From fbb711174fc3bb6222c9656546bf7f3bb279e130 Mon Sep 17 00:00:00 2001
From: Ruben Pollan <meskio@sindominio.net>
Date: Fri, 25 Jul 2014 19:26:19 -0500
Subject: gpg.verify_file() gets the data as a filename not as a binary stream

---
 src/leap/keymanager/openpgp.py | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

(limited to 'src/leap/keymanager/openpgp.py')

diff --git a/src/leap/keymanager/openpgp.py b/src/leap/keymanager/openpgp.py
index 950d022..46ae2aa 100644
--- a/src/leap/keymanager/openpgp.py
+++ b/src/leap/keymanager/openpgp.py
@@ -649,13 +649,17 @@ class OpenPGPScheme(EncryptionScheme):
                 result = gpg.verify(data)
             else:
                 # to verify using a detached sig we have to use
-                # gpg.verify_file(), which receives the data as a binary
-                # stream and the name of a file containing the signature.
+                # gpg.verify_file(), which receives the name of
+                # files containing the date and the signature.
                 sf, sfname = tempfile.mkstemp()
                 with os.fdopen(sf, 'w') as sfd:
                     sfd.write(detached_sig)
-                with closing(_make_binary_stream(data, gpg._encoding)) as df:
-                    result = gpg.verify_file(df, sig_file=sfname)
+                df, dfname = tempfile.mkstemp()
+                with os.fdopen(df, 'w') as sdd:
+                    sdd.write(data)
+                result = gpg.verify_file(dfname, sig_file=sfname)
+                os.unlink(sfname)
+                os.unlink(dfname)
             gpgpubkey = gpg.list_keys().pop()
             valid = result.valid
             rfprint = result.fingerprint
-- 
cgit v1.2.3


From 8f01d6b818a36014e21a13baaf6c5112ef9e9a35 Mon Sep 17 00:00:00 2001
From: drebs <drebs@leap.se>
Date: Wed, 27 Aug 2014 12:59:28 -0300
Subject: Fix call to python-gnupg verify_file() method (#6022).

---
 src/leap/keymanager/openpgp.py | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

(limited to 'src/leap/keymanager/openpgp.py')

diff --git a/src/leap/keymanager/openpgp.py b/src/leap/keymanager/openpgp.py
index 46ae2aa..ee37a34 100644
--- a/src/leap/keymanager/openpgp.py
+++ b/src/leap/keymanager/openpgp.py
@@ -22,12 +22,11 @@ import os
 import re
 import shutil
 import tempfile
+import io
 
-from contextlib import closing
 
 from gnupg import GPG
 from gnupg.gnupg import GPGUtilities
-from gnupg._util import _make_binary_stream
 
 from leap.common.check import leap_assert, leap_assert_type, leap_check
 from leap.keymanager import errors
@@ -649,17 +648,13 @@ class OpenPGPScheme(EncryptionScheme):
                 result = gpg.verify(data)
             else:
                 # to verify using a detached sig we have to use
-                # gpg.verify_file(), which receives the name of
-                # files containing the date and the signature.
+                # gpg.verify_file(), which receives the data as a binary
+                # stream and the name of a file containing the signature.
                 sf, sfname = tempfile.mkstemp()
                 with os.fdopen(sf, 'w') as sfd:
                     sfd.write(detached_sig)
-                df, dfname = tempfile.mkstemp()
-                with os.fdopen(df, 'w') as sdd:
-                    sdd.write(data)
-                result = gpg.verify_file(dfname, sig_file=sfname)
+                result = gpg.verify_file(io.BytesIO(data), sig_file=sfname)
                 os.unlink(sfname)
-                os.unlink(dfname)
             gpgpubkey = gpg.list_keys().pop()
             valid = result.valid
             rfprint = result.fingerprint
-- 
cgit v1.2.3


From 2c8cfffad0cf214951628b771db2322533a8fe50 Mon Sep 17 00:00:00 2001
From: Ruben Pollan <meskio@sindominio.net>
Date: Fri, 1 Aug 2014 10:20:27 -0500
Subject: Implement 'fetch_key' for ascii keys

binary keys support is still missing
---
 src/leap/keymanager/openpgp.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'src/leap/keymanager/openpgp.py')

diff --git a/src/leap/keymanager/openpgp.py b/src/leap/keymanager/openpgp.py
index ee37a34..6a825cd 100644
--- a/src/leap/keymanager/openpgp.py
+++ b/src/leap/keymanager/openpgp.py
@@ -327,7 +327,10 @@ class OpenPGPScheme(EncryptionScheme):
                 privkey = gpg.list_keys(secret=True).pop()
             except IndexError:
                 pass
-            pubkey = gpg.list_keys(secret=False).pop()  # unitary keyring
+            try:
+                pubkey = gpg.list_keys(secret=False).pop()  # unitary keyring
+            except IndexError:
+                return (None, None)
 
             # extract adress from first uid on key
             match = re.match(mail_regex, pubkey['uids'].pop())
-- 
cgit v1.2.3


From 3ebb6be0c628b3a2b45a28690b6b6dc1bb2ae850 Mon Sep 17 00:00:00 2001
From: Ruben Pollan <meskio@sindominio.net>
Date: Sun, 12 Oct 2014 03:21:47 -0500
Subject: Basic validation levels support

---
 src/leap/keymanager/openpgp.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'src/leap/keymanager/openpgp.py')

diff --git a/src/leap/keymanager/openpgp.py b/src/leap/keymanager/openpgp.py
index 6a825cd..57a7754 100644
--- a/src/leap/keymanager/openpgp.py
+++ b/src/leap/keymanager/openpgp.py
@@ -38,6 +38,7 @@ from leap.keymanager.keys import (
     KEYMANAGER_KEY_TAG,
     TAGS_ADDRESS_PRIVATE_INDEX,
 )
+from leap.keymanager.validation import ValidationLevel
 
 
 logger = logging.getLogger(__name__)
@@ -183,7 +184,7 @@ def _build_key_from_gpg(address, key, key_data):
         private=True if key['type'] == 'sec' else False,
         length=key['length'],
         expiry_date=key['expires'],
-        validation=None,  # TODO: verify for validation.
+        validation=ValidationLevel.Weak_Chain,
     )
 
 
-- 
cgit v1.2.3


From a5cf287dabc77b7172c2f058696cee1024ea3297 Mon Sep 17 00:00:00 2001
From: Ruben Pollan <meskio@sindominio.net>
Date: Mon, 20 Oct 2014 18:35:11 -0500
Subject: Update doc string of OpenPGPScheme._temporary_gpgwrapper

---
 src/leap/keymanager/openpgp.py | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

(limited to 'src/leap/keymanager/openpgp.py')

diff --git a/src/leap/keymanager/openpgp.py b/src/leap/keymanager/openpgp.py
index 57a7754..e84cd29 100644
--- a/src/leap/keymanager/openpgp.py
+++ b/src/leap/keymanager/openpgp.py
@@ -452,10 +452,8 @@ class OpenPGPScheme(EncryptionScheme):
         Return a gpg wrapper that implements the context manager protocol and
         contains C{keys}.
 
-        :param key_data: ASCII armored key data.
-        :type key_data: str
-        :param gpgbinary: Name for GnuPG binary executable.
-        :type gpgbinary: C{str}
+        :param keys: keys to conform the keyring.
+        :type key: list(OpenPGPKey)
 
         :return: a TempGPGWrapper instance
         :rtype: TempGPGWrapper
-- 
cgit v1.2.3


From d9df76ea2504a78865209cda3ae6e41613d5e5aa Mon Sep 17 00:00:00 2001
From: Ruben Pollan <meskio@sindominio.net>
Date: Thu, 30 Oct 2014 21:54:32 -0600
Subject: Merge keys when updating an exisiting key

This is needed to prevent roll back attacks where the attacker push us
to accept a key with an old expiration date that could be use to push an
untrusted key when after it's expiration.
---
 src/leap/keymanager/openpgp.py | 12 ++++++++++++
 1 file changed, 12 insertions(+)

(limited to 'src/leap/keymanager/openpgp.py')

diff --git a/src/leap/keymanager/openpgp.py b/src/leap/keymanager/openpgp.py
index e84cd29..f86b35d 100644
--- a/src/leap/keymanager/openpgp.py
+++ b/src/leap/keymanager/openpgp.py
@@ -37,6 +37,8 @@ from leap.keymanager.keys import (
     build_key_from_dict,
     KEYMANAGER_KEY_TAG,
     TAGS_ADDRESS_PRIVATE_INDEX,
+    KEY_FINGERPRINT_KEY,
+    KEY_DATA_KEY,
 )
 from leap.keymanager.validation import ValidationLevel
 
@@ -394,6 +396,16 @@ class OpenPGPScheme(EncryptionScheme):
         if doc is None:
             self._soledad.create_doc_from_json(key.get_json())
         else:
+            if key.fingerprint == doc.content[KEY_FINGERPRINT_KEY]:
+                # in case of an update of the key merge them with gnupg
+                with self._temporary_gpgwrapper() as gpg:
+                    gpg.import_keys(doc.content[KEY_DATA_KEY])
+                    gpg.import_keys(key.key_data)
+                    gpgkey = gpg.list_keys(secret=key.private).pop()
+                    key = _build_key_from_gpg(
+                        key.address, gpgkey,
+                        gpg.export_keys(gpgkey['fingerprint'],
+                                        secret=key.private))
             doc.set_json(key.get_json())
             self._soledad.put_doc(doc)
 
