aboutsummaryrefslogtreecommitdiff
blob: b838fb192e971f33fe965c7c4a240f498066494e (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
#!/bin/bash

#   split multi-key files into separate keys like ssh-authkeys likes

# WHY
# ---
#
# Yeah I wonder that too, when it's so much more maintainable to keep the damn
# keys as sitaram@home.pub and sitaram@work.pub or such.  But there's no
# accounting for tastes, and some old fogies apparently want to put all of a
# user's keys into a single ".pub" file.

# WARNINGS AND CAVEATS
# --------------------
#
# - assumes no "@" sign in basenames of any multi-key files (single line file
#   may still have them)

# - assumes you don't have a subdir in keydir called "__split_keys__"

# - RUNNING "GITOLITE SETUP" WILL LOSE ALL THESE KEYS.  So if you ever do
#   that, you will then need to make a dummy push to the admin repo to add
#   them back.  If all your **admin** keys were in split keys, then you lost
#   remote access.  If that happens, log on to the server using "su - git" or
#   such, then use the methods described in the "bypassing gitolite" section
#   in "emergencies.html" instead of a remote push.

# SUPPORT
# -------
#
# NONE.

# USAGE
# -----
#
# to enable, uncomment the 'ssh-authkeys-split' line in the ENABLE list in the
# rc file.

echo "ERROR: ssh-authkeys-split is not support by gitolite-gentoo" 1>&2
echo "ERROR: because metadata might be lost. You should split the keys manually!" 1>&2
exit 1

cd $GL_ADMIN_BASE/keydir

rm -rf __split_keys__
mkdir __split_keys__
export SKD=$PWD/__split_keys__

find . -type f -name "*.pub" | while read k
do
    # do we need to split?
    lines=`wc -l < $k`
    case $lines in
        (0|1) continue
    esac

    # is it sane to split?
    base=`basename $k .pub`
    echo $base | grep '@' >/dev/null && continue

    # ok do it
    seq=1
    while read line
    do
        f=$SKD/$base@$seq.pub
        echo "$line" > $f
        # similar sanity check as main ssh-authkeys script
        if ! ssh-keygen -l -f $f >/dev/null
        then
            echo 1>&2 "ssh-authkeys-split: bad line $seq in keydir/$k"
            rm -f $f
        fi
        (( seq++ ))
    done < $k

    # now delete the original file
    rm $k
done