diff options
| -rw-r--r-- | debian/changelog | 3 | ||||
| -rw-r--r-- | src/Propellor/Gpg.hs | 10 | ||||
| -rw-r--r-- | src/Propellor/Property/Gpg.hs | 39 |
3 files changed, 37 insertions, 15 deletions
diff --git a/debian/changelog b/debian/changelog index d9e9bead..a4857ba4 100644 --- a/debian/changelog +++ b/debian/changelog @@ -5,6 +5,9 @@ propellor (2.15.1) UNRELEASED; urgency=medium * Added User.systemAccountFor and User.systemAccountFor' properties. Thanks, Félix Sipma. * Merged Utility changes from git-annex. + * Gpg.keyImported converted to not use a flag file and instead check + if gpg has the provided key already. + Thanks, Félix Sipma. -- Joey Hess <id@joeyh.name> Tue, 08 Dec 2015 11:59:43 -0400 diff --git a/src/Propellor/Gpg.hs b/src/Propellor/Gpg.hs index 960c70d3..949eb5b5 100644 --- a/src/Propellor/Gpg.hs +++ b/src/Propellor/Gpg.hs @@ -79,12 +79,12 @@ rmKey keyid = exitBool =<< allM (uncurry actionMessage) ] where rmkeyring = boolSystem "gpg" $ - (map Param useKeyringOpts) ++ + (map Param useKeyringOpts) ++ [ Param "--batch" , Param "--yes" , Param "--delete-key", Param keyid ] - + gitconfig = ifM ((==) (keyid++"\n", True) <$> processTranscript "git" ["config", "user.signingkey"] Nothing) ( boolSystem "git" [ Param "config" @@ -92,7 +92,7 @@ rmKey keyid = exitBool =<< allM (uncurry actionMessage) , Param "user.signingkey" ] , return True - ) + ) reencryptPrivData :: IO Bool reencryptPrivData = ifM (doesFileExist privDataFile) @@ -101,7 +101,7 @@ reencryptPrivData = ifM (doesFileExist privDataFile) gitAdd privDataFile , return True ) - + gitAdd :: FilePath -> IO Bool gitAdd f = boolSystem "git" [ Param "add" @@ -125,7 +125,7 @@ gpgSignParams ps = ifM (doesFileExist keyring) -- Automatically sign the commit if there'a a keyring. gitCommit :: Maybe String -> [CommandParam] -> IO Bool gitCommit msg ps = do - let ps' = Param "commit" : ps ++ + let ps' = Param "commit" : ps ++ maybe [] (\m -> [Param "-m", Param m]) msg ps'' <- gpgSignParams ps' if isNothing msg diff --git a/src/Propellor/Property/Gpg.hs b/src/Propellor/Property/Gpg.hs index a16df11d..bd710ca7 100644 --- a/src/Propellor/Property/Gpg.hs +++ b/src/Propellor/Property/Gpg.hs @@ -12,6 +12,8 @@ installed = Apt.installed ["gnupg"] -- A numeric id, or a description of the key, in a form understood by gpg. newtype GpgKeyId = GpgKeyId { getGpgKeyId :: String } +data GpgKeyType = GpgPubKey | GpgPrivKey + -- | Sets up a user with a gpg key from the privdata. -- -- Note that if a secret key is exported using gpg -a --export-secret-key, @@ -21,22 +23,39 @@ newtype GpgKeyId = GpgKeyId { getGpgKeyId :: String } -- Recommend only using this for low-value dedicated role keys. -- No attempt has been made to scrub the key out of memory once it's used. keyImported :: GpgKeyId -> User -> Property HasInfo -keyImported (GpgKeyId keyid) user@(User u) = flagFile' prop genflag +keyImported key@(GpgKeyId keyid) user@(User u) = prop `requires` installed where desc = u ++ " has gpg key " ++ show keyid - genflag = do - d <- dotDir user - return $ d </> ".propellor-imported-keyid-" ++ keyid prop = withPrivData src (Context keyid) $ \getkey -> - property desc $ getkey $ \key -> makeChange $ - withHandle StdinHandle createProcessSuccess - (proc "su" ["-c", "gpg --import", u]) $ \h -> do - fileEncoding h - hPutStr h (unlines (privDataLines key)) - hClose h + property desc $ getkey $ \key' -> do + let keylines = privDataLines key' + ifM (liftIO $ hasGpgKey (parse keylines)) + ( return NoChange + , makeChange $ withHandle StdinHandle createProcessSuccess + (proc "su" ["-c", "gpg --import", u]) $ \h -> do + fileEncoding h + hPutStr h (unlines keylines) + hClose h + ) src = PrivDataSource GpgKey "Either a gpg public key, exported with gpg --export -a, or a gpg private key, exported with gpg --export-secret-key -a" + parse ("-----BEGIN PGP PUBLIC KEY BLOCK-----":_) = Just GpgPubKey + parse ("-----BEGIN PGP PRIVATE KEY BLOCK-----":_) = Just GpgPrivKey + parse _ = Nothing + + hasGpgKey Nothing = error $ "Failed to run gpg parser on armored key " ++ keyid + hasGpgKey (Just GpgPubKey) = hasPubKey key user + hasGpgKey (Just GpgPrivKey) = hasPrivKey key user + +hasPrivKey :: GpgKeyId -> User -> IO Bool +hasPrivKey (GpgKeyId keyid) (User u) = catchBoolIO $ + snd <$> processTranscript "su" ["-c", "gpg --list-secret-keys " ++ shellEscape keyid, u] Nothing + +hasPubKey :: GpgKeyId -> User -> IO Bool +hasPubKey (GpgKeyId keyid) (User u) = catchBoolIO $ + snd <$> processTranscript "su" ["-c", "gpg --list-public-keys " ++ shellEscape keyid, u] Nothing + dotDir :: User -> IO FilePath dotDir (User u) = do home <- homeDirectory <$> getUserEntryForName u |