feat(crypt-gpg): handle multiple gpg pubkeys

diff --git a/modules.d/91crypt-gpg/crypt-gpg-lib.sh b/modules.d/91crypt-gpg/crypt-gpg-lib.sh
index 59fb4d3d434285405fe63ec73b8d7b0f987c7bc0..95cafb5d3ed6dac1d3c01361c4f10ae19298e2b3 100755 (executable)
--- a/modules.d/91crypt-gpg/crypt-gpg-lib.sh
+++ b/modules.d/91crypt-gpg/crypt-gpg-lib.sh
@@ -36,11 +36,13 @@ gpg_decrypt() {
     gpgMinorVersion="$(gpg --version | sed -n 1p | sed -n -r -e 's|.* [0-9]*\.([0-9]*).*|\1|p')"
 
     if [ "${gpgMajorVersion}" -ge 2 ] && [ "${gpgMinorVersion}" -ge 1 ] \
-        && [ -f /root/crypt-public-key.gpg ] && getargbool 1 rd.luks.smartcard; then
+        && ls /root/crypt-public-key*.gpg > /dev/null 2>&1 && getargbool 1 rd.luks.smartcard; then
         useSmartcard="1"
         echo "allow-loopback-pinentry" >> "$gpghome/gpg-agent.conf"
         GNUPGHOME="$gpghome" gpg-agent --quiet --daemon
-        GNUPGHOME="$gpghome" gpg --quiet --no-tty --import < /root/crypt-public-key.gpg
+        for file in /root/crypt-public-key*.gpg; do
+            GNUPGHOME="$gpghome" gpg --quiet --no-tty --import < "$file"
+        done
         GNUPGHOME="$gpghome" gpg-connect-agent 1> /dev/null learn /bye
         local smartcardSerialNumber
         smartcardSerialNumber="$(GNUPGHOME=$gpghome gpg --no-tty --card-status \

diff --git a/modules.d/91crypt-gpg/module-setup.sh b/modules.d/91crypt-gpg/module-setup.sh
index 501869a26e96a511acfa05fcee9612c1f29034ab..205d563c38ee6b28d20b122deeb58c7545425952 100755 (executable)
--- a/modules.d/91crypt-gpg/module-setup.sh
+++ b/modules.d/91crypt-gpg/module-setup.sh
@@ -30,12 +30,15 @@ install() {
         inst_multiple gpg-agent
         inst_multiple gpg-connect-agent
         inst_multiple -o /usr/libexec/scdaemon /usr/lib/gnupg/scdaemon
-        cp "$dracutsysrootdir$(sc_public_key)" "${initdir}/root/"
+
+        while IFS= read -r -d '' key; do
+            cp "$dracutsysrootdir$key" "${initdir}/root/"
+        done < <(sc_public_key)
     fi
 }
 
 sc_public_key() {
-    echo -n "/etc/dracut.conf.d/crypt-public-key.gpg"
+    find /etc/dracut.conf.d -maxdepth 1 -type f -iname 'crypt-public-key*.gpg' -print0
 }
 
 # CCID Smartcard support requires GnuPG >= 2.1 with scdaemon and libusb
@@ -65,9 +68,10 @@ sc_supported() {
 }
 
 sc_requested() {
-    if [ -f "$dracutsysrootdir$(sc_public_key)" ]; then
-        return 0
-    else
-        return 1
-    fi
+    while IFS= read -r -d '' key; do
+        if [ -f "$dracutsysrootdir$key" ]; then
+            return 0
+        fi
+    done < <(sc_public_key)
+    return 1
 }