47 lines
1.9 KiB
Text
47 lines
1.9 KiB
Text
|
#!/usr/bin/env nu
|
||
|
|
def main [
|
||
|
|
--key-type: string = ""
|
||
|
|
--new-key-path: string = ""
|
||
|
|
--new-pubkey-path: string = ""
|
||
|
|
--dry-run
|
||
|
|
]: nothing -> nothing {
|
||
|
|
let ktype = if ($key_type | is-not-empty) { $key_type } else { $env.PLAYBOOK_PARAM_KEY_TYPE? | default "" }
|
||
|
|
let key_path = if ($new_key_path | is-not-empty) { $new_key_path } else { $env.PLAYBOOK_PARAM_NEW_KEY_PATH? | default "" }
|
||
|
|
let pubkey_path = if ($new_pubkey_path | is-not-empty) { $new_pubkey_path } else { $env.PLAYBOOK_PARAM_NEW_PUBKEY_PATH? | default "" }
|
||
|
|
|
||
|
|
if ($key_path | is-empty) { error make { msg: "new-key-path is required" } }
|
||
|
|
|
||
|
|
if $dry_run {
|
||
|
|
print $"[dry-run] would validate Ed25519 keypair at ($key_path)"
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
if not ($key_path | path exists) {
|
||
|
|
error make { msg: $"Private key not found: ($key_path)" }
|
||
|
|
}
|
||
|
|
|
||
|
|
let key_check = do { ^openssl pkey -in $key_path -noout -text } | complete
|
||
|
|
if $key_check.exit_code != 0 {
|
||
|
|
error make { msg: $"Key file is not a valid PEM private key: ($key_check.stderr | str trim)" }
|
||
|
|
}
|
||
|
|
|
||
|
|
if not ($key_check.stdout | str contains "ED25519") {
|
||
|
|
error make { msg: $"Key at ($key_path) is not an Ed25519 key. Found: ($key_check.stdout | lines | first 3 | str join ' ')" }
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($pubkey_path | is-not-empty) {
|
||
|
|
if not ($pubkey_path | path exists) {
|
||
|
|
error make { msg: $"Public key not found: ($pubkey_path)" }
|
||
|
|
}
|
||
|
|
let pubkey_check = do { ^openssl pkey -in $pubkey_path -pubin -noout -text } | complete
|
||
|
|
if $pubkey_check.exit_code != 0 {
|
||
|
|
error make { msg: $"Public key file is not a valid PEM public key: ($pubkey_check.stderr | str trim)" }
|
||
|
|
}
|
||
|
|
if not ($pubkey_check.stdout | str contains "ED25519") {
|
||
|
|
error make { msg: "Public key is not Ed25519" }
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
print $"validated ($ktype) Ed25519 keypair at ($key_path)"
|
||
|
|
}
|