<?php

function rg_gpg_set_error($s)
{
	global $rg_gpg_error;
	rg_log('gpg_set_error: ' . $s);
	$rg_gpg_error = $s;
}

function rg_gpg_error()
{
	global $rg_gpg_error;
	return $rg_gpg_error;
}

/*
 * Generates a key
 */
function rg_gpg_key_gen($user_id)
{
	$ret = array('ok' => 0);
	do {
		// TODO: hd - how to clean it? Take care of on current access! Lock?
		$hd = rg_tmp_path('gpg_key_gen_hd-' . rg_id(16), 120);
		$ehd = escapeshellarg($hd);
		$kr = rg_tmp_path('gpg_key_gen_kr-' . rg_id(16), 120);
		$ekr = escapeshellarg($kr);
		$euser_id = escapeshellarg($user_id);

		if (!is_dir($hd)) {
			$r = @mkdir($hd, 0700);
			if ($r === FALSE) {
				$ret['errmsg'] = 'cannot create gpg homedir [' . $hd . ']: '
					. rg_php_err();
				break;
			}
		}

		$base = 'gpg2'
			. ' --no-options'
			. ' --lock-never'
			. ' --keyring ' . $ekr
			. ' --no-default-keyring'
			. ' --homedir ' . $ehd;

		$a = array(
			'cmds' => array(
				'cmd1' => array(
					'cmd' => $base
						. ' --passphrase \'\''
						. ' --batch'
						. ' --quick-generate-key'
						. ' ' . $euser_id
						. ' rsa4096 default never'
				)
			)
		);
		$r = rg_exec2($a);
		if (($r['ok'] != 1) || ($r['cmds']['cmd1']['exitcode'] != 0)) {
			$ret['errmsg'] = 'cannot generate: '
				. $r['cmds']['cmd1']['last_errmsg']
				. ' [' . $r['cmds']['cmd1']['err_buf'] . ']';
			break;
		}

		$a = array(
			'cmds' => array(
				'cmd1' => array(
					'cmd' => $base
						. ' --export-secret-keys'
						. ' --armour'
				)
			)
		);
		$r = rg_exec2($a);
		if (($r['ok'] != 1) || ($r['cmds']['cmd1']['exitcode'] != 0)) {
			$ret['errmsg'] = 'cannot export secret: '
				. $r['cmds']['cmd1']['last_errmsg']
				. ' [' . $r['cmds']['cmd1']['err_buf'] . ']';
			break;
		}
		$ret['priv_key'] = $r['cmds']['cmd1']['in_buf'];

		$a = array(
			'cmds' => array(
				'cmd1' => array(
					'cmd' => $base
						. ' --export'
						. ' --armour'
				)
			)
		);
		$r = rg_exec2($a);
		if (($r['ok'] != 1) || ($r['cmds']['cmd1']['exitcode'] != 0)) {
			$ret['errmsg'] = 'cannot export public: '
				. $r['cmds']['cmd1']['last_errmsg']
				. ' [' . $r['cmds']['cmd1']['err_buf'] . ']';
			break;
		}
		$ret['pub_key'] = $r['cmds']['cmd1']['in_buf'];

		$ret['ok'] = 1;
	} while (0);
	rg_del_tree($kr);
	@unlink($kr . '.meta');
	rg_del_tree($hd);
	@unlink($hd . '.meta');

	return $ret;
}

/*
 * Save a keyring based on a private key (not used)
 */
function rg_gpg_save_kr($out, $key)
{
	rg_log_enter('gpg_save_kr');

	$ret = array('ok' => 0);
	do {
		// TODO: hd - how to clean it? Take care of on current access! Lock?
		$hd = rg_tmp_path('gpg_save_kr_hd-' . rg_id(16), 120);
		$ehd = escapeshellarg($hd);
		$eout = escapeshellarg($out);

		if (!is_dir($hd)) {
			$r = @mkdir($hd, 0700);
			if ($r === FALSE) {
				$ret['errmsg'] = 'cannot create gpg homedir [' . $hd . ']: '
					. rg_php_err();
				break;
			}
		}

		$base = 'gpg2'
			. ' --no-options'
			. ' --lock-never'
			. ' --keyring ' . $eout
			. ' --no-default-keyring'
			. ' --homedir ' . $ehd;

		$a = array(
			'cmds' => array(
				'cmd1' => array(
					'cmd' => $base
						. ' --import'
						. ' --batch',
					'out_buf' => $key
				)
			)
		);
		$r = rg_exec2($a);
		if (($r['ok'] != 1) || ($r['cmds']['cmd1']['exitcode'] != 0)) {
			rg_log_debug('import: ' . print_r($r, TRUE));
			$ret['errmsg'] = 'cannot import key: '
				. $r['cmds']['cmd1']['last_errmsg']
				. ' [' . $r['cmds']['cmd1']['err_buf'] . ']';
			break;
		}

		$ret['ok'] = 1;
	} while (0);
	rg_del_tree($hd);
	@unlink($hd . '.meta');

	rg_log_exit();
	return $ret;
}

/*
 * Saves a keyring based on a private key.
 * This is a special version of the above one, used for Debian (public keyring v4).
 * @out - out file
 * @key - private key
 */
function rg_gpg_save_public_kr($out, $key)
{
	rg_log_enter('gpg_save_public_kr');

