Malte Meiboom
30b1d29274
- Add functionality to query online sources (Keyservers, etc) for certificates. - Use introducers to determine which UserIDs should be fetched from online soources. Check certifications before importing certifiactes into the local cert store. - start docker image for local end-to-end testing.
45 lines
2.0 KiB
Bash
45 lines
2.0 KiB
Bash
#!/usr/bin/bash
|
|
|
|
export SEQUOIA_HOME=$(mktemp -d)
|
|
export TMP=$(mktemp -d)
|
|
export SEQUOIA_TARGET=/tmp/sq_home
|
|
|
|
mkdir -p $SEQUOIA_TARGET
|
|
|
|
# create keys
|
|
ALICE_FPR=$(sq key generate --own-key --without-password --name "Alice" --email "alice@example.com" 2>&1 | grep "Fingerprint:" | cut -d ':' -f 2)
|
|
BOB_FPR=$(sq key generate --own-key --without-password --name "Bob" --email "bob@example.com" 2>&1 | grep "Fingerprint:" | cut -d ':' -f 2)
|
|
CAROL_FPR=$(sq key generate --own-key --without-password --name "Carol" --email "carol@example.com" 2>&1 | grep "Fingerprint:" | cut -d ':' -f 2)
|
|
DAVE_FPR=$(sq key generate --own-key --without-password --name "Dave" --email "dave@example.com" 2>&1 | grep "Fingerprint:" | cut -d ':' -f 2)
|
|
|
|
CA_FPR=$(sq key generate --own-key --without-password --name "CA" --email "ca@example.com" 2>&1 | grep "Fingerprint:" | cut -d ':' -f 2)
|
|
|
|
# vouch for bob
|
|
sq pki vouch add --certifier $CA_FPR --cert $BOB_FPR --email "bob@example.com"
|
|
# vouch for carol
|
|
sq pki vouch add --certifier $CA_FPR --cert $CAROL_FPR --email "carol@example.com"
|
|
|
|
# export
|
|
sq key export --cert $ALICE_FPR > $TMP/alice_sk.pgp
|
|
sq key export --cert $CA_FPR > $TMP/ca_sk.pgp
|
|
# only certs
|
|
sq cert export --cert $BOB_FPR > $TMP/bob_pk.pgp
|
|
sq network keyserver publish --server hkps://example.com --cert $CAROL_FPR
|
|
sq network keyserver publish --server hkps://example.com --cert $DAVE_FPR
|
|
|
|
# create store
|
|
export SEQUOIA_HOME=$SEQUOIA_TARGET
|
|
sq key import $TMP/alice_sk.pgp
|
|
sq key import $TMP/ca_sk.pgp
|
|
sq cert import $TMP/bob_pk.pgp
|
|
|
|
sq pki link authorize --unconstrained --cert $CA_FPR --all --domain example.com
|
|
|
|
# Outcome:
|
|
# ca@example.com is authenticated with an unlimited trust depth and a restriction for domain example.com
|
|
# alice@example.com has a local key, but it is not authenticated
|
|
# bob@example.com has a local cert, which is certified by ca@example.com
|
|
# carol@example.com is published on a keyserver and certified by ca@example.com
|
|
# dave@example.com is published on a keyserver but uncertified
|
|
|