diff --git a/NEWS b/NEWS index 95d37da7..cff1dffa 100644 --- a/NEWS +++ b/NEWS @@ -51,6 +51,18 @@ has the self-signed user ID "Alice ", then `--userid-by-email alice@example.org` selects "Alice " for certification. + - Change `sq key userid revoke --email` to use a user ID with just + the specified email address, if the email address is part of a + self-signed user ID. That is, if the certificate has the + self-signed user ID "Alice ", then `--email + alice@example.org` would have selected "Alice + " for revocation, but now it selects + "". + - Add `sq key userid revoke --userid-by-email`, which uses the + self-signed user ID with the specified email address. That is, + if the certificate has the self-signed user ID "Alice + ", then `--userid-by-email alice@example.org` + selects "Alice " for revocation. * Changes in 0.41.0 ** New functionality diff --git a/src/cli/key/userid.rs b/src/cli/key/userid.rs index c4177580..84e5e195 100644 --- a/src/cli/key/userid.rs +++ b/src/cli/key/userid.rs @@ -219,7 +219,7 @@ pub struct RevokeCommand { #[command(flatten)] pub userids: UserIDDesignators< - userid_designator::PlainByAndAddArgs, + userid_designator::ExactByAndAddArgs, userid_designator::OneValue>, #[clap( diff --git a/src/cli/types/userid_designator.rs b/src/cli/types/userid_designator.rs index 6618ee36..72721310 100644 --- a/src/cli/types/userid_designator.rs +++ b/src/cli/types/userid_designator.rs @@ -57,10 +57,6 @@ pub type PlainByArgs pub type PlainAddArgs = >::Output; -pub type PlainByAndAddArgs - = <>::Output - as std::ops::BitOr>::Output; - pub type ExactAndAddArgs = >::Output; @@ -1197,7 +1193,6 @@ mod test { check!(AddArgs, None, false, true); check!(PlainByArgs, By, false, false); check!(PlainAddArgs, Add, false, false); - check!(PlainByAndAddArgs, By, false, true); check!(ExactAndAddArgs, Exact, false, true); check!(ExactByAndAddArgs, Exact, true, true); check!(AllExactByAndAddArgs, Exact, true, true); diff --git a/tests/integration/sq_key_userid_revoke.rs b/tests/integration/sq_key_userid_revoke.rs index 04831609..c7ecb040 100644 --- a/tests/integration/sq_key_userid_revoke.rs +++ b/tests/integration/sq_key_userid_revoke.rs @@ -300,15 +300,15 @@ fn userid_designators() { UserIDArg::AddUserID(other_userid)).is_ok()); revocations(&sq, cert.key_handle(), other_userid, 1); - // 3. --email: use the self-signed user ID with the specified - // email address. + // 3. --userid-by-email: use the self-signed user ID with the + // specified email address. let (cert, fpr, sq) = setup(); // Self-signed and authenticated. assert!(sq.pki_authenticate( &[], &fpr, UserIDArg::UserID(self_signed_userid)).is_ok()); assert!(revoke(&sq, cert.key_handle(), - UserIDArg::Email(self_signed_email)).is_ok()); + UserIDArg::ByEmail(self_signed_email)).is_ok()); revocations(&sq, cert.key_handle(), self_signed_userid, 1); assert!(sq.pki_authenticate( &[], &fpr, UserIDArg::UserID(self_signed_userid)).is_err()); @@ -317,10 +317,32 @@ fn userid_designators() { assert!(sq.pki_authenticate( &[], &fpr, UserIDArg::UserID(other_userid)).is_ok()); assert!(revoke(&sq, cert.key_handle(), - UserIDArg::Email(other_email)).is_err()); + UserIDArg::ByEmail(other_email)).is_err()); revocations(&sq, cert.key_handle(), other_userid, 0); - // 4. --add-email: use a user ID with the email address. + // 4. --email: use a user ID with just the email address if there + // is a self-signed user ID with the specified email address. + let (cert, fpr, sq) = setup(); + + // Self-signed and authenticated. + assert!(sq.pki_authenticate( + &[], &fpr, UserIDArg::UserID(self_signed_userid)).is_ok()); + assert!(revoke(&sq, cert.key_handle(), + UserIDArg::Email(self_signed_email)).is_ok()); + revocations(&sq, cert.key_handle(), self_signed_userid, 0); + revocations(&sq, cert.key_handle(), &format!("<{}>", self_signed_email), 1); + assert!(sq.pki_authenticate( + &[], &fpr, UserIDArg::UserID(self_signed_userid)).is_ok()); + + // Authenticated, but not self-signed. + assert!(sq.pki_authenticate( + &[], &fpr, UserIDArg::UserID(other_userid)).is_ok()); + assert!(revoke(&sq, cert.key_handle(), + UserIDArg::Email(other_email)).is_err()); + revocations(&sq, cert.key_handle(), other_userid, 0); + revocations(&sq, cert.key_handle(), &format!("<{}>", other_email), 0); + + // 5. --add-email: use a user ID with the email address. let (cert, fpr, sq) = setup(); // Self-signed and authenticated.