-- 
cgit v1.2.3


From c223cca848e854d0015314ef517a6a4f928a2d0a Mon Sep 17 00:00:00 2001
From: Ruben Pollan <meskio@sindominio.net>
Date: Tue, 4 Nov 2014 11:53:56 -0600
Subject: Use datetime for key expiration

---
 src/leap/keymanager/openpgp.py | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

(limited to 'src/leap/keymanager/openpgp.py')

diff --git a/src/leap/keymanager/openpgp.py b/src/leap/keymanager/openpgp.py
index f86b35d..d3c305e 100644
--- a/src/leap/keymanager/openpgp.py
+++ b/src/leap/keymanager/openpgp.py
@@ -25,6 +25,7 @@ import tempfile
 import io
 
 
+from datetime import datetime
 from gnupg import GPG
 from gnupg.gnupg import GPGUtilities
 
@@ -178,6 +179,10 @@ def _build_key_from_gpg(address, key, key_data):
     :return: An instance of the key.
     :rtype: OpenPGPKey
     """
+    expiry_date = None
+    if key['expires']:
+        expiry_date = datetime.fromtimestamp(int(key['expires']))
+
     return OpenPGPKey(
         address,
         key_id=key['keyid'],
@@ -185,7 +190,7 @@ def _build_key_from_gpg(address, key, key_data):
         key_data=key_data,
         private=True if key['type'] == 'sec' else False,
         length=key['length'],
-        expiry_date=key['expires'],
+        expiry_date=expiry_date,
         validation=ValidationLevel.Weak_Chain,
     )
 
-- 
cgit v1.2.3


From d1e0322d8c12dfb1511ad0895c5fc1e0271b8a30 Mon Sep 17 00:00:00 2001
From: Ruben Pollan <meskio@sindominio.net>
Date: Thu, 6 Nov 2014 00:47:32 -0600
Subject: Implement the new encryption-key soledad document

---
 src/leap/keymanager/openpgp.py | 22 ++++++++++------------
 1 file changed, 10 insertions(+), 12 deletions(-)

(limited to 'src/leap/keymanager/openpgp.py')

diff --git a/src/leap/keymanager/openpgp.py b/src/leap/keymanager/openpgp.py
index d3c305e..1160434 100644
--- a/src/leap/keymanager/openpgp.py
+++ b/src/leap/keymanager/openpgp.py
@@ -41,7 +41,6 @@ from leap.keymanager.keys import (
     KEY_FINGERPRINT_KEY,
     KEY_DATA_KEY,
 )
-from leap.keymanager.validation import ValidationLevel
 
 
 logger = logging.getLogger(__name__)
@@ -109,9 +108,9 @@ class TempGPGWrapper(object):
         # itself is enough to also have the public key in the keyring,
         # and we want to count the keys afterwards.
 
-        privaddrs = map(lambda privkey: privkey.address, privkeys)
+        privaddrs = map(lambda privkey: privkey.address[0], privkeys)
         publkeys = filter(
-            lambda pubkey: pubkey.address not in privaddrs, publkeys)
+            lambda pubkey: pubkey.address[0] not in privaddrs, publkeys)
 
         listkeys = lambda: self._gpg.list_keys()
         listsecretkeys = lambda: self._gpg.list_keys(secret=True)
@@ -184,14 +183,14 @@ def _build_key_from_gpg(address, key, key_data):
         expiry_date = datetime.fromtimestamp(int(key['expires']))
 
     return OpenPGPKey(
-        address,
+        [address],
         key_id=key['keyid'],
         fingerprint=key['fingerprint'],
         key_data=key_data,
         private=True if key['type'] == 'sec' else False,
-        length=key['length'],
+        length=int(key['length']),
         expiry_date=expiry_date,
-        validation=ValidationLevel.Weak_Chain,
+        refreshed_at=datetime.now(),
     )
 
 
@@ -397,7 +396,7 @@ class OpenPGPScheme(EncryptionScheme):
         :param key: The key to be stored.
         :type key: OpenPGPKey
         """
-        doc = self._get_key_doc(key.address, private=key.private)
+        doc = self._get_key_doc(key.address[0], private=key.private)
         if doc is None:
             self._soledad.create_doc_from_json(key.get_json())
         else:
@@ -408,7 +407,7 @@ class OpenPGPScheme(EncryptionScheme):
                     gpg.import_keys(key.key_data)
                     gpgkey = gpg.list_keys(secret=key.private).pop()
                     key = _build_key_from_gpg(
-                        key.address, gpgkey,
+                        key.address[0], gpgkey,
                         gpg.export_keys(gpgkey['fingerprint'],
                                         secret=key.private))
             doc.set_json(key.get_json())
@@ -452,12 +451,11 @@ class OpenPGPScheme(EncryptionScheme):
         :type key: EncryptionKey
         """
         leap_assert_type(key, OpenPGPKey)
-        stored_key = self.get_key(key.address, private=key.private)
-        if stored_key is None:
+        doc = self._get_key_doc(key.address[0], key.private)
+        if doc is None:
             raise errors.KeyNotFound(key)
-        if stored_key.__dict__ != key.__dict__:
+        if doc.content[KEY_FINGERPRINT_KEY] != key.fingerprint:
             raise errors.KeyAttributesDiffer(key)
-        doc = self._get_key_doc(key.address, key.private)
         self._soledad.delete_doc(doc)
 
     #
-- 
cgit v1.2.3


From 22a16674ce6891de5ea0a9cbea38ddabc9dd6e06 Mon Sep 17 00:00:00 2001
From: Ruben Pollan <meskio@sindominio.net>
Date: Mon, 10 Nov 2014 09:50:56 -0600
Subject: Use type instead of tags to get docs in openpgp

For that that now the type is the class.__name__ instead of
str(class)
---
 src/leap/keymanager/openpgp.py | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

(limited to 'src/leap/keymanager/openpgp.py')

diff --git a/src/leap/keymanager/openpgp.py b/src/leap/keymanager/openpgp.py
index 1160434..38db178 100644
--- a/src/leap/keymanager/openpgp.py
+++ b/src/leap/keymanager/openpgp.py
@@ -36,8 +36,7 @@ from leap.keymanager.keys import (
     EncryptionScheme,
     is_address,
     build_key_from_dict,
-    KEYMANAGER_KEY_TAG,
-    TAGS_ADDRESS_PRIVATE_INDEX,
+    TYPE_ADDRESS_PRIVATE_INDEX,
     KEY_FINGERPRINT_KEY,
     KEY_DATA_KEY,
 )
@@ -210,6 +209,9 @@ class OpenPGPScheme(EncryptionScheme):
     signing and verification).
     """
 
+    # type used on the soledad documents
+    OPENPGP_KEY_TYPE = OpenPGPKey.__name__
+
     def __init__(self, soledad, gpgbinary=None):
         """
         Initialize the OpenPGP wrapper.
@@ -427,8 +429,8 @@ class OpenPGPScheme(EncryptionScheme):
         :rtype: leap.soledad.document.SoledadDocument
         """
         doclist = self._soledad.get_from_index(
-            TAGS_ADDRESS_PRIVATE_INDEX,
-            KEYMANAGER_KEY_TAG,
+            TYPE_ADDRESS_PRIVATE_INDEX,
+            self.OPENPGP_KEY_TYPE,
             address,
             '1' if private else '0')
         if len(doclist) is 0:
-- 
cgit v1.2.3


From 94251a4689d13ef34786334d9f47ce2c9cc6b200 Mon Sep 17 00:00:00 2001
From: Ruben Pollan <meskio@sindominio.net>
Date: Mon, 10 Nov 2014 13:36:35 -0600
Subject: Implement active key document

---
 src/leap/keymanager/openpgp.py | 146 ++++++++++++++++++++++++++++++++++-------
 1 file changed, 122 insertions(+), 24 deletions(-)

(limited to 'src/leap/keymanager/openpgp.py')

diff --git a/src/leap/keymanager/openpgp.py b/src/leap/keymanager/openpgp.py
index 38db178..52655d0 100644
--- a/src/leap/keymanager/openpgp.py
+++ b/src/leap/keymanager/openpgp.py
@@ -36,9 +36,12 @@ from leap.keymanager.keys import (
     EncryptionScheme,
     is_address,
     build_key_from_dict,
+    TYPE_ID_PRIVATE_INDEX,
     TYPE_ADDRESS_PRIVATE_INDEX,
     KEY_FINGERPRINT_KEY,
     KEY_DATA_KEY,
+    KEY_ID_KEY,
+    KEYMANAGER_ACTIVE_TYPE,
 )
 
 
@@ -193,6 +196,18 @@ def _build_key_from_gpg(address, key, key_data):
     )
 
