Fix how ownertrust is set for host key in authentication keyring.

Update TODO, removing completed tasks.

diff --git a/doc/TODO b/doc/TODO
index e50da4dd1de55be70ec231905cb238b4fc2469a6..0d72b25ac4e07734597b552093ac7bfce2fad448 100644 (file)
--- a/doc/TODO
+++ b/doc/TODO
@@ -78,28 +78,15 @@ File bug against ssh-keygen about how "-R" option removes comments
 File bug against ssh-keygen to see if we can get it to write to hash a
    known_hosts file to/from stdout/stdin.
 
-Add environment variables sections to man pages.
-
-Environment variable scoping.
-
-Move environment variable precedence before conf file.
-
 When using ssh-proxycommand, if only host keys found are expired or
    revoked, then output loud warning with prompt, or fail hard.
 
-Update monkeysphere-ssh-proxycommand man page with new keyserver
-   checking policy info.
-
 File bug against seahorse about how, when creating new primary keys,
    it presents option for "RSA (sign only)" but then creates an "esca"
    key.
 
 File bug against enigmail about lack of ability to create subkeys.
 
-Privilege separation: monkeysphere user to handle authn keyring and
-   generate authorized_keys file (which would be moved into place by
-   root).  Host keyring would be owned by root.
-
 Test and document what happens when any filesystem that the
    monkeysphere-server relies on and modifies (/tmp, /etc, and /var?)
    fills up.

diff --git a/src/monkeysphere-server b/src/monkeysphere-server
index 4d7acc6cb50276bb7a46ae589d3c6995ed540252..19b457fed71ea65cf34fa85234f22181619ea1e6 100755 (executable)
--- a/src/monkeysphere-server
+++ b/src/monkeysphere-server
@@ -342,6 +342,10 @@ EOF
     fingerprint=$(gpg_host --list-key --with-colons --with-fingerprint "=${userID}" | \
        grep '^fpr:' | head -1 | cut -d: -f10)
 
+    # export host ownertrust to authentication keyring
+    log "setting ultimate owner trust for server key..."
+    echo "${fingerprint}:6:" | gpg_authentication "--import-ownertrust"
+
     # translate the private key to ssh format, and export to a file
     # for sshs usage.
     # NOTE: assumes that the primary key is the proper key to use
@@ -429,9 +433,6 @@ add_certifier() {
     fi
     export keyID
 
-    # export host ownertrust to authentication keyring
-    gpg_host --export-ownertrust | gpg_authentication "--import-ownertrust"
-
     # get the key from the key server
     gpg_authentication "--keyserver $KEYSERVER --recv-key '$keyID'"
 
@@ -470,7 +471,7 @@ $domain
 y
 save
 EOF
-)
+       )
 
     # ltsign the key
     echo "$ltsignCommand" | gpg_host --quiet --command-fd 0 --edit-key "$fingerprint"