~revu-hackers/revu/trunk

#!/bin/sh

#set -e

# We don't use a secret keyring, of course, but gpg panics and

# implodes if there isn't one available

REVUBASE=/srv/revu1-production

KEYRING=${REVUBASE}/uploaders.gpg

SECRING=$(tempfile)

TRUSTDB=${REVUBASE}/trustdb.gpg

LOCKFILE=/tmp/revu-key.pid

GPG_CMD="gpg --no-options --no-default-keyring --secret-keyring $SECRING --homedir /srv/revu1-production --lock-never " # --trustdb-name $TRUSTDB"

GPG="$GPG_CMD --trust-model=always --keyring $KEYRING"

usage() {

    echo "Usage: revu-key [command] [arguments]"

    echo

    echo "Manage revu's list of trusted keys"

    echo

    echo "  add <file>          - add the key contained in <file> ('-' for stdin)"

    echo "  del <keyid>         - remove the key <keyid>"

    echo "  list                - list keys"

    echo "  import <keyid>	- import key from keyserver.ubuntu.com"

    echo "  refresh		- refresh keys from keyserver.ubuntu.com"

    echo "  update              - imports keys from the launchpad group"

    echo

}

acquire_lock() {

	if [ -e ${LOCKFILE} ]; then

		LPID=$(cat ${LOCKFILE})

		echo "another revu-key instance is already running"

		echo "check ${LOCKFILE} and PID ${LPID}"

		exit 1

	fi

	echo $$ > ${LOCKFILE}

}

release_lock() {

	if [ ! -e ${LOCKFILE} ]; then

		echo "release_lock: no lockfile found, aborting."

		exit 1

	fi

	LPID=$(cat ${LOCKFILE})

	if [ -z "${LPID}" ]; then

		echo "release_lock: no pid."

		echo "check ${LOCKFILE}."

		exit 1

	fi

	if [ ! "${LPID}" -eq $$ ]; then

		echo "release_lock: pid mismatch."

		echo "check ${LOCKFILE}."

		exit 1

	fi

	rm ${LOCKFILE} || \

		echo "couldn't remove ${LOCKFILE}. please check." 

}

command="$1"

if [ -z "$command" ]; then

    usage

    exit 1

fi

shift

if [ "$command" != "help" ] && ! which gpg >/dev/null 2>&1; then

    echo >&2 "Warning: gnupg does not seem to be installed."

    echo >&2 "Warning: revu requires gnupg for most operations."

    echo >&2

fi

touch $SECRING

case "$command" in

    update)

	acquire_lock

	${REVUBASE}/scripts/fetch-launchpad-keys.py

	chgrp www-data ${REVUBASE}/launchpad.gpg || /bin/true

	chmod g+w ${REVUBASE}/launchpad.gpg || /bin/true

	mv ${REVUBASE}/launchpad.gpg ${KEYRING}

	release_lock

	;;

    add)

        $GPG --quiet --batch --import "$1"

        echo "OK"

        ;;

    del|rm|remove)

        $GPG --quiet --batch --delete-key --yes "$1"

        echo "OK"

        ;;

    import)

	$GPG --keyserver keyserver.ubuntu.com --recv-key "$1"

	;;

    list)

        $GPG --batch --list-keys $*

        ;;

    finger*)

        $GPG --batch --fingerprint $*

        ;;

    enc*)

	$GPG --armor --batch --encrypt --recipient $*

	;;

    adv*)

        echo "Executing: $GPG $*"

        $GPG $*

        ;;

    refresh)

	echo "Refreshing keys"

	$GPG --refresh-keys --keyserver keyserver.ubuntu.com

	;;

    help)

        usage

        ;;

    *)

        usage

        ;;

esac

chgrp www-data ${KEYRING}

chmod 664 ${KEYRING}

rm -f $SECRING

exit 1