Merge branch 'master' into debian

3 files changed, 245 insertions, 8 deletions

diff --git a/lib/keyringer/completions/bash/keyringer b/lib/keyringer/completions/bash/keyringer
new file mode 100644
index 0000000..e33977a
--- /dev/null
+++ b/lib/keyringer/completions/bash/keyringer
@@ -0,0 +1,124 @@
+#!bash
+#
+# Keyringer bash completion
+#
+
+if [[ -n ${ZSH_VERSION-} ]]; then
+	autoload -U +X bashcompinit && bashcompinit
+fi
+
+# Completion for git subcommand
+_keyringer_git_complete() {
+  if [ -e "/etc/bash_completion.d/git" ]; then
+    (
+      source /etc/bash_completion.d/git
+      cd $path
+      COMP_WORDS=(git $*)
+      COMP_CWORD=$((${#COMP_WORDS[*]} - 1))
+
+      if [ "$COMP_CWORD" == "0" ]; then
+        COMP_CWORD=1
+      fi
+
+      _git
+
+      LAST=${COMP_WORDS[COMP_CWORD]}
+      REPLY=${COMPREPLY[@]}
+
+      if [ "$REPLY" == "$LAST" ]; then
+        return
+      fi
+
+      echo ${COMPREPLY[@]}
+    )
+  fi
+}
+
+_keyringer() {
+  # Standard stuff
+  local cur prev opts config
+  COMPREPLY=()
+  cur="${COMP_WORDS[COMP_CWORD]}"
+  prev="${COMP_WORDS[COMP_CWORD-1]}"
+  command="${COMP_WORDS[2]}"
+
+  # Initial options
+  config="$HOME/.keyringer"
+
+  # Check if we have initial configuration
+  if [ ! -d "$config" ]; then
+    return
+  fi
+
+  # Process config
+  source $config/config
+  path="`eval echo '$'$instance`"
+  keyrings="`ls $config | sed -e 's/config//'`"
+
+  # Available instances
+  instances="`echo $keyrings | sed -e 's/ /|/'`"
+
+  # The current instance
+  instance="${COMP_WORDS[1]}"
+
+  # Command completions
+  if [ "${#COMP_WORDS[@]}" == "2" ]; then
+    opts="$keyrings"
+  elif [ "${#COMP_WORDS[@]}" == "3" ] && echo "${prev}" | grep -qe "[$instances]"; then
+    opts="`keyringer $instance commands`"
+  elif [ "${#COMP_WORDS[@]}" == "4" ]; then
+    case "${prev}" in
+      options|preferences)
+        opts="ls edit add"
+        ;;
+      recipients)
+        opts="ls edit"
+        ;;
+      ls|encrypt|encrypt-batch|decrypt|edit|append|append-batch|del|recrypt)
+        opts="$(bash -c "set -f && keyringer $instance ls -p -d ${cur}*" 2> /dev/null)"
+        ;;
+      genpair)
+        opts="gpg ssh ssl ssl-self"
+        ;;
+      git)
+        opts="$(_keyringer_git_complete ${cur})"
+        ;;
+      *)
+        ;;
+    esac
+  elif [ "${#COMP_WORDS[@]}" == "5" ]; then
+    case "${command}" in
+      recipients)
+        opts="$(cd $path/config/recipients && ls -p ${cur}* 2> /dev/null)"
+        ;;
+      genpair)
+        opts="$(bash -c "set -f && keyringer $instance ls -p -d ${cur}*" 2> /dev/null)"
+        ;;
+      git)
+        # TODO
+        opts="$(_keyringer_git_complete ${prev} ${cur})"
+        ;;
+      *)
+        ;;
+    esac
+  elif [ "${command}" == "git" ]; then
+    # TODO
+    opts="$(_keyringer_git_complete ${COMP_WORDS[@]:3})"
+  fi
+
+  # Avoid annoying bell and extra tab
+  if [ -z "$ZSH_VERSION" ]; then
+    bind 'set show-all-if-ambiguous on'
+  fi
+
+  # Return the available options
+  COMPREPLY=( $(compgen -W "${opts}" -- ${cur}) )
+
+  if [ -z "$ZSH_VERSION" ]; then
+    [[ $COMPREPLY == */ ]] && compopt -o nospace
+  fi
+
+  return 0
+}
+
+complete -F _keyringer keyringer
diff --git a/lib/keyringer/completions/zsh/_keyringer b/lib/keyringer/completions/zsh/_keyringer
new file mode 100644
index 0000000..c8ada9b
--- /dev/null
+++ b/lib/keyringer/completions/zsh/_keyringer
@@ -0,0 +1,88 @@
+#compdef keyringer
+
+# Completion for git subcommand
+_keyringer_git_complete() {
+  # TODO: how to call _git() properly?
+  return
+}
+
+_keyringer() {
+    local curcontext="$curcontext" state line
+    typeset -A opt_args
+
+    # Initial options
+    local config="$HOME/.keyringer"
+
+    # Check if we have initial configuration
+    if [ ! -d "$config" ]; then
+      return
+    fi
+
+    # Process config
+    local keyrings="`ls $config | sed -e 's/config//'`"
+    source $config/config
+    keyring_path="`eval echo '$'$words[2]`"
+
+    _arguments        \
+      '1: :->keyring' \
+      '2: :->action'  \
+      '3: :->options' \
+      '4: :->misc'    \
+      '*: :->final'
+
+    case $state in
+      keyring)
+        _arguments "1:Keyrings:($keyrings)"
+        ;;
+      action)
+        compadd "$@" `keyringer $words[2] commands`
+        ;;
+      options)
+        case $words[3] in
+          options|preferences)
+            compadd "$@" ls edit add
+            ;;
+          recipients)
+            compadd "$@" ls edit
+            ;;
+          ls|encrypt|encrypt-batch|decrypt|edit|append|append-batch|del|recrypt)
+            # TODO: do not rely on bash
+            compadd "$@" $(bash -c "set -f && keyringer $words[2] ls -p -d $words[4]*" 2> /dev/null)
+            ;;
+          genpair)
+            compadd "$@" gpg ssh ssl ssl-self
+            ;;
+          git)
+            compadd "$@" $(_keyringer_git_complete $words[4])
+            ;;
+          *)
+            ;;
+        esac
+        ;;
+      misc)
+        case "$words[3]" in
+          recipients)
+            compadd "$@" $(cd $keyring_path/config/recipients && ls -p $words[5]* 2> /dev/null)
+            ;;
+          genpair)
+            # TODO: do not rely on bash
+            compadd "$@" $(bash -c "set -f && keyringer $words[2] ls -p -d $words[5]*" 2> /dev/null)
+            ;;
+          git)
+            # TODO
+            compadd "$@" $(_keyringer_git_complete $words[4] $words[5])
+            ;;
+          *)
+            ;;
+        esac
+        ;;
+      *)
+        if [ $words[3] == "git" ]; then
+          # TODO
+          true
+        fi
+        ;;
+    esac 
+}
+
+_keyringer "$@"
diff --git a/lib/keyringer/functions b/lib/keyringer/functions
index 6ac8bf8..3fa7170 100644
--- a/lib/keyringer/functions
+++ b/lib/keyringer/functions
@@ -74,6 +74,10 @@ function keyringer_exec {
   # Dispatch
   if keyringer_has_action "$action"; then
     "$ACTIONS/$action" "$basedir" $*
+    err="$?"
+    if [ "$err" != "0" ]; then
+      exit "$err"
+    fi
   fi
 }
 
