Skip to content
Commits on Source (4)
Expand all Show whitespace changes
Inline Side-by-side
Makefile
View file @ 27fa1b30
......@@ -73,12 +73,6 @@ install: all installman
install src/monkeysphere-authentication-keys-for-user $(DESTDIR)$(PREFIX)/share/monkeysphere
install -m 0644 src/share/common $(DESTDIR)$(PREFIX)/share/monkeysphere
install -m 0644 replaced/src/share/defaultenv $(DESTDIR)$(PREFIX)/share/monkeysphere
install -m 0755 src/share/checkperms $(DESTDIR)$(PREFIX)/share/monkeysphere
install -m 0755 src/share/keytrans $(DESTDIR)$(PREFIX)/share/monkeysphere
ln -sf ../share/monkeysphere/keytrans $(DESTDIR)$(PREFIX)/bin/pem2openpgp
ln -sf ../share/monkeysphere/keytrans $(DESTDIR)$(PREFIX)/bin/openpgp2ssh
ln -sf ../share/monkeysphere/keytrans $(DESTDIR)$(PREFIX)/bin/openpgp2pem
ln -sf ../share/monkeysphere/keytrans $(DESTDIR)$(PREFIX)/bin/openpgp2spki
install -m 0755 src/agent-transfer/agent-transfer $(DESTDIR)$(PREFIX)/bin
install -m 0744 replaced/src/transitions/* $(DESTDIR)$(PREFIX)/share/monkeysphere/transitions
install -m 0644 src/transitions/README.txt $(DESTDIR)$(PREFIX)/share/monkeysphere/transitions
......@@ -97,15 +91,13 @@ installman: $(REPLACED_COMPRESSED_MANPAGES)
install replaced/man/man1/* $(DESTDIR)$(MANPREFIX)/man1
install replaced/man/man7/* $(DESTDIR)$(MANPREFIX)/man7
install replaced/man/man8/* $(DESTDIR)$(MANPREFIX)/man8
ln -sf openpgp2ssh.1.gz $(DESTDIR)$(MANPREFIX)/man1/openpgp2pem.1.gz
ln -sf openpgp2ssh.1.gz $(DESTDIR)$(MANPREFIX)/man1/openpgp2spki.1.gz
# this target depends on you having the monkeysphere-docs
# repo checked out as a peer of your monkeysphere repo.
releasenote:
../monkeysphere-docs/utils/build-releasenote
test: test-keytrans test-basic test-ed25519
test: test-basic test-ed25519
check: test
......@@ -115,7 +107,4 @@ test-basic: src/agent-transfer/agent-transfer
test-ed25519: src/agent-transfer/agent-transfer
MONKEYSPHERE_TEST_NO_EXAMINE=true MONKEYSPHERE_TEST_USE_ED25519=true ./tests/basic
test-keytrans: src/agent-transfer/agent-transfer
MONKEYSPHERE_TEST_NO_EXAMINE=true ./tests/keytrans
.PHONY: all tarball debian-package freebsd-distinfo clean install installman releasenote test check
README
View file @ 27fa1b30
......@@ -20,7 +20,9 @@ Dependencies
Monkeysphere depends on:
* GnuPG >= 2.1.17
* find (POSIX or GNU should both work)
* Perl
* lockfile-progs or procmail's lockfile
* Bash
* OpenSSH's ssh-keygen utility (>= 6.0)
* base64 (coreutils or fourmilab)
man/man1/openpgp2ssh.1 deleted 100644 → 0
View file @ 130cdadc
.\" -*- nroff -*-
.Dd $Mdocdate: January 18, 2013 $
.Dt OPENPGP2SSH 1
.Os
.Sh NAME
openpgp2ssh
.Nd translate OpenPGP keys to SSH keys
.Sh SYNOPSIS
.Nm openpgp2ssh < mykey.gpg
.Pp
.Nm gpg \-\-export $KEYID | openpgp2ssh $KEYID
.Pp
.Nm gpg \-\-export $KEYID | openpgp2pem $KEYID
.Pp
.Nm gpg \-\-export $KEYID | openpgp2spki $KEYID
.Pp
.Nm gpg \-\-export\-secret\-key $KEYID | openpgp2ssh $KEYID
.Sh DESCRIPTION
.Nm
takes an OpenPGP-formatted primary key and associated
subkeys on standard input, and spits out the requested equivalent
SSH-style (or PEM-encoded) key on standard output.
