universalize and consolidate on --fixed-list-mode

diff --git a/Changelog b/Changelog
index 90514a03438e98ec64d1a0854968cd063bae86b6..7e0cd8125adeb2022909bff88dd2bed73e69681d 100644 (file)
--- a/Changelog
+++ b/Changelog
@@ -1,7 +1,8 @@
 monkeysphere (0.35~pre) upstream;
 
   * Remove reference to USE_VALIDATION_AGENT.
-  * Fix ssh_proxycommand for marginal hosts.
+  * Fix ssh_proxycommand for marginal hosts (closes MS #2593)
+  * GnuPG should always behave as --fixed-list-mode (closes MS #2587)
 
  -- Jameson Rollins <jrollins@finestructure.net>  Fri, 29 Oct 2010 20:21:54 -0400
 

diff --git a/src/monkeysphere b/src/monkeysphere
index 9d0685b705cfaeebb5bc62f3d1318a20c8c5eb2c..cf7752adac72385cb58c8dc370b2dbda63269ac7 100755 (executable)
--- a/src/monkeysphere
+++ b/src/monkeysphere
@@ -62,7 +62,7 @@ EOF
 
 # user gpg command to define common options
 gpg_user() {
-    LC_ALL=C gpg --no-greeting --quiet --no-tty "$@"
+    LC_ALL=C gpg --fixed-list-mode --no-greeting --quiet --no-tty "$@"
 }
 
 # output the ssh fingerprint of a gpg key
@@ -78,10 +78,10 @@ check_gpg_sec_key_id() {
 
     case "$#" in
        0)
-           gpgSecOut=$(gpg_user --fixed-list-mode --list-secret-keys --with-colons 2>/dev/null | egrep '^sec:')
+           gpgSecOut=$(gpg_user --list-secret-keys --with-colons 2>/dev/null | egrep '^sec:')
            ;;
        1)
-           gpgSecOut=$(gpg_user --fixed-list-mode --list-secret-keys --with-colons "$1" | egrep '^sec:') || failure
+           gpgSecOut=$(gpg_user --list-secret-keys --with-colons "$1" | egrep '^sec:') || failure
            ;;
        *)
            failure "You must specify only a single primary key ID."
@@ -119,7 +119,7 @@ check_gpg_authentication_subkey() {
 
     # check that a valid authentication key does not already exist
     IFS=$'\n'
-    for line in $(gpg_user --fixed-list-mode --list-keys --with-colons "$keyID") ; do
+    for line in $(gpg_user --list-keys --with-colons "$keyID") ; do
        type=$(echo "$line" | cut -d: -f1)
        validity=$(echo "$line" | cut -d: -f2)
        usage=$(echo "$line" | cut -d: -f12)

diff --git a/src/monkeysphere-authentication b/src/monkeysphere-authentication
index 99b818dc0b549651399d28247ae14b4ab859cf6b..46f349a21b83cb87ed1f72b1ddf674d84249ea73 100755 (executable)
--- a/src/monkeysphere-authentication
+++ b/src/monkeysphere-authentication
@@ -73,7 +73,7 @@ gpg_core() {
     GNUPGHOME="$GNUPGHOME_CORE"
     export GNUPGHOME
 
-    gpg --no-greeting --quiet --no-tty "$@"
+    gpg --fixed-list-mode --no-greeting --quiet --no-tty "$@"
 }
 
 # function to interact with the gpg sphere keyring
@@ -81,7 +81,7 @@ gpg_sphere() {
     GNUPGHOME="$GNUPGHOME_SPHERE"
     export GNUPGHOME
  
-    su_monkeysphere_user "gpg --no-greeting --quiet --no-tty $@"
+    su_monkeysphere_user "gpg --fixed-list-mode --no-greeting --quiet --no-tty $@"
 }
 
 # output to stdout the core fingerprint from the gpg core secret
@@ -89,7 +89,7 @@ gpg_sphere() {
 core_fingerprint() {
     log debug "determining core key fingerprint..."
     gpg_core --list-secret-key --with-colons \
-       --fixed-list-mode --with-fingerprint \
+        --with-fingerprint \
        | grep ^fpr: | cut -d: -f10
 }
 

diff --git a/src/monkeysphere-host b/src/monkeysphere-host
index ff56e98be8ad2a8767fecc837ce94e7204acb16a..a49823d540691d722cc19555c893e691490b6429 100755 (executable)
--- a/src/monkeysphere-host
+++ b/src/monkeysphere-host
@@ -71,17 +71,17 @@ EOF
 
 # function to interact with the gpg keyring
 gpg_host() {
-    GNUPGHOME="$GNUPGHOME_HOST" LC_ALL=C gpg --no-auto-check-trustdb --trust-model=always --no-greeting --quiet --no-tty "$@"
+    GNUPGHOME="$GNUPGHOME_HOST" LC_ALL=C gpg --no-auto-check-trustdb --trust-model=always --no-greeting --quiet --no-tty --fixed-list-mode "$@"
 }
 
