signet

#!/bin/sh

. ./signet.conf

remove_sigs () {
	printf "Minimizing key...\n"
	printf "minimize\nsave\ny\n" | gpg --command-fd 0 --homedir "$SIGNET_TEMP_DIR" --no-default-keyring --keyring "$TEMPORARY_KEYRING" --edit-key $1
}

save_key () {
	printf "Exporting key %s\n" "$1"
	gpg --homedir "$SIGNET_TEMP_DIR" --no-default-keyring --keyring "$TEMPORARY_KEYRING" --no-emit-version --export --armor $1 | if [ "$ENCRYPT_SIGNATURES" = "n" ]; then
		printf "Saving to %s\n" "$2"
      		tee "$SIGNET_OUTPUT_DIR/$2" > /dev/null
	else
		printf "Encrypting to %s\n" "$2"
		gpg --homedir "$SIGNET_TEMP_DIR" --no-default-keyring --keyring "$TEMPORARY_KEYRING" --keyring "$PUBLIC_SIGNER_KEYRING" --always-trust --no-emit-version --armor --encrypt --recipient "$1" --recipient "$SIGNERKEY" > "$SIGNET_OUTPUT_DIR/$2"
	fi
}

store_mailhelper(){
	printf "%s\t%s\n" "$1" "$2" >> "$SIGNET_OUTPUT_DIR/$MAILHELPER_FILE"
}

store_mbox(){
	(
		BOUNDARY="SIGNET-MULTIPART-BOUNDARY"
		printf "From %s %s\n" "$MBOX_SENDER" "$(date --utc)"
		printf "Date: %s\n" "$(date --rfc-2822)"
		printf "From: %s\n" "$MBOX_SENDER"
		printf "To: %s\n" "$2"
		printf "Subject: %s\n" "$MBOX_MAIL_SUBJECT"
		printf "MIME-Version: 1.0\n"
		printf "Content-Type: multipart/mixed; boundary=\"%s\"\n" "$BOUNDARY"
		printf "\n--%s\n" "$BOUNDARY"
		printf "Content-Type: text/plain\n"
		printf "\n%s" "$MBOX_MAIL_BODY"
		printf "\n--%s\n" "$BOUNDARY"
		printf "Content-Type: application/pgp-signature\n"
		printf "Content-Transfer-Encoding: base64\n"
		printf "Content-Disposition: attachment\n"
		printf "\n%s" "$(base64 "$SIGNET_OUTPUT_DIR/$1")"
		printf "\n--%s\n\n" "$BOUNDARY"
	) >> "$SIGNET_OUTPUT_DIR/$MBOX_FILE"
}

sign_uid () {
	clear

	if [ "$4" = "r" ]; then
		printf "Key %s UID %s (%s) was revoked, so not signing\n" "$1" "$2" "$3"
		sleep 2
		return 0
	fi

	if [ -n "$SIGNING_POLICY_URL" ]; then
		gpgopts="--sig-policy-url $SIGNING_POLICY_URL "
	fi

	if [ "$USE_CERT_LEVELS" = "y" ]; then
		gpgopts="$gpgopts --ask-cert-level"
	fi

	printf "Invoking GPG in order to sign key %s UID %s (%s) with key %s\n" "$1" "$2" "$3" "$SIGNERKEY"
	#GPG does its own user sanity check
	gpg --homedir "$SIGNET_TEMP_DIR" --no-default-keyring --primary-keyring "$TEMPORARY_KEYRING" --secret-keyring "$PRIVATE_SIGNER_KEYRING" --keyring "$PUBLIC_SIGNER_KEYRING" --default-key "$SIGNERKEY" $gpgopts --edit-key $1 uid $2 sign save < /dev/tty

	if [ "$?" != "0" ]; then
		printf "GPG reported a problem while signing this UID. Abort? (y/n): "
		read action < /dev/tty
		if [ "$action" = "y" ]; then
			exit 6
		fi
	fi

	if [ "$UIDS_AS_FILENAMES" = "y" ]; then
		filename="$1_UID$2_$3_by_$SIGNERKEY.sig"
	else
		filename="$1_UID$2_by_$SIGNERKEY.sig"
	fi

	save_key "$1" "$filename"

	if [ "$GENERATE_MAILHELPER_FILE" = "y" ]; then
		store_mailhelper "$filename" "$3"
	fi

	if [ "$GENERATE_MBOX" = "y" ]; then
		store_mbox "$filename" "$3"
	fi

	sleep 2
	remove_sigs "$1"
}

sign_key () {
	printf "Now processing key %s (Signerkey %s)\n\n" "$1" "$SIGNERKEY"
	remove_sigs "$1"

	#TODO: Show fingerprint and ask for match

	current_uid=1

	printf "Now processing UIDs\n"

	gpg --homedir "$SIGNET_TEMP_DIR" --no-default-keyring --keyring "$TEMPORARY_KEYRING" --with-colons --fixed-list-mode --list-keys $1 | grep ^uid: | while read uid; do
		uid_name=$(echo "$uid" | cut -d : -f 10)
		uid_status=$(echo "$uid" | cut -d : -f 2)
		sign_uid "$1" "$current_uid" "$uid_name" "$uid_status"
		current_uid=$(expr $current_uid + 1)
	done

	printf "\nDone signing key %s\n" "$1"
	sleep 2
}

load_key_file (){
	printf "Enter path to signee public key: "
	read key_file

	gpg --homedir "$SIGNET_TEMP_DIR" --no-default-keyring --keyring "$TEMPORARY_KEYRING" --import-options import-minimal --import "$key_file"
	if [ "$?" = "0" ]; then
		printf "Signee key seems to have been imported successfully\n"
	else
		printf "GPG reported an error importing the key. Abort? (y/n): "
		read action
		if [ "$action" = "y" ]; then
			exit 5
		fi
	fi