 
+def _parse_address(address):
+    """
+    Remove the identity suffix after the '+' until the '@'
+    e.g.: test_user+something@provider.com becomes test_user@provider.com
+    since the key belongs to the identity without the '+' suffix.
+
+    :type address: str
+    :rtype: str
+    """
+    return re.sub(r'\+.*\@', '@', address)
+
+
 #
 # The OpenPGP wrapper
 #
@@ -210,7 +225,8 @@ class OpenPGPScheme(EncryptionScheme):
     """
 
     # type used on the soledad documents
-    OPENPGP_KEY_TYPE = OpenPGPKey.__name__
+    KEY_TYPE = OpenPGPKey.__name__
+    ACTIVE_TYPE = KEY_TYPE + KEYMANAGER_ACTIVE_TYPE
 
     def __init__(self, soledad, gpgbinary=None):
         """
@@ -282,7 +298,7 @@ class OpenPGPScheme(EncryptionScheme):
                 openpgp_key = _build_key_from_gpg(
                     address, key,
                     gpg.export_keys(key['fingerprint'], secret=secret))
-                self.put_key(openpgp_key)
+                self.put_key(openpgp_key, address)
 
         return self.get_key(address, private=True)
 
@@ -299,10 +315,7 @@ class OpenPGPScheme(EncryptionScheme):
         :rtype: OpenPGPKey
         @raise KeyNotFound: If the key was not found on local storage.
         """
-        # Remove the identity suffix after the '+' until the '@'
-        # e.g.: test_user+something@provider.com becomes test_user@provider.com
-        # since the key belongs to the identity without the '+' suffix.
-        address = re.sub(r'\+.*\@', '@', address)
+        address = _parse_address(address)
 
         doc = self._get_key_doc(address, private)
         if doc is None:
@@ -371,12 +384,15 @@ class OpenPGPScheme(EncryptionScheme):
 
             return (openpgp_pubkey, openpgp_privkey)
 
-    def put_ascii_key(self, key_data):
+    def put_ascii_key(self, key_data, address=None):
         """
         Put key contained in ascii-armored C{key_data} in local storage.
 
         :param key_data: The key data to be stored.
         :type key_data: str or unicode
+        :param address: address for which this key will be active. If not set
+                        all the uids will be activated
+        :type address: str
         """
         leap_assert_type(key_data, (str, unicode))
 
@@ -387,21 +403,41 @@ class OpenPGPScheme(EncryptionScheme):
             leap_assert(False, repr(e))
 
         if openpgp_pubkey is not None:
-            self.put_key(openpgp_pubkey)
+            self.put_key(openpgp_pubkey, address)
         if openpgp_privkey is not None:
-            self.put_key(openpgp_privkey)
+            self.put_key(openpgp_privkey, address)
 
-    def put_key(self, key):
+    def put_key(self, key, address=None):
         """
         Put C{key} in local storage.
 
         :param key: The key to be stored.
         :type key: OpenPGPKey
+        :param address: address for which this key will be active. If not set
+                        all the uids will be activated
+        :type address: str
         """
-        doc = self._get_key_doc(key.address[0], private=key.private)
-        if doc is None:
-            self._soledad.create_doc_from_json(key.get_json())
+        if address is not None:
+            active_address = [_parse_address(address)]
         else:
+            active_address = key.address
+
+        self._put_key_doc(key)
+        self._put_active_doc(key, active_address)
+
+    def _put_key_doc(self, key):
+        """
+        Put key document in soledad
+
+        :type key: OpenPGPKey
+        """
+        docs = self._soledad.get_from_index(
+            TYPE_ID_PRIVATE_INDEX,
+            self.KEY_TYPE,
+            key.key_id,
+            '1' if key.private else '0')
+        if len(docs) != 0:
+            doc = docs.pop()
             if key.fingerprint == doc.content[KEY_FINGERPRINT_KEY]:
                 # in case of an update of the key merge them with gnupg
                 with self._temporary_gpgwrapper() as gpg:
@@ -412,8 +448,41 @@ class OpenPGPScheme(EncryptionScheme):
                         key.address[0], gpgkey,
                         gpg.export_keys(gpgkey['fingerprint'],
                                         secret=key.private))
-            doc.set_json(key.get_json())
-            self._soledad.put_doc(doc)
+                doc.set_json(key.get_json())
+                self._soledad.put_doc(doc)
+            else:
+                logger.critical(
+                    "Can't put a key whith the same key_id and different "
+                    "fingerprint: %s, %s"
+                    % (key.fingerprint, doc.content[KEY_FINGERPRINT_KEY]))
+        else:
+            self._soledad.create_doc_from_json(key.get_json())
+
+    def _put_active_doc(self, key, addresses):
+        """
+        Put active key document in soledad
+
+        :type key: OpenPGPKey
+        :type addresses: list(str)
+        """
+        for address in addresses:
+            docs = self._soledad.get_from_index(
+                TYPE_ADDRESS_PRIVATE_INDEX,
+                self.ACTIVE_TYPE,
+                address,
+                '1' if key.private else '0')
+            if len(docs) == 1:
+                doc = docs.pop()
+                doc.set_json(key.get_active_json(address))
+                self._soledad.put_doc(doc)
+            else:
+                if len(docs) > 1:
+                    logger.error("There is more than one active key document "
+                                 "for the address %s" % (address,))
+                    for doc in docs:
+                        self._soledad.delete_doc(doc)
+                self._soledad.create_doc_from_json(
+                    key.get_active_json(address))
 
     def _get_key_doc(self, address, private=False):
         """
@@ -428,17 +497,26 @@ class OpenPGPScheme(EncryptionScheme):
         :return: The document with the key or None if it does not exist.
         :rtype: leap.soledad.document.SoledadDocument
         """
-        doclist = self._soledad.get_from_index(
+        activedoc = self._soledad.get_from_index(
             TYPE_ADDRESS_PRIVATE_INDEX,
-            self.OPENPGP_KEY_TYPE,
+            self.ACTIVE_TYPE,
             address,
             '1' if private else '0')
-        if len(doclist) is 0:
+        if len(activedoc) is 0:
             return None
+        leap_assert(
+            len(activedoc) is 1,
+            'Found more than one key for address %s!' % (address,))
+
+        key_id = activedoc[0].content[KEY_ID_KEY]
+        doclist = self._soledad.get_from_index(
+            TYPE_ID_PRIVATE_INDEX,
+            self.KEY_TYPE,
+            key_id,
+            '1' if private else '0')
         leap_assert(
             len(doclist) is 1,
-            'Found more than one %s key for address!' %
-            'private' if private else 'public')
+            'There is %d keys for id %s!' % (len(doclist), key_id))
         return doclist.pop()
 
     def delete_key(self, key):
@@ -447,17 +525,37 @@ class OpenPGPScheme(EncryptionScheme):
 
         May raise:
             errors.KeyNotFound
-            errors.KeyAttributesDiffer
 
         :param key: The key to be removed.
         :type key: EncryptionKey
         """
         leap_assert_type(key, OpenPGPKey)
-        doc = self._get_key_doc(key.address[0], key.private)
+        activedocs = self._soledad.get_from_index(
+            TYPE_ID_PRIVATE_INDEX,
+            self.ACTIVE_TYPE,
+            key.key_id,
+            '1' if key.private else '0')
+        for doc in activedocs:
+            self._soledad.delete_doc(doc)
+
+        docs = self._soledad.get_from_index(
+            TYPE_ID_PRIVATE_INDEX,
+            self.KEY_TYPE,
+            key.key_id,
+            '1' if key.private else '0')
+        if len(docs) == 0:
+            raise errors.KeyNotFound(key)
+        if len(docs) > 1:
+            logger.critical("There is more than one key for key_id %s"
+                            % key.key_id)
+
+        doc = None
+        for d in docs:
+            if d.content['fingerprint'] == key.fingerprint:
+                doc = d
+                break
         if doc is None:
             raise errors.KeyNotFound(key)
-        if doc.content[KEY_FINGERPRINT_KEY] != key.fingerprint:
-            raise errors.KeyAttributesDiffer(key)
         self._soledad.delete_doc(doc)
 
     #
-- 
cgit v1.2.3


From f07d407523e6b76076824fa53e4c3568bc88764f Mon Sep 17 00:00:00 2001
From: Ruben Pollan <meskio@sindominio.net>
Date: Mon, 10 Nov 2014 18:36:59 -0600
Subject: Implement multi uid support

---
 src/leap/keymanager/openpgp.py | 120 +++++++++++++++++++----------------------
 1 file changed, 54 insertions(+), 66 deletions(-)

(limited to 'src/leap/keymanager/openpgp.py')

diff --git a/src/leap/keymanager/openpgp.py b/src/leap/keymanager/openpgp.py
index 52655d0..4f96574 100644
--- a/src/leap/keymanager/openpgp.py
+++ b/src/leap/keymanager/openpgp.py
@@ -38,6 +38,7 @@ from leap.keymanager.keys import (
     build_key_from_dict,
     TYPE_ID_PRIVATE_INDEX,
     TYPE_ADDRESS_PRIVATE_INDEX,
+    KEY_ADDRESS_KEY,
     KEY_FINGERPRINT_KEY,
     KEY_DATA_KEY,
     KEY_ID_KEY,
@@ -110,9 +111,9 @@ class TempGPGWrapper(object):
         # itself is enough to also have the public key in the keyring,
         # and we want to count the keys afterwards.
 
