bin/sign: Include `known_hosts' entries in the signed bundle.

[ssh-ca] / bin / sign

#! /bin/sh

set -e
. lib/func.sh

## The key types are adorned with bit lengths.  Work out the raw key type
## names.
rawkeytypes=""
for kt in $keytypes; do
  rawkeytypes="$rawkeytypes ${kt%:*}"
done

## Start a new output directory.
rm -rf publish.new
mkdir publish.new
exec 3<etc/hosts 4>publish.new/hosts.list
echo ":certificate-authority" >&4
for kt in $rawkeytypes; do
  cp ca/ca-$kt.pub publish.new/
  read pub <ca/ca-$kt.pub
  echo "@cert-authority $scope $pub" |
	tee publish.new/ca-$kt.entry >&4
  ssh-keygen -lv -fca/ca-$kt.pub | sed 's,^,| ,' >&4
done

## Sign the various host keys.
last=%%%
while read line <&3; do

  ## Ignore comments and empty lines.
  case "$line" in
    "#"* | "") continue ;;
    ##*[! 	]*) ;;
    ##*) continue ;;
  esac

  ## Read the host line.
  set -- $line
  host=$1
  names=""
  nicks=""

  ## If this is a different host, then start a new section of the list.
  case "$last" in
    "$host") ;;
    *) { echo; echo ":host $host"; } >&4 ;;
  esac
  last=$host

  ## Build a list of names for the host.
  for n in "$@"; do
    case "$n" in
      .*) for h in $nicks; do names=${names:+$names,}$h$n.$domain; done ;;
      *.* | *:*) names=${names:+$names,}$n ;;
      *) nicks=${nicks:+$nicks }$n names=${names:+$names,}$n.$domain ;;
    esac
  done

  ## Sign certificates.
  for kt in $rawkeytypes; do
    if [ ! -f host/$host-$kt.pub ]; then continue; fi
    cp host/$host-$kt.pub publish.new/
    ssh-keygen -q -tv00 -sca/ca-$kt \
      -h -I"$cacomment:$host.$domain" -n$names \
      -V$validity \
      publish.new/$host-$kt.pub
    mv publish.new/$host-$kt-cert.pub \
      publish.new/$host-$kt.cert
    { printf "%s " $names; cat host/$host-$kt.pub; } >&4
    ssh-keygen -lv -fhost/$host-$kt.pub | sed 's,^,| ,' >&4
  done
done
exec 3>&- 4>&-

## Sign the list.
run_gpg --armor -o publish.new/hosts.asc \
  --clearsign publish.new/hosts.list
rm publish.new/hosts.list

## Include a copy of the public key.
run_gpg --export --armor -o publish.new/ca-gnupg.asc

## Done.
if [ -d publish ]; then
  rm -rf publish.old
  mv publish publish.old
fi
mv publish.new publish
rm -rf publish.old