pijul/pijul - Change F6C6CUAARYNS7W3HUN362HYEMIJJWOFFQRRVNCMHYFPC7UFIWIHQC

Migrate key management to public interface

This patch moves the functionality from pijul key into the crate's public interface. The change is a precursor to the identity management wizard which should allow for significantly greater ergonomics in regards to using keys.

Created by finchie on April 22, 2022

F6C6CUAARYNS7W3HUN362HYEMIJJWOFFQRRVNCMHYFPC7UFIWIHQC

Dependencies

In discussions

#673 DRAFT: Improved identity management

Change contents

Insertion in pijul/src/main.rs at line 6 [8.83981]
[8.84262]
[9.576]
```
mod key;
```
File move: key.rs → key.rs
BF:BFD[8.93386] → [10.200:217]
BF:BF[10.217] → [11.2558:2558]
[8.21414]
[11.2558]
Deletion in pijul/src/key.rs at line 4 [11.2558]
B:BD[11.2599] → [7.138:174]
```
use clap::{CommandFactory, Parser};
```

Replacement in pijul/src/key.rs at line 9 [11.2558]

B:BD[11.2695] → [12.936:961]

∅:D[12.961] → [11.2718:2791]

B:BD[11.2718] → [11.2718:2791]

#[derive(Parser, Debug)]
pub struct Key {
    #[clap(subcommand)]
    subcmd: Option<SubCommand>,

[11.2695]

[11.2791]

pub fn load_key() -> Result<(libpijul::key::SecretKey, libpijul::key::SKey), anyhow::Error> {
    if let Some(mut dir) = crate::config::global_config_dir() {
        dir.push("secretkey.json");
        if let Ok(key) = std::fs::File::open(&dir) {
            let k: libpijul::key::SecretKey = serde_json::from_reader(key)?;
            let pass = if k.encryption.is_some() {
                Some(rpassword::read_password_from_tty(Some(&format!(
                    "Password for {:?}: ",
                    dir
                )))?)
            } else {
                None
            };
            let sk = k.load(pass.as_deref())?;
            Ok((k, sk))
        } else {
            bail!("Secret key not found, please use `pijul key generate` and try again")
        }
    } else {
        bail!("Secret key not found, please use `pijul key generate` and try again")
    }

Replacement in pijul/src/key.rs at line 32 [11.2558]

B:BD[11.2794] → [12.962:987]

∅:D[12.987] → [11.2817:2839]

B:BD[11.2817] → [11.2817:2839]

B:BD[11.2839] → [10.218:289]

B:BD[10.289] → [6.9:80]

∅:D[6.80] → [10.361:420]

B:BD[10.361] → [10.361:420]

∅:D[10.420] → [13.2521:2536]

B:BD[11.2839] → [13.2521:2536]

∅:D[10.430] → [13.2536:2599]

B:BD[13.2536] → [13.2536:2599]

B:BD[13.2599] → [14.22162:22192]

B:BD[14.22192] → [10.431:580]

B:BD[10.580] → [6.81:174]

∅:D[6.174] → [14.22192:22286]

∅:D[10.674] → [14.22192:22286]

B:BD[14.22192] → [14.22192:22286]

∅:D[14.22286] → [13.2621:2628]

B:BD[13.2621] → [13.2621:2628]

∅:D[13.2628] → [11.2856:2858]

B:BD[11.2856] → [11.2856:2858]

#[derive(Parser, Debug)]
pub enum SubCommand {
    /// Generate a new key. The name used for a key is not required to
    /// match a user's remote or SSH credentials. By default, new keys
    /// are stored in your global configuration directory.
    Generate {
        #[clap(long = "email")]
        email: Option<String>,
        login: String,
    },
    /// Associate a generated key with a remote identity. Patches authored
    /// by unproven keys will only display the key as the author. Example
    /// of proving a key (after generating one): `pijul key prove <nestlogin>@ssh.pijul.com`
    Prove {
        #[clap(short = 'k')]
        no_cert_check: bool,
        remote: String,
    },
}

[11.2794]

[11.2858]

/// Generate a new key. The name used for a key is not required to
/// match a user's remote or SSH credentials. By default, new keys
/// are stored in your global configuration directory.
pub fn generate(email: Option<String>, login: String) -> Result<(), anyhow::Error> {
    if let Some(mut dir) = global_config_dir() {
        std::fs::create_dir_all(&dir)?;
        dir.push("secretkey.json");
        if std::fs::metadata(&dir).is_ok() {
            bail!("Cannot overwrite key file {:?}", dir)
        }
        debug!("creating file {:?}", dir);
        let mut f = open_secret_file(&dir)?;
        let pass = rpassword::read_password_from_tty(Some(
            "Password for the new key (press enter to leave it unencrypted): ",
        ))?;
        let pass = if pass.is_empty() {
            None
        } else {
            Some(pass.as_ref())
        };

