keys.*: Enforce separation between user's files and the system.

[distorted-keys] / keys.keeper-cards

diff --git a/keys.keeper-cards b/keys.keeper-cards
index 73f2411..825f6f5 100755 (executable)
--- a/keys.keeper-cards
+++ b/keys.keeper-cards
@@ -31,22 +31,38 @@ defhelp <<HELP
 KEEPER [INDICES ...]
 Typeset cards for a set of keeper secrets.
 
-This program writes a file KEEPER.ps which will contain private keys from the
-keeper set KEEPER, specifically the keys with the given INDICES.  Elements of
-the list are either simple integers or ranges [LOW]-[HIGH]; if LOW is
-omitted, it means 0, and if HIGH is omitted, it means the highest possible
-index.  If no INDICES are given then all secret keys are written.
+This program writes a PostScript file to standard output which will contain
+key nubs from the keeper set KEEPER, specifically the keys with the given
+INDICES.  Elements of the list are either simple integers or ranges
+[LOW]-[HIGH]; if LOW is omitted, it means 0, and if HIGH is omitted, it means
+the highest possible index.  If no INDICES are given then all secret keys are
+written.
 
 The public keys are found in $KEYS/keeper/KEEPER/I.pub;
-private keys are read from KEEPER/I in the current directory.
+key nubs are read from the safe place where \`keys new-keeper' left
+them.
 HELP
 
 ## Parse the command line.
 case $# in 0) usage_err ;; esac
 keeper=$1; shift
 checkword "keeper set label" "$keeper"
+
+## Find out about the set.
+if [ ! -f $KEYS/keeper/$keeper/meta ]; then
+  echo >&2 "$quis: unknown keeper set \`$keeper'"
+  exit 1
+fi
 read n hunoz <$KEYS/keeper/$keeper/meta
 
+## Check that nubs are available for the keeper set.
+reqsafe
+if [ ! -d $SAFE/keys.keeper/$keeper/ ]; then
+  echo >&2 "$quis: no nubs available for keeper set \`$keeper'"
+  exit 1
+fi
+cd $SAFE/keys.keeper/$keeper/
+
 ## Build a colon-separated list of the indices we actually want.
 want=:
 case $# in 0) set 0- ;; esac
@@ -239,8 +255,8 @@ i=0
 while [ $i -lt $n ]; do
   case $want in
     *:"$i":*)
-      read secret <$keeper/$i
-      tr -d '\n' <$keeper/$i | qrencode -m0 -s1 -o$tmp/$i.png
+      read secret <$i
+      tr -d '\n' <$i | qrencode -m0 -s1 -o$tmp/$i.png
       convert $tmp/$i.png $tmp/$i.eps
       cat >&3 <<EOF
 \card{$i}{$secret}
@@ -261,6 +277,6 @@ if ! (cd $tmp
   sed >&2 's/^/| /' $tmp/tex.out
   exit 1
 fi
-cp $tmp/$keeper.ps .
+cat $tmp/$keeper.ps
 
 ###----- That's all, folks --------------------------------------------------