.Pp
If the data on standard input contains no subkeys, you can invoke
.Nm
without arguments. If the data on standard input contains multiple
keys (e.g. a primary key and associated subkeys), you must specify a
specific OpenPGP key identifier as the first argument to indicate
which key to export. The key ID is normally the 40 hex digit OpenPGP
fingerprint of the key or subkey desired, but
.Nm
will accept as few as the last 8 digits of the fingerprint as a key
ID.
.Pp
If the input contains an OpenPGP RSA public key, it will be converted
to the OpenSSH-style single-line keystring, prefixed with the key type
(`ssh\-rsa'). This format is suitable (with minor alterations) for
insertion into known_hosts files and authorized_keys files. If
invoked as `openpgp2pem', a PEM-encoded public key will be emitted
instead.
.Pp
If invoked as `openpgp2spki', a PEM-encoded subjectPublicKeyInfo (as
defined in the X.509 standard) will be emitted instead.
.Pp
If the input contains an OpenPGP RSA secret key, it will be converted
to the equivalent PEM-encoded private key.
.Pp
.Nm
is part of the
.Xr monkeysphere 7
framework for providing a PKI for SSH.
.Sh CAVEATS
The keys produced by this process are stripped of all identifying
information, including certifications, self-signatures, etc. This is
intentional, since ssh attaches no inherent significance to these
features.
.Pp
.Nm
will produce output for any requested RSA key. This means, among
other things, that it will happily export revoked keys, unverifiable
keys, expired keys, etc. Make sure you do your own key validation
before using this tool!
.Sh EXAMPLES
.Nm gpg \-\-export\-secret\-key $KEYID | openpgp2ssh $KEYID | ssh\-add \-c /dev/stdin
.Pp
This pushes the secret key into the active
.Xr ssh\-agent 1 .
Tools such as
.Xr ssh 1
which know how to talk to the
.Xr ssh\-agent 1
can now rely on the key.
.Sh AUTHOR
.Nm
and this man page were written by Daniel Kahn Gillmor
<dkg@fifthhorseman.net>.
.Sh BUGS
.Nm
only works with RSA keys. DSA keys are the only other key type
available in both OpenPGP and SSH, but they are currently unsupported
by this utility.
.Pp
.Nm
only accepts raw OpenPGP packets on standard input. It does not
accept ASCII-armored input.
.Nm
Currently only exports into formats used by the OpenSSH.
It should support other key output formats, such as those used by
.Xr lsh 1
and
.Xr putty 1 .
.Pp
Secret key output is currently not passphrase-protected.
.Pp
.Nm
currently cannot handle passphrase-protected secret keys on input.
.Sh SEE ALSO
.Xr pem2openpgp 1 ,
.Xr monkeysphere 1 ,
.Xr monkeysphere 7 ,
.Xr ssh 1 ,
.Xr monkeysphere-authentication 8 ,
.Xr monkeysphere-host 8
man/man1/pem2openpgp.1 deleted 100644 → 0
View file @ 130cdadc
.\" -*- nroff -*-
.Dd $Mdocdate: Jan 22, 2019 $
.Dt PEM2OPENPGP 1
.Os
.Sh NAME
pem2openpgp
.Nd translate PEM-encoded RSA keys to OpenPGP certificates
.Sh SYNOPSIS
.Nm pem2openpgp "$USERID" < mykey.pem | gpg \-\-import
.Pp
.Nm PEM2OPENPGP_EXPIRATION=$((86400 * $DAYS)) PEM2OPENPGP_USAGE_FLAGS=authenticate,certify pem2openpgp "$USERID" <mykey.pem
.Sh DESCRIPTION
.Nm
is a low-level utility for transforming raw, PEM-encoded RSA secret
keys into OpenPGP-formatted certificates. The generated certificates
include the secret key material, so they should be handled carefully.
