remove gpg

8 files changed, 12 insertions, 186 deletions

diff --git a/.gitmodules b/.gitmodules
index 8dd443e..43d1ad1 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,9 +1,6 @@
 [submodule "fsmgr"]
         path = fsmgr
         url = d@cryptonomic.net:public_git/fsmgr.git
-[submodule "kiki"]
-        path = kiki
-        url = d@cryptonomic.net:public_git/kiki.git
 [submodule "cryptonomic-dyndns-server"]
         path = cryptonomic-dyndns-server
         url = d@cryptonomic.net:public_git/cryptonomic-dyndns-server.git
diff --git a/Makefile b/Makefile
index 634a418..a376a64 100644
--- a/Makefile
+++ b/Makefile
@@ -8,7 +8,7 @@ compiled_programs=${cc_files} ${cpp_files}
 CC=gcc -std=gnu99
 CFLAGS=-Os
 
-INSTALL_SUBMODULES = fsmgr kiki
+INSTALL_SUBMODULES = fsmgr
 NO_INSTALL_SUBMODULES = cryptonomic-dyndns-server
 SUBMODULES = $(INSTALL_SUBMODULES) $(NO_INSTALL_SUBMODULES)
 
@@ -47,9 +47,8 @@ $(addprefix src/, $(dyndns_links)):
 
 src_bin_programs = xorriso-usb.sh btrfs-functions.sh btrfs-receive-root.sh      \
 btrfs-send-root.sh var.sh grub-efi.sh keygen.sh initrd.sh qemu.sh               \
-dnsmasq-dhcp-script.sh samizdat-password-agent samizdat-gpg-agent publish-ip.sh \
-samizdat-daily-snapshot-root samizdat-diff-root kiki-export-stdout              \
-kiki-import-stdin store-child-permanently git-ll-remote usb                     \
+dnsmasq-dhcp-script.sh publish-ip.sh \
+git-ll-remote usb \
 hostname.cryptonomic.net partvi ficlonerange.py ${dyndns_progs}
 
 bin_programs=$(addprefix src/, $(src_bin_programs)) samizdat-paths.sh ${cc_files} ${btrfs_utils}
@@ -118,8 +117,6 @@ ifndef instdir
 else
         install  -p  -m0644  -DT  conf/postfix_main.cf           ${instdir}/etc/postfix/main.cf
         install  -p  -m0644  -DT  conf/torrc                     ${instdir}/etc/tor/torrc
-        ln -sf /var/cache/kiki/config/tor/hostname  ${instdir}/etc/mailname
-        ln -sf /var/cache/kiki/config/tor/hostname  ${instdir}/etc/hostname
 endif
 
 include user.mk
@@ -178,23 +175,10 @@ boot: rootfs
 fastboot: rootfs
         sudo qemu.sh
 
-reuse_child := $(shell 2>/dev/null read child < reused-child && echo --reuse-child=$$child; true)
-
 samizdat.netinst.iso: | rootfs/samizdat.btrfs
         exit 1; sudo initrd.sh
         sudo xorriso-usb.sh $(reuse_child) --bootloader --out $@
 
-reused-child:
-        sudo keygen.sh ${samizdat_child_dir}/child.$$$$ && \
-                sudo store-child-permanently $$$$ && \
-                echo $$$$ > $@
-
-testclean:
-        make -C kiki install
-        sudo mv /root/.gnupg /root/.gnupg.$$(date -Im) || true
-        sudo killall gpg-agent || true
-        rm -f reused-child
-
 cleantest:
         make testclean
         make isotest
@@ -205,9 +189,6 @@ isotest: samizdat.iso
 isotest-netinst: samizdat.netinst.iso
         USE_ISO=y SLOW_BOOT=y qemu.sh $^
 
-gpg_iso_path=gnupghome
-GPG_INPUT_DIR=${samizdat_child_dir}/child.$(shell cat reused-child)/root/.gnupg
-
 samizdat_btrfs_patch_size=256M
 
 get_loop_dev="$$(sudo losetup -n -O name -j $@~tmp)"
@@ -233,9 +214,6 @@ veritymount: rootfs/samizdat.seed.btrfs.verity.log
                               $(verity_root_hash)
         sudo veritysetup remove samizverity
 
-%.verity.log.asc: %.verity.log
-        sudo gpg --armor --detach-sign $^
-
 rootfs/%.btrfs:
         $(SUDO_MAKE) -C rootfs $(notdir $@)
 
