1038 Commits

Author SHA1 Message Date
Justus Winter
d8f8d167a6
Emit a hint if sq cert importing a key.
- Fixes #367.
2024-10-14 15:07:07 +02:00
Justus Winter
a7389f78b0
Drop the free-form command hint interface. 2024-10-14 14:45:05 +02:00
Justus Winter
72f1af22d8
Make all command hints use the structured hint framework.
- And fix all mistakes and CLI rots that crept in.  Also, align the
    hints a little.
2024-10-14 14:45:03 +02:00
Justus Winter
20ee1c77d1
On debug builds, parse the emitted hints and panic if that fails. 2024-10-14 14:44:48 +02:00
Justus Winter
718bffbe9f
Add a structured command hint framework.
- Instead of producing a free-form string, add a
    `std::process::Command`-inspired framework for command hints.

  - There are three benefits: First, we can provide robust quoting.
    Then, we can validate sq invocations using the CLI parser.
    Finally, we can nicely wrap the hints.
2024-10-14 14:44:47 +02:00
Justus Winter
1e54dc4c72
Emit hint on how to extract a particular certificate.
- Fixes #296.
2024-10-14 12:03:12 +02:00
Justus Winter
fdeb745fba
Move function. 2024-10-14 11:50:03 +02:00
Justus Winter
bc30d73f76
Always list found certificates, and reword the message.
- Also list the found certificates when writing to a file.

  - Emphasize that the results are not to be trusted by saying that
    the are related to the query.

  - See #296.
2024-10-14 11:44:03 +02:00
Justus Winter
e2fbc4b9b5
Rename sq network fetch to search, likewise hkp, WKD, and DANE.
- Rename `sq network fetch` to `sq network search` to emphasize that
    this is key discovery, and may return related or even wrong results.
    Likewise for the key server, WKD, and DANE methods.

  - See #296.
2024-10-14 10:50:11 +02:00
Justus Winter
3ff6b50fa9
Merge certificates fetched from the network earlier. 2024-10-14 10:50:11 +02:00
Justus Winter
bc5c6629ac
Move type ImportStatus. 2024-10-14 10:19:35 +02:00
Justus Winter
0a665ed98c
Unify key and cert import stats, be explicit about what is imported.
- When importing keys, also print whether the key or cert component
    was unchanged, new, or updated, and also print cert import stats:

      % sq key import test-modified.key

      Imported CDBDAC59F236D281AAE839E923B926148F77F86F
      test@example.org (UNAUTHENTICATED) from test-modified.key: key
      unchanged, cert updated
      Imported 0 new keys, updated 0 keys, 1 key unchanged, 0 errors.
      Imported 0 new certificates, updated 1 certificate,
      0 certificates unchanged, 0 errors.

  - By being more consistent in our output, and more explicit about
    what is happening and the distinction between key and cert, this
    will hopefully be less confusing.

  - Fixes #256.
2024-10-14 10:11:27 +02:00
Neal H. Walfield
1544660a97
Add a test to execute some sanity checks against the CLI.
- `clap` includes a function to sanity check the CLI.  Use it.
2024-10-11 17:10:16 +02:00
Justus Winter
72de5d1234
Make --rev-cert argument mandatory if --output has been given.
- Fixes #132.
2024-10-11 16:55:35 +02:00
Justus Winter
aaae90ce6e
Improve some integration tests to use more of the test framework. 2024-10-11 16:53:54 +02:00
Justus Winter
8f337bbd1e
Remove sq network keyserver publish --require-all.
- This should be the default, and ignoring errors should be done
    explicitly by the caller.

  - Fixes #359.
2024-10-11 16:11:58 +02:00
Justus Winter
383c5689a8
Always print the error message in addition to propagating it. 2024-10-11 16:10:24 +02:00
Justus Winter
e941c649b0
Emit a hint that the Mailvelope key server rejects some certs.
- Currently, the server rejects certificates that are not
    encryption-capable.

  - See https://github.com/mailvelope/keyserver/issues/149
2024-10-11 16:07:27 +02:00
Justus Winter
a5d40cd76e
Augment usage messages with examples.
- Fixes #319.
2024-10-10 18:13:57 +02:00
Justus Winter
9e3b020dec
Slightly indent the pointer to the global arguments. 2024-10-10 16:23:08 +02:00
Justus Winter
307a8bc806
Provide helpful guidance if there are no secret keys.
- Fixes #228.
2024-10-10 16:22:40 +02:00
Justus Winter
4737f55511
Make sq key generate --rev-cert behave like other outputs.
- Notably, this allows the revocation certificate be written to
    stdout, unless --output is also stdout, in which case we throw an
    error.

