<commit_before># # -*- coding: utf-8 -*-
'''
Manage a GPG keychains, add keys, create keys, retrieve keys
from keyservers.  Sign, encrypt and sign & encrypt text and files.

.. versionadded:: 2015.5.0

.. note::

    The ``python-gnupg`` library and gpg binary are
    required to be installed.

'''

# Import python libs
from __future__ import absolute_import
import distutils.version  # pylint: disable=import-error,no-name-in-module
import logging
import os
import re
import time

# Import salt libs
import salt.utils
import salt.syspaths
from salt.exceptions import SaltInvocationError

# Import 3rd-party libs
import salt.ext.six as six

# Set up logging
log = logging.getLogger(__name__)

# Define the module's virtual name
__virtualname__ = 'gpg'

LETTER_TRUST_DICT = {
    'e': 'Expired',
    'q': 'Unknown',
    'n': 'Not Trusted',
    'f': 'Fully Trusted',
    'm': 'Marginally Trusted',
    'u': 'Ultimately Trusted',
    '-': 'Unknown',
}

NUM_TRUST_DICT = {
    'expired': '1',
    'unknown': '2',
    'not_trusted': '3',
    'marginally': '4',
    'fully': '5',
    'ultimately': '6',
}

INV_NUM_TRUST_DICT = {
    '1': 'Expired',
    '2': 'Unknown',
    '3': 'Not Trusted',
    '4': 'Marginally',
    '5': 'Fully Trusted',
    '6': 'Ultimately Trusted'
}

VERIFY_TRUST_LEVELS = {
    '0': 'Undefined',
    '1': 'Never',
    '2': 'Marginal',
    '3': 'Fully',
    '4': 'Ultimate'
}

HAS_LIBS = False
GPG_1_3_1 = False

try:
    import gnupg
    HAS_LIBS = True
except ImportError:
    pass


def _check_gpg():
    '''
    Looks to see if gpg binary is present on the system.
    '''
    # Get the path to the gpg binary.
    return salt.utils.which('gpg')


def __virtual__():
    '''
    Makes sure that python-gnupg and gpg are available.
    '''
    if _check_gpg() and HAS_LIBS:
        gnupg_version = distutils.version.LooseVersion(gnupg.__version__)
        if gnupg_version >= '1.3.1':
            global GPG_1_3_1
            GPG_1_3_1 = True
        return __virtualname__
    return False


def _create_gpg(user=None, gnupghome=None):
    '''
    Create the GPG object
    '''
    if not user:
        user = __salt__['config.option']('user')

    if user == 'salt':
        if gnupghome:
            homeDir = gnupghome
        else:
            homeDir = os.path.join(salt.syspaths.CONFIG_DIR, 'gpgkeys')
    else:
        if gnupghome:
            homeDir = gnupghome
        else:
            userinfo = __salt__['user.info'](user)
            if userinfo:
                homeDir = '{0}/.gnupg'.format(userinfo['home'])
            else:
                raise SaltInvocationError('User does not exist')

    if GPG_1_3_1:
        gpg = gnupg.GPG(homedir='{0}'.format(homeDir))
    else:
        gpg = gnupg.GPG(gnupghome='{0}'.format(homeDir))
    return gpg


def _list_keys(user=None, gnupghome=None, secret=False):
    '''
    Helper function for Listing keys
    '''
    gpg = _create_gpg(user, gnupghome)
    _keys = gpg.list_keys(secret)
    return _keys


def _search_keys(text, keyserver, user=None):
    '''
    Helper function for searching keys from keyserver
    '''
    gpg = _create_gpg(user)
    if keyserver:
        _keys = gpg.search_keys(text, keyserver)
    else:
        _keys = gpg.search_keys(text)
    return _keys


def search_keys(text, keyserver=None, user=None):
    '''
    Search keys from keyserver

    text
        Text to search the keyserver for, e.g. email address, keyID or fingerprint.

    keyserver
        Keyserver to use for searching for GPG keys, defaults to pgp.mit.edu

    user
        Which user's keychain to access, defaults to user Salt is running as.  Passing
        the user as 'salt' will set the GPG home directory to /etc/salt/gpgkeys.