.Pp
It works as an element within a pipeline: feed it the raw key on
stdin, supply the desired User ID as a command line argument. Note
that you may need to quote the string to ensure that it is entirely in
a single argument.
.Pp
Other choices about how to generate the new OpenPGP certificate are
governed by environment variables.
.Sh ENVIRONMENT
The following environment variables influence the behavior of
.Nm :
.Pp
.ti 3
\fBPEM2OPENPGP_TIMESTAMP\fP controls the timestamp (measured in
seconds since the UNIX epoch) indicated as the creation time (a.k.a
"not valid before") of the generated certificate (self-signature) and
the key itself. By default,
.Nm
uses the current time.
.Pp
.ti 3
\fBPEM2OPENPGP_KEY_TIMESTAMP\fP controls the timestamp (measured in
seconds since the UNIX epoch) indicated as the creation time of just
the key itself (not the self-signature). By default,
.Nm
uses the value from PEM2OPENPGP_TIMESTAMP.
.Pp
.ti 3
\fBPEM2OPENPGP_USAGE_FLAGS\fP should contain a comma-separated list of
valid OpenPGP usage flags (see section 5.2.3.21 of RFC 4880 for what
these mean). The available choices are: certify, sign, encrypt_comms,
encrypt_storage, encrypt (this means both encrypt_comms and
encrypt_storage), authenticate, split, shared. By default,
.Nm
only sets the certify flag.
.Pp
.ti 3
\fBPEM2OPENPGP_EXPIRATION\fP sets an expiration (measured in seconds
after the creation time of the key) in each self-signature packet. By
default, no expiration subpacket is included.
.Pp
.ti 3
\fBPEM2OPENPGP_NEWKEY\fP indicates that
.Nm
should ignore stdin, and instead generate a new key internally and
build the certificate based on this new key. Set this variable to the
number of bits for the new RSA key (e.g. 3072). By default (when this is
unset),
.Nm
will read the key from stdin.
.Sh AUTHOR
.Nm
and this man page were written by Daniel Kahn Gillmor
<dkg@fifthhorseman.net>.
.Sh BUGS
Only handles RSA keys at the moment. It might be nice to handle DSA
keys as well.
.Pp
Currently only creates certificates with a single User ID. Should be
able to create certificates with multiple User IDs.
.Pp
Currently only accepts unencrypted RSA keys. It should be able to
deal with passphrase-locked key material.
.Pp
Currently outputs OpenPGP certificates with cleartext secret key
material. It would be good to be able to lock the output with a
passphrase.
.Pp
If you find other bugs, please report them at
https://labs.riseup.net/code/projects/show/monkeysphere
.Sh SEE ALSO
.Xr openpgp2ssh 1 ,
.Xr monkeysphere 1 ,
.Xr monkeysphere 7 ,
.Xr ssh 1 ,
.Xr monkeysphere\-host 8 ,
.Xr monkeysphere\-authentication 8
man/man7/monkeysphere.7
View file @ 27fa1b30
......@@ -82,8 +82,6 @@ Daniel Kahn Gillmor <dkg@fifthhorseman.net>
.BR monkeysphere (1),
.BR monkeysphere\-host (8),
.BR monkeysphere\-authentication (8),
.BR openpgp2ssh (1),
.BR pem2openpgp (1),
.BR gpg (1),
.BR https://tools.ietf.org/html/rfc4880,
.BR ssh (1),
......