	#Get imported key ID
	signee_fp=$(gpg --homedir "$SIGNET_TEMP_DIR" --no-default-keyring --keyring "$TEMPORARY_KEYRING" --list-keys --with-colons | grep pub | cut -d : -f 5)
	printf "Detected imported fingerprint %s\n" "$signee_fp"

	sign_key "$signee_fp"
}

load_key_net (){
	printf "Enter signee key fingerprint: "
	read signee_fp

	#FIXME: import-options seems to not work with recv-keys
	gpg --homedir "$SIGNET_TEMP_DIR" --no-default-keyring --keyring "$TEMPORARY_KEYRING" --import-options import-minimal --keyserver "$KEY_SERVER" --recv-keys "$signee_fp"
	if [ "$?" = "0" ]; then
		printf "Signee key seems to have been imported successfully.\n"
	else
		printf "GPG reported an error fetching/importing the key. Abort? (y/n): "
		read action
		if [ "$action" = "y" ]; then
			exit 5
		fi
	fi

	signee_fp=$(gpg --homedir "$SIGNET_TEMP_DIR" --no-default-keyring --keyring "$TEMPORARY_KEYRING" --list-keys --with-colons | grep pub | cut -d : -f 5)
	printf "Detected imported fingerprint %s\n" "$signee_fp"

	sign_key $signee_fp
}

load_keyring () {
	printf "Enter path to keyring containing keys to sign: "
	read keyring

	printf "Transferring and minimizing keys...\n"
	gpg --homedir "$SIGNET_TEMP_DIR" --no-default-keyring --keyring "$keyring" --export | gpg --homedir "$SIGNET_TEMP_DIR" --no-default-keyring --keyring "$TEMPORARY_KEYRING" --import-options import-minimal --import

	if [ "$?" = "0" ]; then
		printf "Import seems to have been successful\n"
	else
		printf "GPG reported an error importing the keyring. Abort? (y/n): "
		read action
		if [ "$action" = "y" ]; then
			exit 5
		fi
	fi

	printf "Iterating over keys...\n"
	gpg --homedir "$SIGNET_TEMP_DIR" --no-default-keyring --keyring "$TEMPORARY_KEYRING" --list-keys --with-colons | grep "^pub:" | cut -d : -f 5 | while read signee; do
		sign_key "$signee"
	done
}

printf "Signet v0.2 - Welcome\n"

printf "Setting up environment...\n"
if [ ! -d "$SIGNET_TEMP_DIR" ]; then
	printf "Creating temporary directory\n"
	mkdir "$SIGNET_TEMP_DIR"
fi
if [ ! -d "$SIGNET_OUTPUT_DIR" ]; then
	printf "Creating output directory\n"
	mkdir "$SIGNET_OUTPUT_DIR"
fi
chmod 700 "$SIGNET_TEMP_DIR"
rm -rf $SIGNET_TEMP_DIR/* > /dev/null 2>&1
if [ -n "$PRIVATE_SIGNER_KEYDIR" ]; then
	ln -s "$PRIVATE_SIGNER_KEYDIR" "$SIGNET_TEMP_DIR"
fi
gpg --homedir "$SIGNET_TEMP_DIR" --list-keys
if [ "$CHECK_AGENT_INFO" = "y" ]; then
	if [ -n "$GPG_AGENT_INFO" ]; then
		printf "Using GPG agent with info %s" "$GPG_AGENT_INFO"
	else
		printf "\nGPG_AGENT_INFO not set. GPG might not be able to communicate with the agent.\nAbort? (y/n): "
		read action
		if [ "$action" = "y" ]; then
			exit 4
		fi
	fi
fi

printf "\nAvailable signing keys:\n"
gpg --homedir "$SIGNET_TEMP_DIR" --no-default-keyring --secret-keyring "$PRIVATE_SIGNER_KEYRING" --keyring "$PUBLIC_SIGNER_KEYRING" --list-secret-keys | grep "^sec[^#]" --after 1

printf "\nEnter ID of key to use for signing: "
read SIGNERKEY

printf "\nSigner key details:\n"
gpg --homedir "$SIGNET_TEMP_DIR" --no-default-keyring --secret-keyring "$PRIVATE_SIGNER_KEYRING" --keyring "$PUBLIC_SIGNER_KEYRING" --list-secret-keys $SIGNERKEY


if [ "$?" = "0" ]; then
	printf "Signer key seems ok\n"
else
	printf "GPG reported a failure while listing the key. Aborting\n"
	exit 2
fi

printf "Select signee source:\n\t(k)eyring (signs all keys on ring)\n\t(n)et (signs one key from a keyserver)\n\t(f)ile (signs one key imported from a file)\n"
read mode

case $mode in
	k) load_keyring;;
	n) load_key_net;;
	f) load_key_file;;
	*) printf "Could not determine signee source. Aborting.\n";
	   exit 3;;
esac