Malte Meiboom
bd0b48398d
- If the signing key is replaced too fast (within the same second) the resolution of OpenPGP timestamps is not good enough to identify the sequence of certifications - which might to the selection of the wrong signing key.
73 lines
2.1 KiB
Bash
73 lines
2.1 KiB
Bash
#!/usr/bin/bash
|
|
|
|
# source some functions
|
|
. common.sh
|
|
|
|
test_header "Signing"
|
|
|
|
# sq key generate --shared-key --without-password --email 'signing@example.com' --output /tmp/signing.pgp --rev-cert /tmp/signing.rev
|
|
|
|
SIGN_FPR=$(sq key generate --own-key --without-password --name "Signing Key" 2>&1 | grep "Fingerprint:" | cut -d ':' -f 2)
|
|
|
|
cd $HUSK_DIR
|
|
|
|
$HUSK_BIN --config config/config.toml signkey set --cert $SIGN_FPR
|
|
SIGN_FPR=$($HUSK_BIN --config config/config.toml signkey show | cut -d ':' -f 2 | tr -d ' ')
|
|
echo "found signing key $SIGN_FPR"
|
|
|
|
create_unix_user juliette
|
|
JULIETTE_FPR=$(sq key generate --own-key --without-password --name "Juliette" --email "juliette@example.com" 2>&1 | grep "Fingerprint:" | cut -d ':' -f 2)
|
|
sq pki vouch add --certifier-userid "CA" --cert $JULIETTE_FPR --all > /dev/null 2>&1
|
|
|
|
# send a mail, husk should encrypt it
|
|
echo "send mail to juliette@example.com"
|
|
send_test_mail juliette@example.com
|
|
|
|
if [ -f /var/mail/juliette ] ; then
|
|
if grep -q "BEGIN PGP MESSAGE" /var/mail/juliette ; then
|
|
|
|
FOUND_FPR=$(sq packet dump /var/mail/juliette | grep "Issuer Fingerprint:" | cut -d ':' -f 2 | tr -d ' ')
|
|
|
|
if [ "$SIGN_FPR" != "$FOUND_FPR" ] ; then
|
|
echo "Found wrong fingerprint '$FOUND_FPR' - expected '$SIGN_FPR'"
|
|
exit 1
|
|
fi
|
|
else
|
|
echo "no encryption detected"
|
|
exit 1
|
|
fi
|
|
else
|
|
echo "no mail detected"
|
|
exit 1
|
|
fi
|
|
|
|
sleep 1
|
|
echo "set new signing key"
|
|
|
|
SIGN_FPR=$($HUSK_BIN --config config/config.toml signkey create | cut -d ':' -f 2 | tr -d ' ')
|
|
echo "new signing key $SIGN_FPR"
|
|
|
|
# remove old mail
|
|
rm /var/mail/juliette
|
|
|
|
echo "send mail to juliette@example.com"
|
|
send_test_mail juliette@example.com
|
|
|
|
if [ -f /var/mail/juliette ] ; then
|
|
if grep -q "BEGIN PGP MESSAGE" /var/mail/juliette ; then
|
|
|
|
FOUND_FPR=$(sq packet dump /var/mail/juliette | grep "Issuer Fingerprint:" | cut -d ':' -f 2 | tr -d ' ')
|
|
|
|
if [ "$SIGN_FPR" != "$FOUND_FPR" ] ; then
|
|
echo "Found wrong fingerprint '$FOUND_FPR' - expected '$SIGN_FPR'"
|
|
exit 1
|
|
fi
|
|
else
|
|
echo "no encryption detected"
|
|
exit 1
|
|
fi
|
|
else
|
|
echo "no mail detected"
|
|
exit 1
|
|
fi
|