packaging/macports/Portfile
View file @ 27fa1b30
......@@ -56,8 +56,7 @@ post-build {
# fix perl shebang line to point to macports perl install
exec sed -i .tmp -e "s|^#!/usr/bin/perl -T$|#!/opt/local/bin/perl -T|" \
${worksrcpath}/src/share/keytrans \
${worksrcpath}/src/share/checkperms
${worksrcpath}/src/share/keytrans
# remove leftover sed cruft
exec find ${worksrcpath} -name *.tmp -delete
......
src/monkeysphere-host
View file @ 27fa1b30
......@@ -131,11 +131,15 @@ check_service_name() {
[ -n "$name" ] || \
failure "You must supply a service name to check"
printf '%s' "$name" | perl -n -e '($str = $_) =~ s/\s//g ; exit !(lc($str) eq $_);' || \
[[ "$name" = "${name,,}" ]] || \
failure "Not a valid service name: '$name'
Service names should be canonicalized to all lower-case,
with no whitespace"
Service names should be canonicalized to all lower-case."
[[ "$name" = "${name//$' \n\r\t'/}" ]] || \
failure "Not a valid service name: '$name'
Service names should not contain whitespace."
[[ "$name" =~ ^[a-z0-9./:-]+$ ]] || \
failure "Not a valid service name: '$name'
......
src/share/checkperms deleted 100755 → 0
View file @ 130cdadc
#!/usr/bin/perl -T
# checkperms: ensure as best we can that a given file can only be
# modified by the given user (or the superuser, naturally). This
# means checking file ownership and permissions all the way back to
# the root directory. Pass the file by its absolute path.
# example invocation:
# checkperms dkg /home/dkg/.monkeysphere/authorized_user_ids
# return values: zero if we believe the file and path can only be
# modified by the user. non-zero otherwise.
# see StrictModes in sshd_config(5) (and its implementation in
# OpenSSH's secure_filename() in auth.c) for the initial
# inspiration/rationale for this code.
# Author:
# Daniel Kahn Gillmor <dkg@fifthhorseman.net>
# Started on: 2009-07-31 11:10:16-0400
# License: GPL v3 or later
use strict;
use Cwd qw(realpath); # found in debian in perl-base
use File::stat; # found in debian in perl-modules
use User::pwent; # found in debian in perl-modules
use Fcntl qw(:mode); # for S_IS* functions (in perl-base)
use File::Basename; # for dirname (in perl-modules)
my $username = shift;
my $path = shift;
defined($username) or die "You must pass a username and an absolute path.\n";
defined($path) or die "You must pass a username and an absolute path.\n";
my $pw = getpwnam($username) or die "no such user $username\n";
$path =~ m#^/# or die "path was not absolute (did not start with /)\n";
sub mslog {
my $level = shift;
# FIXME: check and compare the log level
if ($ENV{LOG_LEVEL} eq 'DEBUG') {
my $format = shift;
my $out = sprintf($format, @_);
$out =~ s/^/$ENV{LOG_PREFIX}/ ;
printf STDERR "%s", $out;
}
}
## return undef if permissions are OK. otherwise return an error string
sub permissions_ok {
my $user = shift;
my $path = shift;
# if we can't even stat the path, the permissions are not ok:
my $stat = lstat($path) or return "cannot stat '$path'";
while (S_ISLNK($stat->mode)) {
my $newpath = realpath($path) or return "cannot trace symlink '$path'";
mslog('DEBUG', "tracing link %s to %s\n", $path, $newpath);
$path = $newpath;
$stat = lstat($path) or return "cannot stat '$path'";
}
mslog('DEBUG', "checking '%s'\n", $path);
if (($stat->uid != $user->uid) &&
($stat->uid != 0)) {
return sprintf("improper ownership on '%s': owner ID %d is neither %s (ID %d) nor the superuser",