-        privaddrs = map(lambda privkey: privkey.address[0], privkeys)
+        privids = map(lambda privkey: privkey.key_id, privkeys)
         publkeys = filter(
-            lambda pubkey: pubkey.address[0] not in privaddrs, publkeys)
+            lambda pubkey: pubkey.key_id not in privids, publkeys)
 
         listkeys = lambda: self._gpg.list_keys()
         listsecretkeys = lambda: self._gpg.list_keys(secret=True)
@@ -163,16 +164,13 @@ class TempGPGWrapper(object):
             shutil.rmtree(self._gpg.homedir)
 
 
-def _build_key_from_gpg(address, key, key_data):
+def _build_key_from_gpg(key, key_data):
     """
-    Build an OpenPGPKey for C{address} based on C{key} from
-    local gpg storage.
+    Build an OpenPGPKey based on C{key} from local gpg storage.
 
     ASCII armored GPG key data has to be queried independently in this
     wrapper, so we receive it in C{key_data}.
 
-    :param address: The address bound to the key.
-    :type address: str
     :param key: Key obtained from GPG storage.
     :type key: dict
     :param key_data: Key data obtained from GPG storage.
@@ -183,9 +181,12 @@ def _build_key_from_gpg(address, key, key_data):
     expiry_date = None
     if key['expires']:
         expiry_date = datetime.fromtimestamp(int(key['expires']))
+    address = []
+    for uid in key['uids']:
+        address.append(_parse_address(uid))
 
     return OpenPGPKey(
-        [address],
+        address,
         key_id=key['keyid'],
         fingerprint=key['fingerprint'],
         key_data=key_data,
@@ -198,14 +199,18 @@ def _build_key_from_gpg(address, key, key_data):
 
 def _parse_address(address):
     """
-    Remove the identity suffix after the '+' until the '@'
+    Remove name, '<', '>' and the identity suffix after the '+' until the '@'
     e.g.: test_user+something@provider.com becomes test_user@provider.com
     since the key belongs to the identity without the '+' suffix.
 
     :type address: str
     :rtype: str
     """
-    return re.sub(r'\+.*\@', '@', address)
+    mail_regex = '(.*<)?([\w.-]+)(\+.*)?(@[\w.-]+)(>.*)?'
+    match = re.match(mail_regex, address)
+    if match is None:
+        return None
+    return ''.join(match.group(2, 4))
 
 
 #
@@ -289,15 +294,17 @@ class OpenPGPScheme(EncryptionScheme):
             leap_assert(
                 len(key['uids']) is 1,  # with just one uid!
                 'Wrong number of uids for key: %d.' % len(key['uids']))
-            leap_assert(
-                re.match('.*<%s>$' % address, key['uids'][0]) is not None,
-                'Key not correctly bound to address.')
+            uid_match = False
+            for uid in key['uids']:
+                if re.match('.*<%s>$' % address, uid) is not None:
+                    uid_match = True
+                    return
+            leap_assert(uid_match, 'Key not correctly bound to address.')
             # insert both public and private keys in storage
             for secret in [True, False]:
                 key = gpg.list_keys(secret=secret).pop()
                 openpgp_key = _build_key_from_gpg(
-                    address, key,
-                    gpg.export_keys(key['fingerprint'], secret=secret))
+                    key, gpg.export_keys(key['fingerprint'], secret=secret))
                 self.put_key(openpgp_key, address)
 
         return self.get_key(address, private=True)
@@ -320,7 +327,10 @@ class OpenPGPScheme(EncryptionScheme):
         doc = self._get_key_doc(address, private)
         if doc is None:
             raise errors.KeyNotFound(address)
-        return build_key_from_dict(OpenPGPKey, address, doc.content)
+        leap_assert(
+            address in doc.content[KEY_ADDRESS_KEY],
+            'Wrong address in key data.')
+        return build_key_from_dict(OpenPGPKey, doc.content)
 
     def parse_ascii_key(self, key_data):
         """
@@ -337,7 +347,6 @@ class OpenPGPScheme(EncryptionScheme):
         leap_assert_type(key_data, (str, unicode))
         # TODO: add more checks for correct key data.
         leap_assert(key_data is not None, 'Data does not represent a key.')
-        mail_regex = '.*<([\w.-]+@[\w.-]+)>.*'
 
         with self._temporary_gpgwrapper() as gpg:
             # TODO: inspect result, or use decorator
@@ -354,44 +363,30 @@ class OpenPGPScheme(EncryptionScheme):
             except IndexError:
                 return (None, None)
 
-            # extract adress from first uid on key
-            match = re.match(mail_regex, pubkey['uids'].pop())
-            leap_assert(match is not None, 'No user address in key data.')
-            address = match.group(1)
-
             openpgp_privkey = None
             if privkey is not None:
-                match = re.match(mail_regex, privkey['uids'].pop())
-                leap_assert(match is not None, 'No user address in key data.')
-                privaddress = match.group(1)
-
                 # build private key
                 openpgp_privkey = _build_key_from_gpg(
-                    privaddress, privkey,
+                    privkey,
                     gpg.export_keys(privkey['fingerprint'], secret=True))
-
-                leap_check(address == privaddress,
-                           'Addresses in public and private key differ.',
-                           errors.KeyAddressMismatch)
                 leap_check(pubkey['fingerprint'] == privkey['fingerprint'],
                            'Fingerprints for public and private key differ.',
                            errors.KeyFingerprintMismatch)
 
             # build public key
             openpgp_pubkey = _build_key_from_gpg(
-                address, pubkey,
+                pubkey,
                 gpg.export_keys(pubkey['fingerprint'], secret=False))
 
             return (openpgp_pubkey, openpgp_privkey)
 
-    def put_ascii_key(self, key_data, address=None):
+    def put_ascii_key(self, key_data, address):
         """
         Put key contained in ascii-armored C{key_data} in local storage.
 
         :param key_data: The key data to be stored.
         :type key_data: str or unicode
-        :param address: address for which this key will be active. If not set
-                        all the uids will be activated
+        :param address: address for which this key will be active
         :type address: str
         """
         leap_assert_type(key_data, (str, unicode))
@@ -407,23 +402,17 @@ class OpenPGPScheme(EncryptionScheme):
         if openpgp_privkey is not None:
             self.put_key(openpgp_privkey, address)
 
-    def put_key(self, key, address=None):
+    def put_key(self, key, address):
         """
         Put C{key} in local storage.
 
         :param key: The key to be stored.
         :type key: OpenPGPKey
-        :param address: address for which this key will be active. If not set
-                        all the uids will be activated
+        :param address: address for which this key will be active.
         :type address: str
         """
-        if address is not None:
-            active_address = [_parse_address(address)]
-        else:
-            active_address = key.address
-
         self._put_key_doc(key)
-        self._put_active_doc(key, active_address)
+        self._put_active_doc(key, address)
 
     def _put_key_doc(self, key):
         """
@@ -445,7 +434,7 @@ class OpenPGPScheme(EncryptionScheme):
                     gpg.import_keys(key.key_data)
                     gpgkey = gpg.list_keys(secret=key.private).pop()
                     key = _build_key_from_gpg(
-                        key.address[0], gpgkey,
+                        gpgkey,
                         gpg.export_keys(gpgkey['fingerprint'],
                                         secret=key.private))
                 doc.set_json(key.get_json())
@@ -458,31 +447,30 @@ class OpenPGPScheme(EncryptionScheme):
         else:
             self._soledad.create_doc_from_json(key.get_json())
 
-    def _put_active_doc(self, key, addresses):
+    def _put_active_doc(self, key, address):
         """
         Put active key document in soledad
 
         :type key: OpenPGPKey
-        :type addresses: list(str)
-        """
-        for address in addresses:
-            docs = self._soledad.get_from_index(
-                TYPE_ADDRESS_PRIVATE_INDEX,
-                self.ACTIVE_TYPE,
-                address,
-                '1' if key.private else '0')
-            if len(docs) == 1:
-                doc = docs.pop()
-                doc.set_json(key.get_active_json(address))
-                self._soledad.put_doc(doc)
-            else:
-                if len(docs) > 1:
-                    logger.error("There is more than one active key document "
-                                 "for the address %s" % (address,))
-                    for doc in docs:
-                        self._soledad.delete_doc(doc)
-                self._soledad.create_doc_from_json(
-                    key.get_active_json(address))
+        :type addresses: str
+        """
+        docs = self._soledad.get_from_index(
+            TYPE_ADDRESS_PRIVATE_INDEX,
+            self.ACTIVE_TYPE,
+            address,
+            '1' if key.private else '0')
+        if len(docs) == 1:
+            doc = docs.pop()
+            doc.set_json(key.get_active_json(address))
+            self._soledad.put_doc(doc)
+        else:
+            if len(docs) > 1:
+                logger.error("There is more than one active key document "
+                             "for the address %s" % (address,))
+                for doc in docs:
+                    self._soledad.delete_doc(doc)
+            self._soledad.create_doc_from_json(
+                key.get_active_json(address))
 
     def _get_key_doc(self, address, private=False):
         """
-- 
cgit v1.2.3


From 2f29739946db6cd360296639830a3bfe7d8c3f31 Mon Sep 17 00:00:00 2001
From: Ruben Pollan <meskio@sindominio.net>
Date: Mon, 10 Nov 2014 19:00:04 -0600
Subject: Fix comments

