1 files changed, 35 insertions, 12 deletions

diff --git a/lib/Kiki.hs b/lib/Kiki.hs
index b1f7ad7..8a1878b 100644
--- a/lib/Kiki.hs
+++ b/lib/Kiki.hs
@@ -82,6 +82,11 @@ run args x =
         Left e   -> hPutStrLn stderr $ usageErrorMessage e
         Right io -> io
 
+outputReport :: [(FilePath, KikiReportAction)] -> IO ()
+outputReport report = do
+    forM_ report $ \(fname,act) -> do
+        putStrLn $ fname ++ ": " ++ reportString act
+
 importAndRefresh :: (FilePath -> FilePath) -> CommonArgsParsed -> IO ()
 importAndRefresh root cmn = do
     let rootdir = do guard (root "x" /= "x")
@@ -195,8 +200,7 @@ importAndRefresh root cmn = do
             }
     -- if bUnprivileged then doNothing else mkdirFor torpath
     KikiResult rt report <- runKeyRing (if bUnprivileged then nop else op)
-    forM_ report $ \(fname,act) -> do
-        putStrLn $ fname ++ ": " ++ reportString act
+    outputReport report
     rt <- case rt of
         BadPassphrase ->
             error "Operation requires correct passphrase. (Hint: Use --passphrase-fd=0 to input it on stdin.)"
@@ -237,16 +241,35 @@ refreshCache rt rootdir = do
 
     let grip = fingerprint wk
         wkkd = rtKeyDB rt Map.! keykey wk
-
-    either warn (write $ mkpath "ipsec.d/private/" ++ Char8.unpack oname++".pem") $ do
-        -- Note: no sig check here. That may be incautious...
-        let my_ipsecs :: [Packet]
-            my_ipsecs = sortOn (Down . timestamp)
-                         $ getSubkeys Unsigned wk (keySubKeys wkkd) "ipsec"
-        case my_ipsecs of
-            ipsec:_ -> maybe (Left "unsupported ipsec key type") Right
-                            $ secretPemFromPacket ipsec
-            _       -> Left "missing ipsec key?"
+        getSecret tag = sortOn (Down . timestamp)
+                        $ getSubkeys Unsigned wk (keySubKeys wkkd) tag
+
+    let writeSecret tag path warning = do
+        let my_ks :: [Packet]
+            my_ks = getSecret "ipsec"
+        case my_ks of
+            sec:_ -> do report <- writeKeyToFile streaminfo { typ = PEMFile
+                                                            , access = Sec
+                                                            , spill = KF_All
+                                                            }
+                                                 (ArgFile path)
+                                                 sec
+                        let ctx = Just $ InputFileContext "secring.gpg" "pubring.gpg"
+                        outputReport $ map (first $ resolveForReport ctx)
+                                     $ filter ((/=ExportedSubkey) . snd) report
+            _     -> warn warning
+
+    writeSecret "ipsec"
+                (mkpath "ipsec.d/private/" ++ Char8.unpack oname++".pem")
+                "missing ipsec key?"
+
+    writeSecret "ssh-client"
+                (mkpath "root/.ssh/id_rsa")
+                "missing ssh-client key?"
+
+    writeSecret "ssh-server"
+                (mkpath "ssh_host_rsa_key")
+                "missing ssh host key?"
 
     -- Finally, export public keys if they do not exist.
     either warn (write $ mkpath "root/.ssh/id_rsa.pub")