    CLI Example:

    .. code-block:: bash

        salt '*' gpg.search_keys <EMAIL>

        salt '*' gpg.search_keys <EMAIL> keyserver=keyserver.ubuntu.com

        salt '*' gpg.search_keys <EMAIL> keyserver=keyserver.ubuntu.com user=username

    '''
    if GPG_1_3_1:
        raise SaltInvocationError('The search_keys function is not support with this version of python-gnupg.')
    else:
        if not keyserver:
            keyserver = 'pgp.mit.edu'

        _keys = []
        for _key in _search_keys(text, keyserver, user):
            tmp = {}
            tmp['keyid'] = _key['keyid']
            tmp['uids'] = _key['uids']
            if 'expires' in _key:
                if _key['expires']:
                    tmp['expires'] = time.strftime('%Y-%m-%d',
                                                   time.localtime(float(_key['expires'])))
            if 'date' in _key:
                if _key['date']:
                    tmp['created'] = time.strftime('%Y-%m-%d',
                                                   time.localtime(float(_key['date'])))
            if 'length' in _key:
                tmp['keyLength'] = _key['length']
            _keys.append(tmp)
        return _keys


def list_keys(user=None, gnupghome=None):
    '''
    List keys in GPG keychain

    user
        Which user's keychain to access, defaults to user Salt is running as.  Passing
        the user as 'salt' will set the GPG home directory to /etc/salt/gpgkeys.

    gnupghome
        Specify the location where GPG related files are stored.

    CLI Example:

    .. code-block:: bash

        salt '*' gpg.list_keys

    '''
    log.debug('GPG_1_3_1 {0}'.format(GPG_1_3_1))
    _keys = []
    for _key in _list_keys(user, gnupghome):
        tmp = {}
        tmp['keyid'] = _key['keyid']
        tmp['fingerprint'] = _key['fingerprint']
        tmp['uids'] = _key['uids']
        if 'expires' in _key:
            if _key['expires']:
                tmp['expires'] = time.strftime('%Y-%m-%d',
                                               time.localtime(float(_key['expires'])))
        if 'date' in _key:
            if _key['date']:
                tmp['created'] = time.strftime('%Y-%m-%d',
                                               time.localtime(float(_key['date'])))
        if 'length' in _key:
            tmp['keyLength'] = _key['length']
        if 'ownertrust' in _key:
            if _key['ownertrust']:
                tmp['ownerTrust'] = LETTER_TRUST_DICT[_key['ownertrust']]
        if 'trust' in _key:
            if _key['trust']:
                tmp['trust'] = LETTER_TRUST_DICT[_key['trust']]
        _keys.append(tmp)
    return _keys


def list_secret_keys(user=None, gnupghome=None):
    '''
    List secret keys in GPG keychain

    user
        Which user's keychain to access, defaults to user Salt is running as.  Passing
        the user as 'salt' will set the GPG home directory to /etc/salt/gpgkeys.

    gnupghome
        Specify the location where GPG related files are stored.

    CLI Example:

    .. code-block:: bash

        salt '*' gpg.list_secret_keys
    '''
    _keys = []
    for _key in _list_keys(user, gnupghome, secret=True):
        tmp = {}
        tmp['keyid'] = _key['keyid']
        tmp['fingerprint'] = _key['fingerprint']
        tmp['uids'] = _key['uids']
        if 'expires' in _key:
            if _key['expires']:
                tmp['expires'] = time.strftime('%Y-%m-%d',
                                               time.localtime(float(_key['expires'])))
        if 'date' in _key:
            if _key['date']:
                tmp['created'] = time.strftime('%Y-%m-%d',
                                               time.localtime(float(_key['date'])))
        if 'length' in _key:
            tmp['keyLength'] = _key['length']
        if 'ownertrust' in _key:
            if _key['ownertrust']:
                tmp['ownerTrust'] = LETTER_TRUST_DICT[_key['ownertrust']]
        if 'trust' in _key:
            if _key['trust']:
                tmp['trust'] = LETTER_TRUST_DICT[_key['trust']]
        _keys.append(tmp)
    return _keys


def create_key(key_type='RSA',
               key_length=1024,
               name_real='Autogenerated Key',
               name_comment='Generated by SaltStack',
               name_email=None,
               subkey_type=None,
               subkey_length=None,
               expire_date=None,
               use_passphrase=False,
               user=None,
               gnupghome=None):
    '''
    Create a key in the GPG keychain

    .. note::

        GPG key generation requires *a lot* of entropy and randomness.
        Difficult to do over a remote connection, consider having
        another process available which is generating randomness for
        the machine.  Also especially difficult on virtual machines,
        consider the `rng-tools
        <http://www.gnu.org/software/hurd/user/tlecarrour/rng-tools.html>`_
        package.

        The create_key process takes awhile so increasing the timeout
        may be necessary, e.g. -t 15.

    key_type
        The type of the primary key to generate. It must be capable of signing.
        'RSA' or 'DSA'.

    key_length
        The length of the primary key in bits.

    name_real
        The real name of the user identity which is represented by the key.

    name_comment
        A comment to attach to the user id.

    name_email
        An email address for the user.

    subkey_type
        The type of the secondary key to generate.

    subkey_length
        The length of the secondary key in bits.

    expire_date
        The expiration date for the primary and any secondary key.
        You can specify an ISO date, A number of days/weeks/months/years,
        an epoch value, or 0 for a non-expiring key.

    use_passphrase
        Whether to use a passphrase with the signing key.  Passphrase is received from pillar.

    user
        Which user's keychain to access, defaults to user Salt is running as.  Passing
        the user as 'salt' will set the GPG home directory to /etc/salt/gpgkeys.

    gnupghome
        Specify the location where GPG related files are stored.

