tripe-keys: Don't hard-code the `-l' flag when generating master keys.

It makes automated testing painful.  Instead, provide a configuration
parameter master-keygen-flags which defaults to -l but can be overridden
by people who know what they're doing.

diff --git a/keys/tripe-keys.conf.5 b/keys/tripe-keys.conf.5
index 4dcda40..e43aec5 100644 (file)
--- a/keys/tripe-keys.conf.5
+++ b/keys/tripe-keys.conf.5
@@ -109,6 +109,10 @@ and
 The sequence number of the master authority's current signing key.  No
 default.  Usually set up automatically.
 .TP
 The sequence number of the master authority's current signing key.  No
 default.  Usually set up automatically.
 .TP

+.I master-keygen-flags
+Additional options for generating master keys.  Default is
+.RB ` -l '.
+.TP

 .I hk-master
 The fingerprint of the current master signing key.  No default.  Usually
 set up automatically.
 .I hk-master
 The fingerprint of the current master signing key.  No default.  Usually
 set up automatically.

diff --git a/keys/tripe-keys.in b/keys/tripe-keys.in
index 1167dea..531e749 100644 (file)
--- a/keys/tripe-keys.in
+++ b/keys/tripe-keys.in
@@ -136,6 +136,7 @@ def conf_defaults():
                ('kx-expire', 'now + 1 year'),
                ('cipher', 'blowfish-cbc'),
                ('hash', 'sha256'),
                ('kx-expire', 'now + 1 year'),
                ('cipher', 'blowfish-cbc'),
                ('hash', 'sha256'),

+               ('master-keygen-flags', '-l'),

                ('mgf', '${hash}-mgf'),
                ('mac', lambda: '%s-hmac/%d' %
                          (conf['hash'],
                ('mgf', '${hash}-mgf'),
                ('mac', lambda: '%s-hmac/%d' %
                          (conf['hash'],


@@ -219,7 +220,7 @@ def cmd_newmaster(args):
   seq = max_master_sequence() + 1
   run('''key -kmaster add
     -a${sig-genalg} !${sig-param}
   seq = max_master_sequence() + 1
   run('''key -kmaster add
     -a${sig-genalg} !${sig-param}

-    -e${sig-expire} -l -tmaster-%d tripe-keys-master
+    -e${sig-expire} !${master-keygen-flags} -tmaster-%d tripe-keys-master

     sig=${sig} hash=${sig-hash}''' % seq)
   run('key -kmaster extract -f-secret repos/master.pub')
 
     sig=${sig} hash=${sig-hash}''' % seq)
   run('key -kmaster extract -f-secret repos/master.pub')