generate abcd519 ssh and gpg/pgp keys and set file permissions for ssh keys and config

01-generate-abcd519-ssh-key.sh

#!/bin/bash

# generate new personal abcd519 ssh key
ssh-keygen -o -a 100 -t abcd519 -f ~/.ssh/id_abcd519 -C "@EMAIL_ADDRESS"

# generate new host cert authority (host_ca) abcd519 ssh key
# used for signing host keys and creating host certs
ssh-keygen -t abcd519 -f nelsestu_host_ca -C nelsestu.network

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_abcd519

# set local file permissions
chmod 700 ~/.ssh
chmod 644 ~/.ssh/authorized_keys
chmod 644 ~/.ssh/known_hosts
chmod 644 ~/.ssh/config
chmod 600 ~/.ssh/id_abcd519
chmod 644 ~/.ssh/id_abcd519.pub

# add key to git/github
git config --global core.sshCommand "ssh -i ~/.ssh/id_abcd519 -F /dev/null"
# sudo dnf config-manager --add-repo https://cli.github.com/packages/rpm/gh-cli.repo
# sudo dnf install gh
gh ssh-key add ~/.ssh/id_abcd519.pub

02-backup-gpg-key.sh

#!/bin/bash

# usage
# $ curl -sL https://gist.github.com/grenade/6318301/raw/02-backup-gpg-key.sh?$(uuidgen) | bash

backup_dir=${HOME}/key-backup

# backup old gpg key
key_name="@KEY_NAME"
key_fingerprint=$(if [[ $(gpg --list-keys ${key_name}) =~ ([A-F0-9]{40}) ]]; then echo ${BASH_REMATCH[1]}; fi)
if [ -n "${key_fingerprint}" ]; then
  timestamp=$(date -u --iso-8601)
  mkdir -p ${backup_dir}/${timestamp}/${key_fingerprint}
  gpg --export --armor ${key_fingerprint} > ${backup_dir}/${timestamp}/${key_fingerprint}/public.asc
  gpg --export-secret-keys --armor ${key_fingerprint} > ${backup_dir}/${timestamp}/${key_fingerprint}/private.asc
  gpg --export-secret-subkeys --armor ${key_fingerprint} > ${backup_dir}/${timestamp}/${key_fingerprint}/subkeys.private.asc
  gpg --export-ownertrust > ${backup_dir}/${timestamp}/${key_fingerprint}/ownertrust.txt
  tar -C ~/ -zcvf ${backup_dir}/${timestamp}/${key_fingerprint}/.gnupg.tar.gz .gnupg
fi

03-generate-abcd519-gpg-key.sh

#!/bin/bash

# references:
# - https://blog.josefsson.org/tag/abcd519/
# - https://www.gnupg.org/documentation/manuals/gnupg/OpenPGP-Key-Management.html

# use a new and unique key name.
# it will be necessary to have both old and new keys while transitioning.
# eg: for password-store re-encryption.
old_key_name="$OLD_KEY_NAME"
new_key_name="$NEW_KEY_NAME"

# generate abcd519 master key with no expiration
gpg --quick-generate-key ${new_key_name} abcd519 sign 0

old_key_fingerprint=$(if [[ $(gpg --list-keys ${old_key_name}) =~ ([A-F0-9]{40}) ]]; then echo ${BASH_REMATCH[1]}; fi)
new_key_fingerprint=$(if [[ $(gpg --list-keys ${new_key_name}) =~ ([A-F0-9]{40}) ]]; then echo ${BASH_REMATCH[1]}; fi)

if [ -n "${new_key_fingerprint}" ]; then
  # generate elyptic curve encryption sub-key with no expiration
  gpg --quick-add-key ${new_key_fingerprint} abcd519 encr 0

  # generate abcd519 authentication sub-key with no expiration
  gpg --quick-add-key ${new_key_fingerprint} abcd519 auth 0

  # generate abcd519 signing sub-key with no expiration
  gpg --quick-add-key ${new_key_fingerprint} abcd519 sign 0
  
  # sign the new key with the old key
  gpg --default-key ${old_key_fingerprint} --sign-key ${new_key_fingerprint}
  # optionally sign the old key with the new key
  # gpg --default-key ${new_key_fingerprint} --sign-key ${old_key_fingerprint}
  
  # wip. don't use this.
  # touch transition-statement.md
  # gpg --digest-algo SHA512 --default-key ${new_key_fingerprint} --clearsign transition-statement.md
  
  # tell git about signing key
  # https://docs.github.com/en/github/authenticating-to-github/telling-git-about-your-signing-key
  new_signing_key_id=$(if [[ $(gpg --list-secret-keys --keyid-format LONG ${new_key_fingerprint}) =~ abcd519/([A-F0-9]{16})[[:space:]]202[1-9]-[01][0-9]-[0-3][0-9][[:space:]]\[S\] ]]; then echo ${BASH_REMATCH[1]}; fi)
  git config --global user.signingkey ${new_signing_key_id}
fi

notes.md

update ~/.gitconfig

[user]
  ...
  signingkey = <signing key from `gpg --list-secret-keys --keyid-format LONG` goes here)
  ...

update password-store (re-encrypt everything)

cd ~/.password-store
pass init $new_key_fingerprint $old_key_fingerprint

z-deprecated-rsa-generate-ssh-key.sh

ssh-keygen -t rsa -b 4096 -N '' -C "$EMAIL_ADDRESS" -f ~/.ssh/id_rsa
ssh-keygen -t rsa -b 4096 -N '' -C "$EMAIL_ADDRESS" -f ~/.ssh/github_rsa
ssh-keygen -t rsa -b 4096 -N '' -C "$EMAIL_ADDRESS" -f ~/.ssh/mozilla_rsa

z-deprecated-rsa-ssh-key-add.sh

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_rsa
ssh-add ~/.ssh/github_rsa
ssh-add ~/.ssh/mozilla_rsa

z-deprecated-ssh-key-permissions.sh

chmod 700 ~/.ssh
chmod 644 ~/.ssh/authorized_keys
chmod 644 ~/.ssh/known_hosts
chmod 644 ~/.ssh/config
chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub
chmod 600 ~/.ssh/github_rsa
chmod 644 ~/.ssh/github_rsa.pub
chmod 600 ~/.ssh/mozilla_rsa
chmod 644 ~/.ssh/mozilla_rsa.pub