == len(keyrings) or preserve_filename:
for index, key in enumerate(keyrings):
keyring_sub_dir = Path(mkdtemp(dir=keyring_dir, prefix=f"{keyring.name}-")).absolute()
keyrings[index] = key.rename(keyring_sub_dir / keyring.name)
feature(keyringctl): keep filename if keyring split yields one keyring Instead of always returning an artificial name try to preserve the keyring filename if the split only yields a single certificate.
2021-10-19 19:16:10 -05:00
return keyrings
keyringctl: Deal with multi-certificate per user files keyringctl: Add `sanitize_certificate_file()` to potentially split per-user input files that contain more than one certificate. Change `packet_split()` to add documentation and rename the key parameter to certificate, as it is more generic. Change `convert_certificate()` to use named parameters when calling `packet_split()`. Change `convert()` to call `convert_certificate()` on a list of sanitized certificates (generated using `sanitized_certificate_file()`) to be able to deal with multi-certificate files per user.
2021-10-04 15:12:33 -05:00
feature(keyringctl): add force parameter to keyring_merge
2021-10-21 14:03:02 -05:00
def keyring_merge(certificates: List[Path], output: Optional[Path] = None, force: bool = False) -> str:
feature(keyringctl): add dedicated keyring_merge function
2021-10-21 13:34:07 -05:00
"""Merge multiple certificates into a keyring
Parameters
----------
certificates: List[Path]
List of paths to certificates to merge into a keyring
output: Optional[Path]
Path to a file which the keyring is written, return the result instead if None
feature(keyringctl): add force parameter to keyring_merge
2021-10-21 14:03:02 -05:00
force: bool
Whether to force overwriting existing files (defaults to False)
feature(keyringctl): add dedicated keyring_merge function
2021-10-21 13:34:07 -05:00
Returns
-------
str
The result if no output file has been used
"""
cmd = ["sq", "keyring", "merge"]
feature(keyringctl): add force parameter to keyring_merge
2021-10-21 14:03:02 -05:00
if force:
cmd.insert(1, "--force")
feature(keyringctl): add dedicated keyring_merge function
2021-10-21 13:34:07 -05:00
if output:
cmd += ["--output", str(output)]
cmd += [str(cert) for cert in sorted(certificates)]
chore(keyringctl): throw exception instead of exit on failed system calls
2021-10-21 14:05:03 -05:00
return system(cmd)
feature(keyringctl): add dedicated keyring_merge function
2021-10-21 13:34:07 -05:00
keyringctl: Deal with multi-certificate per user files keyringctl: Add `sanitize_certificate_file()` to potentially split per-user input files that contain more than one certificate. Change `packet_split()` to add documentation and rename the key parameter to certificate, as it is more generic. Change `convert_certificate()` to use named parameters when calling `packet_split()`. Change `convert()` to call `convert_certificate()` on a list of sanitized certificates (generated using `sanitized_certificate_file()`) to be able to deal with multi-certificate files per user.
2021-10-04 15:12:33 -05:00
def packet_split(working_dir: Path, certificate: Path) -> Iterable[Path]:
"""Split a file containing a PGP certificate into separate packet files
The files are split using sq
Parameters
----------
working_dir: Path
The path of the working directory below which to create the output files
certificate: Path
The absolute path of a file containing one PGP certificate
Returns
-------
Iterable[Path]
An iterable over the naturally sorted list of packet files derived from certificate
"""
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
packet_dir = Path(mkdtemp(dir=working_dir, prefix="packet-")).absolute()
keyringctl: Deal with multi-certificate per user files keyringctl: Add `sanitize_certificate_file()` to potentially split per-user input files that contain more than one certificate. Change `packet_split()` to add documentation and rename the key parameter to certificate, as it is more generic. Change `convert_certificate()` to use named parameters when calling `packet_split()`. Change `convert()` to call `convert_certificate()` on a list of sanitized certificates (generated using `sanitized_certificate_file()`) to be able to deal with multi-certificate files per user.
2021-10-04 15:12:33 -05:00
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
with cwd(packet_dir):
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
system(["sq", "packet", "split", "--prefix", "", str(certificate)])
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
return natural_sort_path(packet_dir.iterdir())
feature(keyringctl): improve packet_join to optionally return the result
2021-10-21 13:19:33 -05:00
def packet_join(packets: List[Path], output: Optional[Path] = None, force: bool = False) -> str:
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
"""Join PGP packet data in files to a single output file
Parameters
----------
packets: List[Path]
A list of paths to files that contain PGP packet data
feature(keyringctl): improve packet_join to optionally return the result
2021-10-21 13:19:33 -05:00
output: Optional[Path]
Path to a file to which all PGP packet data is written, return the result instead if None
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
force: bool
feature(keyringctl): add force parameter to keyring_merge
2021-10-21 14:03:02 -05:00
Whether to force overwriting existing files (defaults to False)
feature(keyringctl): improve packet_join to optionally return the result
2021-10-21 13:19:33 -05:00
Returns
-------
str
The result if no output file has been used
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
"""
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
cmd = ["sq", "packet", "join"]
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
if force:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
cmd.insert(1, "--force")
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
packets_str = list(map(lambda path: str(path), packets))
cmd.extend(packets_str)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
cmd.extend(["--output", str(output)])
chore(keyringctl): throw exception instead of exit on failed system calls
2021-10-21 14:05:03 -05:00
return system(cmd)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
def inspect(
packet: Path, certifications: bool = True, fingerprints: Optional[Dict[Fingerprint, Username]] = None
) -> str:
feature(keyringctl): add inspect command to pretty print certificates This command prints a new and pretty representation of the certificate data to visualize the keyring and its signatures.
2021-10-21 14:51:02 -05:00
"""Inspect PGP packet data and return the result
Parameters
----------
packet: Path
Path to a file that contain PGP data
certifications: bool
Whether to print third-party certifications
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
fingerprints: Optional[Dict[Fingerprint, Username]]
Optional dict of fingerprints to usernames to enrich the output with
feature(keyringctl): add inspect command to pretty print certificates This command prints a new and pretty representation of the certificate data to visualize the keyring and its signatures.