@@ -298,7 +276,7 @@ gold.iso: rootfs/seed.iso reused-child
         mv $@~tmp $@
 
 rootfs/seed.iso: $(addprefix rootfs/samizdat.seed.btrf, s \
-                  $(if $(VERITY), s.verity s.verity.log $(if $(VERITY_SIGN), s.verity.log.asc)))
+                  $(if $(VERITY), s.verity s.verity.log))
         rm -f $@~tmp
         touch $@~tmp
         fallocate -n -l 10G $@~tmp
diff --git a/initramfs-tools/scripts/samizdat b/initramfs-tools/scripts/samizdat
index 8e9d4fa..9d8b846 100644
--- a/initramfs-tools/scripts/samizdat
+++ b/initramfs-tools/scripts/samizdat
@@ -62,15 +62,11 @@ mountroot()
   if [ "$nbdroot" ]; then
       my_configure_networking
       run_nbd_client
-
-      wait_for_gnupghome_tar
-      (sleep 5; echo ) &
-      (. common.sh && . btrfs-create.sh && init_gpg)
+      (. common.sh && . btrfs-create.sh)
   fi
 
   bootmenu
   samizdat_install_udev_rules
-  bootwait samizdat-gpg
   bootwait root-mounted
   osname=$(get_os_name)
   write_resolv_dot_conf
@@ -87,19 +83,6 @@ Press alt-f9 for rescue terminal.
 EOF
 }
 
-wait_for_gnupghome_tar()
-{
-  [ -e /gnupghome.tar ] && return
-  echo -n Waiting to receive GPG keys through the network... > /dev/tty1
-  (while ! tftp -g -r gnupghome.tar -l /gnupghome.tar.$$ "$ROOTSERVER" 2>/run/initramfs/samizdat/log/tftp.$$.log; do
-    sleep 1;
-    echo -n . > /dev/tty1
-  done
-  mv /gnupghome.tar.$$ /gnupghome.tar)
-  echo '  done.' > /dev/tty1
-  bootdone gnupg-tar
-}
-
 samizdat_restart_udev()
 {
   local LOG_DIR=/run/initramfs/samizdat/log
diff --git a/src/initrd/btrfs-create.sh b/src/initrd/btrfs-create.sh
index 894d835..5a43977 100644
--- a/src/initrd/btrfs-create.sh
+++ b/src/initrd/btrfs-create.sh
@@ -5,21 +5,6 @@
 
 losetup() { /sbin/losetup "$@"; }
 
-luks_secret()
-{
-  local parms=$-; # this junk keeps set -x from being too annoying
-  set +x
-  [ -n "$luks_secret" ] || luks_secret="$(head -c256 /dev/urandom)"
-  printf %s "$luks_secret"
-  case $parms in *x*) set -x; set -x ;; esac
-}
-
-floor4()
-{
-  # Negatives round up, but aren't used.
-  echo $(($1 / 4 * 4))
-}
-
 ceil4()
 {
   local x="$1"
@@ -205,11 +190,8 @@ initialize_root_filesystem()
     done
     chroot /root chown -R u:u ${uhome}
 
-    mv /root/root/.gnupg /root/root/.gnupg~
-    mv /gpg/gnupghome /root/root/.gnupg                 || return
-
     copy_execs sbin  mdadm dmsetup cryptsetup fsck.hfsplus
-    copy_execs bin   btrfs rsync gpg gpg2 gpg-agent
+    copy_execs bin   btrfs rsync
 
     # Copy these over unconditionally, because they ought to remain in sync with
     # the initrd.
@@ -333,8 +315,7 @@ open_samizdat_blockdev()
 
   if [ ! -e "$decrypted_keyfile" ]
   then
-    gpg2 --verify "$keyfile" || return
-    gpg2 --output=- --verify "$keyfile" | gpg2 --decrypt > "$decrypted_keyfile" || return
+    echo -n secret > "$decrypted_keyfile"
   fi
 
   cryptsetup --key-file "$decrypted_keyfile" luksOpen "$dev" "$cryptname" || return
@@ -349,12 +330,9 @@ init_samizdat_blockdev()
 
   [ ! -b /dev/mapper/"$cryptname" ] || return
 
-  luks_secret >/dev/null
-  luks_secret | gpg2 --default-recipient-self --encrypt --armor | gpg2 --clearsign --output "$keyfile" || return
-
-  luks_secret | cryptsetup -v luksFormat "$dev" - || return
+  echo -n secret | cryptsetup -v luksFormat "$dev" - || return
   cryptsetup luksDump "$dev" >&2
-  luks_secret | cryptsetup --key-file - luksOpen "$dev" "$cryptname" || return
+  echo -n secret | cryptsetup --key-file - luksOpen "$dev" "$cryptname" || return
 
