init/Makefile.am: Install `tripe.conf' as data, not executable.

[tripe] / keys / tripe-keys.in

diff --git a/keys/tripe-keys.in b/keys/tripe-keys.in
index b0dbf94574ade95ab7267f593994e1c1a1c4a9e6..2be5e2dde3a6c869828f31baf37341378ae2236b 100644 (file)
--- a/keys/tripe-keys.in
+++ b/keys/tripe-keys.in
@@ -59,6 +59,12 @@ rx_nonalpha = RX.compile(r'\W')
 ## Match the literal string "<SEQ>".
 rx_seq = RX.compile(r'\<SEQ\>')
 
+## Match a shell metacharacter.
+rx_shmeta = RX.compile('[\\s`!"#$&*()\\[\\];\'|<>?\\\\]')
+
+## Match a character which needs escaping in a shell double-quoted string.
+rx_shquote = RX.compile(r'["`$\\]')
+
 ###--------------------------------------------------------------------------
 ### Utility functions.
 
@@ -97,6 +103,20 @@ def subst(s, rx, map):
   out.write(s[i:])
   return out.getvalue()
 
+def shell_quotify(arg):
+  """
+  Quotify ARG to keep the shell happy.
+
+  This isn't actually used for invoking commands, just for presentation
+  purposes; but correctness is still nice.
+  """
+  if not rx_shmeta.search(arg):
+    return arg
+  elif arg.find("'") == -1:
+    return "'%s'" % arg
+  else:
+    return '"%s"' % rx_shquote.sub(lambda m: '\\' + m.group(0), arg)
+
 def rmtree(path):
   """Delete the directory tree given by PATH."""
   try:
@@ -142,7 +162,7 @@ def run(args):
     else:
       nargs += a[1:].split()
   args = nargs
-  print '+ %s' % ' '.join(args)
+  print '+ %s' % ' '.join([shell_quotify(arg) for arg in args])
   SYS.stdout.flush()
   rc = OS.spawnvp(OS.P_WAIT, args[0], args)
   if rc != 0:
@@ -217,10 +237,10 @@ def conf_defaults():
                ('conf-file', '${base-dir}tripe-keys.conf'),
                ('upload-hook', ': run upload hook'),
                ('kx', 'dh'),
-               ('kx-param', lambda: {'dh': '-LS -b2048 -B256',
+               ('kx-param', lambda: {'dh': '-LS -b3072 -B256',
                                      'ec': '-Cnist-p256'}[conf['kx']]),
                ('kx-expire', 'now + 1 year'),
-               ('cipher', 'blowfish-cbc'),
+               ('cipher', 'rijndael-cbc'),
                ('hash', 'sha256'),
                ('master-keygen-flags', '-l'),
                ('mgf', '${hash}-mgf'),
@@ -235,10 +255,10 @@ def conf_defaults():
                                        'rsapss': 'rsa',
                                        'ecdsa': 'ec',
                                        'eckcdsa': 'ec'}[conf['sig']]),
-               ('sig-param', lambda: {'dh': '-LS -b2048 -B256',
-                                      'dsa': '-b2048 -B256',
+               ('sig-param', lambda: {'dh': '-LS -b3072 -B256',
+                                      'dsa': '-b3072 -B256',
                                       'ec': '-Cnist-p256',
-                                      'rsa': '-b2048'}[conf['sig-genalg']]),
+                                      'rsa': '-b3072'}[conf['sig-genalg']]),
                ('sig-hash', '${hash}'),
                ('sig-expire', 'forever'),
                ('fingerprint-hash', '${hash}')]:
@@ -343,8 +363,8 @@ def cmd_setup(args):
   OS.mkdir('repos')
   run('''key -krepos/param add
     -a${kx}-param !${kx-param}
-    -eforever -tparam tripe-${kx}-param
-    cipher=${cipher} hash=${hash} mac=${mac} mgf=${mgf}''')
+    -eforever -tparam tripe-param
+    kx-group=${kx} cipher=${cipher} hash=${hash} mac=${mac} mgf=${mgf}''')
   cmd_newmaster(args)
 
 ###--------------------------------------------------------------------------
@@ -456,7 +476,7 @@ def cmd_generate(args):
   keyring_pub = 'peer-%s.pub' % tag
   zap('keyring'); zap(keyring_pub)
   run('key -kkeyring merge repos/param')
-  run('key -kkeyring add -a${kx} -pparam -e${kx-expire} -t%s tripe-${kx}' %
+  run('key -kkeyring add -a${kx} -pparam -e${kx-expire} -t%s tripe' %
       tag)
   run('key -kkeyring extract -f-secret %s %s' % (keyring_pub, tag))