$path, $stat->uid, $user->name, $user->uid);
}
if ($stat->mode & S_IWGRP) {
return sprintf("improper group writability on '%s'", $path);
}
if ($stat->mode & S_IWOTH) {
return sprintf("improper other writability on '%s'", $path);
}
# see the rationalization in secure_filename() in auth.c in the
# OpenSSH sources for an explanation of this bailout (see also
# monkeysphere #675):
if ($path eq $user->dir) {
mslog('DEBUG', "stopping at %s's home directory '%s'\n", $user->name, $path);
return undef;
}
my $nextlevel = dirname($path);
if ($path eq $nextlevel) { # we bottom out at the root (/ in UNIX)
return undef;
}
return permissions_ok($user, $nextlevel);
}
my $err = permissions_ok($pw, $path);
if (defined($err)) {
printf(STDERR "%s%s\n", $ENV{LOG_PREFIX}, $err);
exit(1);
} else {
exit(0);
}
src/share/common
View file @ 27fa1b30
......@@ -417,6 +417,43 @@ touch_key_file_or_fail() {
fi
}
check_perms() {
local username="$1"
local pathname="$2"
if [ -z "$username" ]; then
log error 'missing username'
return 1
fi
if [ -z "$pathname" ]; then
log error 'missing pathname'
return 1
fi
if ! [[ "$pathname" =~ ^/ ]]; then
log error 'pathname must be absolute (did not start with a /)'
return 1
fi
local homedir=$(realpath "$(get_homedir "$username")")
local cur=$(realpath "$pathname")
local -a paths=("$cur")
while [ "$cur" != "/" ] && [ "$cur" != "$homedir" ]; do
cur="${cur%/*}"
if [ -z "$cur" ]; then
cur=/
fi
paths+=("$cur")
done
log debug "$(printf 'checking permissions on %s\n' "${paths[@]}")"
local trouble=$(find "${paths[@]}" -maxdepth 0 \( \! \( -uid 0 -o -user "$username" \) \) -o -perm /go+w)
if [ -n "$trouble" ]; then
log error "$(printf 'bad ownership or permissions on file(s): %s' "${trouble//$'\n'/, }")"
return 1
fi
}
# check that a file is properly owned, and that all it's parent
# directories are not group/other writable
check_key_file_permissions() {
......@@ -431,7 +468,7 @@ check_key_file_permissions() {
return 0
fi
log debug "checking path permission '$path'..."
"${SYSSHAREDIR}/checkperms" "$uname" "$path"
check_perms "$uname" "$path"
}
# return a list of all users on the system
......
src/share/keytrans deleted 100755 → 0
View file @ 130cdadc
This diff is collapsed.
src/share/ma/setup
View file @ 27fa1b30
......@@ -67,7 +67,7 @@ EOF
if [ -z "$CORE_FPR" ] ; then
log info "setting up Monkeysphere authentication trust core..."
local CORE_UID=$(printf "Monkeysphere authentication trust core UID (random string: %s)" $(dd if=/dev/urandom bs=21 count=1 2>/dev/null | perl -MMIME::Base64 -ne 'print encode_base64($_)'))
local CORE_UID=$(printf "Monkeysphere authentication trust core UID (random string: %s)" $(dd if=/dev/urandom bs=21 count=1 2>/dev/null | base64))
printf "generating monkeysphere authentication trust core RSA key:\nsize: %d bits\nuid: '%s'\n" "$CORE_KEYLENGTH" "$CORE_UID" | log debug
gpg_core --pinentry-mode=loopback --passphrase '' --quick-generate-key "$CORE_UID" "rsa$CORE_KEYLENGTH" cert \
......
tests/basic
View file @ 27fa1b30
......@@ -165,7 +165,7 @@ export DISPLAY=monkeys
## we cannot do proper directory permissions checking if the current
## working directory has unsatisfactory permissions:
if "$MONKEYSPHERE_SYSSHAREDIR"/checkperms $(whoami) "$TEMPDIR"; then
if bash -c "$(printf 'source %q/common && check_perms %q %q' "$MONKEYSPHERE_SYSSHAREDIR" "$(whoami)" "$TEMPDIR")"; then
echo "Permissions on temporary directory '$TEMPDIR' are OK for permissions checks."
