Safe defaults

[auto-upgrade-with-pinch] / overlays / keyedgpg.nix

diff --git a/overlays/keyedgpg.nix b/overlays/keyedgpg.nix
index 202abb380f2637d6a9e74277b7bf9a0b943681e8..a78062ffae92acf0a14ee88e3033ccdc0c232bfc 100644 (file)
--- a/overlays/keyedgpg.nix
+++ b/overlays/keyedgpg.nix
@@ -11,42 +11,19 @@ let
     ${self.gnupg}/bin/gpg --no-default-keyring "$@"
   '';
 in {
     ${self.gnupg}/bin/gpg --no-default-keyring "$@"
   '';
 in {

-  keyedgpg = super.writeShellScript "keyed-gpg" ''
+  keyedgpg = keyfiles: super.writeShellScript "keyed-gpg" ''

     set -eo pipefail
 
     set -eo pipefail
 

-    usage() {
-      echo "usage: keyed-gpg /path/to/keyfile1.asc ... -- gpg-command..." >&2
-      exit 1
-    }
-
-    incomplete=true
-    keyfiles=()
-    while (( $# > 0 ));do
-      if [[ "$1" == -- ]];then
-        shift
-        incomplete=false
-        break
-      fi
-      if [[ ! -r "$1" ]];then
-        usage
-      fi
-      keyfiles+=$1
-      shift
-    done
-    if "$incomplete";then
-      usage
-    fi
-

     keyring=$(${self.coreutils}/bin/mktemp)
     cleanup() { ${self.coreutils}/bin/rm "$keyring"; }
     trap cleanup EXIT
     keyring=$(${self.coreutils}/bin/mktemp)
     cleanup() { ${self.coreutils}/bin/rm "$keyring"; }
     trap cleanup EXIT

-    ${homelessGPG} --keyring="$keyring" --import "''${keyfiles[@]}"
+    ${homelessGPG} --keyring="$keyring" --import ${self.lib.escapeShellArgs keyfiles}

 
     trusted_key_args=()
     while read keyid;do
       trusted_key_args+=( --trusted-key "$keyid" )
     done < <(
 
     trusted_key_args=()
     while read keyid;do
       trusted_key_args+=( --trusted-key "$keyid" )
     done < <(

-      ${homelessGPG} --with-colons --show-keys "''${keyfiles[@]}" |
+      ${homelessGPG} --with-colons --show-keys ${self.lib.escapeShellArgs keyfiles} |

         ${self.gawk}/bin/awk -F: '$1 == "pub" { print $5 }')
 
     ${homelessGPG} --keyring="$keyring" "''${trusted_key_args[@]}" "$@"
         ${self.gawk}/bin/awk -F: '$1 == "pub" { print $5 }')
 
     ${homelessGPG} --keyring="$keyring" "''${trusted_key_args[@]}" "$@"