    CLI Example:

    .. code-block:: bash

        salt -t 15 '*' gpg.create_key

    '''
    ret = {
           'res': True,
           'fingerprint': '',
           'message': ''
          }

    create_params = {'key_type': key_type,
                     'key_length': key_length,
                     'name_real': name_real,
                     'name_comment': name_comment,
                     }

    gpg = _create_gpg(user, gnupghome)

    if name_email:
        create_params['name_email'] = name_email

    if subkey_type:
        create_params['subkey_type'] = subkey_type

    if subkey_length:
        create_params['subkey_length'] = subkey_length

    if expire_date:
        create_params['expire_date'] = expire_date

    if use_passphrase:
        gpg_passphrase = __salt__['pillar.item']('gpg_passphrase')
        if not gpg_passphrase:
            ret['res'] = False
            ret['message'] = "gpg_passphrase not available in pillar."
            return ret
        else:
            create_params['passphrase'] = gpg_passphrase

    input_data = gpg.gen_key_input(**create_params)

    key = gpg.gen_key(input_data)
    if key.fingerprint:
        ret['fingerprint'] = key.fingerprint
        ret['message'] = 'GPG key pair successfully generated.'
    else:
        ret['res'] = False
        ret['message'] = 'Unable to generate GPG key pair.'
    return ret


def delete_key(keyid=None,
               fingerprint=None,
               delete_secret=False,
               user=None,
               gnupghome=None):
    '''
    Get a key from the GPG keychain

    keyid
        The keyid of the key to be deleted.

    fingerprint
        The fingerprint of the key to be deleted.

    delete_secret
        Whether to delete a corresponding secret key prior to deleting the public key.
        Secret keys must be deleted before deleting any corresponding public keys.

    user
        Which user's keychain to access, defaults to user Salt is running as.  Passing
        the user as 'salt' will set the GPG home directory to /etc/salt/gpgkeys.

    gnupghome
        Specify the location where GPG related files are stored.

    CLI Example:

    .. code-block:: bash

        salt '*' gpg.delete_key keyid=3FAD9F1E

        salt '*' gpg.delete_key fingerprint=53C96788253E58416D20BCD352952C84C3252192

        salt '*' gpg.delete_key keyid=3FAD9F1E user=username

        salt '*' gpg.delete_key keyid=3FAD9F1E user=username delete_secret=True

    '''
    ret = {
           'res': True,
           'message': ''
          }

    if fingerprint and keyid:
        ret['res'] = False
        ret['message'] = 'Only specify one argument, fingerprint or keyid'
        return ret

    if not fingerprint and not keyid:
        ret['res'] = False
        ret['message'] = 'Required argument, fingerprint or keyid'
        return ret

    gpg = _create_gpg(user, gnupghome)
    key = get_key(keyid, fingerprint, user)
    if key:
        fingerprint = key['fingerprint']
        skey = get_secret_key(keyid, fingerprint, user)
        if skey and not delete_secret:
            ret['res'] = False
            ret['message'] = 'Secret key exists, delete first or pass delete_secret=True.'
            return ret
        elif skey and delete_secret:
            # Delete the secret key
            if str(gpg.delete_keys(fingerprint, True)) == 'ok':
                ret['message'] = 'Secret key for {0} deleted\n'.format(fingerprint)
        # Delete the public key
        if str(gpg.delete_keys(fingerprint)) == 'ok':
            ret['message'] += 'Public key for {0} deleted'.format(fingerprint)
        ret['res'] = True
        return ret
    else:
        ret['res'] = False
        ret['message'] = 'Key not available in keychain.'
        return ret


def get_key(keyid=None, fingerprint=None, user=None, gnupghome=None):
    '''
    Get a key from the GPG keychain

    keyid
        The keyid of the key to be retrieved.

    fingerprint
        The fingerprint of the key to be retrieved.

    user
        Which user's keychain to access, defaults to user Salt is running as.  Passing
        the user as 'salt' will set the GPG home directory to /etc/salt/gpgkeys.

    gnupghome
        Specify the location where GPG related files are stored.