2021-10-21 14:51:02 -05:00
Returns
-------
str
The result of the inspection
"""
cmd = ["sq", "inspect"]
if certifications:
cmd.append("--certifications")
cmd.append(str(packet))
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
result: str = system(cmd)
if fingerprints:
for fingerprint, username in fingerprints.items():
result = sub(f"{fingerprint}", f"{fingerprint} {username}", result)
result = sub(f" {fingerprint[24:]}", f" {fingerprint[24:]} {username}", result)
return result
feature(keyringctl): add inspect command to pretty print certificates This command prints a new and pretty representation of the certificate data to visualize the keyring and its signatures.
2021-10-21 14:51:02 -05:00
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
def simplify_user_id(user_id: Uid) -> Uid:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Simplify the User ID string to contain more filesystem friendly characters
Parameters
----------
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
user_id: Uid
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
A User ID string (e.g. 'Foobar McFooface <foobar@foo.face>')
Returns
-------
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
Uid
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
The simplified representation of user_id
"""
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
user_id_str: str = user_id.replace("@", "_at_")
user_id_str = sub("[<>]", "", user_id_str)
user_id_str = sub("[" + escape(r" !@#$%^&*()_-+=[]{}\|;:,.<>/?") + "]", "_", user_id_str)
return Uid(user_id_str)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
feature(keyringctl): introduce Username type instead of plain str
2021-10-19 14:03:53 -05:00
def derive_username_from_fingerprint(keyring_dir: Path, certificate_fingerprint: Fingerprint) -> Optional[Username]:
feature(keyringctl): avoid splitting a certificate multiple times Move the name cascade to derive the username into the `convert_certificate` function which allows to use the certificate_fingerprint directly instead of trying to find it by splitting the certificate one more time before converting.
2021-10-19 12:10:51 -05:00
"""Attempt to derive the username of a public key fingerprint from a keyring directory
keyringctl: Derive username from target when importing existing key keyringctl: Add `derive_user_from_target()` to derive the username from an existing public key in the target directory when importing (updates to) an already known key. Change `convert()` to either use a custom name override (if provided), a username derived from target dir (if existing) or the file name of the to be imported file as username.
2021-10-17 05:58:19 -05:00
Parameters
----------
feature(keyringctl): avoid splitting a certificate multiple times Move the name cascade to derive the username into the `convert_certificate` function which allows to use the certificate_fingerprint directly instead of trying to find it by splitting the certificate one more time before converting.
2021-10-19 12:10:51 -05:00
keyring_dir: Path
keyringctl: Derive username from target when importing existing key keyringctl: Add `derive_user_from_target()` to derive the username from an existing public key in the target directory when importing (updates to) an already known key. Change `convert()` to either use a custom name override (if provided), a username derived from target dir (if existing) or the file name of the to be imported file as username.
2021-10-17 05:58:19 -05:00
The directory in which to look up a username
feature(keyringctl): avoid splitting a certificate multiple times Move the name cascade to derive the username into the `convert_certificate` function which allows to use the certificate_fingerprint directly instead of trying to find it by splitting the certificate one more time before converting.
2021-10-19 12:10:51 -05:00
certificate_fingerprint: Fingerprint
The public key fingerprint to derive the username from
keyringctl: Derive username from target when importing existing key keyringctl: Add `derive_user_from_target()` to derive the username from an existing public key in the target directory when importing (updates to) an already known key. Change `convert()` to either use a custom name override (if provided), a username derived from target dir (if existing) or the file name of the to be imported file as username.
2021-10-17 05:58:19 -05:00
Raises
------
Exception
If more than one username is found (a public key can only belong to one individual)
Returns
-------
feature(keyringctl): introduce Username type instead of plain str
2021-10-19 14:03:53 -05:00
Optional[Username]
keyringctl: Derive username from target when importing existing key keyringctl: Add `derive_user_from_target()` to derive the username from an existing public key in the target directory when importing (updates to) an already known key. Change `convert()` to either use a custom name override (if provided), a username derived from target dir (if existing) or the file name of the to be imported file as username.
2021-10-17 05:58:19 -05:00
A string representing the username a public key certificate belongs to, None otherwise
"""
feature(keyringctl): derive username from short key id fingerprints Allow short key id fingerprints to be used with the username derive function by adding a glob in front of the fingerprint component.
2021-10-19 12:12:48 -05:00
matches = list(keyring_dir.glob(f"*/*{certificate_fingerprint}"))
keyringctl: Derive username from target when importing existing key keyringctl: Add `derive_user_from_target()` to derive the username from an existing public key in the target directory when importing (updates to) an already known key. Change `convert()` to either use a custom name override (if provided), a username derived from target dir (if existing) or the file name of the to be imported file as username.
2021-10-17 05:58:19 -05:00
if len(matches) > 1:
raise Exception(
chore(keyringctl): apply black formatter
2021-10-19 14:11:37 -05:00
f"More than one username found in {keyring_dir} when probing for fingerprint '{certificate_fingerprint}': "
f"{matches}"
keyringctl: Derive username from target when importing existing key keyringctl: Add `derive_user_from_target()` to derive the username from an existing public key in the target directory when importing (updates to) an already known key. Change `convert()` to either use a custom name override (if provided), a username derived from target dir (if existing) or the file name of the to be imported file as username.
2021-10-17 05:58:19 -05:00
)
feature(keyringctl): avoid splitting a certificate multiple times Move the name cascade to derive the username into the `convert_certificate` function which allows to use the certificate_fingerprint directly instead of trying to find it by splitting the certificate one more time before converting.
2021-10-19 12:10:51 -05:00
elif not matches:
debug(f"Can not derive username from target directory for fingerprint {certificate_fingerprint}")
keyringctl: Derive username from target when importing existing key keyringctl: Add `derive_user_from_target()` to derive the username from an existing public key in the target directory when importing (updates to) an already known key. Change `convert()` to either use a custom name override (if provided), a username derived from target dir (if existing) or the file name of the to be imported file as username.