---
 src/leap/keymanager/openpgp.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'src/leap/keymanager/openpgp.py')

diff --git a/src/leap/keymanager/openpgp.py b/src/leap/keymanager/openpgp.py
index 4f96574..3f298f7 100644
--- a/src/leap/keymanager/openpgp.py
+++ b/src/leap/keymanager/openpgp.py
@@ -742,8 +742,8 @@ class OpenPGPScheme(EncryptionScheme):
                              verified against this detached signature.
         :type detached_sig: str
 
-        :return: The ascii-armored signed data.
-        :rtype: str
+        :return: signature matches
+        :rtype: bool
         """
         leap_assert_type(pubkey, OpenPGPKey)
         leap_assert(pubkey.private is False)
-- 
cgit v1.2.3


From 9774f9b185118e77ee1c59cf3e9eecc0e43e6030 Mon Sep 17 00:00:00 2001
From: Ruben Pollan <meskio@sindominio.net>
Date: Thu, 20 Nov 2014 10:56:21 -0600
Subject: Return signing key on signature verification

Don't throw an exception if verification fails
---
 src/leap/keymanager/openpgp.py | 27 ++++++++++-----------------
 1 file changed, 10 insertions(+), 17 deletions(-)

(limited to 'src/leap/keymanager/openpgp.py')

diff --git a/src/leap/keymanager/openpgp.py b/src/leap/keymanager/openpgp.py
index 3f298f7..1d1de98 100644
--- a/src/leap/keymanager/openpgp.py
+++ b/src/leap/keymanager/openpgp.py
@@ -640,12 +640,10 @@ class OpenPGPScheme(EncryptionScheme):
         :param verify: The key used to verify a signature.
         :type verify: OpenPGPKey
 
-        :return: The decrypted data.
-        :rtype: unicode
+        :return: The decrypted data and if signature verifies
+        :rtype: (unicode, bool)
 
         :raise DecryptError: Raised if failed decrypting for some reason.
-        :raise InvalidSignature: Raised if unable to verify the signature with
-                                 C{verify} key.
         """
         leap_assert(privkey.private is True, 'Key is not private.')
         keys = [privkey]
@@ -658,15 +656,15 @@ class OpenPGPScheme(EncryptionScheme):
                 result = gpg.decrypt(
                     data, passphrase=passphrase, always_trust=True)
                 self._assert_gpg_result_ok(result)
+
                 # verify signature
-                if (verify is not None):
-                    if result.valid is False or \
-                            verify.fingerprint != result.pubkey_fingerprint:
-                        raise errors.InvalidSignature(
-                            'Failed to verify signature with key %s: %s' %
-                            (verify.key_id, result.stderr))
+                sign_valid = False
+                if (verify is not None and
+                        result.valid is True and
+                        verify.fingerprint == result.pubkey_fingerprint):
+                    sign_valid = True
 
-                return result.data
+                return (result.data, sign_valid)
             except errors.GPGError as e:
                 logger.error('Failed to decrypt: %s.' % str(e))
                 raise errors.DecryptError(str(e))
@@ -764,9 +762,4 @@ class OpenPGPScheme(EncryptionScheme):
             valid = result.valid
             rfprint = result.fingerprint
             kfprint = gpgpubkey['fingerprint']
-            # raise in case sig is invalid
-            if valid is False or rfprint != kfprint:
-                raise errors.InvalidSignature(
-                    'Failed to verify signature '
-                    'with key %s.' % gpgpubkey['keyid'])
-            return True
+            return valid and rfprint == kfprint
-- 
cgit v1.2.3


From 7bd310c0b67c337f4a13ffac631a2068c57e9740 Mon Sep 17 00:00:00 2001
From: Ruben Pollan <meskio@sindominio.net>
Date: Fri, 28 Nov 2014 10:37:00 -0600
Subject: Port to soledad new async API

---
 src/leap/keymanager/openpgp.py | 366 +++++++++++++++++++++++++----------------
 1 file changed, 222 insertions(+), 144 deletions(-)

(limited to 'src/leap/keymanager/openpgp.py')

diff --git a/src/leap/keymanager/openpgp.py b/src/leap/keymanager/openpgp.py
index 1d1de98..f81fb0a 100644
--- a/src/leap/keymanager/openpgp.py
+++ b/src/leap/keymanager/openpgp.py
@@ -28,6 +28,7 @@ import io
 from datetime import datetime
 from gnupg import GPG
 from gnupg.gnupg import GPGUtilities
+from twisted.internet import defer
 
 from leap.common.check import leap_assert, leap_assert_type, leap_check
 from leap.keymanager import errors
@@ -243,6 +244,7 @@ class OpenPGPScheme(EncryptionScheme):
         :type gpgbinary: C{str}
         """
         EncryptionScheme.__init__(self, soledad)
+        self._wait_indexes("get_key", "put_key")
         self._gpgbinary = gpgbinary
 
     #
@@ -255,59 +257,67 @@ class OpenPGPScheme(EncryptionScheme):
 
         :param address: The address bound to the key.
         :type address: str
-        :return: The key bound to C{address}.
-        :rtype: OpenPGPKey
-        @raise KeyAlreadyExists: If key already exists in local database.
+
+        :return: A Deferred which fires with the key bound to address, or fails
+                 with KeyAlreadyExists if key already exists in local database.
+        :rtype: Deferred
         """
         # make sure the key does not already exist
         leap_assert(is_address(address), 'Not an user address: %s' % address)
-        try:
-            self.get_key(address)
-            raise errors.KeyAlreadyExists(address)
-        except errors.KeyNotFound:
-            logger.debug('Key for %s not found' % (address,))
-
-        with self._temporary_gpgwrapper() as gpg:
-            # TODO: inspect result, or use decorator
-            params = gpg.gen_key_input(
-                key_type='RSA',
-                key_length=4096,
-                name_real=address,
-                name_email=address,
-                name_comment='')
-            logger.info("About to generate keys... This might take SOME time.")
-            gpg.gen_key(params)
-            logger.info("Keys for %s have been successfully "
-                        "generated." % (address,))
-            pubkeys = gpg.list_keys()
-
-            # assert for new key characteristics
-
-            # XXX This exception is not properly catched by the soledad
-            # bootstrapping, so if we do not finish generating the keys
-            # we end with a blocked thread -- kali
 
-            leap_assert(
-                len(pubkeys) is 1,  # a unitary keyring!
-                'Keyring has wrong number of keys: %d.' % len(pubkeys))
-            key = gpg.list_keys(secret=True).pop()
-            leap_assert(
-                len(key['uids']) is 1,  # with just one uid!
-                'Wrong number of uids for key: %d.' % len(key['uids']))
-            uid_match = False
-            for uid in key['uids']:
-                if re.match('.*<%s>$' % address, uid) is not None:
-                    uid_match = True
-                    return
-            leap_assert(uid_match, 'Key not correctly bound to address.')
-            # insert both public and private keys in storage
-            for secret in [True, False]:
-                key = gpg.list_keys(secret=secret).pop()
-                openpgp_key = _build_key_from_gpg(
-                    key, gpg.export_keys(key['fingerprint'], secret=secret))
-                self.put_key(openpgp_key, address)
+        def _gen_key(_):
+            with self._temporary_gpgwrapper() as gpg:
+                # TODO: inspect result, or use decorator
+                params = gpg.gen_key_input(
+                    key_type='RSA',
+                    key_length=4096,
+                    name_real=address,
+                    name_email=address,
+                    name_comment='')
+                logger.info("About to generate keys... "
+                            "This might take SOME time.")
+                gpg.gen_key(params)
+                logger.info("Keys for %s have been successfully "
+                            "generated." % (address,))
+                pubkeys = gpg.list_keys()
+
+                # assert for new key characteristics
+
+                # XXX This exception is not properly catched by the soledad
+                # bootstrapping, so if we do not finish generating the keys
+                # we end with a blocked thread -- kali
+
+                leap_assert(
+                    len(pubkeys) is 1,  # a unitary keyring!
+                    'Keyring has wrong number of keys: %d.' % len(pubkeys))
+                key = gpg.list_keys(secret=True).pop()
+                leap_assert(
+                    len(key['uids']) is 1,  # with just one uid!
+                    'Wrong number of uids for key: %d.' % len(key['uids']))
+                uid_match = False
+                for uid in key['uids']:
+                    if re.match('.*<%s>$' % address, uid) is not None:
+                        uid_match = True
+                        return
+                leap_assert(uid_match, 'Key not correctly bound to address.')
+                # insert both public and private keys in storage
+                deferreds = []
+                for secret in [True, False]:
+                    key = gpg.list_keys(secret=secret).pop()
+                    openpgp_key = _build_key_from_gpg(
+                        key,
+                        gpg.export_keys(key['fingerprint'], secret=secret))
+                    d = self.put_key(openpgp_key, address)
+                    deferreds.append(d)
+                return defer.gatherResults(deferreds)
+
+        def key_already_exists(_):
+            raise errors.KeyAlreadyExists(address)
 