    CLI Example:

    .. code-block:: bash

        salt '*' gpg.get_key keyid=3FAD9F1E

        salt '*' gpg.get_key fingerprint=53C96788253E58416D20BCD352952C84C3252192

        salt '*' gpg.get_key keyid=3FAD9F1E user=username

    '''
    tmp = {}
    for _key in _list_keys(user, gnupghome):
        if _key['fingerprint'] == fingerprint or _key['keyid'] == keyid:
            tmp['keyid'] = _key['keyid']
            tmp['fingerprint'] = _key['fingerprint']
            tmp['uids'] = _key['uids']
            if 'expires' in _key:
                if _key['expires']:
                    tmp['expires'] = time.strftime('%Y-%m-%d',
                                                   time.localtime(float(_key['expires'])))
            if 'date' in _key:
                if _key['date']:
                    tmp['created'] = time.strftime('%Y-%m-%d',
                                                   time.localtime(float(_key['date'])))
            if 'length' in _key:
                tmp['keyLength'] = _key['length']
            if 'ownertrust' in _key:
                if _key['ownertrust']:
                    tmp['ownerTrust'] = LETTER_TRUST_DICT[_key['ownertrust']]
            if 'trust' in _key:
                if _key['trust']:
                    tmp['trust'] = LETTER_TRUST_DICT[_key['trust']]
    if not tmp:
        return False
    else:
        return tmp


def get_secret_key(keyid=None, fingerprint=None, user=None, gnupghome=None):
    '''
    Get a key from the GPG keychain

    keyid
        The keyid of the key to be retrieved.

    fingerprint
        The fingerprint of the key to be retrieved.

    user
        Which user's keychain to access, defaults to user Salt is running as.  Passing
        the user as 'salt' will set the GPG home directory to /etc/salt/gpgkeys.

    gnupghome
        Specify the location where GPG related files are stored.

    CLI Example:

    .. code-block:: bash

        salt '*' gpg.get_secret_key keyid=3FAD9F1E

        salt '*' gpg.get_secret_key fingerprint=53C96788253E58416D20BCD352952C84C3252192

        salt '*' gpg.get_secret_key keyid=3FAD9F1E user=username


    '''
    tmp = {}
    for _key in _list_keys(user, gnupghome, secret=True):
        if _key['fingerprint'] == fingerprint or _key['keyid'] == keyid:
            tmp['keyid'] = _key['keyid']
            tmp['fingerprint'] = _key['fingerprint']
            tmp['uids'] = _key['uids']
            if 'expires' in _key:
                if _key['expires']:
                    tmp['expires'] = time.strftime('%Y-%m-%d',
                                                   time.localtime(float(_key['expires'])))
            if 'date' in _key:
                if _key['date']:
                    tmp['created'] = time.strftime('%Y-%m-%d',
                                                   time.localtime(float(_key['date'])))
            if 'length' in _key:
                tmp['keyLength'] = _key['length']
            if 'ownertrust' in _key:
                if _key['ownertrust']:
                    tmp['ownerTrust'] = LETTER_TRUST_DICT[_key['ownertrust']]
            if 'trust' in _key:
                if _key['trust']:
                    tmp['trust'] = LETTER_TRUST_DICT[_key['trust']]
    if not tmp:
        return False
    else:
        return tmp


def import_key(user=None,
               text=None,
               filename=None,
               gnupghome=None):
    '''
    Import a key from text or file

    user
        Which user's keychain to access, defaults to user Salt is running as.  Passing
        the user as 'salt' will set the GPG home directory to /etc/salt/gpgkeys.

    text
        The text containing to import.

    filename
        The filename containing the key to import.

    gnupghome
        Specify the location where GPG related files are stored.

    CLI Example:

    .. code-block:: bash

        salt '*' gpg.import_key text='-----BEGIN PGP PUBLIC KEY BLOCK-----\n ... -----END PGP PUBLIC KEY BLOCK-----'
        salt '*' gpg.import_key filename='/path/to/public-key-file'
    '''
    ret = {
           'res': True,
           'message': ''
          }

    gpg = _create_gpg(user, gnupghome)

    if not text and not filename:
        raise SaltInvocationError('filename or text must be passed.')

    if filename:
        try:
            with salt.utils.flopen(filename, 'rb') as _fp:
                lines = _fp.readlines()
                text = ''.join(lines)
        except IOError:
            raise SaltInvocationError('filename does not exist.')

    import_result = gpg.import_keys(text)
    log.debug('imported_data {0}'.format(list(import_result.__dict__.keys())))
    log.debug('imported_data {0}'.format(import_result.counts))

    if import_result.imported or import_result.imported_rsa:
        ret['message'] = 'Successfully imported key(s).'
    elif import_result.unchanged:
        ret['message'] = 'Key(s) already exist in keychain.'
    elif import_result.not_imported:
        ret['res'] = False
        ret['message'] = 'Unable to import key.'
    elif not import_result.count:
        ret['res'] = False
        ret['message'] = 'Unable to import key.'<commit_msg>gpg module: fix result checking of import_key()<commit_after># # -*- coding: utf-8 -*-
'''
Manage a GPG keychains, add keys, create keys, retrieve keys
from keyservers.  Sign, encrypt and sign & encrypt text and files.

