tools/gpgsm-gencert.sh

   1 #!/bin/sh
   2 #                                                              -*- sh -*-
   3 # gpgsm-gencert.c - Generate X.509 certificates through GPGSM.
   4 #       Copyright (C) 2004, 2005 Free Software Foundation, Inc.
   5 #
   6 # This file is part of GnuPG.
   7 #
   8 # GnuPG is free software; you can redistribute it and/or modify
   9 # it under the terms of the GNU General Public License as published by
  10 # the Free Software Foundation; either version 3 of the License, or
  11 # (at your option) any later version.
  12 #
  13 # GnuPG is distributed in the hope that it will be useful,
  14 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  15 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16 # GNU General Public License for more details.
  17 #
  18 # You should have received a copy of the GNU General Public License
  19 # along with this program; if not, see <http://www.gnu.org/licenses/>.
  20
  21 set -e
  22
  23 ASSUAN_FP_IN=4
  24 ASSUAN_FP_OUT=5
  25
  26 ASSUAN_COMMANDS="\
  27 INPUT FD=$ASSUAN_FP_IN\n\
  28 OUTPUT FD=$ASSUAN_FP_OUT --armor\n\
  29 GENKEY\n\
  30 BYE\n"
  31
  32 ANSWER=""
  33
  34 query_user()
  35 {
  36     message=$1; shift
  37
  38     echo "$message" >&2
  39     echo -n "> " >&2
  40     read answer
  41
  42     ANSWER=$answer;
  43 }
  44
  45 query_user_menu()
  46 {
  47     message=$1; shift
  48     i=0
  49
  50     echo "$message" >&2
  51     for choice in "$@"; do
  52         i=$(expr $i + 1)
  53         echo " [$i] $choice" >&2
  54     done
  55
  56     while true; do
  57         j=1
  58         echo -n "Your selection: " >&2
  59         read idx
  60
  61         while [ $j -lt $i -o $j -eq $i ]; do
  62             if [ "$idx" = $j ]; then
  63                 break
  64             fi
  65             j=$(expr $j + 1)
  66         done
  67         if [ $j -lt $i -o $j -eq $i ]; then
  68             break
  69         fi
  70     done
  71
  72     i=0
  73     for choice in "$@"; do
  74         i=$(expr $i + 1)
  75         if [ $i -eq $idx ]; then
  76             ANSWER=$1
  77             break;
  78         fi
  79         shift
  80     done
  81
  82     echo "You selected: $ANSWER" >&2
  83 }
  84
  85
  86
  87 KEY_TYPE=""
  88 while [ -z "$KEY_TYPE" ]; do
  89   query_user_menu "Key type" "RSA" "Existing key" "Direct from card"
  90   case "$ANSWER" in
  91     RSA)
  92       KEY_TYPE=$ANSWER
  93       query_user_menu "Key length" "1024" "2048"
  94       KEY_LENGTH=$ANSWER
  95       KEY_GRIP=
  96       ;;
  97     Existing*)
  98       # User requested to use an existing key; need to set some dummy defaults
  99       query_user "Keygrip "
 100       if [ -n "$ANSWER" ]; then
 101         KEY_TYPE=RSA
 102         KEY_LENGTH=1024
 103         KEY_GRIP=$ANSWER
 104       fi
 105       ;;
 106     Direct*)
 107       tmp=$(echo 'SCD SERIALNO' | gpg-connect-agent | \
 108             awk '$2 == "SERIALNO" {print $3}')
 109       if [ -z "$tmp" ]; then
 110           echo "No card found" >&2
 111       else
 112         echo "Card with S/N $tmp found" >&2
 113         tmp=$(echo 'SCD LEARN --force' | gpg-connect-agent | \
 114               awk '$2 == "KEYPAIRINFO" {printf " %s", $4}')
 115         sshid=$(echo 'SCD GETATTR $AUTHKEYID' | gpg-connect-agent | \
 116                 awk '$2 == "$AUTHKEYID" {print $3}')
 117         [ -n "$sshid" ] && echo "gpg-agent uses $sshid as ssh key" >&2
 118         query_user_menu "Select key " $tmp "back"
 119         if [ "$ANSWER" != "back" ]; then
 120           KEY_TYPE="card:$ANSWER"
 121           KEY_LENGTH=
 122           KEY_GRIP=
 123         fi
 124       fi
 125       ;;
 126     *)
 127       exit 1
 128       ;;
 129   esac
 130 done
 131
 132 query_user_menu "Key usage" "sign, encrypt" "sign" "encrypt"
 133 KEY_USAGE=$ANSWER
 134
 135 query_user "Name (DN)"
 136 NAME=$ANSWER
 137
 138 EMAIL_ADDRESSES=
 139 LF=
 140 while : ; do
 141   query_user "E-Mail addresses (end with an empty line)"
 142   [ -z "$ANSWER" ] && break
 143   EMAIL_ADDRESSES="${EMAIL_ADDRESSES}${LF}Name-Email: $ANSWER"
 144   LF='
 145 '
 146 done
 147
 148 DNS_ADDRESSES=
 149 LF=
 150 while : ; do
 151   query_user "DNS Names (optional; end with an empty line)"
 152   [ -z "$ANSWER" ] && break
 153   DNS_ADDRESSES="${DNS_ADDRESSES}${LF}Name-DNS: $ANSWER"
 154   LF='
 155 '
 156 done
 157
 158 URI_ADDRESSES=
 159 LF=
 160 while : ; do
 161   query_user "URIs (optional; end with an empty line)"
 162   [ -z "$ANSWER" ] && break
 163   URI_ADDRESSES="${URI_ADDRESSES}${LF}Name-URI: $ANSWER"
 164   LF='
 165 '
 166 done
 167
 168 file_parameter=$(mktemp "/tmp/gpgsm.XXXXXX")
 169 outfile=$(mktemp "/tmp/gpgsm.XXXXXX")
 170
 171
 172 (
 173 cat <<EOF
 174 Key-Type: $KEY_TYPE
 175 Key-Length: $KEY_LENGTH
 176 Key-Usage: $KEY_USAGE
 177 Name-DN: $NAME
 178 EOF
 179 [ -n "$KEY_GRIP" ] && echo "Key-Grip: $KEY_GRIP"
 180 [ -n "$EMAIL_ADDRESSES" ] && echo "$EMAIL_ADDRESSES"
 181 [ -n "$DNS_ADDRESSES" ] && echo "$DNS_ADDRESSES"
 182 [ -n "$URI_ADDRESSES" ] && echo "$URI_ADDRESSES"
 183 ) > "$file_parameter"
 184
 185
 186 echo 'Parameters for certificate request to create:' >&2
 187 cat -n "$file_parameter" >&2
 188 echo  >&2
 189
 190 query_user_menu "Really create such a CSR?" "yes" "no"
 191 [ "$ANSWER" != "yes" ] && exit 1
 192
 193
 194 printf "$ASSUAN_COMMANDS" | \
 195      gpgsm --no-log-file --debug-level none --debug-none \
 196            --server 4< "$file_parameter" 5>"$outfile" >/dev/null
 197
 198 cat "$outfile"
 199
 200 rm "$file_parameter" "$outfile"
 201 exit 0