keys.delete-keeper: Only do one pass through the file system.

[distorted-keys] / cryptop.recover

diff --git a/cryptop.recover b/cryptop.recover
index 26142e99533ab0761ef8669a82026450e19f9639..f1fc9db8e6b3e2a7c50c48e57f0312029f4a97b2 100755 (executable)
--- a/cryptop.recover
+++ b/cryptop.recover
@@ -28,15 +28,24 @@ case "${KEYSLIB+t}" in t) ;; *) echo >&2 "$0: KEYSLIB unset"; exit 1 ;; esac
 . "$KEYSLIB"/keyfunc.sh
 
 defhelp <<HELP
-KEY RECOV
+[-i INST] KEY RECOV
 Recover the named user KEY using a blob protected using the recovery key
 RECOV; it is an error if RECOV is not currently revealed.
 HELP
 
+inst=current
+while getopts "i:" opt; do
+  case "$opt" in
+    i) inst=$OPTARG ;;
+    *) usage_err ;;
+  esac
+done
+shift $(( $OPTIND - 1 ))
 case $# in 2) ;; *) usage_err ;; esac
 key=$1 recov=$2
 parse_keylabel "$key"
 if [ ! -d $kdir ]; then echo >&2 "$quis: unknown key \`$key'"; exit 1; fi
+checkword "recovery instance" "$inst"
 checkword "recovery key label" "$recov"
 case $kowner in
   $USERV_USER) ;;
@@ -58,11 +67,12 @@ if [ -f $knub ]; then
 fi
 
 umask 077
-recover $recov $kowner/$klabel >$knub.new
+recover $recov $inst $kowner/$klabel >$knub.new
 nubbin=$(nubid <$knub.new)
 case "$nubbin" in
   "$nubid") ;;
   *)
+    rm -f $knub.new
     echo >&2 "$quis: recovery produced incorrect nub"
     exit 1
     ;;