sshkeyupdate

#!/usr/bin/env bash
# sshkeyupdate - download and verify new ~/.ssh/authorized_keys

readonly unix_user="grawity"
readonly src_url="http://nullroute.lt/~grawity/files/authorized_keys.txt"
readonly signer_fpr="2357E10CEF4F7ED27E233AD5D24F6CB2C1B52632"

PATH="$HOME/bin:$PATH"

# for libff/libhf
PATH="$HOME/bin/bin:$PATH"

. lib.bash || exit
. libfilterfile.bash || exit
. libhttpfetch.bash || exit

progname_prefix=0

usage() {
	echo "Usage: $progname [-f] [-q] [-r [-k URL]]"
	echo ""
	echo_opt "-f"		"proceed on username mismatch"
	echo_opt "-q"		"quietly exit if update is not to be done"
	echo_opt "-r"		"import the signing key from keyserver"
	echo_opt "-k URL"	"use a different keyserver for -r"
}

filter_keys() {
	filter_file 'match_hostname'
}

recv_key() {
	local key=$1 status=
	if status=$(gpg --keyserver "$keyserver" --recv-key "$key" 2>&1); then
		lib:trace "$status"
	else
		echo "$status" >&2
		vmsg "failed to receive key $key from $keyserver" >&2
		return 1
	fi
}

fetch() {
	local url=$1 out=$2
	local maxtries=3 delay=3 attempt=1
	while true; do
		debug "fetching $url (try #$attempt)"
		if http_fetch "$url" "$out"; then
			return 0
		elif (( $? == 99 )); then
			break
		fi
		rm -f "$out"
		if (( attempt++ >= maxtries )); then
			break
		fi
		sleep $delay
		(( delay *= 2 ))
	done
	return 1
}

verify() {
	local input=$1 output=$2 status= errors=0
	if ! status=$(gpg --batch --yes --status-fd 1 --output "$output" \
	                 --trust-model pgp --decrypt "$input" 2> /dev/null); then
		vmsg "unknown gpg error" >&2
		echo "$status" >&2
		return 1
	fi
	if ! grep -Eqs "^\\[GNUPG:\\] VALIDSIG $signer_fpr " <<< "$status"; then
		vmsg "file has invalid signature" >&2
		echo "$status" >&2
		return 1
	fi
	if ! grep -Eqs "^\\[GNUPG:\\] TRUST_ULTIMATE( 0 .+)?\$" <<< "$status"; then
		vmsg "signer key is not ultimately trusted" >&2
		echo "$status" >&2
		return 1
	fi
	return 0
}

opt_testfilter=0
opt_force=0
opt_import=0
opt_quiet=0
keyserver="hkps://keyserver.ubuntu.com"
dst_file=~/.ssh/authorized_keys

while getopts :Ffk:rq OPT; do
	case $OPT in
	F) opt_testfilter=1;;
	f) opt_force=1;;
	k) keyserver=$OPTARG;;
	r) opt_import=1;;
	q) opt_quiet=1;;
	*) lib:die_getopts;;
	esac
done; shift $[OPTIND-1]

if (( $# )); then
	vdie "excess arguments"
fi

umask 077

if (( opt_testfilter )); then
	if [[ -t 0 ]]; then
		vdie "filter test mode requires file input"
	fi
	if [[ -t 1 ]]; then
		export FILTERDEBUG=1
		exec >/dev/null
	fi
	filter_keys
	exit
fi

if [[ -e ~/.ssh/authorized_keys.optout ]]; then
	if (( opt_force )); then
		true
	elif (( !opt_quiet )); then
		vdie "optout marker found"
	else
		exit 0
	fi
fi

if [[ "$LOGNAME" != "$unix_user" ]]; then
	if [[ -e ~/.ssh/authorized_keys.optin ]]; then
		true
	elif (( opt_force )); then
		echo "$LOGNAME on $(date)" > ~/.ssh/authorized_keys.optin
	elif (( !opt_quiet )); then
		vdie "username mismatch, this program isn't for you"
	else
		exit 0
	fi
fi

if ! have gpg; then
	vdie "gpg is not installed"
fi

# ensure key exists in keyring

if (( opt_import )); then
	recv_key "$signer_fpr" || vdie "failed to import key '$signer_fpr'"
	vmsg "owner key imported"
	echo "$signer_fpr:6:" | gpg --import-ownertrust
	vmsg "ultimate trust set"
elif ! [[ -d ~/.gnupg ]]; then
	if (( !opt_quiet )); then
		vdie "~/.gnupg is not initialized"
	else
		exit 0
	fi
elif ! gpg --list-keys "$signer_fpr" > /dev/null; then
	if (( !opt_quiet )); then
		vdie "signer key $signer_fpr not found in keyring"
	else
		exit 0
	fi
fi

# download new pubkeys

mkdir -p "${dst_file%/*}"

tmp_signed=$(mktemp "$dst_file.XXXXXXXX")

if ! fetch "$src_url" "$tmp_signed"; then
	rm -f "$tmp_signed"
	vdie "fetch of $src_url failed"
elif ! test -s "$tmp_signed"; then
	rm -f "$tmp_signed"
	vdie "empty file fetched from $src_url"
fi

tmp_plain=$(mktemp "$dst_file.XXXXXXXX")

if ! verify "$tmp_signed" "$tmp_plain"; then
	rm -f "$tmp_plain"
	vdie "verification of $tmp_signed failed"
fi

local_file="$dst_file.local"

{
	echo "# updated: at $(date +"%Y-%m-%d %H:%M:%S %z")"
	echo "# updated: from $src_url"
	cat "$tmp_plain"
	if [[ -s $local_file ]]; then
		echo "# updated: from $local_file"
		cat "$local_file"
	fi
	echo "# updated: end"
} | filter_keys > "$dst_file"

rm -f "$tmp_plain" "$tmp_signed"

if [[ -t 1 ]]; then
	num=$(grep -c '^[^#]' "$dst_file")
	vmsg "imported $num keys"
fi