2021-10-17 05:58:19 -05:00
return None
else:
username = matches[0].parent.stem
chore(keyringctl): apply black formatter
2021-10-19 14:11:37 -05:00
debug(
f"Successfully derived username '{username}' from target directory for fingerprint "
f"{certificate_fingerprint}"
)
feature(keyringctl): introduce Username type instead of plain str
2021-10-19 14:03:53 -05:00
return Username(username)
keyringctl: Derive username from target when importing existing key keyringctl: Add `derive_user_from_target()` to derive the username from an existing public key in the target directory when importing (updates to) an already known key. Change `convert()` to either use a custom name override (if provided), a username derived from target dir (if existing) or the file name of the to be imported file as username.
2021-10-17 05:58:19 -05:00
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
def convert(
working_dir: Path,
feature(keyringctl): support importing multiple paths Lets pass in a list of path's and reduce them to one set of path iterables. This allows us to specify multiple source files/directories
2021-10-20 13:15:42 -05:00
source: Iterable[Path],
keyringctl: Copy files instead of moving them keyringctl: Change `__main__` to create the `target_dir` before calling any further function that relies on it. Change `convert()` to require the `target_dir` to be not None and to create all username based target directories before using `shutil.copytree()` to copy all sources to their respective target directories when iterating over the paths to persist. This has the upside, that updates to a target directory structure can be done on the fly (overwriting existing data), which is not possible with `shutil.move()`.
2021-10-04 12:25:24 -05:00
target_dir: Path,
feature(keyringctl): introduce Username type instead of plain str
2021-10-19 14:03:53 -05:00
name_override: Optional[Username] = None,
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
fingerprint_filter: Optional[Set[Fingerprint]] = None,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
) -> Path:
feature(keyringctl): use sq to split a keyring into individual certificates Lets use sequoia as well to split an input into individual certificates instead of creating a custom made function for this job. Pass down the name of the original input file to `convert_certificate` in case no override has been defined.
2021-10-12 12:20:33 -05:00
"""Convert a path containing PGP certificate material to a decomposed directory structure
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
feature(keyringctl): use sq to split a keyring into individual certificates Lets use sequoia as well to split an input into individual certificates instead of creating a custom made function for this job. Pass down the name of the original input file to `convert_certificate` in case no override has been defined.
2021-10-12 12:20:33 -05:00
Any input is first split by `keyring_split()` into individual certificates.
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
Parameters
----------
working_dir: Path
A directory to use for temporary files
feature(keyringctl): support importing multiple paths Lets pass in a list of path's and reduce them to one set of path iterables. This allows us to specify multiple source files/directories
2021-10-20 13:15:42 -05:00
source: Iterable[Path]
chore(doc): extend source parameter description
2021-10-12 12:39:07 -05:00
A path to a file or directory to decompose
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
target_dir: Path
A directory path to write the new directory structure to
feature(keyringctl): introduce Username type instead of plain str
2021-10-19 14:03:53 -05:00
name_override: Optional[Username]
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
An optional username override for the call to `convert_certificate()`
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
fingerprint_filter: Optional[Set[Fingerprint]]
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
An optional set of strings defining fingerprints of PGP public keys that all certificates will be filtered with
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
Returns
-------
Path
The directory that contains the resulting directory structure (target_dir)
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
directories: List[Path] = []
feature(keyringctl): support importing multiple paths Lets pass in a list of path's and reduce them to one set of path iterables. This allows us to specify multiple source files/directories
2021-10-20 13:15:42 -05:00
keys: Iterable[Path] = set(chain.from_iterable(map(lambda s: s.iterdir() if s.is_dir() else [s], source)))
chore(keyringctl): deduplicate iteration and split code in convert()
2021-10-12 12:42:22 -05:00
for key in keys:
fix(keyringctl): preserve keyring split filenames in separated dirs This aids initial imports of keyrings that contain multiple certificates by allowing keyring_split to enforce preserving the filenames. This is achieved by moving each split keyring into unique sub directories where the original input filename remains unique.
2021-10-21 17:58:52 -05:00
for cert in keyring_split(working_dir=working_dir, keyring=key, preserve_filename=True):
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
directories.append(
convert_certificate(
working_dir=working_dir,
certificate=cert,
feature(keyringctl): avoid splitting a certificate multiple times Move the name cascade to derive the username into the `convert_certificate` function which allows to use the certificate_fingerprint directly instead of trying to find it by splitting the certificate one more time before converting.
2021-10-19 12:10:51 -05:00
keyring_dir=target_dir,
name_override=name_override,
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
fingerprint_filter=fingerprint_filter,
)
)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
for path in directories:
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
(target_dir / path.name).mkdir(parents=True, exist_ok=True)
keyringctl: Copy files instead of moving them keyringctl: Change `__main__` to create the `target_dir` before calling any further function that relies on it. Change `convert()` to require the `target_dir` to be not None and to create all username based target directories before using `shutil.copytree()` to copy all sources to their respective target directories when iterating over the paths to persist. This has the upside, that updates to a target directory structure can be done on the fly (overwriting existing data), which is not possible with `shutil.move()`.
2021-10-04 12:25:24 -05:00
copytree(src=path, dst=(target_dir / path.name), dirs_exist_ok=True)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
return target_dir
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
def get_trusted_and_revoked_certs(certs: List[Path]) -> Tuple[List[Fingerprint], List[Fingerprint]]:
"""Get the fingerprints of all trusted and all self revoked public keys in a directory
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
Parameters
----------
certs: List[Path]
The certificates to trust
Returns
-------
Tuple[List[str], List[str]]
A tuple with the first item containing the fingerprints of all public keys and the second item containing the
fingerprints of all self-revoked public keys
"""
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
all_certs: List[Fingerprint] = []
revoked_certs: List[Fingerprint] = []
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
# TODO: what about direct key revocations/signatures?
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
debug(f"Retrieving trusted and self-revoked certificates from {[str(cert_dir) for cert_dir in certs]}")
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
for cert_dir in sorted(get_cert_paths(certs)):
cert_fingerprint = Fingerprint(cert_dir.stem)
all_certs.append(cert_fingerprint)
for revocation_cert in cert_dir.glob("revocation/*.asc"):
if cert_fingerprint.endswith(revocation_cert.stem):
debug(f"Revoking {cert_fingerprint} due to self-revocation")
revoked_certs.append(cert_fingerprint)
trusted_keys = [cert for cert in all_certs if cert not in revoked_certs]
return trusted_keys, revoked_certs
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
def export_ownertrust(certs: List[Path], output: Path) -> Tuple[List[Fingerprint], List[Fingerprint]]:
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
"""Export ownertrust from a set of keys and return the trusted and revoked fingerprints
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
The output file format is compatible with `gpg --import-ownertrust` and lists the main fingerprint ID of all
non-revoked keys as fully trusted.
