From 965743c6789c75ad1ac17cf61441155114ae4c79 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20K=C3=BCtemeier?= <joerg@kuetemeier.de>
Date: Sun, 16 May 2021 14:21:37 +0200
Subject: [PATCH 1/4] Add optional generation of Curve25519 type GPG keys

---
 pkgs/sops-init-gpg-key/sops-init-gpg-key | 30 ++++++++++++++++++++++--
 1 file changed, 28 insertions(+), 2 deletions(-)

diff --git a/pkgs/sops-init-gpg-key/sops-init-gpg-key b/pkgs/sops-init-gpg-key/sops-init-gpg-key
index f0a4f65..547b3ee 100755
--- a/pkgs/sops-init-gpg-key/sops-init-gpg-key
+++ b/pkgs/sops-init-gpg-key/sops-init-gpg-key
@@ -3,7 +3,7 @@
 set -o errexit -o pipefail -o noclobber -o nounset
 
 OPTIONS=h
-LONGOPTS=help,gpghome:,hostname:
+LONGOPTS=help,gpghome:,hostname:,keytype:
 
 ! PARSED=$(getopt --options=$OPTIONS --longoptions=$LONGOPTS --name "$0" -- "$@")
 
@@ -17,9 +17,13 @@ eval set -- "$PARSED"
 
 FINAL_GNUPGHOME=/root/.gnupg
 HOSTNAME=$(hostname)
+KEYTYPE="RSA"
 
 usage() {
-    echo "$0: [--hostname hostname] [--gpghome home]"
+    echo "$0: [--hostname hostname] [--gpghome home] [--keytype keytype]"
+    echo
+    echo "  keytype: RSA (default) or Curve25519"
+    echo
 }
 
 while true; do
@@ -36,6 +40,10 @@ while true; do
       HOSTNAME=$2
       shift 2
       ;;
+    --keytype)
+      KEYTYPE=$2
+      shift 2
+      ;;
     --)
       shift
       break
@@ -56,10 +64,28 @@ fi
 export GNUPGHOME=$(mktemp -d)
 trap "rm -rf $GNUPGHOME" EXIT
 
+
 cat > "$GNUPGHOME/key-template" <<EOF
 %no-protection
+EOF
+
+if [[ "$KEYTYPE" == "Curve25519" ]]; then
+  cat >> "$GNUPGHOME/key-template" <<EOF
+Key-Type: eddsa
+Key-Curve: Ed25519
+Key-Usage: sign
+Subkey-Type: ecdh
+Subkey-Curve: Curve25519
+Subkey-Usage: encrypt
+EOF
+else 
+  cat >> "$GNUPGHOME/key-template" <<EOF
 Key-Type: 1
 Key-Length: 2048
+EOF
+fi
+
+cat >> "$GNUPGHOME/key-template" <<EOF
 Name-Real: $HOSTNAME
 Name-Email: root@$HOSTNAME
 Expire-Date: 0

From 08a2634b42c98490bb9b23eb52886edca1023638 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20K=C3=BCtemeier?= <joerg@kuetemeier.de>
Date: Thu, 5 Jan 2023 23:08:24 +0100
Subject: [PATCH 2/4] Add documentation for sops-init-gpg-key with a
 Curved25119 key to the README file

