diff options
Diffstat (limited to 'scripts')
| -rwxr-xr-x | scripts/continuum-signed | 28 |
1 files changed, 25 insertions, 3 deletions
diff --git a/scripts/continuum-signed b/scripts/continuum-signed index 6dd1f4c..1523094 100755 --- a/scripts/continuum-signed +++ b/scripts/continuum-signed @@ -14,6 +14,9 @@ # continuum-signed seal PATH JSON writes JSON at PATH sealed for its readers, # signed # continuum-signed open PATH the JSON sealed at PATH, opened +# continuum-signed key-add ID FILE adds (or replaces) key ID of the user's own, +# the public key in FILE (.pub), signed +# continuum-signed key-remove ID removes key ID of the user's own, signed # # PATH is the store's (`config/mode`), its segments without `/` or characters that need # escaping in a URL. Settings, from the environment: @@ -88,10 +91,11 @@ raw() { "$url/store/$1?raw=true" || true } -# Writes JSON $2 at $1, signed: replacing the envelope there, if any (`prev`). +# Writes JSON $2 at $1, signed: replacing the envelope there, if any (`prev`; $3, if +# given, instead of reading it). write() { [ -n "$user" ] || die "who signs? set CONTINUUM_USER" - current=$(raw "$1") + if [ $# -ge 3 ]; then current=$3; else current=$(raw "$1"); fi case $current in cv1.*) prev=$(printf %s "$current" | sha256sum | cut -d' ' -f1) ;; *) prev= ;; @@ -186,10 +190,26 @@ verify() { echo "$1: signed by $signer at $(jq -r .at "$work/payload")" } +# The user's own entry with key $1 set to the line in file $2, or removed (no $2), +# signed: a user manages its own keys, whatever else it may do (GET /auth/keys gives +# its entry and the envelope holding it). +own_key() { + curl -sf -H "Authorization: Bearer $CONTINUUM_TOKEN" "$url/auth/keys" >"$work/own" || + die "no entry of $user's" + if [ $# -ge 2 ]; then + line=$(head -n 1 "$2") || die "no key in $2" + entry=$(jq -c --arg id "$1" --arg line "$line" '.entry | .keys[$id] = $line' "$work/own") + else + jq -e --arg id "$1" '.keys | has($id)' "$work/own" >/dev/null || die "no key $1" + entry=$(jq -c --arg id "$1" '.entry | del(.keys[$id])' "$work/own") + fi + write "_continuum/users/$user" "$entry" "$(jq -r '.signed // empty' "$work/own")" +} + command=${1:-} [ $# -gt 0 ] && shift case $command in - put | delete | get | verify | seal | open) + put | delete | get | verify | seal | open | key-add | key-remove) # One login for all the command's requests, unless given a token. CONTINUUM_TOKEN=${CONTINUUM_TOKEN:-$(login)} [ -n "$CONTINUUM_TOKEN" ] || die "couldn't log in as $user" @@ -203,5 +223,7 @@ case $command in verify) [ $# -eq 1 ] || die "verify PATH"; verify "$1" ;; seal) [ $# -eq 2 ] || die "seal PATH JSON"; seal "$1" "$2" ;; open) [ $# -eq 1 ] || die "open PATH"; open_sealed "$1" ;; + key-add) [ $# -eq 2 ] || die "key-add ID FILE"; own_key "$1" "$2" ;; + key-remove) [ $# -eq 1 ] || die "key-remove ID"; own_key "$1" ;; *) sed -n '2,/^$/s/^# \{0,1\}//p' "$0" >&2; exit 2 ;; esac |