  - Fixes #219.
2024-10-10 13:58:09 +02:00
Justus Winter
2bc425e080
Move CLI definition of sq key generate to its own module. 2024-10-10 13:40:28 +02:00
Justus Winter
1a8ff4349a
Display the signers cert fingerprint when inspecting artifacts.
- Fixes #243.
2024-10-10 13:19:43 +02:00
Justus Winter
c93cd3d667
Fix formatting. 2024-10-10 12:33:19 +02:00
Justus Winter
4a635d2be2
Return the selected certificate from Sq::best_userid_for. 2024-10-10 12:32:16 +02:00
Justus Winter
1b36330763
Make Sq::best_userid_for work with use_wot=false.
- This error condition has been introduced during refactoring but
    wasn't motivated and seems superfluous.
2024-10-10 12:32:16 +02:00
Justus Winter
8ea5c1dabd
Improve best user ID computation.
- Compute the best user ID and the associated trust amount for each
    cert.  Then, pick the one with the highest trust amount.
2024-10-10 12:32:16 +02:00
Justus Winter
e905bdb2d2
Improve certificate lookups when computing best user ID.
- The keyflags argument restricts which certificates to display,
    which was wrong in four of the callers, and right in one.  Fix
    this by supplying the right key flags to Sq::best_userid_for.
2024-10-10 12:20:05 +02:00
Justus Winter
1239977a90
Use cheaper predicate to see if an iterator is empty. 2024-10-09 16:58:04 +02:00
Justus Winter
b885328662
Make sq toolbox keyring filter --handle robust.
- By splitting `--handle` into `--cert` and `--key`, where the
    former only matches on primary keys, and the latter matches on
    both primary keys and subkeys.

  - Fixes #287.
2024-10-09 16:58:04 +02:00
Justus Winter
2d8ee7a146
Apply the cert filter only once.
- Fixes ec933036dd44606197888ce7d17ba23bc717893c.
2024-10-09 16:57:48 +02:00
Justus Winter
d4ce7ac095
Add tests for sq toolbox keyring filter. 2024-10-09 16:57:48 +02:00
Justus Winter
fcfbfb73b6
Run tests in a separate working directory.
- This way they can create artifacts in their working directory.
2024-10-09 16:57:48 +02:00
Justus Winter
0e5b1c0611
Deduplicate function to locate test artifacts. 2024-10-09 16:57:48 +02:00
Neal H. Walfield
62d7813900
Change sq pki certify to reject expired and revoked certs.
- It was possible to use `--allow-not-alive-certifier` and
    `--allow-revoked-certifier` to force `sq pki certify` to use
    expired and revoked certificates.

  - Consistent with the principle that `sq` should support a lot, but
    not everything, remove them.

  - Fixes #365.
2024-10-09 14:57:02 +02:00
Justus Winter
79b3f035f1
Don't word-wrap commands in hints. 2024-10-08 18:49:47 +02:00
Justus Winter
aadf406c9e
Fix hints emitted when fetching certs from the network.
- Fixes #330.
2024-10-08 18:46:08 +02:00
Justus Winter
a22f40410a
Improve hint formatting. 2024-10-08 18:45:48 +02:00
Justus Winter
54b0613e19
Add an explicit output parameter for sq toolbox packet split.
- Fixes #357.
2024-10-08 16:14:13 +02:00
Justus Winter
fb0680ff30
Align the value-name for --home. 2024-10-08 16:14:13 +02:00
Justus Winter
fce1bc2110
Add an ENVIRONMENT section to the top-level man page. 2024-10-08 16:14:13 +02:00
Justus Winter
6517b63378
Rename environment variables to override cert and key store.
- This makes them more consistent with the other environment
    variables SEQUOIA_HOME and SEQUOIA_CRYPTO_POLICY.

  - Fixes #364.
2024-10-08 16:14:09 +02:00
Justus Winter
907a16caa2
Use a custom CLI parser for state directories.
- Add and use a custom value parser for absolute directories with
   explicit default for --home, --cert-store, and --key-store.

 - If `default` is given, this parses to `None`.  If an empty path is
   given, a hint is displayed to give `default` instead.

 - If a relative path is given, a hint is displayed to use an
   absolute path instead.

 - Fixes #299.
2024-10-08 15:10:13 +02:00
Neal H. Walfield
4dde1b2928
Improve documentation for sq key expire and sq key subkey expire. 2024-10-08 12:06:38 +02:00
Neal H. Walfield
5e80d02b5e
Don't extend the expiration of subkeys that are hard revoke.
- If a subkey is hard revoked, refuse to extend the expiration.
2024-10-08 11:46:07 +02:00
Neal H. Walfield
7862c1609f
Add a unit test for sq key subkey expire for soft revocations.
- Check that `sq key subkey expire` extends the expiration of a
    subkey that is soft revoked.
2024-10-08 11:42:33 +02:00
Neal H. Walfield
b266d9dea1
Add a unit test for sq key subkey expire for unbound subkeys.
- Check that `sq key subkey expire` won't extend the expiration of a
    subkey that isn't bound.

  - Improve the error message when this happens.
2024-10-08 11:42:27 +02:00
Neal H. Walfield
f6d62ab749
Normalize naming.
- Make the code (and output) less confusing by normalizing names.
2024-10-08 11:41:53 +02:00
Neal H. Walfield
7292c6c347
Fix setting a certificate's expiration time.
- When setting a certificate's expiration time, we update each user
    ID's self signature.  If a user ID is revoked, creating a new self
    signature will "unrevoke it."

  - Skip user IDs that are revoked.
2024-10-08 10:52:33 +02:00