---
 README.md | 29 ++++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 3a708cf..89f3c49 100644
--- a/README.md
+++ b/README.md
@@ -764,7 +764,34 @@ EOF
 # fingerprint: E4CA86768F176AEB6C01554153AF8D7F149613B1
 ```
 
-In this case, you must upload the GPG key directory `/tmp/newkey` onto the server.
+You can choose between a RSA GPG key (default, like in the example above) or a
+Curve25519 based one by adding `--keytype Curve25519` like so:
+
+```console
+$ nix-shell -p sops-init-gpg-key
+$ sops-init-gpg-key --hostname server01 --gpghome /tmp/newkey --keytype Curve25519
+You can use the following command to save it to a file:
+cat > server01.asc <<EOF
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMEY7dJExYJKwYBBAHaRw8BAQdAloRZFyqNh3nIDtyUQKaBSMJOtLkbNeg+4TPg
+BG5TduG0OG5peC1hLmhvbWUua3VldGVtZWllci5kZSA8cm9vdEBuaXgtYS5ob21l
+Lmt1ZXRlbWVpZXIuZGU+iJMEExYKADsWIQREE2hPxiNijOo+CSmrLxbGte+J7wUC
+Y7dJEwIbAwULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIXgAAKCRCrLxbGte+J79LX
+AQDtLfQFDKm04ORIk28DrzTBbMTFQEW21dGBXk7ykBx4jQD/ZOnt1RPnB9mzMc8L
+wIS3oI8D9719DjoS9hrHnJ4xvge4OARjt0kTEgorBgEEAZdVAQUBAQdA0t1X35pN
+ic+etscIIkHjKUwrXhbTgWrARgXUuEMwwz8DAQgHiHgEGBYKACAWIQREE2hPxiNi
+jOo+CSmrLxbGte+J7wUCY7dJEwIbDAAKCRCrLxbGte+J7+0NAQCfj95TSyPEFKz3
+eLJ1aCA1bZZV/rkhHd+OwX1MFL3mKQD9GMPgvMzDIoofycDzMY2ttJgkRJfq+zOZ
+juXFQdUkMgY=
+=pf3V
+-----END PGP PUBLIC KEY BLOCK-----
+EOF
+fingerprint: 4413684FC623628CEA3E0929AB2F16C6B5EF89EF
+F0477297E369CD1D189DD901278D1535AB473B9E
+```
+
+In both cases, you must upload the GPG key directory `/tmp/newkey` onto the server.
 If you uploaded it to `/var/lib/sops` than your sops configuration will look like this:
 
 ```nix

From 0ef86b61ee4944bf8f41faba087adff5015e0f87 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20K=C3=BCtemeier?= <joerg@kuetemeier.de>
Date: Wed, 11 Jan 2023 10:00:25 +0100
Subject: [PATCH 3/4] Update pkgs/sops-init-gpg-key/sops-init-gpg-key
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Jörg Thalheim <Mic92@users.noreply.github.com>
---
 pkgs/sops-init-gpg-key/sops-init-gpg-key | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/sops-init-gpg-key/sops-init-gpg-key b/pkgs/sops-init-gpg-key/sops-init-gpg-key
index 547b3ee..821ae8d 100755
--- a/pkgs/sops-init-gpg-key/sops-init-gpg-key
+++ b/pkgs/sops-init-gpg-key/sops-init-gpg-key
@@ -78,7 +78,7 @@ Subkey-Type: ecdh
 Subkey-Curve: Curve25519
 Subkey-Usage: encrypt
 EOF
-else 
+elif [[ "$KEYTYPE" == "RSA" ]]; then
   cat >> "$GNUPGHOME/key-template" <<EOF
 Key-Type: 1
 Key-Length: 2048

From 7e0e6790503c7bd7a51eff0c7442a2c3a1e09ddb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20K=C3=BCtemeier?= <joerg@kuetemeier.de>
Date: Wed, 11 Jan 2023 10:00:33 +0100
Subject: [PATCH 4/4] Update pkgs/sops-init-gpg-key/sops-init-gpg-key
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Jörg Thalheim <Mic92@users.noreply.github.com>
---
 pkgs/sops-init-gpg-key/sops-init-gpg-key | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/sops-init-gpg-key/sops-init-gpg-key b/pkgs/sops-init-gpg-key/sops-init-gpg-key
index 821ae8d..1d4a28f 100755
--- a/pkgs/sops-init-gpg-key/sops-init-gpg-key
+++ b/pkgs/sops-init-gpg-key/sops-init-gpg-key
@@ -83,6 +83,9 @@ elif [[ "$KEYTYPE" == "RSA" ]]; then
 Key-Type: 1
 Key-Length: 2048
 EOF
+else
+  echo "unknown keytype '$KEYTYPE'"
+  exit 1
 fi
 
 cat >> "$GNUPGHOME/key-template" <<EOF