   [ -b /dev/mapper/"$cryptname" ] || return
 }
@@ -415,28 +393,6 @@ get_cdrom_sizelimit()
   fi
 }
 
-init_gpg()
-{
-  export GNUPGHOME=/gpg/gnupghome
-  mkdir -p "$GNUPGHOME"
-  if [ -e /gnupghome.tar ]; then
-      tar -C "$GNUPGHOME" -zxf /gnupghome.tar && bootdone samizdat-gpg
-      return
-  else
-      bootwait samizdat-cdrom
-      (umask 077; rsync --exclude '/luks-key*' --ignore-existing -rpP /cdrom/gnupghome/ "$GNUPGHOME")
-      bootdone samizdat-gpg
-  fi
-
-  local LOG_DIR=/run/initramfs/samizdat/log
-  if samizdat-password-agent > "$LOG_DIR"/samizdat-password-agent.log 2>&1; then
-    true
-  else
-    echo 'samizdat-password-agent failed; continuing in hope of hope...'
-    true # false
-  fi
-}
-
 start_meter()
 {
   local startmsg="$*"
diff --git a/src/initrd/common.sh b/src/initrd/common.sh
index 8f4e101..d7d7fa0 100644
--- a/src/initrd/common.sh
+++ b/src/initrd/common.sh
@@ -148,9 +148,4 @@ my_openvt()
   /bin/openvt -c "$@"
 }
 
-# This runs before way before NTP and on a LiveCD we have no
-# reason to trust the system clock.
-gpg2_nobatch() { GPG_TTY=$(tty) command gpg2 --ignore-time-conflict --ignore-valid-from "$@"; }
-gpg2() { gpg2_nobatch --batch "$@"; }
-
 xcp() { if [ -f "$1" -a ! -f "$2" ]; then cp "$1" "$2"; fi; }
diff --git a/src/initrd/grok-block b/src/initrd/grok-block
index a7056ad..d194486 100755
--- a/src/initrd/grok-block
+++ b/src/initrd/grok-block
@@ -7,15 +7,6 @@ case "$DEVNAME" in /dev/loop*|/dev/ram*|/dev/dm-*|/dev/md*|/dev/fd*) exit ;; esa
 
 debug_log "grok-block.${DEVNAME##*/}"
 
-addmenu_choosekey()
-{
-  dev=$1
-  dir=$2
-  addmenu "$dev//$dir" \
-          "[ Use the GPG key on $dev ]" \
-          "menu-select boot-gpg $dev $dir"
-}
-
 addmenu_repairhfs()
 {
   local device="$1"
@@ -87,26 +78,6 @@ retry_mount()
   done
 }
 
-Gpg2()
-{
-    gpg2 --lock-never --no-permission-warning --no-auto-check-trustdb --no-options "$@"
-}
-
-gpg_verify()
-{
-  [ -e "$1" ] || return
-  bootwait samizdat-gpg
-  export GNUPGHOME=/gpg/gnupghome
-  Gpg2 --verify "$1"
-}
-
-gpg_can_decrypt()
-{
-  [ -e "$1" ] || return
-  bootwait samizdat-gpg
-  Gpg2 --decrypt "$1" | Gpg2 --decrypt "$1" >/dev/null
-}
-
 is_lvm()
 {
   for n in 0 1 2 3; do
@@ -229,21 +200,7 @@ grok_block()
       # TODO: And what if we create partitions and then reboot the machine mid-install?
 
   elif [ "$ID_PART_ENTRY_NAME" = samizdat-rootfs ]; then
-      :
-
-  elif [ "$ID_PART_ENTRY_NAME" = samizdat-keys ]; then
-      mkdir -p /gpg
-      cp -a "$mountpoint"/gnupghome /gpg/ && bootdone samizdat-gpg && bootdone samizdat-cdrom
-
-  elif [ "$ID_PART_ENTRY_NAME" = samizdat-plaintext ]; then
-    if gpg_verify "$mountpoint"/disk.key && gpg_can_decrypt "$mountpoint"/disk.key; then
-      umount "$mountpoint"
-      addmenu_choose_native_root "$(parent_device "$DEVNAME")"
-      bootdone key-mounted
-    else
-      umount "$mountpoint"
-    fi
-
+    bootdone samizdat-rootfs
   elif [ "$DEVNAME" = /dev/nbd1 ]; then
     # This is our rootfs, over the network
     umount "$mountpoint"
@@ -307,25 +264,6 @@ eval "$(PATH=$PATH:/lib/udev vol_id "$DEVNAME" |
   sed "s/'/'\\\\''/; s/=\(.*\)/='\1'/"
 )"
 
