1 files changed, 155 insertions, 0 deletions
diff --git a/scripts/Dpkg/OpenPGP.pm b/scripts/Dpkg/OpenPGP.pm
new file mode 100644
index 0000000..2e12ea7
--- /dev/null
+++ b/scripts/Dpkg/OpenPGP.pm
@@ -0,0 +1,155 @@
+# Copyright © 2017 Guillem Jover <guillem@debian.org>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package Dpkg::OpenPGP;
+
+use strict;
+use warnings;
+
+use List::Util qw(none);
+
+use Dpkg::Gettext;
+use Dpkg::ErrorHandling;
+use Dpkg::IPC;
+use Dpkg::Path qw(find_command);
+
+our $VERSION = '0.01';
+
+my @BACKENDS = qw(
+    sop
+    sq
+    gpg
+);
+my %BACKEND = (
+    sop => 'SOP',
+    sq => 'Sequoia',
+    gpg => 'GnuPG',
+);
+
+sub new {
+    my ($this, %opts) = @_;
+    my $class = ref($this) || $this;
+
+    my $self = {};
+    bless $self, $class;
+
+    my $backend = $opts{backend} // 'auto';
+    my %backend_opts = (
+        cmdv => $opts{cmdv} // 'auto',
+        cmd => $opts{cmd} // 'auto',
+    );
+
+    if ($backend eq 'auto') {
+        # Defaults for stateless full API auto-detection.
+        $opts{needs}{api} //= 'full';
+        $opts{needs}{keystore} //= 0;
+
+        if (none { $opts{needs}{api} eq $_ } qw(full verify)) {
+            error(g_('unknown OpenPGP api requested %s'), $opts{needs}{api});
+        }
+
+        $self->{backend} = $self->_auto_backend($opts{needs}, %backend_opts);
+    } elsif (exists $BACKEND{$backend}) {
+        $self->{backend} = $self->_load_backend($BACKEND{$backend}, %backend_opts);
+        if (! $self->{backend}) {
+            error(g_('cannot load OpenPGP backend %s'), $backend);
+        }
+    } else {
+        error(g_('unknown OpenPGP backend %s'), $backend);
+    }
+
+    return $self;
+}
+
+sub _load_backend {
+    my ($self, $backend, %opts) = @_;
+
+    my $module = "Dpkg::OpenPGP::Backend::$backend";
+    eval qq{
+        pop \@INC if \$INC[-1] eq '.';
+        require $module;
+    };
+    return if $@;
+
+    return $module->new(%opts);
+}
+
+sub _auto_backend {
+    my ($self, $needs, %opts) = @_;
+
+    foreach my $backend (@BACKENDS) {
+        my $module = $self->_load_backend($BACKEND{$backend}, %opts);
+
+        if ($needs->{api} eq 'verify') {
+            next if ! $module->has_verify_cmd();
+        } else {
+            next if ! $module->has_backend_cmd();
+        }
+        next if $needs->{keystore} && ! $module->has_keystore();
+
+        return $module;
+    }
+
+    # Otherwise load a dummy backend.
+    return Dpkg::OpenPGP::Backend->new();
+}
+
+sub can_use_secrets {
+    my ($self, $key) = @_;
+
+    return 0 unless $self->{backend}->has_backend_cmd();
+    return 0 if $key->type eq 'keyfile' && ! -f $key->handle;
+    return 0 if $key->type eq 'keystore' && ! -e $key->handle;
+    return 0 unless $self->{backend}->can_use_key($key);
+    return 1;
+}
+
+sub get_trusted_keyrings {
+    my $self = shift;
+
+    return $self->{backend}->get_trusted_keyrings();
+}
+
+sub armor {
+    my ($self, $type, $in, $out) = @_;
+
+    return $self->{backend}->armor($type, $in, $out);
+}
+
+sub dearmor {
+    my ($self, $type, $in, $out) = @_;
+
+    return $self->{backend}->dearmor($type, $in, $out);
+}
+
+sub inline_verify {
+    my ($self, $inlinesigned, $data, @certs) = @_;
+
+    return $self->{backend}->inline_verify($inlinesigned, $data, @certs);
+}
+
+sub verify {
+    my ($self, $data, $sig, @certs) = @_;
+
+    return $self->{backend}->verify($data, $sig, @certs);
+}
+
+sub inline_sign {
+    my ($self, $data, $inlinesigned, $key) = @_;
+
+    return $self->{backend}->inline_sign($data, $inlinesigned, $key);
+}
+
+1;