X-Git-Url: https://git.distorted.org.uk/~mdw/distorted-keys/blobdiff_plain/c47f2aba7d705252c660ba1ad0931fbb93122d80..0bc47568f2c94d6e48bc389ac508d5f905daa9c7:/cryptop.recover

diff --git a/cryptop.recover b/cryptop.recover
old mode 100644
new mode 100755
index f661569..c4b1e7f
--- a/cryptop.recover
+++ b/cryptop.recover
@@ -28,21 +28,34 @@ case "${KEYSLIB+t}" in t) ;; *) echo >&2 "$0: KEYSLIB unset"; exit 1 ;; esac
 . "$KEYSLIB"/keyfunc.sh
 
 defhelp <<HELP
-KEY RECOV
+[-i INST] KEY RECOV
 Recover the named user KEY using a blob protected using the recovery key
 RECOV; it is an error if RECOV is not currently revealed.
 HELP
 
+inst=current
+while getopts "i:" opt; do
+  case "$opt" in
+    i) inst=$OPTARG ;;
+    *) usage_err ;;
+  esac
+done
+shift $(( $OPTIND - 1 ))
 case $# in 2) ;; *) usage_err ;; esac
 key=$1 recov=$2
 parse_keylabel "$key"
 if [ ! -d $kdir ]; then echo >&2 "$quis: unknown key \`$key'"; exit 1; fi
+checkword "recovery instance" "$inst"
 checkword "recovery key label" "$recov"
+case $kowner in
+  $USERV_USER) ;;
+  *) echo >&2 "$quis: you're not the owner of key \`$key'"; exit 1 ;;
+esac
 
 mktmp
 nubid=$(cat $kdir/nubid)
 readmeta $kdir
-read_profile "$profile"
+read_profile $kowner "$profile"
 if [ -f $knub ]; then
   nubbin=$(nubid <$knub)
   case "$nubbin" in
@@ -54,7 +67,7 @@ if [ -f $knub ]; then
 fi
 
 umask 077
-recover $recov $kowner/$klabel >$knub.new
+recover $recov $inst $kowner/$klabel >$knub.new
 nubbin=$(nubid <$knub.new)
 case "$nubbin" in
   "$nubid") ;;