@@ -338,8 +342,24 @@ function keyringer_action_usage {
   fi
 }
 
+# Return available actions
+function keyringer_show_actions {
+  ls $ACTIONS
+}
+
+# Usage
+function keyringer_usage {
+  printf "Usage: %s <keyring> <action> [arguments]\n" "$BASENAME"
+  printf "Available commands: \n"
+  keyringer_show_actions | sed -e 's/^/\t/'
+}
+
 # Check recipients
 function keyringer_check_recipients {
+  if [ "$KEYRINGER_CHECK_RECIPIENTS" == "false" ]; then
+    return
+  fi
+
   # Check if recipients file is empty.
   if [ "`grep -vE "^#|^$" "$RECIPIENTS"/* | wc -l`" == 0 ] && [ "$SUBCOMMAND" != "edit" ]; then
     echo "Fatal: no recipients configured for this keyring."
@@ -364,15 +384,19 @@ function keyringer_check_recipients {
       echo "Fatal: please set the full GPG signature hash for key ID $recipient:"
       cat <<-EOF
 
-Recipients file can't have 32-bit keyids (e.g.  DEADBEEF or DECAF123).  These
-are trivial to spoof.  With a few gigs of disk space and a day of time on
-cheap, readily-available hardware, it's possible to build keys to match every
-possible 32-bit keyid.  The search space just isn't big enough.
+Please provide a full OpenPGP fingerprint, for example:
+
+  john@doe.com ABCD1234ABCD12345678ABCD1234ABCD12345678
 
-If you're going to specify keys by keyid, they should be specified by full
-160-bit OpenPGP fingerprint.  It would be very bad if someone spoofed a keyID
-and caused another participant in a keyringer instance to reencrypt a secret
-store to the spoofed key in addition to your own.
+Short key ids (for example, DEADBEEF or DECAF123) are not allowed in
+recipient files because they are easy to spoof. Researchers have proven
+that it is possible to build fake keys to match any possible short key
+id by using a few gigabytes of disk space, and a day of computation on
+common hardware.
+
+Otherwise, the encryption can be broken, if someone spoofs a short key
+id, and causes a participant in a keyringer repository to encrypt
+secrets to a fake key.
 EOF
       exit 1
     else
@@ -446,5 +470,6 @@ function keyringer_create_new_recipients {
 
 # Setup environment
 if [ "$(basename "$0")" != "keyringer" ]; then
+  keyringer_config_load_preferences
   keyringer_set_env $*
 fi