
­­­­­­­­­­­­­­­­­­
<!DOCTYPE html>
<html>
3
\me                 @   sr   d Z ddlZddlZddlmZ ejeZdddddgZd	d
 Z	dd Z
dddZdddZdd ZdddZdS )z0gpg.py - Collection of gpg key related functions    N)subpgpgz--with-fingerprintz--no-default-keyringz--list-keysz	--keyringc             C   sZ   yt j ddd| gdd\}}W n6 t jk
rT } ztjd| | d}W Y dd}~X nX |S )z*Export gpg key, armoured key gets returnedr   z--exportz--armourT)capturez&Failed to export armoured key "%s": %sN)r   ProcessExecutionErrorLOGdebug)keyarmour_error r   /usr/lib/python3.6/gpg.pyexport_armour   s    r   c             C   s   t j ddg| ddjS )z~Dearmor gpg key, dearmored key gets returned

    note: man gpg(1) makes no mention of an --armour spelling, only --armor
    r   z	--dearmorF)datadecode)r   stdout)r   r   r   r   dearmor'   s    r   Fc             C   sN   g }|j t |s|jd |j|  tj|dd\}}|rJtjd| | |S )zList keys from a keyring with fingerprints. Default to a stable machine
    parseable format.

    @param key_file: a string containing a filepath to a key
    @param human_output: return output intended for human parsing
    z--with-colonsT)r   z&Failed to export armoured key "%s": %s)extendGPG_LISTappendr   r   warning)Zkey_fileZhuman_outputcmdr   stderrr   r   r   list/   s    


r      c       	       C   s   t jd| | ddd| d| g}|dkr,g }d}d}t|}x|d7 }y"tj|d	d
 t jd| || dS  tjk
r } z
|}W Y dd}~X nX y&t|}t jd|j| tj| W q> t	k
r } zt
d| |||f |W Y dd}~X q>X q>W dS )a  Receive gpg key from the specified keyserver.

    Retries are done by default because keyservers can be unreliable.
    Additionally, there is no way to determine the difference between
    a non-existant key and a failure.  In both cases gpg (at least 2.2.4)
    exits with status 2 and stderr: "keyserver receive failed: No data"
    It is assumed that a key provided to cloud-init exists on the keyserver
    so re-trying makes better sense than failing.

    @param key: a string key fingerprint (as passed to gpg --recv-keys).
    @param keyserver: the keyserver to request keys from.
    @param retries: an iterable of sleep lengths for retries.
                    Use None to indicate no retries.z&Importing key '%s' from keyserver '%s'r   z--no-ttyz--keyserver=%sz--recv-keysNr   r   T)r   z/Imported key '%s' from keyserver '%s' on try %dz6Import failed with exit code %d, will try again in %ssz@Failed to import key '%s' from keyserver '%s' after %d tries: %s)r   r   iterr   r   nextZ	exit_codetimeZsleepStopIteration
ValueError)	r   	keyserverZretriesr   Ztrynumr   ZsleepseZnaplenr   r   r   recv_keyB   s>    r"   c             C   sT   yt j dddd| gdd W n2 t jk
rN } ztjd| | W Y dd}~X nX dS )	z0Delete the specified key from the local gpg ringr   z--batchz--yesz--delete-keysT)r   zFailed delete key "%s": %sN)r   r   r   r   )r   r   r   r   r   
delete_keys   s
    r#   keyserver.ubuntu.comc             C   s\   t | }|sXz@yt| |d t | }W n" tk
rH   tjd|   Y nX W dt|  X |S )zget gpg keyid from keyserver)r    zFailed to obtain gpg key %sN)r   r"   r   r   Z	exceptionr#   )Zkeyidr    r	   r   r   r   
getkeybyid}   s    
r%   )Fr   r   )r&   )r$   )__doc__Zloggingr   Z	cloudinitr   Z	getLogger__name__r   r   r   r   r   r"   r#   r%   r   r   r   r   <module>   s   


1
