gpg-client-wrapper

#!/bin/bash

options=()  # the buffer array for the parameters
eoo=0       # end of options reached
output=0    # do we try to write to file
target=()   # where do we try to write to
fd_for_logfile=62 # some (hopefuly) unused FD, later redirected to logfile
fd_for_stdout=63 # some (hopefuly) unused FD, later redirected to stdout
special_filenames=0 # --enable-special-filenames was given
localgpg=0 #use local gpg (for ex --gen-rand etc.)
origargs=( "$@" )

while [[ $1 ]]; do
    if ! ((eoo)); then
        case "$1" in
            #when those arguments are present will not use the keyring, and so they can be executed with local gpg
            # can be used in combination with sign
            #-c)
            #    localgpg=1
            #    break
            #;;
            --gen-rand)
                localgpg=1
                break
                ;;
            --gen-prime)
                localgpg=1
                break
                ;;
            --enarmor)
                localgpg=1
                break
                ;;
            --dearmor)
                localgpg=1
                break
                ;;
            --no-default-keyring)
                # this is not possible with split gpg right?
                localgpg=1
                break
                ;;
            --print-md)
                localgpg=1
                break
                ;;
            -h)
                localgpg=1
                break
                ;;
            --help)
                localgpg=1
                break
                ;;

            --import)
                # ignore all the options and only collect file name(s) - if any
                shift
                exec qubes-gpg-import-key "$@"
                ;;
            # Keyserver options makes no sense for offline GPG VM, so it is
            # rejected by qubes-gpg-client and qubes-gpg-server. But since
            # it is forced by Torbirdy extension, simply ignore the option.
            --keyserver-options)
                shift 2
                ;;
            # Using dirmngr in an offline GPG VM makes no sense, however
            # qubes-gpg-client does not recognize the command line option
            # --disable-dirmngr so to avoid an error message we ignore
            # this option.
            --disable-dirmngr)
                shift
                ;;
            # --photo-viewer shouldn't be passed to the backend as it allow
            # arbitrary command execution
            --photo-viewer)
                shift 2
                ;;
            # ignore tty/display related options - those are meaningless in another VM
            --display)
                shift 2
                ;;
            --ttyname)
                shift 2
                ;;
            --ttytype)
                shift 2
                ;;
            --yes)
                shift
                ;;
            --enable-special-filenames)
                special_filenames=1
                shift
                ;;
            -q)
                shift
                ;;
            -o)
                output=1
                target="$2"
                shift 2
                ;;
            --output)
                output=1
                target="$2"
                shift 2
                ;;
            --status-fd|\
            --logger-fd|\
            --attribute-fd)
                if [ "x$2" = "x1" ]; then
                    # don't use stdout for status fd, since it might be later
                    # redirected to a file with --output
                    options+=( "$1" "$fd_for_stdout" )
                    shift 2
                else
                    options+=( "$1" )
                    shift
                fi
                ;;    
            --log-file)
                # rejected by split-gpg to not allow a write to arbitrary file
                # on the backend side; emulate using --logger-fd
                # 62 is $fd_for_logfile but bash seems to reject variables here
                exec 62>"$2"
                options+=( "--logger-fd" "$fd_for_logfile" )
                shift 2
                ;;
            --)
                eoo=1
                options+=("$1")
                shift
                ;;
            *)
                options+=("$1")
                shift
                ;;
        esac
    else
        if ((special_filenames)) && [[ "$1" = "-&"* ]]; then
            options+=("/proc/self/fd/${1#-&}")
        else
            options+=("$1")
        fi
        shift
    fi
done

if [ $localgpg -eq 1 ]
then
    exec /usr/bin/gpg "${origargs[@]}"
    exit $?
fi

. /etc/profile.d/qubes-gpg.sh
# 63 is $fd_for_stdout but bash seems to reject variables here

if  ! (($output)) || [ "$target" = "-" ] ; then
    exec qubes-gpg-client "${options[@]}" 63>&1
else
    exec qubes-gpg-client "${options[@]}" 63>&1 >"$target"
fi