TEMPDIR_PERMISSIONS_SAFE=yes
else
......
tests/keytrans deleted 100755 → 0
View file @ 130cdadc
#!/usr/bin/env bash
# Tests to ensure that the monkeysphere is working
# Authors:
# Daniel Kahn Gillmor <dkg@fifthhorseman.net>
# Jameson Rollins <jrollins@fifthhorseman.net>
# Micah Anderson <micah@riseup.net>
#
# Copyright: 2008-2019
# License: GPL v3 or later
# these tests should all be able to run as a non-privileged user.
# all subcommands in this script should complete without failure:
set -e
# piped commands should return the code of the first non-zero return
set -o pipefail
declare -a child_procs=($(ps -o pid h --ppid $$))
if [ "${#child_procs[@]}" -gt 1 ]; then
printf 'found %d pre-existing child processes: %s\n' "${#child_procs[@]}" "${child_procs[*]}"
printf "spawning my own subprocess to avoid https://bugs.debian.org/920038...\n"
"$0" "$@"
exit
fi
# make sure the TESTDIR is an absolute path, not a relative one.
export TESTDIR=$(cd $(dirname "$0") && pwd)
source "$TESTDIR"/common
perl -MCrypt::OpenSSL::RSA -e 1 2>/dev/null || { echo "You must have the perl module Crypt::OpenSSL::RSA installed to run this test.
On debian-derived systems, you can set this up with:
apt-get install libcrypt-openssl-rsa-perl" ; exit 1; }
perl -MDigest::SHA -e 1 2>/dev/null || { echo "You must have the perl module Digest::SHA installed to run this test.
On debian-derived systems, you can set this up with:
apt-get install libdigest-sha1-perl" ; exit 1; }
######################################################################
### SETUP VARIABLES
## set up some variables to ensure that we're operating strictly in
## the tests, not system-wide:
mkdir -p "$TESTDIR"/tmp
TEMPDIR=$(mktemp -d "${TMPDIR:-$TESTDIR/tmp}/ms.XXX")
if [ -z "$MONKEYSPHERE_TEST_USE_SYSTEM" ] ; then
mkdir "$TEMPDIR"/bin
ln -s "$TESTDIR"/../src/share/keytrans "$TEMPDIR"/bin/openpgp2ssh
ln -s "$TESTDIR"/../src/share/keytrans "$TEMPDIR"/bin/pem2openpgp
ln -s "$TESTDIR"/../src/share/keytrans "$TEMPDIR"/bin/keytrans
# Use the local copy of executables first, instead of system ones.
# This should help us test without installing.
export PATH="$TEMPDIR"/bin:"$PATH"
else
export PATH=/usr/share/monkeysphere:"$PATH"
fi
## setup trap
trap failed_cleanup EXIT
######################################################################
### TEST KEYTRANS
echo "##################################################"
echo "### generating openpgp key..."
export GNUPGHOME="$TEMPDIR"
chmod 700 "$TEMPDIR"
# create the key with the same preferences that monkeysphere uses.
cat > "$TEMPDIR"/gpg.conf <<EOF
default-preference-list SHA512 SHA384 SHA256 SHA224 RIPEMD160 SHA1 ZLIB BZIP2 ZIP AES256 AES192 AES CAST5 3DES
cert-digest-algo SHA256
list-options show-uid-validity,show-unusable-uids
fixed-list-mode
EOF
cat > "$TEMPDIR"/gpg-agent.conf <<EOF
pinentry-program $TESTDIR/phony-pinentry-nopass
EOF
# generate a key
gpg --batch --$(get_gpg_prng_arg) --gen-key <<EOF
Key-Type: RSA
Key-Length: 3072
Key-Usage: sign
Name-Real: testtest
Expire-Date: 0
%no-ask-passphrase
%no-protection
%commit
%echo done
EOF
echo "##################################################"
echo "### retrieving key timestamp..."
