X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ian/git?a=blobdiff_plain;f=README.make-secnet-sites;h=aa4b216d2f580f96f7dc8047bbc0bce7bc69b6cd;hb=4bc0381500403be5f3e40bc39f65a2d8fb75cf19;hp=cef436851caf633a9c921791bc83e1b0df91b31b;hpb=8644ac83446ced746cc232643974c4120bff5a6b;p=secnet.git

diff --git a/README.make-secnet-sites b/README.make-secnet-sites
index cef4368..aa4b216 100644
--- a/README.make-secnet-sites
+++ b/README.make-secnet-sites
@@ -34,6 +34,57 @@ USAGE
 	produce Secnet configuration.
 
 
+OPTIONS
+
+	--output-version NUMBER
+
+		Write backward-compatible sites file output,
+		targeting a particular sites format.  Values of
+		NUMBER that are understood are:
+		    1	The original format, pre signing key
+			negotiation.
+		    2	Signing key algorithm agility and negotiation.
+		If NUMBER is higher than make-secnet-sites supports,
+		it writes out what it can.
+
+	--pubkeys-install
+
+		Specifies that public keys are to be installed in the
+		live pubkeys area (and not hardcoded in secnet conf
+		files).  With this option, generated site configs
+		refer to keys in PUBKEYS; also, the generated secnet
+		configuration enables live peer public update.
+
+	--pubkeys-single
+
+		Specifies that one public key per site is to be
+		written directly into the sites.conf output.  If
+		--output-version=1, this is the rsa1 key 0000000000.
+		Otherwise it is an error if there are multiple public
+		keys defined for any site, in the input.
+		--pubkeys-single is the default.
+
+	--pubkeys-elide
+
+		In the sites.conf output, just write the peer-keys
+		entry referring to keys in PUBKEYS.  But do not write
+		public keys anywhere.
+
+	--pubkeys-dir PUBKEYS
+
+		Specifies the live pubkeys area pathname.
+		The default is /var/lib/secnet/pubkeys.
+
+		Key files are named
+			PUBKEYS/peer.<mangled-peer-name>[~...]
+		mangled-peer-name is chosen by make-secnet-sites
+			/ => ,
+
+	--debug | -D
+
+		Increase amount of debugging output.
+
+
 INPUT SYNTAX
 
 	The input files have a simple line-based syntax.  Blank lines,
@@ -117,8 +168,9 @@ INPUT SYNTAX
 
 	Finally, the properties.
 
-	If a property has already been defined on an item, then it is an
-	error to try to redefine it.
+	Usually, if a property has already been defined on an item, then
+	it is an error to try to redefine it.  But some properties are
+	list-like: the values are accumulated into a single list.
 
 	Mostly, properties are written to corresponding assignments in
 	the generated Secnet configuration file, .  The entries below
@@ -178,13 +230,37 @@ INPUT SYNTAX
 		Assigns a public-key closure to the `key' key,
 		constructed as `rsa-public(E, N)'.  The argument HUNOZ
 		must be an integer, but is otherwise ignored; it's
-		conventionally the length of N in bits.  Acceptable only
-		at site level; required at site level.
+		conventionally the length of N in bits.
+		Acceptable only at site level.  See `pub'.
 
 	mobile BOOL
 		Assigns BOOL to the `mobile' key.  Acceptable only at
 		site level, but optional.
 
+	Properties which can also appear in public key files.
+	(named by `peer-keys' key to secnet sites closure.)
+	These are acceptable to make-secnet-sites only at
+	site level.  See also `Site long-term keys' in NOTES.
+
+	pub ALG DATAB91S
+		Defines a public key.  ALG is an algorithm name and
+		DATA91S is the public key data, encoded according to
+		secnet-base91 (see below).
+		Gives make-public("ALG","DATAB91S") in sites.conf;
+		at least one `pub' or `pubkey' must be specified.
+
+	serial SETIDHEX
+		Specifies the key set id (8 hex digits representing
+		4 bytes: each pair is the value of the next byte).
+		May appear at most once.  If not present, 00000000.
+
+	pkg GROUPIDHEX
+	pkgf GROUPIDHEX
+		Specifies the key group id for subsequent keys.
+		pkgf indicates a fallback group.
+		May be repeated (with different id values).
+		If not specified, 00000000.
+
 
 OUTPUT STRUCTURE