Added "keychain restrict" command

dedupestore/archiver.py

@@ -78,15 +78,10 @@ class Archiver(object):
         return self.exit_code_from_logger()
 
     def do_keychain_generate(self, args):
-        password = ''
-        password2 = 'x'
-        while password != password2:
-            password = getpass('Keychain password: ')
-            password2 = getpass('Keychain password again: ')
-            if password != password2:
-                logging.error('Passwords do not match')
-        keychain = KeyChain.generate(args.path, password)
-        return 0
+        return KeyChain.generate(args.path)
+
+    def do_keychain_restrict(self, args):
+        return KeyChain(args.input).restrict(args.output)
 
     def run(self, args=None):
         parser = argparse.ArgumentParser(description='Dedupestore')
@@ -104,6 +99,12 @@ class Archiver(object):
         subparser.add_argument('path', metavar='PATH', type=str,
                                help='Path to keychain')
         subparser.set_defaults(func=self.do_keychain_generate)
+        subparser = subsubparsers.add_parser('restrict')
+        subparser.add_argument('input', metavar='INPUT', type=str,
+                               help='Existing keychain')
+        subparser.add_argument('output', metavar='OUTPUT', type=str,
+                               help='Keychain to create')
+        subparser.set_defaults(func=self.do_keychain_restrict)
 
         subparser = subparsers.add_parser('create')
         subparser.set_defaults(func=self.do_create)

dedupestore/crypto.py

@@ -28,10 +28,10 @@ class KeyChain(object):
             cdata = fd.read()
         data = self.decrypt(cdata, '')
         while not data:
-            password = getpass('Keychain password: ')
-            if not password:
+            self.password = getpass('Keychain password: ')
+            if not self.password:
                 raise Exception('Keychain decryption failed')
-            data = self.decrypt(cdata, password)
+            data = self.decrypt(cdata, self.password)
             if not data:
                 logging.error('Incorrect password')
         chain = msgpack.unpackb(data)
@@ -79,15 +79,33 @@ class KeyChain(object):
             fd.write(data)
             logging.info('Key chain "%s" saved', path)
 
+    def restrict(self, path):
+        if os.path.exists(path):
+            logging.error('%s already exists', path)
+            return 1
+        self.rsa_read = self.rsa_read.publickey()
+        self.save(path, self.password)
+        return 0
+
     @staticmethod
-    def generate(path, password):
+    def generate(path):
+        if os.path.exists(path):
+            logging.error('%s already exists', path)
+            return 1
+        password = ''
+        password2 = 'x'
+        while password != password2:
+            password = getpass('Keychain password: ')
+            password2 = getpass('Keychain password again: ')
+            if password != password2:
+                logging.error('Passwords do not match')
         chain = KeyChain()
         logging.info('Generating keys')
         chain.aes_id = os.urandom(32)
         chain.rsa_read = RSA.generate(2048)
         chain.rsa_create = RSA.generate(2048)
         chain.save(path, password)
-        return chain
+        return 0
 
 class CryptoManager(object):