The exported file is used by pacman-key when importing a keyring (see
https://man.archlinux.org/man/pacman-key.8#PROVIDING_A_KEYRING_FOR_IMPORT).
Parameters
----------
certs: List[Path]
The certificates to trust
output: Path
The file path to write to
"""
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
trusted_certs, revoked_certs = get_trusted_and_revoked_certs(certs=certs)
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
with open(file=output, mode="w") as trusted_certs_file:
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
for cert in sorted(set(trusted_certs)):
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
debug(f"Writing {cert} to {output}")
trusted_certs_file.write(f"{cert}:4:\n")
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
return trusted_certs, revoked_certs
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
def export_revoked(certs: List[Path], main_keys: List[Fingerprint], output: Path, min_revoker: int = 2) -> None:
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
"""Export the PGP revoked status from a set of keys
The output file contains the fingerprints of all self-revoked keys and all keys for which at least two revocations
by any main key exist.
The exported file is used by pacman-key when importing a keyring (see
https://man.archlinux.org/man/pacman-key.8#PROVIDING_A_KEYRING_FOR_IMPORT).
Parameters
----------
certs: List[Path]
A list of directories with keys to check for their revocation status
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
main_keys: List[Fingerprint]
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
A list of strings representing the fingerprints of (current and/or revoked) main keys
output: Path
The file path to write to
min_revoker: int
The minimum amount of revocation certificates on a User ID from any main key to deem a public key as revoked
(defaults to 2)
"""
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
trusted_certs, revoked_certs = get_trusted_and_revoked_certs(certs=certs)
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
debug(f"Retrieving certificates revoked by main keys from {[str(cert_dir) for cert_dir in certs]}")
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
foreign_revocations: Dict[Fingerprint, Set[Fingerprint]] = defaultdict(set)
for cert_dir in sorted(get_cert_paths(certs)):
fingerprint = Fingerprint(cert_dir.name)
debug(f"Inspecting public key {fingerprint}")
for revocation_cert in cert_dir.glob("uid/*/revocation/*.asc"):
revocation_fingerprint = Fingerprint(revocation_cert.stem)
foreign_revocations[fingerprint].update(
[revocation_fingerprint for main_key in main_keys if main_key.endswith(revocation_fingerprint)]
)
# TODO: find a better (less naive) approach, as this would also match on public certificates,
# where some UIDs are signed and others are revoked
if len(foreign_revocations[fingerprint]) >= min_revoker:
debug(
f"Revoking {cert_dir.name} due to {set(foreign_revocations[fingerprint])} "
"being main key revocations"
)
revoked_certs.append(fingerprint)
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
with open(file=output, mode="w") as trusted_certs_file:
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
for cert in sorted(set(revoked_certs)):
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
debug(f"Writing {cert} to {output}")
trusted_certs_file.write(f"{cert}\n")
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
def get_fingerprints_from_import_source(working_dir: Path, source: List[Path]) -> Dict[Fingerprint, Username]:
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
"""Get all fingerprints of PGP public keys from import file(s)
Parameters
----------
working_dir: Path
A directory to use for temporary files
feature(keyringctl): support importing multiple paths Lets pass in a list of path's and reduce them to one set of path iterables. This allows us to specify multiple source files/directories
2021-10-20 13:15:42 -05:00
source: List[Path]
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
The path to a source file or directory containing keyrings
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
Returns
-------
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
Dict[Fingerprint, Username]
A dict of all fingerprints and their usernames of PGP public keys below path
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
"""
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
fingerprints: Dict[Fingerprint, Username] = {}
feature(keyringctl): support importing multiple paths Lets pass in a list of path's and reduce them to one set of path iterables. This allows us to specify multiple source files/directories
2021-10-20 13:15:42 -05:00
keys: Iterable[Path] = set(chain.from_iterable(map(lambda s: s.iterdir() if s.is_dir() else [s], source)))
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
for key in keys:
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
for certificate in keyring_split(working_dir=working_dir, keyring=key, preserve_filename=True):
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
for packet in packet_split(working_dir=working_dir, certificate=certificate):
if packet.name.endswith("--PublicKey"):
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
fingerprints[Fingerprint(packet_dump_field(packet, "Fingerprint"))] = Username(certificate.stem)
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
debug(f"Fingerprints of PGP public keys in {source}: {fingerprints}")
return fingerprints
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
def get_fingerprints_from_decomposed_dir(path: Path) -> Dict[Fingerprint, Username]:
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
"""Get all fingerprints of PGP public keys from a decomposed directory structure
Parameters
----------
path: Path
The path to a decomposed directory structure
Returns
-------
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
Dict[Fingerprint, Username]
A dict of all fingerprints and their usernames of PGP public keys below path
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
"""
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
fingerprints: Dict[Fingerprint, Username] = {}
for cert in sorted(get_cert_paths([path])):
fingerprints[Fingerprint(cert.name)] = Username(cert.parent.name)
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
debug(f"Fingerprints of PGP public keys in {path}: {fingerprints}")
return fingerprints
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
def get_fingerprints(working_dir: Path, decomposed_paths: List[Path]) -> Dict[Fingerprint, Username]:
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
"""Get the fingerprints of PGP public keys from input paths and decomposed directory structures
Parameters
----------
working_dir: Path
A directory to use for temporary files
decomposed_paths: List[Path]
A list of paths that identify decomposed PGP data in directory structures
Returns
-------
feature(keyringctl): add type hinting for fingerprint and uid This drastically improves readability and type safety when joggling with different keys in the data structures.