-        return self.get_key(address, private=True)
+        d = self.get_key(address)
+        d.addCallbacks(key_already_exists, _gen_key)
+        d.addCallback(lambda _: self.get_key(address, private=True))
+        return d
 
     def get_key(self, address, private=False):
         """
@@ -318,19 +328,24 @@ class OpenPGPScheme(EncryptionScheme):
         :param private: Look for a private key instead of a public one?
         :type private: bool
 
-        :return: The key bound to C{address}.
-        :rtype: OpenPGPKey
-        @raise KeyNotFound: If the key was not found on local storage.
+        :return: A Deferred which fires with the OpenPGPKey bound to address,
+                 or which fails with KeyNotFound if the key was not found on
+                 local storage.
+        :rtype: Deferred
         """
         address = _parse_address(address)
 
-        doc = self._get_key_doc(address, private)
-        if doc is None:
-            raise errors.KeyNotFound(address)
-        leap_assert(
-            address in doc.content[KEY_ADDRESS_KEY],
-            'Wrong address in key data.')
-        return build_key_from_dict(OpenPGPKey, doc.content)
+        def build_key(doc):
+            if doc is None:
+                raise errors.KeyNotFound(address)
+            leap_assert(
+                address in doc.content[KEY_ADDRESS_KEY],
+                'Wrong address in key data.')
+            return build_key_from_dict(OpenPGPKey, doc.content)
+
+        d = self._get_key_doc(address, private)
+        d.addCallback(build_key)
+        return d
 
     def parse_ascii_key(self, key_data):
         """
@@ -388,6 +403,9 @@ class OpenPGPScheme(EncryptionScheme):
         :type key_data: str or unicode
         :param address: address for which this key will be active
         :type address: str
+
+        :return: A Deferred which fires when the OpenPGPKey is in the storage.
+        :rtype: Deferred
         """
         leap_assert_type(key_data, (str, unicode))
 
@@ -395,12 +413,17 @@ class OpenPGPScheme(EncryptionScheme):
         try:
             openpgp_pubkey, openpgp_privkey = self.parse_ascii_key(key_data)
         except (errors.KeyAddressMismatch, errors.KeyFingerprintMismatch) as e:
-            leap_assert(False, repr(e))
+            return defer.fail(e)
 
+        def put_key(_, key):
+            return self.put_key(key, address)
+
+        d = defer.succeed(None)
         if openpgp_pubkey is not None:
-            self.put_key(openpgp_pubkey, address)
+            d.addCallback(put_key, openpgp_pubkey)
         if openpgp_privkey is not None:
-            self.put_key(openpgp_privkey, address)
+            d.addCallback(put_key, openpgp_privkey)
+        return d
 
     def put_key(self, key, address):
         """
@@ -410,42 +433,59 @@ class OpenPGPScheme(EncryptionScheme):
         :type key: OpenPGPKey
         :param address: address for which this key will be active.
         :type address: str
+
+        :return: A Deferred which fires when the key is in the storage.
+        :rtype: Deferred
         """
-        self._put_key_doc(key)
-        self._put_active_doc(key, address)
+        d = self._put_key_doc(key)
+        d.addCallback(lambda _: self._put_active_doc(key, address))
+        return d
 
     def _put_key_doc(self, key):
         """
         Put key document in soledad
 
         :type key: OpenPGPKey
-        """
-        docs = self._soledad.get_from_index(
+        :rtype: Deferred
+        """
+        def check_and_put(docs, key):
+            if len(docs) == 1:
+                doc = docs.pop()
+                if key.fingerprint == doc.content[KEY_FINGERPRINT_KEY]:
+                    # in case of an update of the key merge them with gnupg
+                    with self._temporary_gpgwrapper() as gpg:
+                        gpg.import_keys(doc.content[KEY_DATA_KEY])
+                        gpg.import_keys(key.key_data)
+                        gpgkey = gpg.list_keys(secret=key.private).pop()
+                        key = _build_key_from_gpg(
+                            gpgkey,
+                            gpg.export_keys(gpgkey['fingerprint'],
+                                            secret=key.private))
+                    doc.set_json(key.get_json())
+                    d = self._soledad.put_doc(doc)
+                else:
+                    logger.critical(
+                        "Can't put a key whith the same key_id and different "
+                        "fingerprint: %s, %s"
+                        % (key.fingerprint, doc.content[KEY_FINGERPRINT_KEY]))
+                    d = defer.fail(
+                        errors.KeyFingerprintMismatch(key.fingerprint))
+            elif len(docs) > 1:
+                logger.critical(
+                    "There is more than one key with the same key_id %s"
+                    % (key.key_id,))
+                d = defer.fail(errors.KeyAttributesDiffer(key.key_id))
+            else:
+                d = self._soledad.create_doc_from_json(key.get_json())
+            return d
+
+        d = self._soledad.get_from_index(
             TYPE_ID_PRIVATE_INDEX,
             self.KEY_TYPE,
             key.key_id,
             '1' if key.private else '0')
-        if len(docs) != 0:
-            doc = docs.pop()
-            if key.fingerprint == doc.content[KEY_FINGERPRINT_KEY]:
-                # in case of an update of the key merge them with gnupg
-                with self._temporary_gpgwrapper() as gpg:
-                    gpg.import_keys(doc.content[KEY_DATA_KEY])
-                    gpg.import_keys(key.key_data)
-                    gpgkey = gpg.list_keys(secret=key.private).pop()
-                    key = _build_key_from_gpg(
-                        gpgkey,
-                        gpg.export_keys(gpgkey['fingerprint'],
-                                        secret=key.private))
-                doc.set_json(key.get_json())
-                self._soledad.put_doc(doc)
-            else:
-                logger.critical(
-                    "Can't put a key whith the same key_id and different "
-                    "fingerprint: %s, %s"
-                    % (key.fingerprint, doc.content[KEY_FINGERPRINT_KEY]))
-        else:
-            self._soledad.create_doc_from_json(key.get_json())
+        d.addCallback(check_and_put, key)
+        return d
 
     def _put_active_doc(self, key, address):
         """
@@ -453,24 +493,37 @@ class OpenPGPScheme(EncryptionScheme):
 
         :type key: OpenPGPKey
         :type addresses: str
+        :rtype: Deferred
         """
-        docs = self._soledad.get_from_index(
+        def check_and_put(docs):
+            if len(docs) == 1:
+                doc = docs.pop()
+                doc.set_json(key.get_active_json(address))
+                d = self._soledad.put_doc(doc)
+            else:
+                if len(docs) > 1:
+                    logger.error("There is more than one active key document "
+                                 "for the address %s" % (address,))
+                    deferreds = []
+                    for doc in docs:
+                        delete = self._soledad.delete_doc(doc)
+                        deferreds.append(delete)
+                    d = defer.gatherResults(deferreds, consumeErrors=True)
+                else:
+                    d = defer.succeed(None)
+
+                d.addCallback(
+                    lambda _: self._soledad.create_doc_from_json(
+                        key.get_active_json(address)))
+            return d
+
+        d = self._soledad.get_from_index(
             TYPE_ADDRESS_PRIVATE_INDEX,
             self.ACTIVE_TYPE,
             address,
             '1' if key.private else '0')
-        if len(docs) == 1:
-            doc = docs.pop()
-            doc.set_json(key.get_active_json(address))
-            self._soledad.put_doc(doc)
-        else:
-            if len(docs) > 1:
-                logger.error("There is more than one active key document "
-                             "for the address %s" % (address,))
-                for doc in docs:
-                    self._soledad.delete_doc(doc)
-            self._soledad.create_doc_from_json(
-                key.get_active_json(address))
+        d.addCallback(check_and_put)
+        return d
 
     def _get_key_doc(self, address, private=False):
         """
@@ -482,69 +535,94 @@ class OpenPGPScheme(EncryptionScheme):
         :type address: str
         :param private: Whether to look for a private key.
         :type private: bool
-        :return: The document with the key or None if it does not exist.
-        :rtype: leap.soledad.document.SoledadDocument
+
+        :return: A Deferred which fires with the SoledadDocument with the key
+                 or None if it does not exist.
+        :rtype: Deferred
         """
-        activedoc = self._soledad.get_from_index(
+        def get_key_from_active_doc(activedoc):
+            if len(activedoc) is 0:
+                return None
+            leap_assert(
+                len(activedoc) is 1,
+                'Found more than one key for address %s!' % (address,))
+
+            key_id = activedoc[0].content[KEY_ID_KEY]
+            d = self._soledad.get_from_index(
+                TYPE_ID_PRIVATE_INDEX,
+                self.KEY_TYPE,
+                key_id,
+                '1' if private else '0')
+            d.addCallback(get_doc, key_id)
+            return d
+
+        def get_doc(doclist, key_id):
+            leap_assert(
+                len(doclist) is 1,
+                'There is %d keys for id %s!' % (len(doclist), key_id))
+            return doclist.pop()
+
+        d = self._soledad.get_from_index(
             TYPE_ADDRESS_PRIVATE_INDEX,
             self.ACTIVE_TYPE,
             address,
             '1' if private else '0')
-        if len(activedoc) is 0:
-            return None
-        leap_assert(
-            len(activedoc) is 1,
-            'Found more than one key for address %s!' % (address,))
-
-        key_id = activedoc[0].content[KEY_ID_KEY]
-        doclist = self._soledad.get_from_index(
-            TYPE_ID_PRIVATE_INDEX,
-            self.KEY_TYPE,
-            key_id,
-            '1' if private else '0')
-        leap_assert(
-            len(doclist) is 1,
-            'There is %d keys for id %s!' % (len(doclist), key_id))
-        return doclist.pop()
+        d.addCallback(get_key_from_active_doc)
+        return d
 
     def delete_key(self, key):
         """
         Remove C{key} from storage.
 
