tools/gpgsm-gencert.sh

   1 #!/bin/sh
   2 #                                                              -*- sh -*-
   3 # gpgsm-gencert.c - Generate X.509 certificates through GPGSM.
   4 #       Copyright (C) 2004, 2005 Free Software Foundation, Inc.
   5 #
   6 # This file is part of GnuPG.
   7 #
   8 # GnuPG is free software; you can redistribute it and/or modify
   9 # it under the terms of the GNU General Public License as published by
  10 # the Free Software Foundation; either version 2 of the License, or
  11 # (at your option) any later version.
  12 #
  13 # GnuPG is distributed in the hope that it will be useful,
  14 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  15 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16 # GNU General Public License for more details.
  17 #
  18 # You should have received a copy of the GNU General Public License
  19 # along with this program; if not, write to the Free Software
  20 # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
  21 # 02111-1307, USA.
  22
  23 set -e
  24
  25 ASSUAN_FP_IN=4
  26 ASSUAN_FP_OUT=5
  27
  28 ASSUAN_COMMANDS="\
  29 INPUT FD=$ASSUAN_FP_IN\n\
  30 OUTPUT FD=$ASSUAN_FP_OUT --armor\n\
  31 GENKEY\n\
  32 BYE"
  33
  34 ANSWER=""
  35
  36 query_user()
  37 {
  38     message=$1; shift
  39
  40     echo "$message" >&2
  41     echo -n "> " >&2
  42     read answer
  43
  44     ANSWER=$answer;
  45 }
  46
  47 query_user_menu()
  48 {
  49     message=$1; shift
  50     i=0
  51
  52     echo "$message" >&2
  53     for choice in "$@"; do
  54         i=$(expr $i + 1)
  55         echo " [$i] $choice" >&2
  56     done
  57
  58     while true; do
  59         j=1
  60         echo -n "Your selection: " >&2
  61         read idx
  62
  63         while [ $j -lt $i -o $j -eq $i ]; do
  64             if [ "$idx" = $j ]; then
  65                 break
  66             fi
  67             j=$(expr $j + 1)
  68         done
  69         if [ $j -lt $i -o $j -eq $i ]; then
  70             break
  71         fi
  72     done
  73
  74     i=0
  75     for choice in "$@"; do
  76         i=$(expr $i + 1)
  77         if [ $i -eq $idx ]; then
  78             ANSWER=$1
  79             break;
  80         fi
  81         shift
  82     done
  83
  84     echo "You selected: $ANSWER" >&2
  85 }
  86
  87
  88
  89 KEY_TYPE=""
  90 while [ -z "$KEY_TYPE" ]; do
  91   query_user_menu "Key type" "RSA" "Existing key" "Direct from card"
  92   case "$ANSWER" in
  93     RSA)
  94       KEY_TYPE=$ANSWER
  95       query_user_menu "Key length" "1024" "2048"
  96       KEY_LENGTH=$ANSWER
  97       KEY_GRIP=
  98       ;;
  99     Existing*)
 100       # User requested to use an existing key; need to set some dummy defaults
 101       query_user "Keygrip "
 102       if [ -n "$ANSWER" ]; then
 103         KEY_TYPE=RSA
 104         KEY_LENGTH=1024
 105         KEY_GRIP=$ANSWER
 106       fi
 107       ;;
 108     Direct*)
 109       tmp=$(echo 'SCD SERIALNO' | gpg-connect-agent | \
 110             awk '$2 == "SERIALNO" {print $3}')
 111       if [ -z "$tmp" ]; then
 112           echo "No card found" >&2
 113       else
 114         echo "Card with S/N $tmp found" >&2
 115         tmp=$(echo 'SCD LEARN --force' | gpg-connect-agent | \
 116               awk '$2 == "KEYPAIRINFO" {printf " %s", $4}')
 117         sshid=$(echo 'SCD GETATTR $AUTHKEYID' | gpg-connect-agent | \
 118                 awk '$2 == "$AUTHKEYID" {print $3}')
 119         [ -n "$sshid" ] && echo "gpg-agent uses $sshid as ssh key" >&2
 120         query_user_menu "Select key " $tmp "back"
 121         if [ "$ANSWER" != "back" ]; then
 122           KEY_TYPE="card:$ANSWER"
 123           KEY_LENGTH=
 124           KEY_GRIP=
 125         fi
 126       fi
 127       ;;
 128     *)
 129       exit 1
 130       ;;
 131   esac
 132 done
 133
 134 query_user_menu "Key usage" "sign, encrypt" "sign" "encrypt"
 135 KEY_USAGE=$ANSWER
 136
 137 query_user "Name (DN)"
 138 NAME=$ANSWER
 139
 140 EMAIL_ADDRESSES=
 141 LF=
 142 while : ; do
 143   query_user "E-Mail addresses (end with an empty line)"
 144   [ -z "$ANSWER" ] && break
 145   EMAIL_ADDRESSES="${EMAIL_ADDRESSES}${LF}Name-Email: $ANSWER"
 146   LF='
 147 '
 148 done
 149
 150 DNS_ADDRESSES=
 151 LF=
 152 while : ; do
 153   query_user "DNS Names (optional; end with an empty line)"
 154   [ -z "$ANSWER" ] && break
 155   DNS_ADDRESSES="${DNS_ADDRESSES}${LF}Name-DNS: $ANSWER"
 156   LF='
 157 '
 158 done
 159
 160 URI_ADDRESSES=
 161 LF=
 162 while : ; do
 163   query_user "URIs (optional; end with an empty line)"
 164   [ -z "$ANSWER" ] && break
 165   URI_ADDRESSES="${URI_ADDRESSES}${LF}Name-URI: $ANSWER"
 166   LF='
 167 '
 168 done
 169
 170 file_parameter=$(mktemp "/tmp/gpgsm.XXXXXX")
 171 outfile=$(mktemp "/tmp/gpgsm.XXXXXX")
 172
 173
 174 (
 175 cat <<EOF
 176 Key-Type: $KEY_TYPE
 177 Key-Length: $KEY_LENGTH
 178 Key-Usage: $KEY_USAGE
 179 Name-DN: $NAME
 180 EOF
 181 [ -n "$KEY_GRIP" ] && echo "Key-Grip: $KEY_GRIP"
 182 [ -n "$EMAIL_ADDRESSES" ] && echo "$EMAIL_ADDRESSES"
 183 [ -n "$DNS_ADDRESSES" ] && echo "$DNS_ADDRESSES"
 184 [ -n "$URI_ADDRESSES" ] && echo "$URI_ADDRESSES"
 185 ) > "$file_parameter"
 186
 187
 188 echo 'Parameters for certificate request to create:' >&2
 189 cat -n "$file_parameter" >&2
 190 echo  >&2
 191
 192 query_user_menu "Really create such a CSR?" "yes" "no"
 193 [ "$ANSWER" != "yes" ] && exit 1
 194
 195
 196 echo -e "$ASSUAN_COMMANDS" | \
 197      gpgsm --no-log-file --debug-level none --debug-none \
 198            --server 4< "$file_parameter" 5>"$outfile" >/dev/null
 199
 200 cat "$outfile"
 201
 202 rm "$file_parameter" "$outfile"
 203 exit 0