	$ret = array('ok' => 0);
	do {
		// TODO: hd - how to clean it? Take care of on current access! Lock?
		$hd = rg_tmp_path('gpg_save_public_kr_home-' . rg_id(16), 120);
		$ehd = escapeshellarg($hd);
		$kr = rg_tmp_path('gpg-save_public_kr_kr-' . rg_id(16), 120);
		$ekr = escapeshellarg($kr);

		if (!is_dir($hd)) {
			$r = @mkdir($hd, 0700);
			if ($r === FALSE) {
				$ret['errmsg'] = 'cannot create gpg homedir [' . $hd . ']: '
					. rg_php_err();
				break;
			}
		}

		$base = 'gpg2'
			. ' --no-options'
			. ' --lock-never'
			. ' --keyring ' . $ekr
			. ' --no-default-keyring'
			. ' --homedir ' . $ehd;

		$a = array(
			'cmds' => array(
				'cmd1' => array(
					'cmd' => $base
						. ' --import'
						. ' --batch',
					'out_buf' => $key
				)
			)
		);
		$r = rg_exec2($a);
		if (($r['ok'] != 1) || ($r['cmds']['cmd1']['exitcode'] != 0)) {
			rg_log_debug('import: ' . print_r($r, TRUE));
			$ret['errmsg'] = 'cannot import key: '
				. $r['cmds']['cmd1']['last_errmsg']
				. ' [' . $r['cmds']['cmd1']['err_buf'] . ']';
			break;
		}

		if (file_exists($out))
			@unlink($out);

		$eout = escapeshellarg($out);

		$a = array(
			'cmds' => array(
				'cmd1' => array(
					'cmd' => $base
						. ' --batch'
						. ' --export'
						. ' --output ' . $eout
				)
			)
		);
		$r = rg_exec2($a);
		if (($r['ok'] != 1) || ($r['cmds']['cmd1']['exitcode'] != 0)) {
			//rg_log_debug('export: ' . print_r($r, TRUE));
			$ret['errmsg'] = 'cannot export public keyring: '
				. $r['cmds']['cmd1']['last_errmsg']
				. ' [' . $r['cmds']['cmd1']['err_buf'] . ']';
			break;
		}

		$ret['ok'] = 1;
	} while (0);
	rg_del_tree($kr);
	@unlink($kr . '.meta');
	rg_del_tree($hd);
	@unlink($hd . '.meta');

	rg_log_exit();
	return $ret;
}

/*
 * Sign a file providing priv key
 */
function rg_gpg_sign($out, $in, $priv_key, $extra)
{
	rg_log_enter('gpg_sign');

	$ret = array('ok' => 0);
	do {
		// TODO: hd - how to clean it? Take care of on current access! Lock?
		$hd = rg_tmp_path('gpg_sign_hd-' . rg_id(16), 120);
		$ehd = escapeshellarg($hd);
		$kr = rg_tmp_path('gpg_sign_kr-' . rg_id(16), 120);
		$ekr = escapeshellarg($kr);

		if (!is_dir($hd)) {
			$r = @mkdir($hd, 0700);
			if ($r === FALSE) {
				$ret['errmsg'] = 'cannot create gpg homedir [' . $hd . ']: '
					. rg_php_err();
				break;
			}
		}

		$base = 'gpg2'
			. ' --no-options'
			. ' --lock-never'
			. ' --keyring ' . $ekr
			. ' --no-default-keyring'
			. ' --homedir ' . $ehd;

		$a = array(
			'cmds' => array(
				'cmd1' => array(
					'cmd' => $base
						. ' --import'
						. ' --batch',
					'out_buf' => $priv_key
				)
			)
		);
		$r = rg_exec2($a);
		if (($r['ok'] != 1) || ($r['cmds']['cmd1']['exitcode'] != 0)) {
			rg_log_debug('import: ' . print_r($r, TRUE));
			$ret['errmsg'] = 'cannot import key: '
				. $r['cmds']['cmd1']['last_errmsg']
				. ' [' . $r['cmds']['cmd1']['err_buf'] . ']';
			break;
		}

		$out2 = $out . '-sign';
		$a = array(
			'cmds' => array(
				'cmd1' => array(
					'cmd' => $base
						. ' --sign'
						. ' ' . $extra
						. ' --output ' . escapeshellarg($out2)
						. ' ' . escapeshellarg($in)
				)
			)
		);
		$r = rg_exec2($a);
		if (($r['ok'] != 1) || ($r['cmds']['cmd1']['exitcode'] != 0)) {
			rg_log_debug('sign: ' . print_r($r, TRUE));
			$ret['errmsg'] = 'cannot sign: '
				. $r['cmds']['cmd1']['last_errmsg']
				. ' [' . $r['cmds']['cmd1']['err_buf'] . ']';
			break;
		}

		$r = @rename($out2, $out);
		if ($r === FALSE) {
			$ret['errmsg'] = 'cannot rename: '
				. rg_php_err();
			break;
		}

		$ret['ok'] = 1;
	} while (0);
	rg_del_tree($kr);
	@unlink($kr . '.meta');
	rg_del_tree($hd);
	@unlink($hd . '.meta');

	rg_log_exit();
	return $ret;
}