Replacement in pijul/src/key.rs at line 53 [11.2558]

B:BD[11.2859] → [11.2859:2956]

B:BD[11.2956] → [14.22287:22348]

∅:D[13.2689] → [11.3003:3064]

∅:D[14.22348] → [11.3003:3064]

B:BD[11.3003] → [11.3003:3064]

B:BD[11.3064] → [13.2690:2742]

∅:D[13.2742] → [11.3064:3372]

B:BD[11.3064] → [11.3064:3372]

B:BD[11.3509] → [11.3509:3874]

impl Key {
    pub async fn run(self) -> Result<(), anyhow::Error> {
        match self.subcmd {
            Some(SubCommand::Generate { email, login }) => {
                if let Some(mut dir) = global_config_dir() {
                    std::fs::create_dir_all(&dir)?;
                    dir.push("secretkey.json");
                    if std::fs::metadata(&dir).is_ok() {
                        bail!("Cannot overwrite key file {:?}", dir)
                    }
                    debug!("creating file {:?}", dir);
                    let mut f = open_secret_file(&dir)?;
                    let pass = rpassword::read_password_from_tty(Some(
                        "Password for the new key (press enter to leave it unencrypted): ",
                    ))?;
                    let pass = if pass.is_empty() {
                        None
                    } else {
                        Some(pass.as_ref())
                    };

[11.2859]

[11.3874]

        let k = libpijul::key::SKey::generate(None);
        serde_json::to_writer_pretty(&mut f, &k.save(pass))?;
        f.write_all(b"\n")?;
        let mut stderr = std::io::stderr();
        writeln!(stderr, "Wrote secret key in {:?}", dir)?;
        dir.pop();

Replacement in pijul/src/key.rs at line 60 [11.2558]

B:BD[11.3875] → [14.22349:22414]

∅:D[14.22414] → [11.3943:4058]

B:BD[11.3943] → [11.3943:4058]

B:BD[11.4059] → [11.4059:4218]

                    let k = libpijul::key::SKey::generate(None);
                    serde_json::to_writer_pretty(&mut f, &k.save(pass))?;
                    f.write_all(b"\n")?;
                    let mut stderr = std::io::stderr();
                    writeln!(stderr, "Wrote secret key in {:?}", dir)?;
                    dir.pop();

[11.3875]

[13.2743]

        dir.push("publickey.json");
        debug!("creating file {:?}", dir);
        let mut f = std::fs::File::create(&dir)?;
        let pk = k.public_key();
        serde_json::to_writer_pretty(&mut f, &pk)?;
        f.write_all(b"\n")?;

Replacement in pijul/src/key.rs at line 67 [11.2558]

∅:D[13.2744] → [11.4218:4383]

B:BD[11.4218] → [11.4218:4383]

B:BD[11.4383] → [13.2745:2895]

                    dir.push("publickey.json");
                    debug!("creating file {:?}", dir);
                    let mut f = std::fs::File::create(&dir)?;
                    let pk = k.public_key();
                    serde_json::to_writer_pretty(&mut f, &pk)?;
                    f.write_all(b"\n")?;

[13.2744]

[13.2895]

        dir.pop();
        dir.push("identities");
        std::fs::create_dir_all(&dir)?;
        dir.push(&pk.key);
        debug!("creating file {:?}", dir);
        let mut f = std::fs::File::create(&dir)?;
        serde_json::to_writer_pretty(
            &mut f,
            &super::Identity {
                public_key: pk,
                origin: String::new(),
                login,
                email,
                name: None,
                last_modified: std::time::SystemTime::now()
                    .duration_since(std::time::SystemTime::UNIX_EPOCH)
                    .unwrap()
                    .as_secs(),
            },
        )?;
        f.write_all(b"\n")?;
    }

Replacement in pijul/src/key.rs at line 90 [11.2558]

B:BD[13.2896] → [13.2896:3399]

B:BD[13.3399] → [14.22415:22450]

∅:D[14.22450] → [13.3433:3468]

B:BD[13.3433] → [13.3433:3468]

B:BD[13.3468] → [14.22451:22732]

∅:D[14.22732] → [13.3468:3519]

B:BD[13.3468] → [13.3468:3519]

∅:D[13.3519] → [11.4459:4532]

B:BD[11.4459] → [11.4459:4532]

B:BD[11.4532] → [14.22733:23023]

B:BD[14.23023] → [2.2499:2804]

∅:D[2.2804] → [14.23116:23404]

B:BD[14.23116] → [14.23116:23404]

B:BD[14.23404] → [3.1580:1808]

∅:D[3.1808] → [14.23476:23576]

B:BD[14.23476] → [14.23476:23576]

B:BD[14.23576] → [5.2441:2492]

∅:D[5.2492] → [14.23622:23678]

