blob: 81669b834ec39f08b45ae96cfc53202af12d2b37 (
about) (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
|
#!/bin/bash
set -o pipefail
exec &>>/var/log/gpg-verify.log
if [ $# -ne 4 ]; then
exit 2
fi
username="$1"
nonce="$2"
key="$3"
sig="$4"
cd /opt/autopeer
NOTIFY_TO="$(python3 -c 'import config; print(config.NOTIFY_TO)')"
echo "[autopeer $(hostname -f)] pgp: $username $key" | socat stdio "$NOTIFY_TO"
keyring="$(mktemp)"
curl -sL "$key" | gpg -o - --dearmor >"$keyring" || exit 7
gpgv_out="$(gpgv --status-fd 1 --keyring "$keyring" <(echo "$sig" | sed 's/-----BEGIN PGP SIGNATURE-----/&\n\n/') <(echo "$nonce"))"
#[GNUPG:] VALIDSIG 1449565B711BABA3BC5347AE66B26E9D823D8647 2026-05-18 1779109475 0 4 0 22 10 00 1449565B711BABA3BC5347AE66B26E9D823D8647
echo "keyring: $keyring"
echo "$gpgv_out"
if ! echo "$gpgv_out" | grep -qP '^\[GNUPG:\] VALIDSIG '; then
exit 3
fi
verified_key="$(echo "$gpgv_out" | grep -P '^\[GNUPG:\] VALIDSIG ' | cut -d' ' -f12)"
if [ -z "$verified_key" ]; then
exit 4
fi
if [ "$username" = "new" ]; then
if new_user="$(grep -l -s -r -P '^\s*auth:\s*pgp-fingerprint\s+\Q'"$verified_key"'\E(\s|$)' /opt/autopeer/dn42-registry/data/mntner/ | perl -ne 's@^.*/@@; s@-MNT$@@; print lc;' | head -1)"; then
echo "making $new_user"; exit 0
if getent passwd "$new_user" &>/dev/null; then
exit 0
else
echo "[autopeer $(hostname -f)] New user being created: $new_user from $key $verified_key" | socat stdio "$NOTIFY_TO"
/usr/sbin/adduser --disabled-password --quiet --comment "created at $(date +%s) by $verified_key" --ingroup autopeer "$new_user"
/usr/sbin/adduser "$new_user" bird
( umask 0077; touch "/var/log/autopeer/$new_user".{tim,io}; )
chown "$new_user" "/var/log/autopeer/$new_user".{tim,io}
exit 0
fi
else
exit 5
fi
else
if grep -q -s -P '^\s*auth:\s*pgp-fingerprint\s+\Q'"$verified_key"'\E(\s|$)' /opt/autopeer/dn42-registry/data/mntner/"$(echo "$username" | perl -ne 's@$@-MNT@; print uc;')"; then
exit 0
else
exit 6
fi
fi
exit 1
|