2021-10-19 10:35:59 -05:00
Set[Fingerprint]
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
A dict of all fingerprints and their usernames of PGP public keys below path
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
"""
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
fingerprints: Dict[Fingerprint, Username] = {}
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
fingerprints.update(
get_fingerprints_from_import_source(
working_dir=working_dir,
source=args.source,
)
)
for decomposed_path in decomposed_paths:
fingerprints.update(get_fingerprints_from_decomposed_dir(path=decomposed_path))
return fingerprints
feature(keyringctl): use the export command purely to export keyrings This gives more control over the export command that may be useful to export a single packager to import it into gpg. This will also give more flexibility to chain this function to the future verify stage. By default the command exports the whole keyring directory.
2021-10-21 13:34:48 -05:00
def export(
working_dir: Path,
keyring_root: Path,
sources: Optional[List[Path]] = None,
output: Optional[Path] = None,
) -> str:
"""Export all provided PGP packet files to a single output file
If sources contains directories, any .asc files below them are considered.
Parameters
----------
working_dir: Path
A directory to use for temporary files
keyring_root: Path
The keyring root directory to look up username shorthand sources
sources: Optional[List[Path]]
A list of directories or files from which to read PGP packet information (defaults to `keyring_root`)
output: Optional[Path]
An output file that all PGP packet data is written to, return the result instead if None
Returns
-------
str
The result if no output file has been used
"""
if not sources:
sources = [keyring_root]
# resolve shorthand username exports for packager keys
for index, source in enumerate(sources):
packager_source = keyring_root / "packager" / source.name
if not source.exists() and packager_source.exists():
sources[index] = packager_source
temp_dir = Path(mkdtemp(dir=working_dir, prefix="arch-keyringctl-export-join-")).absolute()
chore(keyringctl): move cert depth first search to own function This way we can reuse the functionality which will allow to simplify a lot of places that have multiple layers of inflexible nested loops.
2021-10-22 13:17:50 -05:00
cert_paths: Set[Path] = get_cert_paths(sources)
certificates: List[Path] = []
feature(keyringctl): use the export command purely to export keyrings This gives more control over the export command that may be useful to export a single packager to import it into gpg. This will also give more flexibility to chain this function to the future verify stage. By default the command exports the whole keyring directory.
2021-10-21 13:34:48 -05:00
chore(keyringctl): move cert depth first search to own function This way we can reuse the functionality which will allow to simplify a lot of places that have multiple layers of inflexible nested loops.
2021-10-22 13:17:50 -05:00
for cert_dir in sorted(cert_paths):
feature(keyringctl): use the export command purely to export keyrings This gives more control over the export command that may be useful to export a single packager to import it into gpg. This will also give more flexibility to chain this function to the future verify stage. By default the command exports the whole keyring directory.
2021-10-21 13:34:48 -05:00
cert_path = temp_dir / f"{cert_dir.name}.asc"
debug(f"Joining {cert_dir} in {cert_path}")
packet_join(
packets=sorted(cert_dir.glob("**/*.asc")),
output=cert_path,
force=True,
)
certificates.append(cert_path)
feature(keyringctl): use build command to create final artifacts This allows an easy to use cli which invokes the export function to get the keyring and uses the ownertrust and revoke functions to write all artifacts into a target directory.
2021-10-21 14:04:16 -05:00
return keyring_merge(certificates, output, force=True)
feature(keyringctl): use the export command purely to export keyrings This gives more control over the export command that may be useful to export a single packager to import it into gpg. This will also give more flexibility to chain this function to the future verify stage. By default the command exports the whole keyring directory.
2021-10-21 13:34:48 -05:00
feature(keyringctl): use build command to create final artifacts This allows an easy to use cli which invokes the export function to get the keyring and uses the ownertrust and revoke functions to write all artifacts into a target directory.
2021-10-21 14:04:16 -05:00
def build(
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
working_dir: Path,
feature(keyringctl): use build command to create final artifacts This allows an easy to use cli which invokes the export function to get the keyring and uses the ownertrust and revoke functions to write all artifacts into a target directory.
2021-10-21 14:04:16 -05:00
keyring_root: Path,
target_dir: Path,
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
) -> None:
feature(keyringctl): use build command to create final artifacts This allows an easy to use cli which invokes the export function to get the keyring and uses the ownertrust and revoke functions to write all artifacts into a target directory.
2021-10-21 14:04:16 -05:00
"""Build keyring PGP artifacts alongside ownertrust and revoked status files
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
Parameters
----------
working_dir: Path
A directory to use for temporary files
feature(keyringctl): use build command to create final artifacts This allows an easy to use cli which invokes the export function to get the keyring and uses the ownertrust and revoke functions to write all artifacts into a target directory.
2021-10-21 14:04:16 -05:00
keyring_root: Path
The keyring root directory to build the artifacts from
target_dir: Path
Output directory that all artifacts are written to
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
"""
feature(keyringctl): use build command to create final artifacts This allows an easy to use cli which invokes the export function to get the keyring and uses the ownertrust and revoke functions to write all artifacts into a target directory.
2021-10-21 14:04:16 -05:00
target_dir.mkdir(parents=True, exist_ok=True)
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
feature(keyringctl): use build command to create final artifacts This allows an easy to use cli which invokes the export function to get the keyring and uses the ownertrust and revoke functions to write all artifacts into a target directory.
2021-10-21 14:04:16 -05:00
keyring: Path = target_dir / Path("archlinux.gpg")
export(working_dir=working_dir, keyring_root=keyring_root, output=keyring)
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
[trusted_main_keys, revoked_main_keys] = export_ownertrust(
feature(keyringctl): use build command to create final artifacts This allows an easy to use cli which invokes the export function to get the keyring and uses the ownertrust and revoke functions to write all artifacts into a target directory.
2021-10-21 14:04:16 -05:00
certs=[keyring_root / "main"],
output=target_dir / "archlinux-trusted",
)
export_revoked(
chore(keyringctl): simplify trust functions and return trusted/revoked The API makes more sense to return (trusted,revoked) as the caller can simply derive all certificates by joining the two sets. To simplify the functions, some code has been replaced to use helper methods to flatten the nested loops.