B:BD[14.23622] → [14.23622:23678]

                    dir.pop();
                    dir.push("identities");
                    std::fs::create_dir_all(&dir)?;
                    dir.push(&pk.key);
                    debug!("creating file {:?}", dir);
                    let mut f = std::fs::File::create(&dir)?;
                    serde_json::to_writer_pretty(
                        &mut f,
                        &super::Identity {
                            public_key: pk,
                            origin: String::new(),
                            login,
                            email,
                            name: None,
                            last_modified: std::time::SystemTime::now()
                                .duration_since(std::time::SystemTime::UNIX_EPOCH)
                                .unwrap()
                                .as_secs(),
                        },
                    )?;
                    f.write_all(b"\n")?;
                }
            }
            Some(SubCommand::Prove {
                remote,
                no_cert_check,
            }) => {
                let mut remote = if let Ok(repo) = Repository::find_root(None) {
                    use crate::remote::*;
                    if let RemoteRepo::Ssh(ssh) = repo
                        .remote(
                            None,
                            &remote,
                            crate::DEFAULT_CHANNEL,
                            Direction::Pull,
                            no_cert_check,
                            false,
                        )
                        .await?
                    {
                        ssh
                    } else {
                        bail!("No such remote: {}", remote)
                    }
                } else if let Some(mut ssh) = crate::remote::ssh::ssh_remote(&remote, false) {
                    if let Some(c) = ssh.connect(&remote, crate::DEFAULT_CHANNEL).await? {
                        c
                    } else {
                        bail!("No such remote: {}", remote)
                    }
                } else {
                    bail!("No such remote: {}", remote)
                };
                let (_, key) = super::load_key()?;
                remote.prove(key).await?;
            }

[13.2896]

[6.175]

    Ok(())
}

Replacement in pijul/src/key.rs at line 93 [11.2558]

∅:D[6.176] → [10.688:710]

B:BD[10.688] → [10.688:710]

B:BD[10.710] → [7.175:249]

∅:D[7.249] → [10.804:818]

B:BD[10.804] → [10.804:818]

            None => {
                Self::command().write_long_help(&mut std::io::stdout())?;
            }

[6.176]

[11.4555]

/// Associate a generated key with a remote identity. Patches authored
/// by unproven keys will only display the key as the author. Example
/// of proving a key (after generating one): `pijul key prove <nestlogin>@ssh.pijul.com`
pub async fn prove(no_cert_check: bool, remote: String) -> Result<(), anyhow::Error> {
    let mut remote = if let Ok(repo) = Repository::find_root(None) {
        use crate::remote::*;
        if let RemoteRepo::Ssh(ssh) = repo
            .remote(
                None,
                &remote,
                crate::DEFAULT_CHANNEL,
                Direction::Pull,
                no_cert_check,
                false,
            )
            .await?
        {
            ssh
        } else {
            bail!("No such remote: {}", remote)

Replacement in pijul/src/key.rs at line 114 [11.2558]

B:BD[11.4565] → [11.4565:4586]

        Ok(())
    }

[11.4565]

[11.4586]

    } else if let Some(mut ssh) = crate::remote::ssh::ssh_remote(&remote, false) {
        if let Some(c) = ssh.connect(&remote, crate::DEFAULT_CHANNEL).await? {
            c
        } else {
            bail!("No such remote: {}", remote)
        }
    } else {
        bail!("No such remote: {}", remote)
    };
    let (_, key) = load_key()?;
    remote.prove(key).await?;
    Ok(())

Replacement in pijul/src/commands/record.rs at line 142 [8.101759]
B:BD[11.1069] → [5.0:43]
```
        let (_, key) = super::load_key()?;
```
[11.1069]
[11.1910]
```
        let (_, key) = crate::key::load_key()?;
```

Deletion in pijul/src/commands/mod.rs at line 272 [8.133619]

B:BD[14.20228] → [5.67:157]

∅:D[5.157] → [14.20290:20787]

B:BD[14.20290] → [14.20290:20787]

B:BD[14.20787] → [5.158:229]

∅:D[5.229] → [14.20828:21042]

B:BD[14.20828] → [14.20828:21042]

B:BD[14.21042] → [15.60:69]

fn load_key() -> Result<(libpijul::key::SecretKey, libpijul::key::SKey), anyhow::Error> {
    if let Some(mut dir) = crate::config::global_config_dir() {
        dir.push("secretkey.json");
        if let Ok(key) = std::fs::File::open(&dir) {
            let k: libpijul::key::SecretKey = serde_json::from_reader(key)?;
            let pass = if k.encryption.is_some() {
                Some(rpassword::read_password_from_tty(Some(&format!(
                    "Password for {:?}: ",
                    dir
                )))?)
            } else {
                None
            };
            let sk = k.load(pass.as_deref())?;
            Ok((k, sk))
        } else {
            bail!("Secret key not found, please use `pijul key generate` and try again")
        }
    } else {
        bail!("Secret key not found, please use `pijul key generate` and try again")
    }
}