.. versionadded:: 2015.5.0

.. note::

    The ``python-gnupg`` library and gpg binary are
    required to be installed.

'''

# Import python libs
from __future__ import absolute_import
import distutils.version  # pylint: disable=import-error,no-name-in-module
import logging
import os
import re
import time

# Import salt libs
import salt.utils
import salt.syspaths
from salt.exceptions import SaltInvocationError

# Import 3rd-party libs
import salt.ext.six as six

# Set up logging
log = logging.getLogger(__name__)

# Define the module's virtual name
__virtualname__ = 'gpg'

LETTER_TRUST_DICT = {
    'e': 'Expired',
    'q': 'Unknown',
    'n': 'Not Trusted',
    'f': 'Fully Trusted',
    'm': 'Marginally Trusted',
    'u': 'Ultimately Trusted',
    '-': 'Unknown',
}

NUM_TRUST_DICT = {
    'expired': '1',
    'unknown': '2',
    'not_trusted': '3',
    'marginally': '4',
    'fully': '5',
    'ultimately': '6',
}

INV_NUM_TRUST_DICT = {
    '1': 'Expired',
    '2': 'Unknown',
    '3': 'Not Trusted',
    '4': 'Marginally',
    '5': 'Fully Trusted',
    '6': 'Ultimately Trusted'
}

VERIFY_TRUST_LEVELS = {
    '0': 'Undefined',
    '1': 'Never',
    '2': 'Marginal',
    '3': 'Fully',
    '4': 'Ultimate'
}

HAS_LIBS = False
GPG_1_3_1 = False

try:
    import gnupg
    HAS_LIBS = True
except ImportError:
    pass


def _check_gpg():
    '''
    Looks to see if gpg binary is present on the system.
    '''
    # Get the path to the gpg binary.
    return salt.utils.which('gpg')


def __virtual__():
    '''
    Makes sure that python-gnupg and gpg are available.
    '''
    if _check_gpg() and HAS_LIBS:
        gnupg_version = distutils.version.LooseVersion(gnupg.__version__)
        if gnupg_version >= '1.3.1':
            global GPG_1_3_1
            GPG_1_3_1 = True
        return __virtualname__
    return False


def _create_gpg(user=None, gnupghome=None):
    '''
    Create the GPG object
    '''
    if not user:
        user = __salt__['config.option']('user')

    if user == 'salt':
        if gnupghome:
            homeDir = gnupghome
        else:
            homeDir = os.path.join(salt.syspaths.CONFIG_DIR, 'gpgkeys')
    else:
        if gnupghome:
            homeDir = gnupghome
        else:
            userinfo = __salt__['user.info'](user)
            if userinfo:
                homeDir = '{0}/.gnupg'.format(userinfo['home'])
            else:
                raise SaltInvocationError('User does not exist')

    if GPG_1_3_1:
        gpg = gnupg.GPG(homedir='{0}'.format(homeDir))
    else:
        gpg = gnupg.GPG(gnupghome='{0}'.format(homeDir))
    return gpg


def _list_keys(user=None, gnupghome=None, secret=False):
    '''
    Helper function for Listing keys
    '''
    gpg = _create_gpg(user, gnupghome)
    _keys = gpg.list_keys(secret)
    return _keys


def _search_keys(text, keyserver, user=None):
    '''
    Helper function for searching keys from keyserver
    '''
    gpg = _create_gpg(user)
    if keyserver:
        _keys = gpg.search_keys(text, keyserver)
    else:
        _keys = gpg.search_keys(text)
    return _keys


def search_keys(text, keyserver=None, user=None):
    '''
    Search keys from keyserver

    text
        Text to search the keyserver for, e.g. email address, keyID or fingerprint.

    keyserver
        Keyserver to use for searching for GPG keys, defaults to pgp.mit.edu

    user
        Which user's keychain to access, defaults to user Salt is running as.  Passing
        the user as 'salt' will set the GPG home directory to /etc/salt/gpgkeys.

    CLI Example:

    .. code-block:: bash

        salt '*' gpg.search_keys <EMAIL>

        salt '*' gpg.search_keys <EMAIL> keyserver=keyserver.ubuntu.com

        salt '*' gpg.search_keys <EMAIL> keyserver=keyserver.ubuntu.com user=username

    '''
    if GPG_1_3_1:
        raise SaltInvocationError('The search_keys function is not support with this version of python-gnupg.')
    else:
        if not keyserver:
            keyserver = 'pgp.mit.edu'

        _keys = []
        for _key in _search_keys(text, keyserver, user):
            tmp = {}
            tmp['keyid'] = _key['keyid']
            tmp['uids'] = _key['uids']
            if 'expires' in _key:
                if _key['expires']:
                    tmp['expires'] = time.strftime('%Y-%m-%d',
                                                   time.localtime(float(_key['expires'])))
            if 'date' in _key:
                if _key['date']:
                    tmp['created'] = time.strftime('%Y-%m-%d',
                                                   time.localtime(float(_key['date'])))
            if 'length' in _key:
                tmp['keyLength'] = _key['length']
            _keys.append(tmp)
        return _keys


def list_keys(user=None, gnupghome=None):
    '''
    List keys in GPG keychain

    user
        Which user's keychain to access, defaults to user Salt is running as.  Passing
        the user as 'salt' will set the GPG home directory to /etc/salt/gpgkeys.

    gnupghome
        Specify the location where GPG related files are stored.