2021-10-22 14:13:52 -05:00
certs=[keyring_root],
main_keys=trusted_main_keys + revoked_main_keys,
feature(keyringctl): use build command to create final artifacts This allows an easy to use cli which invokes the export function to get the keyring and uses the ownertrust and revoke functions to write all artifacts into a target directory.
2021-10-21 14:04:16 -05:00
output=target_dir / "archlinux-revoked",
)
keyringctl: Implement export of ownertrust/ revoker status keyringctl: Add `temp_join_keys()` to generically join PGP packets in a directory below a temporary directory. Add `get_all_and_revoked_certs()` to retrieve a tuple containing a list of all public key fingerprints and a list of all self-revoked public key fingerprints in a list of paths. Add `export_ownertrust()` to export a list of fingerprints of non-revoked public keys to a file that can be imported using `gpg --import-ownertrust`. Add `export_revoked()` to export the fingerprints of all self-revoked public keys and the fingerprints of public keys that have been revoked by third party signing keys (the latter is still fairly naive). Change `export_keyring()` to make use of `temp_join_keys()` for preparing main signing keys and general keys for the export to file. Add integration for exporting ownertrust and revoker status (using `export_ownertrust()` and `export_revoked()`, respectively). Change `__main__` by extending the export_parser by a `-m`/ `--main` argument to provide one or multiple files or directories, that serve as the signing authority for key material located below `-s`/ `--source`. Add a `-p`/ `--pacman-integration` to provide the means to export ownertrust and revoker status on demand.
2021-10-10 11:28:30 -05:00
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
feature(keyringctl): add simple command to list all certificates
2021-10-21 14:13:35 -05:00
def list_keyring(keyring_root: Path, sources: Optional[List[Path]] = None, main_keys: bool = False) -> None:
"""List certificates in the keyring
If sources contains directories, all certificate below them are considered.
Parameters
----------
keyring_root: Path
The keyring root directory to look up username shorthand sources
sources: Optional[List[Path]]
A list of username or files/directories from which to read PGP packet information (defaults to `keyring_root`)
main_keys: bool
List main keys instead of packager keys (defaults to False)
"""
keyring_dir = keyring_root / ("main" if main_keys else "packager")
if not sources:
sources = list(keyring_dir.iterdir())
# resolve shorthand username exports for packager keys
for index, source in enumerate(sources):
packager_source = keyring_dir / source.name
if not source.exists() and packager_source.exists():
sources[index] = packager_source
username_length = max([len(source.name) for source in sources])
for userdir in sources:
certificates = [cert.name for cert in userdir.iterdir()]
print(f"{userdir.name:<{username_length}} {' '.join(certificates)}")
feature(keyringctl): add inspect command to pretty print certificates This command prints a new and pretty representation of the certificate data to visualize the keyring and its signatures.
2021-10-21 14:51:02 -05:00
def inspect_keyring(working_dir: Path, keyring_root: Path, sources: Optional[List[Path]]) -> str:
"""Inspect certificates in the keyring and pretty print the data
If sources contains directories, all certificate below them are considered.
Parameters
----------
working_dir: Path
A directory to use for temporary files
keyring_root: Path
The keyring root directory to look up username shorthand sources
sources: Optional[List[Path]]
A list of username or files/directories from which to read PGP packet information (defaults to `keyring_root`)
Returns
-------
str
The result of the inspect
"""
if not sources:
sources = [keyring_root]
# resolve shorthand username exports for packager keys
for index, source in enumerate(sources):
packager_source = keyring_root / "packager" / source.name
if not source.exists() and packager_source.exists():
sources[index] = packager_source
keyring = Path(mkstemp(dir=working_dir, prefix="packet-", suffix=".asc")[1]).absolute()
export(working_dir=working_dir, keyring_root=keyring_root, sources=sources, output=keyring)
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
return inspect(
packet=keyring, certifications=True, fingerprints=get_fingerprints_from_decomposed_dir(path=keyring_root)
)
feature(keyringctl): add inspect command to pretty print certificates This command prints a new and pretty representation of the certificate data to visualize the keyring and its signatures.
2021-10-21 14:51:02 -05:00
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
def absolute_path(path: str) -> Path:
keyringctl: Add documentation to all functions keyringctl: Add documentation to all functions. Change the inlined functions `convert()` and `alphanum_key()` in `natural_sort_path()` to rely on type Union[int, str] instead of type Any. Change `convert_certificate()` to derive the username using the stem of the provided certificate.
2021-10-11 06:00:48 -05:00
"""Return the absolute path of a given str
Parameters
----------
path: str
A string representing a path
Returns
-------
Path
The absolute path representation of path
"""
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
return Path(path).absolute()
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
if __name__ == "__main__":
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
parser = ArgumentParser()
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
parser.add_argument(
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
"-v", "--verbose", action="store_true", help="Causes to print debugging messages about the progress"
)
parser.add_argument("--wait", action="store_true", help="Block before cleaning up the temp directory")
parser.add_argument(
"-f",
"--force",
action="store_true",
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
default=False,
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
help="force the execution of subcommands (e.g. overwriting of files)",
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
subcommands = parser.add_subparsers(dest="subcommand")
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
convert_parser = subcommands.add_parser(
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
"convert",
feature(keyringctl): unify import subcommand for condensed api Both commands are basically doing the same with the same params except the target directory differs. Lets condense this behavior by using a single subcommand with a boolean options.
2021-10-20 13:02:08 -05:00
help="convert one or multiple PGP public keys to a decomposed directory structure",
keyringctl: Dedicated functions for writing to file keyringctl: Add `persist_basic_key()`, `persist_direct_keys()`, `persist_certifications()` and `persist_revocations()` to allow for dedicated writing of basic key material, direct key signatures, per UID certificates and per UID revocations (respectively). Change `convert_certificate()` to call the new dedicated write functions instead of implementing the functionality. Change `convert_certificate()` to raise on missing current_packet_key when trying to work on signature files (this is unlikely to occur, unless the input data is somehow broken, but it keeps the linter happy). Change `convert_certificate()` to handle direct_keys by issuer on a given root key (DirectKey signatures by the same issuer are combined). Change the argparse subparser for the 'convert' command to include a help text.
