U

Ӈg��@stdZd
dl
Z
d
dlZd
dlZd
dlZd
dlZd
dlmZ
d
dlm	Z	m
Z

d
dlmZ
e
�
e�
ZdZGdd�d�ZdS)	z0gpg.py - Collection of gpg key related functions�N)
�TemporaryDirectory)�Dict�Optional)
�subpZ	GNUPGHOMEc@s�eZ
dZd
d�Zdd�Zeeeefd�
dd��
Zdd	�Z	d
d�
dd�Z
eeed
�dd�Zeed
�dd�Z
d"eed�dd�Zd#eed
d�dd�Zed
d
�dd�Zd$eeeed�dd�Zd
d�
d d!�Zd
S)%�GPGc

Csd
|_i|_
t�|_dS)NF)�gpg_started�_envr�temp_dir�
�self�r�//usr/lib/python3/dist-packages/cloudinit/gpg.py�__init__s


zGPG.__init__c


Cs|S�
Nrr
rrr
�	__enter__s
z
GPG.__enter__)
�returnc

Cs&|jr|jSd
|_
t|jji
|_|jS)a
when this env property gets invoked, set up our temporary
        directory, and also set gpg_started to tell the cleanup()
        method whether or not

        why put this here and not in __init__? pytest seems unhappy
        and it's not obvious how to work around it
        T)rr�HOMEr	�namer
rrr
�env"s
	



zGPG.envcCs|��
dSr)
�cleanup)rZexc_typ�	exc_value�	tracebackrrr
�__exit__1s
zGPG.__exit__Nc

Cs,|��
|j
r(tj�|j
j�
r(|j
��
d
S)z0cleanup the gpg temporary directory and kill gpgN)�kill_gpgr	�os�path�isdirrrr
rrr
r4s

zGPG.cleanup)�keyrc
CsVztjd
dd|
gd|j
d�jWStjk
rP
}
zt�d|
|�
W5d}~XYnXdS)z*Export gpg key, armoured key gets returned�gpgz--exportz--armourT��capture�
update_env�&Failed to export armoured key "%s": %sN)rr�stdout�ProcessExecutionError�LOG�debug�rr�errorrrr
�
export_armour:s




�
 
zGPG.export_armourcCstjd
dg|
d|j
d�jS)z�Dearmor gpg key, dearmored key gets returned

        note: man gpg(1) makes no mention of an --armour spelling, only --armor
        rz	--dearmorF)�data�decoder!)rrr#)rrrrr
�dearmorGs
�zGPG.dearmorF)�key_filercCsTd
dddddg}|s|�d�

|�|
�

t
j
||jdd	�\}}|rPt�d
|
|�
|S)z�List keys from a keyring with fingerprints. Default to a
        stable machine parseable format.

        @param key_file: a string containing a filepath to a key
        @param human_output: return output intended for human parsing
        rz--no-optionsz--with-fingerprintz--no-default-keyringz--list-keysz	--keyringz
--with-colonsT)r!r r")�appendrrr%�warning)rr-Zhuman_output�cmdr#�stderrrrr
�	list_keysPs$




�






�z
GPG.list_keys��
r4)r�	keyserverrc	
Cs�t�
d
|
|�
d}d}t|pg�
}|d7}z6tjddd|d|
gd	|jd
�
t�
d|
||�
WdStjk
r�
}
z|}W5d}~XYnXz&t|�
}t�
d|j|�
t�	|�

Wq"t
k
r�
}
ztd
|
|||f�
|�W5d}~XYq"Xq"dS)a�Receive gpg key from the specified keyserver.

        Retries are done by default because keyservers can be unreliable.
        Additionally, there is no way to determine the difference between
        a non-existent key and a failure.  In both cases gpg (at least 2.2.4)
        exits with status 2 and stderr: "keyserver receive failed: No data"
        It is assumed that a key provided to cloud-init exists on the keyserver
        so re-trying makes better sense than failing.

        @param key: a string key fingerprint (as passed to gpg --recv-keys).
        @param keyserver: the keyserver to request keys from.
        @param retries: an iterable of sleep lengths for retries.
        Use None to indicate no retries.z&Importing key '%s' from keyserver '%s'r
Nr4rz--no-ttyz--keyserver=%sz--recv-keysTrz/Imported key '%s' from keyserver '%s' on try %dz6Import failed with exit code %d, will try again in %ssz@Failed to import key '%s' from keyserver '%s' after %d tries: %s)r%r&�iterrrr$�nextZ	exit_code�time�sleep�
StopIteration�
ValueError)	rrr5ZretriesZtrynumr(Zsleeps�
eZnaplenrrr
�recv_keyjsR








�
�



�







�




���zGPG.recv_keyc
CsXz tjd
ddd|
gd|j
d�
Wn2tjk
rR
}
zt�d|
|�
W5d}~XYnXdS)	z0Delete the specified key from the local gpg ringrz--batchz--yesz
--delete-keysTrzFailed delete key "%s": %sN)rrr$r%r/r'rrr
�
delete_key�s



�

zGPG.delete_key�keyserver.ubuntu.com)�keyidr5rc	Csd|�|
�
}|s`zDz|j|
|d
�
|�|
�
}Wn"tk
rN


t�d|
�
�YnXW5|�
|
�

X|S)zget gpg keyid from keyserver)
r5zFailed to obtain gpg key %s)r)r>r=r;r%Z	exception)rr@r5Zarmourrrr
�
getkeybyid�s








zGPG.getkeybyidc

Cs�z�|jsWd
St
�d�
r4t
j
dddgd|jd�j}
njt
j
ddd	d
dd
dd
d
g	dddgd�j}
t�d|
�}dd�|D�
}|r�t�d|�
|D]}t	�
|tj�
q�Wn0t
j
k
r�
}
zt�d|�
W5d
}~XYnXd
S)a
killing with gpgconf is best practice, but when it isn't available
        failover is possible

        GH: 4344 - stop gpg-agent/dirmgr daemons spawned by gpg
        key imports. Daemons spawned by cloud-config.service on systemd
        v253 report (running)
        NZgpgconfz--kill�allTrZpsz-ozppid,pidz-CZkeyboxdZdirmngrz	gpg-agentr
r4)r Zrcsz(?P<ppid>\d+)\s+(?P<pid>\d+)c
Ss$g|]}
|
dd
krt|
d�
�qS)r
�
1r4)
�int)�.0�pidrrr
�
<listcomp>�s
z GPG.kill_gpg.<locals>.<listcomp>z&Killing gpg-agent and dirmngr pids: %sz"Failed to clean up gpg process: %s)rrZwhichrr#�re�findallr%r&r�kill�signal�SIGKILLr$r/)rZgpg_process_outZgpg_pidsZ
root_gpg_pidsZgpg_pidr<rrr
r�sN







�








�
�
�
�

�


zGPG.kill_gpg)
F)
r3)
r?)�__name__�
__module__�__qualname__rr�propertyr�strrrrrr)r,r2r=r>rArrrrr
rs$


	7�

�r)�__doc__ZloggingrrHrKr8Ztempfiler�typingrrZ	cloudinitrZ	getLoggerrMr%rrrrrr
�<module>s