confium-cli 0.5.4

Command-line interface for the Confium threshold cryptography framework
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78

//! `confium trust <list|add|remove>`.
//!
//! Manages the local trust store (`~/.config/confium/trust/`) via
//! [`confium_registry::TrustStore`]. Each publisher is one TOML file so
//! the store is auditable, diffable, and trivially backed up.

use confium_registry::TrustStore;
use confium_registry::manifest::TrustRoot;

use crate::cli::{TrustAction, TrustArgs};
use crate::commands::common::override_home;

pub fn run(args: TrustArgs) {
    let home = override_home();
    let store = match home {
        Some(h) => TrustStore::for_home(h),
        None => TrustStore::new(),
    };
    match args.action {
        TrustAction::List => list(&store),
        TrustAction::Add(add) => add_publisher(&store, add.publisher, add.key),
        TrustAction::Remove(remove) => remove_publisher(&store, remove.publisher),
    }
}

fn list(store: &TrustStore) {
    match store.list() {
        Ok(entries) if entries.is_empty() => {
            println!("no trusted publishers");
        }
        Ok(entries) => {
            for entry in entries {
                println!(
                    "{:<20} key-id={} fingerprint={}",
                    entry.name, entry.key_id, entry.fingerprint
                );
            }
        }
        Err(e) => {
            eprintln!("confium: {e}");
            std::process::exit(70);
        }
    }
}

fn add_publisher(store: &TrustStore, publisher: String, key: Option<String>) {
    let key_id = key.unwrap_or_default();
    // When --key is absent we record an empty key-id/fingerprint; the
    // user can edit the file later or re-run with --key once they've
    // verified the publisher out of band.
    let entry = TrustRoot {
        name: publisher.clone(),
        key_id: key_id.clone(),
        fingerprint: key_id.clone(),
        key_url: format!("/publishers/{publisher}.asc"),
    };
    match store.add(entry) {
        Ok(()) => println!("trusted {publisher}"),
        Err(e) => {
            eprintln!("confium: {e}");
            std::process::exit(70);
        }
    }
}

fn remove_publisher(store: &TrustStore, publisher: String) {
    match store.remove(&publisher) {
        Ok(true) => println!("untrusted {publisher}"),
        Ok(false) => {
            eprintln!("confium: publisher '{publisher}' is not trusted");
            std::process::exit(64);
        }
        Err(e) => {
            eprintln!("confium: {e}");
            std::process::exit(70);
        }
    }
}