2021-10-03 08:06:33 -05:00
)
feature(keyringctl): support importing multiple paths Lets pass in a list of path's and reduce them to one set of path iterables. This allows us to specify multiple source files/directories
2021-10-20 13:15:42 -05:00
convert_parser.add_argument("source", type=absolute_path, nargs="+", help="Files or directorie to convert")
fix(keyringctl): restore --target option for convert command
2021-10-20 13:08:26 -05:00
convert_parser.add_argument("--target", type=absolute_path, help="Target directory instead of a random tmpdir")
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
convert_parser.add_argument(
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
"--name",
feature(keyringctl): introduce Username type instead of plain str
2021-10-19 14:03:53 -05:00
type=Username,
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
default=None,
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
help="override the username to use (only useful when using a single file as source)",
keyringctl: Derive output dir from file and allow override keyringctl: Change `convert_certificates()` to use a more descriptive `name_override` parameter in its signature to allow the overriding of the username directory name into which key material is persisted. Distinguish between the per-username directory and the eventual key material directory. Instead of the key directory return the username directory. Change the `persist*` functions to use the `key_dir` instead of the `root_dir` terminology as well. Change `convert()` to optionally allow a `name_override` as well and use that in the calls to `convert_certificate()`. Make the moving of files more robust, by at least allowing to move the per-key directories for a username, if the username target directory exists already. NOTE: This needs expansion for the use-case where existing files should be updated/extended by new files. Add an additional argument to the 'convert' argparse parser to allow users to override the target username directory name.
2021-10-03 14:41:09 -05:00
)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
feature(keyringctl): unify import subcommand for condensed api Both commands are basically doing the same with the same params except the target directory differs. Lets condense this behavior by using a single subcommand with a boolean options.
2021-10-20 13:02:08 -05:00
import_parser = subcommands.add_parser(
"import",
help="import one or several PGP keys to the keyring directory structure",
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
)
feature(keyringctl): support importing multiple paths Lets pass in a list of path's and reduce them to one set of path iterables. This allows us to specify multiple source files/directories
2021-10-20 13:15:42 -05:00
import_parser.add_argument("source", type=absolute_path, nargs="+", help="Files or directories to import")
feature(keyringctl): unify import subcommand for condensed api Both commands are basically doing the same with the same params except the target directory differs. Lets condense this behavior by using a single subcommand with a boolean options.
2021-10-20 13:02:08 -05:00
import_parser.add_argument(
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
"--name",
feature(keyringctl): introduce Username type instead of plain str
2021-10-19 14:03:53 -05:00
type=Username,
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
default=None,
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
help="override the username to use (only useful when using a single file as source)",
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
)
feature(keyringctl): unify import subcommand for condensed api Both commands are basically doing the same with the same params except the target directory differs. Lets condense this behavior by using a single subcommand with a boolean options.
2021-10-20 13:02:08 -05:00
import_parser.add_argument("--main", action="store_true", help="Import a main signing key into the keyring")
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
export_parser = subcommands.add_parser(
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
"export",
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
help="export a directory structure of PGP packet data to a combined file",
)
feature(keyringctl): use the export command purely to export keyrings This gives more control over the export command that may be useful to export a single packager to import it into gpg. This will also give more flexibility to chain this function to the future verify stage. By default the command exports the whole keyring directory.
2021-10-21 13:34:48 -05:00
export_parser.add_argument("-o", "--output", type=absolute_path, help="file to write PGP packet data to")
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
export_parser.add_argument(
feature(keyringctl): use the export command purely to export keyrings This gives more control over the export command that may be useful to export a single packager to import it into gpg. This will also give more flexibility to chain this function to the future verify stage. By default the command exports the whole keyring directory.
2021-10-21 13:34:48 -05:00
"source",
nargs="*",
help="username or files/directories containing PGP packet data (can be provided multiple times)",
keyringctl: Add writing to keyring output file keyringctl: Change `packet_join()` to add documentation and a `force` parameter with which sq's force parameter may be toggled (defaults to False). Add `export_keyring()` to allow writing all provided PGP packet files to a single output file using `sq keyring merge`. Change `__main__` to add an `export` subcommand to allow for providing multiple input sources and one output file. Add an optional `-f/--force` parameter that can be used to force subcommands that support it. Remove the unused `start_dir` variable. Move the creation of `target_dir` below the context that creates the working directory and only create it when using the `convert` or `import` subcommands (as it is not used otherwise). Call `export_keyring()` when using the `export` subcommand.
2021-10-05 11:31:31 -05:00
type=absolute_path,
)
feature(keyringctl): use build command to create final artifacts This allows an easy to use cli which invokes the export function to get the keyring and uses the ownertrust and revoke functions to write all artifacts into a target directory.
2021-10-21 14:04:16 -05:00
build_parser = subcommands.add_parser(
"build",
help="build keyring PGP artifacts alongside ownertrust and revoked status files",
)
feature(keyringctl): add simple command to list all certificates
2021-10-21 14:13:35 -05:00
list_parser = subcommands.add_parser(
"list",
help="list the certificates in the keyring",
)
list_parser.add_argument("--main", action="store_true", help="List main signing keys instead of packager keys")
list_parser.add_argument(
"source",
nargs="*",
help="username or files/directories containing certificates (can be provided multiple times)",
type=absolute_path,
)
feature(keyringctl): add inspect command to pretty print certificates This command prints a new and pretty representation of the certificate data to visualize the keyring and its signatures.
2021-10-21 14:51:02 -05:00
inspect_parser = subcommands.add_parser(
"inspect",
help="inspect certificates in the keyring and pretty print the data",
)
inspect_parser.add_argument(
"source",
nargs="*",
help="username or directories containing certificates",
type=absolute_path,
)
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
args = parser.parse_args()
if args.verbose:
basicConfig(level=DEBUG)
# temporary working directory that gets auto cleaned
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
with TemporaryDirectory(prefix="arch-keyringctl-") as tempdir:
feature(keyringctl): move main/packager folders to isolated keyring dir This helps to structure the layout of the repository better by having one root folder that contains the actual decomposed keyring structure.
