Download gnupghome.tar when net-booting

This contains a keyring that is generated on the server for each client
that netboots.

4 files changed, 86 insertions, 2 deletions

diff --git a/Makefile b/Makefile
index bcf851b..893216b 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@ prefix?=/usr/local
 
 all: samizdat-paths.sh
 
-bin_programs=$(addprefix src/, xorriso-usb.sh btrfs-functions.sh btrfs-receive-root.sh btrfs-send-root.sh var.sh grub-efi.sh keygen.sh initrd.sh qemu.sh btarfs) samizdat-paths.sh
+bin_programs=$(addprefix src/, xorriso-usb.sh btrfs-functions.sh btrfs-receive-root.sh btrfs-send-root.sh var.sh grub-efi.sh keygen.sh initrd.sh qemu.sh btarfs dnsmasq-dhcp-script.sh) samizdat-paths.sh
 
 # TODO: compile these here
 samizdat_execs=$(addprefix /home/d/src/samizdat/, wait_for_files samizdat-pinentry dynmenu src/samizdat-password-agent src/samizdat-gpg-agent)
@@ -10,6 +10,8 @@ samizdat_execs=$(addprefix /home/d/src/samizdat/, wait_for_files samizdat-pinent
 initrd_files:=$(wildcard src/initrd/*)
 initramfs_conf_files:=$(wildcard initramfs-tools/*)
 
+isolinux_files:=$(wildcard isolinux/*)
+
 .PHONY: samizdat-paths.sh
 samizdat-paths.sh: src/samizdat-paths.in
         sed -e "s?PREFIX?$(prefix)?g" $< > $@
@@ -25,3 +27,4 @@ install:
         mkdir -p ${instdir}${samizdat_linux_dir}
         cp -r ${initrd_files} ${instdir}${samizdat_initrd_files_dir}
         cp -r ${initramfs_conf_files} ${instdir}${samizdat_initramfs_conf_dir}
+        cp -r ${isolinux_files} ${instdir}${samizdat_isolinux_dir}
diff --git a/initramfs-tools/scripts/samizdat b/initramfs-tools/scripts/samizdat
index 232e3ac..374979f 100644
--- a/initramfs-tools/scripts/samizdat
+++ b/initramfs-tools/scripts/samizdat
@@ -7,11 +7,22 @@ mountroot()
   samizdat_install_udev_rules
   mkfifo "$MENUFIFO"
   sh /scripts/local-top/nbd & # I guess this isn't getting called otherwise?
+  wait_for_gnupghome_tar
   bootmenu
   bootwait root-mounted
   chvt 1
 }
 
+wait_for_gnupghome_tar()
+{
+  [ -e /gnupghome.tar ] && return
+  [ "${nbdroot%%,*}" ] || return
+  (while ! tftp -g -r gnupghome.tar -l /gnupghome.tar.$$ ${nbdroot%%,*}; do
+    sleep 1;
+  done
+  mv /gnupghome.tar.$$ /gnupghome.tar)
+}
+
 samizdat_install_udev_rules()
 {
   mkdir -p /etc/udev/rules.d
diff --git a/src/dnsmasq-dhcp-script.sh b/src/dnsmasq-dhcp-script.sh
new file mode 100644
index 0000000..167d229
--- /dev/null
+++ b/src/dnsmasq-dhcp-script.sh
@@ -0,0 +1,64 @@
+#!/bin/sh
+. samizdat-paths.sh
+TFTP_ROOT=${samizdat_isolinux_dir}
+[ "$1 $4" = "tftp ${TFTP_ROOT}/linux/vmlinuz" ] || exit
+# $2 is the length of the file
+CLIENT_IP=$3
+
+# dnsmasq clears the environment.  kiki needs at least $HOME
+export USER=root
+export MAIL=/var/mail/root
+export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+export LANG=en_US.UTF-8
+export HOME=/root
+export LANGUAGE=en_US:en
+export LOGNAME=root
+
+debug()
+{
+    LOGDIR=/var/log/dnsmasq-dhcp-script
+    mkdir -p "$LOGDIR"
+    exec > "$LOGDIR/$$.log" 2>&1
+    set -x
+}
+
+new_child()
+{
+    child_dir=$samizdat_child_dir/child.$$
+    if [ -d "$child_dir" ]; then
+        rmdir "$child_dir" || exit 1
+    fi
+
+    sh -x "$(which keygen.sh)" "$child_dir" || return
+    tar --exclude '*~' -zcf "$child_dir"/gnupghome.tar -C "$child_dir"/root/.gnupg . || return
+
+    tftp_dir="${TFTP_ROOT}"/"$CLIENT_IP"
+    if [ ! -d "$tftp_dir" ]; then
+        ATOMIC=y
+        dest_dir="$tftp_dir"~
+
+        # DNSMASQ DOCUMENTATION IS WRONG OMFG
+        # Otherwise this symlink farm would be unnecessary
+
+        mkdir -p "$dest_dir"
+        (cd "$dest_dir" && ln -sf ../* . && rm "$CLIENT_IP"~) || return
+    else
+        dest_dir="$tftp_dir"
+    fi
+
+    chown dnsmasq "$child_dir" "$child_dir"/gnupghome.tar
+    ln -sf "$child_dir"/gnupghome.tar "$dest_dir"/
+
+    if [ "$ATOMIC" ]; then
+        mv -T "$dest_dir" "$tftp_dir"
+    fi
+}
+
+cleanup_after_fail()
+{
+    umount "$child_dir"
+    rmdir "$child_dir"
+}
+
+debug
+(new_child || cleanup_after_fail) &
diff --git a/src/keygen.sh b/src/keygen.sh
index 4c13e67..5b48512 100755
--- a/src/keygen.sh
+++ b/src/keygen.sh
@@ -60,13 +60,19 @@ doublecheck()
 
 silent()
 {
+    case "$-" in
+        *x*) return ;;
+    esac
+    SILENT=y
     exec 3>&1 4>&2
     exec >/dev/null 2>&1
 }
 
 noisy()
 {
-    exec >&3 2>&1
+    if [ "$SILENT" ]; then
+        exec >&3 2>&1
+    fi
 }
 
 new_child()