-        May raise:
-            errors.KeyNotFound
-
         :param key: The key to be removed.
         :type key: EncryptionKey
+
+        :return: A Deferred which fires when the key is deleted, or which
+                 fails with KeyNotFound if the key was not found on local
+                 storage.
+        :rtype: Deferred
         """
         leap_assert_type(key, OpenPGPKey)
-        activedocs = self._soledad.get_from_index(
-            TYPE_ID_PRIVATE_INDEX,
-            self.ACTIVE_TYPE,
-            key.key_id,
-            '1' if key.private else '0')
-        for doc in activedocs:
-            self._soledad.delete_doc(doc)
 
-        docs = self._soledad.get_from_index(
+        def delete_docs(activedocs):
+            deferreds = []
+            for doc in activedocs:
+                d = self._soledad.delete_doc(doc)
+                deferreds.append(d)
+            return defer.gatherResults(deferreds)
+
+        def get_key_docs(_):
+            return self._soledad.get_from_index(
+                TYPE_ID_PRIVATE_INDEX,
+                self.KEY_TYPE,
+                key.key_id,
+                '1' if key.private else '0')
+
+        def delete_key(docs):
+            if len(docs) == 0:
+                raise errors.KeyNotFound(key)
+            if len(docs) > 1:
+                logger.critical("There is more than one key for key_id %s"
+                                % key.key_id)
+
+            doc = None
+            for d in docs:
+                if d.content['fingerprint'] == key.fingerprint:
+                    doc = d
+                    break
+            if doc is None:
+                raise errors.KeyNotFound(key)
+            return self._soledad.delete_doc(doc)
+
+        d = self._soledad.get_from_index(
             TYPE_ID_PRIVATE_INDEX,
-            self.KEY_TYPE,
+            self.ACTIVE_TYPE,
             key.key_id,
             '1' if key.private else '0')
-        if len(docs) == 0:
-            raise errors.KeyNotFound(key)
-        if len(docs) > 1:
-            logger.critical("There is more than one key for key_id %s"
-                            % key.key_id)
-
-        doc = None
-        for d in docs:
-            if d.content['fingerprint'] == key.fingerprint:
-                doc = d
-                break
-        if doc is None:
-            raise errors.KeyNotFound(key)
-        self._soledad.delete_doc(doc)
+        d.addCallback(delete_docs)
+        d.addCallback(get_key_docs)
+        d.addCallback(delete_key)
+        return d
 
     #
     # Data encryption, decryption, signing and verifying
-- 
cgit v1.2.3


From 18d8fc8ab26885e24eaa05cc7843937b2381e4a8 Mon Sep 17 00:00:00 2001
From: Ruben Pollan <meskio@sindominio.net>
Date: Fri, 5 Dec 2014 12:28:37 -0600
Subject: Fix key generation

---
 src/leap/keymanager/openpgp.py | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

(limited to 'src/leap/keymanager/openpgp.py')

diff --git a/src/leap/keymanager/openpgp.py b/src/leap/keymanager/openpgp.py
index f81fb0a..c95b381 100644
--- a/src/leap/keymanager/openpgp.py
+++ b/src/leap/keymanager/openpgp.py
@@ -282,11 +282,6 @@ class OpenPGPScheme(EncryptionScheme):
                 pubkeys = gpg.list_keys()
 
                 # assert for new key characteristics
-
-                # XXX This exception is not properly catched by the soledad
-                # bootstrapping, so if we do not finish generating the keys
-                # we end with a blocked thread -- kali
-
                 leap_assert(
                     len(pubkeys) is 1,  # a unitary keyring!
                     'Keyring has wrong number of keys: %d.' % len(pubkeys))
@@ -298,8 +293,9 @@ class OpenPGPScheme(EncryptionScheme):
                 for uid in key['uids']:
                     if re.match('.*<%s>$' % address, uid) is not None:
                         uid_match = True
-                        return
+                        break
                 leap_assert(uid_match, 'Key not correctly bound to address.')
+
                 # insert both public and private keys in storage
                 deferreds = []
                 for secret in [True, False]:
-- 
cgit v1.2.3


From 607e10bab5b81de692a31cfa5624d0f3630f4c55 Mon Sep 17 00:00:00 2001
From: Ruben Pollan <meskio@sindominio.net>
Date: Fri, 19 Dec 2014 07:40:05 -0600
Subject: On key update merge metadata correctly

---
 src/leap/keymanager/openpgp.py | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

(limited to 'src/leap/keymanager/openpgp.py')

diff --git a/src/leap/keymanager/openpgp.py b/src/leap/keymanager/openpgp.py
index c95b381..0adfc52 100644
--- a/src/leap/keymanager/openpgp.py
+++ b/src/leap/keymanager/openpgp.py
@@ -40,8 +40,6 @@ from leap.keymanager.keys import (
     TYPE_ID_PRIVATE_INDEX,
     TYPE_ADDRESS_PRIVATE_INDEX,
     KEY_ADDRESS_KEY,
-    KEY_FINGERPRINT_KEY,
-    KEY_DATA_KEY,
     KEY_ID_KEY,
     KEYMANAGER_ACTIVE_TYPE,
 )
@@ -447,23 +445,30 @@ class OpenPGPScheme(EncryptionScheme):
         def check_and_put(docs, key):
             if len(docs) == 1:
                 doc = docs.pop()
-                if key.fingerprint == doc.content[KEY_FINGERPRINT_KEY]:
+                oldkey = build_key_from_dict(OpenPGPKey, doc.content)
+                if key.fingerprint == oldkey.fingerprint:
                     # in case of an update of the key merge them with gnupg
                     with self._temporary_gpgwrapper() as gpg:
-                        gpg.import_keys(doc.content[KEY_DATA_KEY])
+                        gpg.import_keys(oldkey.key_data)
                         gpg.import_keys(key.key_data)
                         gpgkey = gpg.list_keys(secret=key.private).pop()
-                        key = _build_key_from_gpg(
+                        mergedkey = _build_key_from_gpg(
                             gpgkey,
                             gpg.export_keys(gpgkey['fingerprint'],
                                             secret=key.private))
-                    doc.set_json(key.get_json())
+                    mergedkey.validation = max(
+                        [key.validation, oldkey.validation])
+                    mergedkey.last_audited_at = oldkey.last_audited_at
+                    mergedkey.refreshed_at = key.refreshed_at
+                    mergedkey.encr_used = key.encr_used or oldkey.encr_used
+                    mergedkey.sign_used = key.sign_used or oldkey.sign_used
+                    doc.set_json(mergedkey.get_json())
                     d = self._soledad.put_doc(doc)
                 else:
                     logger.critical(
                         "Can't put a key whith the same key_id and different "
                         "fingerprint: %s, %s"
-                        % (key.fingerprint, doc.content[KEY_FINGERPRINT_KEY]))
+                        % (key.fingerprint, oldkey.fingerprint))
                     d = defer.fail(
                         errors.KeyFingerprintMismatch(key.fingerprint))
             elif len(docs) > 1:
-- 
cgit v1.2.3


From 6fa8b2a9e7f02c59f794e9dd080fac574841e50b Mon Sep 17 00:00:00 2001
From: Ruben Pollan <meskio@sindominio.net>
Date: Fri, 19 Dec 2014 22:37:40 -0600
Subject: upgrade key when signed by old key

---
 src/leap/keymanager/openpgp.py | 99 ++++++++++++++++++++++++++----------------
 1 file changed, 61 insertions(+), 38 deletions(-)

(limited to 'src/leap/keymanager/openpgp.py')

diff --git a/src/leap/keymanager/openpgp.py b/src/leap/keymanager/openpgp.py
index 0adfc52..794a0ec 100644
--- a/src/leap/keymanager/openpgp.py
+++ b/src/leap/keymanager/openpgp.py
@@ -163,39 +163,6 @@ class TempGPGWrapper(object):
             shutil.rmtree(self._gpg.homedir)
 