2021-10-19 18:41:04 -05:00
keyring_root = Path("keyring").absolute()
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
working_dir = Path(tempdir)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
debug(f"Working directory: {working_dir}")
fix(keyringctl): restore cwd before deleting the temporary working dir This avoids potential issues with wrapped runtime like ipython or pdb that try to invoke functions at exit and access the current working directory, which will ultimately lead to an error in case we deleted it before changing the current working directory.
2021-10-12 12:22:30 -05:00
with cwd(working_dir):
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
if "convert" == args.subcommand:
fix(keyringctl): restore --target option for convert command
2021-10-20 13:08:26 -05:00
target_dir = args.target or Path(mkdtemp(prefix="arch-keyringctl-")).absolute()
print(convert(working_dir, args.source, target_dir=target_dir))
feature(keyringctl): unify import subcommand for condensed api Both commands are basically doing the same with the same params except the target directory differs. Lets condense this behavior by using a single subcommand with a boolean options.
2021-10-20 13:02:08 -05:00
elif "import" == args.subcommand:
target_dir = "main" if args.main else "packager"
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
print(
convert(
working_dir=working_dir,
source=args.source,
feature(keyringctl): unify import subcommand for condensed api Both commands are basically doing the same with the same params except the target directory differs. Lets condense this behavior by using a single subcommand with a boolean options.
2021-10-20 13:02:08 -05:00
target_dir=keyring_root / target_dir,
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
name_override=args.name,
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
fingerprint_filter=set(get_fingerprints(
keyringctl: Implement filtering of certifications keyringctl: Add `get_fingerprints_from_import_source()` to derive all fingerprints of PGP public keys found in the import source. Add `get_fingerprints_from_decomposed_dir()` to derive all fingerprints of PGP public keys found in a directory structure holding decomposed PGP packet data. Add `get_fingerprints()` to derive a set of fingerprints of PGP public keys provided through `get_fingerprints_from_import_source()` and `get_fingerprints_from_decomposed_dir()`. Change `convert()` and `convert_certificate()` to accept an optional set of strings (`fingerprint_filter`) that may be used as a filter for valid fingerprints when considering certifications. Change `__main__` to call `convert()` when importing keys to packager or main dir, providing `fingerprint_filter` which will attempt to look up fingerprints in the source as well as the target.
2021-10-18 05:47:12 -05:00
working_dir=working_dir,
chore(keyringctl): use singular for packager directory as well So far we have used singular for all directories, lets keep that for the packager directory as well.
2021-10-19 18:34:44 -05:00
decomposed_paths=[keyring_root / "main", keyring_root / "packager"],
feature(keyringctl): collect usernames to fingerprints to enrich output By collecting the matching usernames to all fingerprints we are able to enrich the output of `inspect` to show the usernames next to the certifications.
2021-10-22 13:21:27 -05:00
).keys()),
keyringctl: Simplify subcommands keyringctl: Change `convert()` to create the target directory including parents. Change `export_keyring()` to create the output directory and its parents before outputting data into it. Remove `keyring_import()` as its functionality is covered by using `convert()` directly with different subcommands. Change `__main__` to define `import-main` and `import-packager` subcommands instead of `import` and to add an `export-keyring` subcommand. Remove the explicit creation of target dirs (it is now implemented in `convert()` and `export_keyring()`.
2021-10-16 17:12:57 -05:00
)
)
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
elif "export" == args.subcommand:
feature(keyringctl): use the export command purely to export keyrings This gives more control over the export command that may be useful to export a single packager to import it into gpg. This will also give more flexibility to chain this function to the future verify stage. By default the command exports the whole keyring directory.
2021-10-21 13:34:48 -05:00
print(
export(
working_dir=working_dir,
keyring_root=keyring_root,
sources=args.source,
output=args.output,
),
end="",
fix(keyringctl): restore cwd before deleting the temporary working dir This avoids potential issues with wrapped runtime like ipython or pdb that try to invoke functions at exit and access the current working directory, which will ultimately lead to an error in case we deleted it before changing the current working directory.
2021-10-12 12:22:30 -05:00
)
feature(keyringctl): use build command to create final artifacts This allows an easy to use cli which invokes the export function to get the keyring and uses the ownertrust and revoke functions to write all artifacts into a target directory.
2021-10-21 14:04:16 -05:00
elif "build" == args.subcommand:
build(
working_dir=working_dir,
keyring_root=keyring_root,
target_dir=keyring_root.parent / "build",
)
feature(keyringctl): add simple command to list all certificates
2021-10-21 14:13:35 -05:00
elif "list" == args.subcommand:
list_keyring(
keyring_root=keyring_root,
sources=args.source,
main_keys=args.main,
)
feature(keyringctl): add inspect command to pretty print certificates This command prints a new and pretty representation of the certificate data to visualize the keyring and its signatures.
2021-10-21 14:51:02 -05:00
elif "inspect" == args.subcommand:
print(
inspect_keyring(
working_dir=working_dir,
keyring_root=keyring_root,
sources=args.source,
),
end="",
)
feature(keyringctl): print help if invoked without any subcommand
2021-10-20 13:04:02 -05:00
else:
parser.print_help()
feature(keyringctl): add tool to work with key data
2021-08-25 11:53:07 -05:00
fix(keyringctl): restore cwd before deleting the temporary working dir This avoids potential issues with wrapped runtime like ipython or pdb that try to invoke functions at exit and access the current working directory, which will ultimately lead to an error in case we deleted it before changing the current working directory.
2021-10-12 12:22:30 -05:00
if args.wait:
keyringctl: Format file keyringctl: Use black to format the file, isort to auto-sort all imports. Remove commented code and (for now) ignore the high complexity in `convert()` so that flake8 can be used.
2021-10-16 17:50:34 -05:00
print("Press [ENTER] to continue")
fix(keyringctl): restore cwd before deleting the temporary working dir This avoids potential issues with wrapped runtime like ipython or pdb that try to invoke functions at exit and access the current working directory, which will ultimately lead to an error in case we deleted it before changing the current working directory.
2021-10-12 12:22:30 -05:00
input()
Reference in New Issue Copy Permalink