-CDROM_ID_FS_UUID_ENC='73256269-4002-4e42-adbd-0e49ed1c7438'
-CDROM_ID_FS_LABEL_ENC=$(sed 's/ /\\x20/g' /lib/samizdat/vol_id.txt)
-if [ "$ID_FS_UUID_ENC"  = "$CDROM_ID_FS_UUID_ENC" -o \
-     "$ID_FS_LABEL_ENC" = "$CDROM_ID_FS_LABEL_ENC" ]
-then
-  # Recognize and mount the Samizdat
-  if ! mountpoint -q /cdrom; then
-    mkdir -p /cdrom
-    . mdadm-dup.sh
-    dup_mount_cdrom "$DEVNAME" /cdrom && bootdone samizdat-cdrom
-    if [ -e /cdrom/gnupghome ]; then
-      # TODO: don't use first match
-      mkdir -p /gpg/gnupghome
-      cp /cdrom/gnupghome/* /gpg/gnupghome
-      bootdone samizdat-gpg
-    fi
-  fi
-else
-  grok_block &
-fi
+grok_block &
 
 # vim:set et sw=2:
diff --git a/src/initrd/menu-select b/src/initrd/menu-select
index 1fcade4..9730c09 100755
--- a/src/initrd/menu-select
+++ b/src/initrd/menu-select
@@ -5,7 +5,6 @@
 #  $0 boot-overwrite    [dev name] [loop file] [megabytes] - overwrite with new luks overlay
 #  $0 boot-luks         [dev name] [loop file]             - boot existing luks-encrypted overlay
 #  $0 boot-destroy-disk [dev-name]                         - install to a fresh hard disk
-#  $0 boot-gpg          [key id] [gnupg homedir] [???]     - boot any device signed with the key
 
 . btrfs-create.sh
 . common.sh
@@ -76,7 +75,6 @@ case "$1" in
     # specified in KB here. I did not really believe it.
     modprobe brd rd_nr=1 rd_size=$memtotal_kb
 
-    init_gpg || error
     init_samizdat /dev/ram0 '' || {
         umount /root/cdrom
         umount /root/outerfs
@@ -94,7 +92,6 @@ case "$1" in
     mkfs.btrfs -f "$dev"2                                 || error
     mkdir /plaintext
     mount "$dev"2 /plaintext                              || error
-    init_gpg                                              || error
 
     init_samizdat_blockdev "$dev"3 /plaintext/disk.key    || error
     init_samizdat /dev/mapper/samizdatcrypt ''            || error
@@ -106,10 +103,7 @@ case "$1" in
   boot-native)
     dev="$2"
     umount /plaintext || true
-    mkdir /plaintext
-    mount "$dev"2 /plaintext                           || error
-    init_gpg                                           || error
-    open_samizdat_blockdev "$dev"3 /plaintext/disk.key || error
+    open_samizdat_blockdev "$dev"3 - || error
     open_samizdat                                      || error open_samizdat
     bootdone root-mounted
   ;;
@@ -128,8 +122,6 @@ case "$1" in
       rm "$loopfile" "$loopfile"k
     fi
 
-    init_gpg || error
-
     if [ "$1" = 'boot-luks' ]; then
       open_samizdat_blockdev_from_loop "$loopfile" "$loopfile"k || error
       open_samizdat || error open_samizdat
diff --git a/src/partvi b/src/partvi
index 54e534c..e34eef6 100755
--- a/src/partvi
+++ b/src/partvi
@@ -298,7 +298,6 @@ copy_data_to_mounted_target_filesystems()
             $sudo systemd-run -p BindPaths="$(realpath -e "$mnt"):/boot" --wait update-grub
             ;;
         samizdat-keys)
-            $sudo rsync  -a  --info=STATS  "$GPG_INPUT_DIR"/ "$mnt"/gnupghome/
             ;;
         efi-system-partition)
             EFI_DIR=$mnt
@@ -319,18 +318,6 @@ then sudo=
 else sudo=sudo
 fi
 
-if [ "$GPG_INPUT_DIR" ]
-then
-    $sudo [ -d "$GPG_INPUT_DIR" ]
-else
-    for d in /root/.gnupg /cdrom/gnupghome
-    do
-        $sudo [ -d "$d" ] || continue
-        GPG_INPUT_DIR=$d
-        break
-    done
-fi
-
 SKIP_ROOTFS_COPY=
 if [ "$1" = 'key' ]
 then