 # list the info about the a key, in colon format, to stdout
 gpg_host_list_keys() {
     if [ "$1" ] ; then
-       gpg_host --list-keys --with-colons --fixed-list-mode \
+       gpg_host --list-keys --with-colons \
            --with-fingerprint --with-fingerprint \
            "$1"
     else
-       gpg_host --list-keys --with-colons --fixed-list-mode \
+       gpg_host --list-keys --with-colons \
            --with-fingerprint --with-fingerprint
     fi
 }

diff --git a/src/share/common b/src/share/common
index b9a20eff148afc0d0909d1cac6f95a086ba7e607..baf4270c0b4b749b488fd78ec9b3203a03963a7e 100644 (file)
--- a/src/share/common
+++ b/src/share/common
@@ -654,7 +654,7 @@ process_user_id() {
     gpg_fetch_userid "$userID"
 
     # output gpg info for (exact) userid and store
-    gpgOut=$(gpg --list-key --fixed-list-mode --with-colon \
+    gpgOut=$(gpg --list-key --fixed-list-mode --with-colons \
        --with-fingerprint --with-fingerprint \
        ="$userID" 2>/dev/null) || returnCode="$?"
 

diff --git a/src/share/m/ssh_proxycommand b/src/share/m/ssh_proxycommand
index 3ac70e1dc8865bd99edd3ee8e79122121adfb2c3..8c7187007d23cd70ddf38f4079094e4f686a0473 100644 (file)
--- a/src/share/m/ssh_proxycommand
+++ b/src/share/m/ssh_proxycommand
@@ -217,7 +217,7 @@ output_no_valid_key() {
     fi
 
     # get the gpg info for userid
-    gpgOut=$(gpg_user --list-key --fixed-list-mode --with-colon \
+    gpgOut=$(gpg_user --list-key --with-colons \
        --with-fingerprint --with-fingerprint \
        ="$userID" 2>/dev/null)
 

diff --git a/src/share/m/subkey_to_ssh_agent b/src/share/m/subkey_to_ssh_agent
index 36eab4f751ce21cdc1baefef000a0d5cc0782da5..79291b11d58f55a4e8745493e2f5d04c30f6007b 100644 (file)
--- a/src/share/m/subkey_to_ssh_agent
+++ b/src/share/m/subkey_to_ssh_agent
@@ -47,7 +47,7 @@ subkey_to_ssh_agent() {
     else
        # get list of secret keys
        # (to work around bug https://bugs.g10code.com/gnupg/issue945):
-       secretkeys=$(gpg_user --list-secret-keys --with-colons --fixed-list-mode \
+       secretkeys=$(gpg_user --list-secret-keys --with-colons \
            --fingerprint | \
            grep '^fpr:' | cut -f10 -d: | awk '{ print "0x" $1 "!" }')
 
@@ -56,7 +56,7 @@ subkey_to_ssh_agent() {
 You might want to run 'gpg --gen-key'."
        fi
     
-       authsubkeys=$(gpg_user --list-secret-keys --with-colons --fixed-list-mode \
+       authsubkeys=$(gpg_user --list-secret-keys --with-colons \
            --fingerprint --fingerprint $secretkeys | \
            cut -f1,5,10,12 -d: | grep -A1 '^ssb:[^:]*::[^:]*a[^:]*$' | \
            grep '^fpr::' | cut -f3 -d: | sort -u)
@@ -78,7 +78,7 @@ You might want to run 'monkeysphere gen-subkey'."
 
     for subkey in $authsubkeys; do
        # test that the subkey has proper capability
-       capability=$(gpg_user --list-secret-keys --with-colons --fixed-list-mode \
+       capability=$(gpg_user --list-secret-keys --with-colons \
            --fingerprint --fingerprint "0x${subkey}!" \
            | egrep -B 1 "^fpr:::::::::${subkey}:$" | grep "^ssb:" | cut -d: -f12)
        if ! check_capability "$capability" 'a' ; then
@@ -91,7 +91,10 @@ You might want to run 'monkeysphere gen-subkey'."
        # fingerprint, but filtering out all / characters to make sure
        # the filename is legit.
 
-       primaryuid=$(gpg_user --with-colons --list-key "0x${subkey}!" | grep '^pub:' | cut -f10 -d: | tr -d /)
+        # FIXME: this assumes that the first listed uid is the primary
+        # UID.  does gpg guarantee that?  is there some better way to
+        # get this info?
+       primaryuid=$(gpg_user --with-colons --list-key "0x${subkey}!" | grep '^uid:' | head -n1 | cut -f10 -d: | tr -d /)
 
        #kname="[monkeysphere] $primaryuid"
        kname="$primaryuid"

diff --git a/src/share/ma/diagnostics b/src/share/ma/diagnostics
index 8eca5862fe258a17e3a4dc2f700b0ebd208e2a43..fadb70ddf5949226bfd02f05646d8dcf3b1d3d32 100644 (file)
--- a/src/share/ma/diagnostics
+++ b/src/share/ma/diagnostics
@@ -51,7 +51,7 @@ fi
 # sshd_config lives?
 sshd_config=/etc/ssh/sshd_config
 