    CLI Example:

    .. code-block:: bash

        salt '*' gpg.list_keys

    '''
    log.debug('GPG_1_3_1 {0}'.format(GPG_1_3_1))
    _keys = []
    for _key in _list_keys(user, gnupghome):
        tmp = {}
        tmp['keyid'] = _key['keyid']
        tmp['fingerprint'] = _key['fingerprint']
        tmp['uids'] = _key['uids']
        if 'expires' in _key:
            if _key['expires']:
                tmp['expires'] = time.strftime('%Y-%m-%d',
                                               time.localtime(float(_key['expires'])))
        if 'date' in _key:
            if _key['date']:
                tmp['created'] = time.strftime('%Y-%m-%d',
                                               time.localtime(float(_key['date'])))
        if 'length' in _key:
            tmp['keyLength'] = _key['length']
        if 'ownertrust' in _key:
            if _key['ownertrust']:
                tmp['ownerTrust'] = LETTER_TRUST_DICT[_key['ownertrust']]
        if 'trust' in _key:
            if _key['trust']:
                tmp['trust'] = LETTER_TRUST_DICT[_key['trust']]
        _keys.append(tmp)
    return _keys


def list_secret_keys(user=None, gnupghome=None):
    '''
    List secret keys in GPG keychain

    user
        Which user's keychain to access, defaults to user Salt is running as.  Passing
        the user as 'salt' will set the GPG home directory to /etc/salt/gpgkeys.

    gnupghome
        Specify the location where GPG related files are stored.

    CLI Example:

    .. code-block:: bash

        salt '*' gpg.list_secret_keys
    '''
    _keys = []
    for _key in _list_keys(user, gnupghome, secret=True):
        tmp = {}
        tmp['keyid'] = _key['keyid']
        tmp['fingerprint'] = _key['fingerprint']
        tmp['uids'] = _key['uids']
        if 'expires' in _key:
            if _key['expires']:
                tmp['expires'] = time.strftime('%Y-%m-%d',
                                               time.localtime(float(_key['expires'])))
        if 'date' in _key:
            if _key['date']:
                tmp['created'] = time.strftime('%Y-%m-%d',
                                               time.localtime(float(_key['date'])))
        if 'length' in _key:
            tmp['keyLength'] = _key['length']
        if 'ownertrust' in _key:
            if _key['ownertrust']:
                tmp['ownerTrust'] = LETTER_TRUST_DICT[_key['ownertrust']]
        if 'trust' in _key:
            if _key['trust']:
                tmp['trust'] = LETTER_TRUST_DICT[_key['trust']]
        _keys.append(tmp)
    return _keys


def create_key(key_type='RSA',
               key_length=1024,
               name_real='Autogenerated Key',
               name_comment='Generated by SaltStack',
               name_email=None,
               subkey_type=None,
               subkey_length=None,
               expire_date=None,
               use_passphrase=False,
               user=None,
               gnupghome=None):
    '''
    Create a key in the GPG keychain

    .. note::

        GPG key generation requires *a lot* of entropy and randomness.
        Difficult to do over a remote connection, consider having
        another process available which is generating randomness for
        the machine.  Also especially difficult on virtual machines,
        consider the `rng-tools
        <http://www.gnu.org/software/hurd/user/tlecarrour/rng-tools.html>`_
        package.

        The create_key process takes awhile so increasing the timeout
        may be necessary, e.g. -t 15.

    key_type
        The type of the primary key to generate. It must be capable of signing.
        'RSA' or 'DSA'.

    key_length
        The length of the primary key in bits.

    name_real
        The real name of the user identity which is represented by the key.

    name_comment
        A comment to attach to the user id.

    name_email
        An email address for the user.

    subkey_type
        The type of the secondary key to generate.

    subkey_length
        The length of the secondary key in bits.

    expire_date
        The expiration date for the primary and any secondary key.
        You can specify an ISO date, A number of days/weeks/months/years,
        an epoch value, or 0 for a non-expiring key.

    use_passphrase
        Whether to use a passphrase with the signing key.  Passphrase is received from pillar.

    user
        Which user's keychain to access, defaults to user Salt is running as.  Passing
        the user as 'salt' will set the GPG home directory to /etc/salt/gpgkeys.

    gnupghome
        Specify the location where GPG related files are stored.

