X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=README.make-secnet-sites;h=c5b8360d0c8a1cdeb6ba962c5c8e704bf71b4a1c;hb=c9fb510e23e466f2b040c8325ec96fe68b2cb8d4;hp=71a0e0f1e9c58a076b4c06bb0e7967762487467e;hpb=c39f04317c5f7fe2bbb305bcebdc965d0c1a2da2;p=secnet.git

diff --git a/README.make-secnet-sites b/README.make-secnet-sites
index 71a0e0f..c5b8360 100644
--- a/README.make-secnet-sites
+++ b/README.make-secnet-sites
@@ -43,9 +43,28 @@ OPTIONS
 		NUMBER that are understood are:
 		    1	The original format, pre signing key
 			negotiation.
+		    2	Signing key algorithm agility and negotiation.
 		If NUMBER is higher than make-secnet-sites supports,
 		it writes out what it can.
 
+	--pubkeys-install
+
+		Specifies that public keys are to be installed in the
+		live pubkeys area (and not hardcoded in secnet conf
+		files).  With this option, generated site configs
+		refer to keys in PUBKEYS; also, the generated secnet
+		configuration enables live peer public update.
+
+	--pubkeys-dir PUBKEYS
+
+		Specifies the live pubkeys area pathname.
+		The default is /var/lib/secnet/pubkeys.
+
+		Key files are named
+			PUBKEYS/peer.<mangled-peer-name>[~...]
+		mangled-peer-name is chosen by make-secnet-sites
+			/ => ,
+
 	--debug | -D
 
 		Increase amount of debugging output.
@@ -196,8 +215,8 @@ INPUT SYNTAX
 		Assigns a public-key closure to the `key' key,
 		constructed as `rsa-public(E, N)'.  The argument HUNOZ
 		must be an integer, but is otherwise ignored; it's
-		conventionally the length of N in bits.  Acceptable only
-		at site level; required at site level.
+		conventionally the length of N in bits.
+		Acceptable only at site level.  See `pub'.
 
 	mobile BOOL
 		Assigns BOOL to the `mobile' key.  Acceptable only at
@@ -212,7 +231,8 @@ INPUT SYNTAX
 		Defines a public key.  ALG is an algorithm name and
 		DATA91S is the public key data, encoded according to
 		secnet-base91 (see below).
-		Not yet suported in make-secnet-sites.
+		Gives make-public("ALG","DATAB91S") in sites.conf;
+		at least one `pub' or `pubkey' must be specified.
 
 	serial SETIDHEX
 		Specifies the key set id (8 hex digits representing