-seckey=$(gpg_core --list-secret-keys --fingerprint --with-colons --fixed-list-mode)
+seckey=$(gpg_core --list-secret-keys --fingerprint --with-colons)
 keysfound=$(echo "$seckey" | grep -c ^sec:)
 curdate=$(date +%s)
 # warn when anything is 2 months away from expiration

diff --git a/src/share/ma/list_certifiers b/src/share/ma/list_certifiers
index 56d52da882b80db060dd0a471e14ceaa2bfd6d1e..0a8f4dfcb86b4c98e891f295ea8de3b15352f130 100644 (file)
--- a/src/share/ma/list_certifiers
+++ b/src/share/ma/list_certifiers
@@ -38,7 +38,7 @@ authgrip=$(core_fingerprint | cut -b 25-40)
 # fingerprint, the trust depth, the trust level (60 == marginal, 120
 # == full), and the domain regex (if any):
 
-gpg_sphere --fingerprint --with-colons --fixed-list-mode --check-sigs | \
+gpg_sphere --fingerprint --with-colons --check-sigs | \
     cut -f 1,2,5,8,9,10 -d: | \
     egrep '^(fpr:::::|uat:|uid:|sig:!:'"$authgrip"':[[:digit:]]+ [[:digit:]]+:)' | \
     while IFS=: read -r type validity grip trustparams trustdomain fpr ; do

diff --git a/src/share/ma/setup b/src/share/ma/setup
index 5cc3aab166a1276f74100538a1080ee95c251995..9a047aad4c896186d352c96eec0bd3c08646f510 100644 (file)
--- a/src/share/ma/setup
+++ b/src/share/ma/setup
@@ -110,7 +110,7 @@ EOF
     # our preferences are reasonable (i.e. 3 marginal OR 1 fully
     # trusted certifications are sufficient to grant full validity.
     log debug "checking trust model for authentication ..."
-    local TRUST_MODEL=$(gpg_sphere "--with-colons --fixed-list-mode --list-keys" 2>/dev/null \
+    local TRUST_MODEL=$(gpg_sphere "--with-colons --list-keys" 2>/dev/null \
        | head -n1 | grep "^tru:" | cut -d: -f3,6,7)
     log debug "sphere trust model: $TRUST_MODEL"
     if [ "$TRUST_MODEL" != '1:3:1' ] ; then

diff --git a/tests/keytrans b/tests/keytrans
index 3aaed50cfc498fce2ab2bf83a5bbfd60d7641734..0c465c3679690d989101107f069ca42407bab4b6 100755 (executable)
--- a/tests/keytrans
+++ b/tests/keytrans
@@ -66,6 +66,7 @@ cat > "$TEMPDIR"/gpg.conf <<EOF
 default-preference-list SHA512 SHA384 SHA256 SHA224 RIPEMD160 SHA1 ZLIB BZIP2 ZIP AES256 AES192 AES CAST5 3DES
 cert-digest-algo SHA256
 list-options show-uid-validity,show-unusable-uids
+fixed-list-mode
 EOF
 
 # generate a key
@@ -82,7 +83,7 @@ EOF
 
 echo "##################################################"
 echo "### retrieving key timestamp..."
-timestamp=$(gpg --list-key --with-colons --fixed-list-mode | \
+timestamp=$(gpg --list-key --with-colons | \
     grep ^pub: | cut -d: -f6)
 
 echo "##################################################"
@@ -135,7 +136,7 @@ uid:u::::$timestamp::8200BD0425CC70C7D698DF3FE412044EAAB83F94::testtest:
 sig:!::1:$KEYID:$timestamp::::monkeymonkey:13x:
 EOF
 
-diff -u "$TEMPDIR"/expectedout <(gpg --check-sigs --with-colons --fixed-list-mode | grep -v ^tru)
+diff -u "$TEMPDIR"/expectedout <(gpg --check-sigs --with-colons | grep -v ^tru)
 
 echo "##################################################"
 echo "### sleeping to avoid test suite breakage on fast"
@@ -165,7 +166,7 @@ rev:!::1:$KEYID:$revtime::::monkeymonkey:30x:
 EOF
 
 
-diff -u "$TEMPDIR"/expectedout <(gpg --check-sigs --with-colons --fixed-list-mode | grep -v ^tru)
+diff -u "$TEMPDIR"/expectedout <(gpg --check-sigs --with-colons | grep -v ^tru)
 
 
 echo "##################################################"
@@ -201,7 +202,7 @@ sig:!::1:$NEWKEYID:$(($timestamp + 1))::::fubar:13x:
 EOF
 
 echo "test: diff expected gpg list output"
-diff -u "$TEMPDIR"/expectedout <(gpg --check-sigs --with-colons --fixed-list-mode | grep -v ^tru)
+diff -u "$TEMPDIR"/expectedout <(gpg --check-sigs --with-colons | grep -v ^tru)
 
 sort >"$TEMPDIR"/expectedout <<EOF
 $KEYFPR