    CLI Example:

    .. code-block:: bash

        salt -t 15 '*' gpg.create_key

    '''
    ret = {
           'res': True,
           'fingerprint': '',
           'message': ''
          }

    create_params = {'key_type': key_type,
                     'key_length': key_length,
                     'name_real': name_real,
                     'name_comment': name_comment,
                     }

    gpg = _create_gpg(user, gnupghome)

    if name_email:
        create_params['name_email'] = name_email

    if subkey_type:
        create_params['subkey_type'] = subkey_type

    if subkey_length:
        create_params['subkey_length'] = subkey_length

    if expire_date:
        create_params['expire_date'] = expire_date

    if use_passphrase:
        gpg_passphrase = __salt__['pillar.item']('gpg_passphrase')
        if not gpg_passphrase:
            ret['res'] = False
            ret['message'] = "gpg_passphrase not available in pillar."
            return ret
        else:
            create_params['passphrase'] = gpg_passphrase

    input_data = gpg.gen_key_input(**create_params)

    key = gpg.gen_key(input_data)
    if key.fingerprint:
        ret['fingerprint'] = key.fingerprint
        ret['message'] = 'GPG key pair successfully generated.'
    else:
        ret['res'] = False
        ret['message'] = 'Unable to generate GPG key pair.'
    return ret


def delete_key(keyid=None,
               fingerprint=None,
               delete_secret=False,
               user=None,
               gnupghome=None):
    '''
    Get a key from the GPG keychain

    keyid
        The keyid of the key to be deleted.

    fingerprint
        The fingerprint of the key to be deleted.

    delete_secret
        Whether to delete a corresponding secret key prior to deleting the public key.
        Secret keys must be deleted before deleting any corresponding public keys.

    user
        Which user's keychain to access, defaults to user Salt is running as.  Passing
        the user as 'salt' will set the GPG home directory to /etc/salt/gpgkeys.

    gnupghome
        Specify the location where GPG related files are stored.

    CLI Example:

    .. code-block:: bash

        salt '*' gpg.delete_key keyid=3FAD9F1E

        salt '*' gpg.delete_key fingerprint=53C96788253E58416D20BCD352952C84C3252192

        salt '*' gpg.delete_key keyid=3FAD9F1E user=username

        salt '*' gpg.delete_key keyid=3FAD9F1E user=username delete_secret=True

    '''
    ret = {
           'res': True,
           'message': ''
          }

    if fingerprint and keyid:
        ret['res'] = False
        ret['message'] = 'Only specify one argument, fingerprint or keyid'
        return ret

    if not fingerprint and not keyid:
        ret['res'] = False
        ret['message'] = 'Required argument, fingerprint or keyid'
        return ret

    gpg = _create_gpg(user, gnupghome)
    key = get_key(keyid, fingerprint, user)
    if key:
        fingerprint = key['fingerprint']
        skey = get_secret_key(keyid, fingerprint, user)
        if skey and not delete_secret:
            ret['res'] = False
            ret['message'] = 'Secret key exists, delete first or pass delete_secret=True.'
            return ret
        elif skey and delete_secret:
            # Delete the secret key
            if str(gpg.delete_keys(fingerprint, True)) == 'ok':
                ret['message'] = 'Secret key for {0} deleted\n'.format(fingerprint)
        # Delete the public key
        if str(gpg.delete_keys(fingerprint)) == 'ok':
            ret['message'] += 'Public key for {0} deleted'.format(fingerprint)
        ret['res'] = True
        return ret
    else:
        ret['res'] = False
        ret['message'] = 'Key not available in keychain.'
        return ret


def get_key(keyid=None, fingerprint=None, user=None, gnupghome=None):
    '''
    Get a key from the GPG keychain

    keyid
        The keyid of the key to be retrieved.

    fingerprint
        The fingerprint of the key to be retrieved.

    user
        Which user's keychain to access, defaults to user Salt is running as.  Passing
        the user as 'salt' will set the GPG home directory to /etc/salt/gpgkeys.

    gnupghome
        Specify the location where GPG related files are stored.