timestamp=$(gpg --list-key --with-colons | \
grep ^pub: | cut -d: -f6)
echo "##################################################"
echo "### exporting key to ssh file..."
gpg --export-secret-keys | openpgp2ssh > \
"$TEMPDIR"/test.pem
gpg --export-secret-keys > "$TEMPDIR"/secret.key
PEM2OPENPGP_USAGE_FLAGS=sign,certify \
PEM2OPENPGP_TIMESTAMP="$timestamp" pem2openpgp testtest \
< "$TEMPDIR"/test.pem > "$TEMPDIR"/converted.secret.key
echo "##################################################"
echo "### reconvert key, and compare to key in gpg keyring..."
diff -u \
<(gpg --list-packets < "$TEMPDIR"/secret.key) \
<(gpg --list-packets < "$TEMPDIR"/converted.secret.key)
diff -u \
<(hd "$TEMPDIR"/secret.key) \
<(hd "$TEMPDIR"/converted.secret.key)
KEYFPR=$(gpg --fingerprint --with-colons --list-keys | awk -F: '/^fpr:/{ if (ok) { print $10 } ; ok=0 } /^pub:/{ ok=1 }')
KEYID=$(printf "%s" "$KEYFPR" | cut -b25-40)
echo "conversions look good!"
echo "Now working with key $KEYID at time $timestamp"
gpg --check-trustdb
gpg --list-keys
echo "##################################################"
echo "### test working with two primary keys ... "
ssh-keygen -m PEM -t rsa -b 3072 -N '' -f "$TEMPDIR"/newkey
PEM2OPENPGP_USAGE_FLAGS=authenticate,certify \
PEM2OPENPGP_TIMESTAMP="$(( $timestamp + 1 ))" pem2openpgp fubar \
< "$TEMPDIR"/newkey > "$TEMPDIR"/newkey.gpg
NEWKEYFPR=$(< "$TEMPDIR"/newkey.gpg gpg --with-colons --import-options import-show --dry-run --import | awk -F: '/^fpr:/{ print $10 }' )
NEWKEYID=$( printf "%s" "$NEWKEYFPR" | cut -b25-40)
< "$TEMPDIR"/newkey.gpg gpg --import
gpg --batch --no-tty --faked-system-time "$timestamp" --quick-add-uid "$KEYID" baz
cat >"$TEMPDIR"/expectedout <<EOF
pub:u:3072:1:$KEYID:$timestamp:::u:::scSC
uid:u::::$timestamp::8200BD0425CC70C7D698DF3FE412044EAAB83F94::testtest
sig:!::1:$KEYID:$timestamp::::testtest:13x::$KEYFPR:::8
uid:u::::$timestamp::EDDC32D783E7F4C7B6982D9AE5DC4A61000648BA::baz
sig:!::1:$KEYID:$timestamp::::testtest:13x::$KEYFPR:::8
pub:-:3072:1:$NEWKEYID:$(($timestamp + 1)):::-:::caCA
uid:-::::$(($timestamp + 1))::A0D708F51CC257DEFC01AEDE1E0A5F329DFD8F16::fubar
sig:!::1:$NEWKEYID:$(($timestamp + 1))::::fubar:13x::$NEWKEYFPR:::8
EOF
echo "test: diff expected gpg list output"
diff -u "$TEMPDIR"/expectedout <(gpg --check-sigs --with-colons | grep -vE '^(tru|fpr):' | cut -d: -f1-16 | sed 's/:*$//')
## FIXME: addtest: not testing subkeys at the moment.
trap - EXIT
echo "##################################################"
echo " Monkeysphere keytrans test completed successfully!"
echo "##################################################"
cleanup