 
-def _build_key_from_gpg(key, key_data):
-    """
-    Build an OpenPGPKey based on C{key} from local gpg storage.
-
-    ASCII armored GPG key data has to be queried independently in this
-    wrapper, so we receive it in C{key_data}.
-
-    :param key: Key obtained from GPG storage.
-    :type key: dict
-    :param key_data: Key data obtained from GPG storage.
-    :type key_data: str
-    :return: An instance of the key.
-    :rtype: OpenPGPKey
-    """
-    expiry_date = None
-    if key['expires']:
-        expiry_date = datetime.fromtimestamp(int(key['expires']))
-    address = []
-    for uid in key['uids']:
-        address.append(_parse_address(uid))
-
-    return OpenPGPKey(
-        address,
-        key_id=key['keyid'],
-        fingerprint=key['fingerprint'],
-        key_data=key_data,
-        private=True if key['type'] == 'sec' else False,
-        length=int(key['length']),
-        expiry_date=expiry_date,
-        refreshed_at=datetime.now(),
-    )
-
-
 def _parse_address(address):
     """
     Remove name, '<', '>' and the identity suffix after the '+' until the '@'
@@ -221,6 +188,26 @@ class OpenPGPKey(EncryptionKey):
     Base class for OpenPGP keys.
     """
 
+    def __init__(self, address, gpgbinary=None, **kwargs):
+        self._gpgbinary = gpgbinary
+        super(OpenPGPKey, self).__init__(address, **kwargs)
+
+    @property
+    def signatures(self):
+        """
+        Get the key signatures
+
+        :return: the key IDs that have signed the key
+        :rtype: list(str)
+        """
+        with TempGPGWrapper(keys=[self], gpgbinary=self._gpgbinary) as gpg:
+            res = gpg.list_sigs(self.key_id)
+            for uid, sigs in res.sigs.iteritems():
+                if _parse_address(uid) in self.address:
+                    return sigs
+
+        return []
+
 
 class OpenPGPScheme(EncryptionScheme):
     """
@@ -298,7 +285,7 @@ class OpenPGPScheme(EncryptionScheme):
                 deferreds = []
                 for secret in [True, False]:
                     key = gpg.list_keys(secret=secret).pop()
-                    openpgp_key = _build_key_from_gpg(
+                    openpgp_key = self._build_key_from_gpg(
                         key,
                         gpg.export_keys(key['fingerprint'], secret=secret))
                     d = self.put_key(openpgp_key, address)
@@ -335,7 +322,9 @@ class OpenPGPScheme(EncryptionScheme):
             leap_assert(
                 address in doc.content[KEY_ADDRESS_KEY],
                 'Wrong address in key data.')
-            return build_key_from_dict(OpenPGPKey, doc.content)
+            key = build_key_from_dict(OpenPGPKey, doc.content)
+            key._gpgbinary = self._gpgbinary
+            return key
 
         d = self._get_key_doc(address, private)
         d.addCallback(build_key)
@@ -375,7 +364,7 @@ class OpenPGPScheme(EncryptionScheme):
             openpgp_privkey = None
             if privkey is not None:
                 # build private key
-                openpgp_privkey = _build_key_from_gpg(
+                openpgp_privkey = self._build_key_from_gpg(
                     privkey,
                     gpg.export_keys(privkey['fingerprint'], secret=True))
                 leap_check(pubkey['fingerprint'] == privkey['fingerprint'],
@@ -383,7 +372,7 @@ class OpenPGPScheme(EncryptionScheme):
                            errors.KeyFingerprintMismatch)
 
             # build public key
-            openpgp_pubkey = _build_key_from_gpg(
+            openpgp_pubkey = self._build_key_from_gpg(
                 pubkey,
                 gpg.export_keys(pubkey['fingerprint'], secret=False))
 
@@ -452,7 +441,7 @@ class OpenPGPScheme(EncryptionScheme):
                         gpg.import_keys(oldkey.key_data)
                         gpg.import_keys(key.key_data)
                         gpgkey = gpg.list_keys(secret=key.private).pop()
-                        mergedkey = _build_key_from_gpg(
+                        mergedkey = self._build_key_from_gpg(
                             gpgkey,
                             gpg.export_keys(gpgkey['fingerprint'],
                                             secret=key.private))
@@ -571,6 +560,40 @@ class OpenPGPScheme(EncryptionScheme):
         d.addCallback(get_key_from_active_doc)
         return d
 
+    def _build_key_from_gpg(self, key, key_data):
+        """
+        Build an OpenPGPKey for C{address} based on C{key} from
+        local gpg storage.
+
+        ASCII armored GPG key data has to be queried independently in this
+        wrapper, so we receive it in C{key_data}.
+
+        :param key: Key obtained from GPG storage.
+        :type key: dict
+        :param key_data: Key data obtained from GPG storage.
+        :type key_data: str
+        :return: An instance of the key.
+        :rtype: OpenPGPKey
+        """
+        expiry_date = None
+        if key['expires']:
+            expiry_date = datetime.fromtimestamp(int(key['expires']))
+        address = []
+        for uid in key['uids']:
+            address.append(_parse_address(uid))
+
+        return OpenPGPKey(
+            address,
+            gpgbinary=self._gpgbinary,
+            key_id=key['keyid'],
+            fingerprint=key['fingerprint'],
+            key_data=key_data,
+            private=True if key['type'] == 'sec' else False,
+            length=int(key['length']),
+            expiry_date=expiry_date,
+            refreshed_at=datetime.now(),
+        )
+
     def delete_key(self, key):
         """
         Remove C{key} from storage.
-- 
cgit v1.2.3


From 3fab338ef4e1ae0efcfaee455ae04881aa013083 Mon Sep 17 00:00:00 2001
From: Bruno Wagner <bwgpro@gmail.com>
Date: Fri, 24 Jul 2015 16:24:13 -0300
Subject: [style] Fixed pep8 warnings

Fixed pep8 warnings to prepare the keymanager for CI
---
 src/leap/keymanager/openpgp.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

(limited to 'src/leap/keymanager/openpgp.py')

diff --git a/src/leap/keymanager/openpgp.py b/src/leap/keymanager/openpgp.py
index 794a0ec..5d91dc9 100644
--- a/src/leap/keymanager/openpgp.py
+++ b/src/leap/keymanager/openpgp.py
@@ -114,8 +114,11 @@ class TempGPGWrapper(object):
         publkeys = filter(
             lambda pubkey: pubkey.key_id not in privids, publkeys)
 
-        listkeys = lambda: self._gpg.list_keys()
-        listsecretkeys = lambda: self._gpg.list_keys(secret=True)
+        def listkeys():
+            return self._gpg.list_keys()
+
+        def listsecretkeys():
+            return self._gpg.list_keys(secret=True)
 
         self._gpg = GPG(binary=self._gpgbinary,
                         homedir=tempfile.mkdtemp())
-- 
cgit v1.2.3


From d12f883eed4a8205440e8a4422605be1a1cfe914 Mon Sep 17 00:00:00 2001
From: Bruno Wagner <bwgpro@gmail.com>
Date: Mon, 3 Aug 2015 17:37:09 -0300
Subject: [style] Re-added lambdas to openpgp on keymanager

---
 src/leap/keymanager/openpgp.py | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

(limited to 'src/leap/keymanager/openpgp.py')

diff --git a/src/leap/keymanager/openpgp.py b/src/leap/keymanager/openpgp.py
index 5d91dc9..bbdedb2 100644
--- a/src/leap/keymanager/openpgp.py
+++ b/src/leap/keymanager/openpgp.py
@@ -111,14 +111,10 @@ class TempGPGWrapper(object):
         # and we want to count the keys afterwards.
 
         privids = map(lambda privkey: privkey.key_id, privkeys)
-        publkeys = filter(
-            lambda pubkey: pubkey.key_id not in privids, publkeys)
+        publkeys = filter(lambda pubkey: pubkey.key_id not in privids, publkeys)
 
-        def listkeys():
-            return self._gpg.list_keys()
-
-        def listsecretkeys():
-            return self._gpg.list_keys(secret=True)
+        listkeys = lambda: self._gpg.list_keys()
+        listsecretkeys = lambda: self._gpg.list_keys(secret=True)
 
         self._gpg = GPG(binary=self._gpgbinary,
                         homedir=tempfile.mkdtemp())
-- 
cgit v1.2.3


From 711fce95bf8f65c0f5a4eaddb4023eda29bc16ad Mon Sep 17 00:00:00 2001
From: Kali Kaneko <kali@leap.se>
Date: Mon, 17 Aug 2015 19:22:14 -0400
Subject: [style] pep8 fix

---
 src/leap/keymanager/openpgp.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'src/leap/keymanager/openpgp.py')

diff --git a/src/leap/keymanager/openpgp.py b/src/leap/keymanager/openpgp.py
index bbdedb2..794a0ec 100644
--- a/src/leap/keymanager/openpgp.py
+++ b/src/leap/keymanager/openpgp.py
@@ -111,7 +111,8 @@ class TempGPGWrapper(object):
         # and we want to count the keys afterwards.
 
         privids = map(lambda privkey: privkey.key_id, privkeys)
-        publkeys = filter(lambda pubkey: pubkey.key_id not in privids, publkeys)
+        publkeys = filter(
+            lambda pubkey: pubkey.key_id not in privids, publkeys)
 
         listkeys = lambda: self._gpg.list_keys()
         listsecretkeys = lambda: self._gpg.list_keys(secret=True)
-- 
cgit v1.2.3