    CLI Example:

    .. code-block:: bash

        salt '*' gpg.get_key keyid=3FAD9F1E

        salt '*' gpg.get_key fingerprint=53C96788253E58416D20BCD352952C84C3252192

        salt '*' gpg.get_key keyid=3FAD9F1E user=username

    '''
    tmp = {}
    for _key in _list_keys(user, gnupghome):
        if _key['fingerprint'] == fingerprint or _key['keyid'] == keyid:
            tmp['keyid'] = _key['keyid']
            tmp['fingerprint'] = _key['fingerprint']
            tmp['uids'] = _key['uids']
            if 'expires' in _key:
                if _key['expires']:
                    tmp['expires'] = time.strftime('%Y-%m-%d',
                                                   time.localtime(float(_key['expires'])))
            if 'date' in _key:
                if _key['date']:
                    tmp['created'] = time.strftime('%Y-%m-%d',
                                                   time.localtime(float(_key['date'])))
            if 'length' in _key:
                tmp['keyLength'] = _key['length']
            if 'ownertrust' in _key:
                if _key['ownertrust']:
                    tmp['ownerTrust'] = LETTER_TRUST_DICT[_key['ownertrust']]
            if 'trust' in _key:
                if _key['trust']:
                    tmp['trust'] = LETTER_TRUST_DICT[_key['trust']]
    if not tmp:
        return False
    else:
        return tmp


def get_secret_key(keyid=None, fingerprint=None, user=None, gnupghome=None):
    '''
    Get a key from the GPG keychain

    keyid
        The keyid of the key to be retrieved.

    fingerprint
        The fingerprint of the key to be retrieved.

    user
        Which user's keychain to access, defaults to user Salt is running as.  Passing
        the user as 'salt' will set the GPG home directory to /etc/salt/gpgkeys.

    gnupghome
        Specify the location where GPG related files are stored.

    CLI Example:

    .. code-block:: bash

        salt '*' gpg.get_secret_key keyid=3FAD9F1E

        salt '*' gpg.get_secret_key fingerprint=53C96788253E58416D20BCD352952C84C3252192

        salt '*' gpg.get_secret_key keyid=3FAD9F1E user=username


    '''
    tmp = {}
    for _key in _list_keys(user, gnupghome, secret=True):
        if _key['fingerprint'] == fingerprint or _key['keyid'] == keyid:
            tmp['keyid'] = _key['keyid']
            tmp['fingerprint'] = _key['fingerprint']
            tmp['uids'] = _key['uids']
            if 'expires' in _key:
                if _key['expires']:
                    tmp['expires'] = time.strftime('%Y-%m-%d',
                                                   time.localtime(float(_key['expires'])))
            if 'date' in _key:
                if _key['date']:
                    tmp['created'] = time.strftime('%Y-%m-%d',
                                                   time.localtime(float(_key['date'])))
            if 'length' in _key:
                tmp['keyLength'] = _key['length']
            if 'ownertrust' in _key:
                if _key['ownertrust']:
                    tmp['ownerTrust'] = LETTER_TRUST_DICT[_key['ownertrust']]
            if 'trust' in _key:
                if _key['trust']:
                    tmp['trust'] = LETTER_TRUST_DICT[_key['trust']]
    if not tmp:
        return False
    else:
        return tmp


def import_key(user=None,
               text=None,
               filename=None,
               gnupghome=None):
    '''
    Import a key from text or file

    user
        Which user's keychain to access, defaults to user Salt is running as.  Passing
        the user as 'salt' will set the GPG home directory to /etc/salt/gpgkeys.

    text
        The text containing to import.

    filename
        The filename containing the key to import.

    gnupghome
        Specify the location where GPG related files are stored.

    CLI Example:

    .. code-block:: bash

        salt '*' gpg.import_key text='-----BEGIN PGP PUBLIC KEY BLOCK-----\n ... -----END PGP PUBLIC KEY BLOCK-----'
        salt '*' gpg.import_key filename='/path/to/public-key-file'
    '''
    ret = {
           'res': True,
           'message': ''
          }

    gpg = _create_gpg(user, gnupghome)

    if not text and not filename:
        raise SaltInvocationError('filename or text must be passed.')

    if filename:
        try:
            with salt.utils.flopen(filename, 'rb') as _fp:
                lines = _fp.readlines()
                text = ''.join(lines)
        except IOError:
            raise SaltInvocationError('filename does not exist.')

    import_result = gpg.import_keys(text)
    counts = import_result.counts
    log.debug('imported_data {0}'.format(list(import_result.__dict__.keys())))
    log.debug('imported_data {0}'.format(counts))

    if counts['imported'] or counts['imported_rsa']:
        ret['message'] = 'Successfully imported key(s).'
    elif counts['unchanged']:
        ret['message'] = 'Key(s) already exist in keychain.'
    elif counts['not_imported']:
        ret['res'] = False
        ret['message'] = 'Unable to import key.'
    elif not counts['count']:
        ret['res'] = False
        ret['message'] = 'Unable to import key.'
{'fraction_non_alphanumeric': 0.10850734725444702, 'fraction_numerical': 0.009435421500386697, 'mean_word_length': 1.97728144907514, 'pattern_counts': {'":': 0, '<': 11, '<?xml version=': 0, '>': 13, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 40, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2315078', 'n_tokens_mistral': 12477, 'n_tokens_neox': 11617, 'n_words': 3297}