#!/usr/bin/bash

export SEQUOIA_HOME=$(mktemp -d)
export TMP=$(mktemp -d)
export SEQUOIA_TARGET=/tmp/sq_home

mkdir -p $SEQUOIA_TARGET

# create keys
ALICE_FPR=$(sq key generate --own-key --without-password --name "Alice" --email "alice@example.com" 2>&1 | grep "Fingerprint:" | cut -d ':' -f 2)
BOB_FPR=$(sq key generate --own-key --without-password --name "Bob" --email "bob@example.com" 2>&1 | grep "Fingerprint:" | cut -d ':' -f 2)
CAROL_FPR=$(sq key generate --own-key --without-password --name "Carol" --email "carol@example.com" 2>&1 | grep "Fingerprint:" | cut -d ':' -f 2)
DAVE_FPR=$(sq key generate --own-key --without-password --name "Dave" --email "dave@example.com" 2>&1 | grep "Fingerprint:" | cut -d ':' -f 2)

CA_FPR=$(sq key generate --own-key --without-password --name "CA" --email "ca@example.com" 2>&1 | grep "Fingerprint:" | cut -d ':' -f 2)

# vouch for bob
sq pki vouch add --certifier $CA_FPR --cert $BOB_FPR --email "bob@example.com"
# vouch for carol
sq pki vouch add --certifier $CA_FPR --cert $CAROL_FPR --email "carol@example.com"

# export
sq key export --cert $ALICE_FPR > $TMP/alice_sk.pgp
sq key export --cert $CA_FPR > $TMP/ca_sk.pgp
# only certs
sq cert export --cert $BOB_FPR > $TMP/bob_pk.pgp
sq network keyserver publish --server hkps://example.com --cert $CAROL_FPR
sq network keyserver publish --server hkps://example.com --cert $DAVE_FPR

# create store
export SEQUOIA_HOME=$SEQUOIA_TARGET
sq key import $TMP/alice_sk.pgp
sq key import $TMP/ca_sk.pgp
sq cert import $TMP/bob_pk.pgp

sq pki link authorize --unconstrained --cert $CA_FPR --all --domain example.com

# Outcome:
# ca@example.com is authenticated with an unlimited trust depth and a restriction for domain example.com
# alice@example.com has a local key, but it is not authenticated
# bob@example.com has a local cert, which is certified by ca@example.com
# carol@example.com is published on a keyserver and certified by ca@example.com
# dave@example.com is published on a keyserver but uncertified