profile.d/02infra: The number of keepers in a set is `tot', not `num'.

[distorted-keys] / ktype.gnupg

### -*-sh-*-
###
### Key type for GNU Privacy Guard
###
### (c) 2011 Mark Wooding
###

###----- Licensing notice ---------------------------------------------------
###
### This file is part of the distorted.org.uk key management suite.
###
### distorted-keys is free software; you can redistribute it and/or modify
### it under the terms of the GNU General Public License as published by
### the Free Software Foundation; either version 2 of the License, or
### (at your option) any later version.
###
### distorted-keys is distributed in the hope that it will be useful,
### but WITHOUT ANY WARRANTY; without even the implied warranty of
### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
### GNU General Public License for more details.
###
### You should have received a copy of the GNU General Public License
### along with distorted-keys; if not, write to the Free Software Foundation,
### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.

run_gnupg () {
  base=$1; shift
  ## Run GnuPG with some standard options.

  gpg --homedir="$base" --no-permission-warning -q --batch \
    --always-trust \
    "$@"
}

defprops k_props <<EOF
main_type		t	$R_WORD
main_length		t	$R_NUMERIC
sub_type		t	$R_WORD
sub_length		t	$R_NUMERIC
s2k_cipher		t	$R_WORD
s2k_digest		t	$R_WORD
cipher_prefs		t	$R_WORDSEQ
digest_prefs		t	$R_WORDSEQ
compress_prefs		t	$R_WORDSEQ
realname		t	$R_LINE
comment			t	$R_LINE
email			t	$R_LINE
EOF

: ${kprop_main_type=RSA} ${kprop_main_length=3072}
: ${kprop_sub_type=ELG-E} ${kprop_sub_length=3072}
: ${kprop_cipher_prefs=AES256 AES TWOFISH 3DES BLOWFISH CAST5}
: ${kprop_digest_prefs=SHA256 SHA1 RIPEMD160}
: ${kprop_compress_prefs=ZLIB ZIP}

: ${kprop_realname=%{realname\}} ${kprop_email=%{email\}}
: ${kprop_comment=%{comment-nil\}}

initdir () {
  base=$1

  prefs="$kprop_cipher_prefs $kprop_digest_prefs $kprop_compress_prefs"

  case ${kprop_s2k_cipher+t} in
    t) ;;
    *) set -- $kprop_cipher_prefs; kprop_s2k_cipher=$1 ;;
  esac
  case ${kprop_s2k_digest+t} in
    t) ;;
    *) set -- $kprop_digest_prefs; kprop_s2k_digest=$1 ;;
  esac

  cat >"$base/gpg.conf" <<EOF
### GnuPG configuration

## Annoying copyright notice and other tedious warnings.
no-greeting
expert
always-trust

## Algorithm selection
s2k-cipher-algo $kprop_s2k_cipher
s2k-digest-algo $kprop_s2k_digest
personal-cipher-preferences $kprop_cipher_prefs
personal-digest-preferences $kprop_digest_prefs
personal-compress-preferences $kprop_compress_prefs
default-preference-list $prefs
EOF
}

k_generate () {
  base=$1 nub=$2

  makenub >"$nub"
  initdir "$base"

  { cat <<EOF
Key-Type: $kprop_main_type
Key-Length: $kprop_main_length
Passphrase: $(cat "$nub")
EOF
    case ${kprop_sub_type-nil} in
      nil) ;;
      *) cat <<EOF
Subkey-Type: $kprop_sub_type
Subkey-Length: $kprop_sub_length
EOF
    esac
    real=$(subst "\`realname' value" "$kprop_realname" kopt_ "$R_LINE")
    email=$(subst "\`email' value" "$kprop_email" kopt_ "$R_LINE")
    cat <<EOF
Name-Real: $real
Name-Email: $email
EOF
    comment=$(subst "\`comment' value" "$kprop_comment" kopt_ "$R_LINE")
    case "$comment" in
      ?*) cat <<EOF
Name-Comment: $comment
EOF
	;;
    esac
  } | run_gnupg "$base" --gen-key

  ## Commit the new key.
  run_gnupg "$base" --fingerprint --with-colons | \
    grep '^fpr:' | cut -d: -f10 >"$base/fpr"
  run_gnupg "$base" --export --armor --output="$base/pub"
}

k_import () {
  base=$1

  initdir "$base"
  run_gnupg "$base" --import "$base/pub"
  run_gnupg "$base" --fingerprint --with-colons | \
    grep '^fpr:' | cut -d: -f10 >"$base/fpr"
}

k_encrypt () {
  base=$1
  run_gnupg "$base" --encrypt --armor --recipient=$(cat "$base/fpr")
}

k_decrypt () {
  base=$1 nub=$2
  run_gnupg "$base" --passphrase-file "$nub" --decrypt
}

k_sign () {
  base=$1 nub=$2
  run_gnupg "$base" --passphrase-file "$nub" --detach-sign --armor
}

k_verify () {
  base=$1 sig=$3
  echo "$sig" >$tmp/sig
  if run_gnupg "$base" --verify $tmp/sig - >/dev/null 2>$tmp/err
  then :; else
    rc=$?
    cat >&2 $tmp/err
    return $rc
  fi
}

###----- That's all, folks --------------------------------------------------