frasertweedale/pgpsubmit — pull request #1 by glasnt (2014-12-18 05:56:56+00:00)
Title: Add environment variable to restrict certain keytypes

Per request in http://lists.lca2015.linux.org.au/pipermail/chat/2014-December/000118.html, I've added optional functionality to restrict weaker keys. Logic around finding the keytype follows. This may not be the best way to find out this information, but I couldn't find a saner alternative that didn't require importing possibly-bad keys into the keyring, then removing them again.

----

The gpg command `--with-fingerprint` allows the parsing of an
ASCII-armored public key without the importing of said key into the
keyring. This can be used to check the strength of a key, and possibly
reject it from being submitted.

Sample fingerprint header: `pub 1024R/AABBCCDDEE 2011-11-11`
In this case, the type is parsed as `1024R`.

Environment variable format is any type of `^pub(\s*)(.+?)/` to
disclude. Example: `1024D,2048R` will reject 1024-DSA and 2048RDA keys.
In the above sample fingerprint header, this key would be rejected.

By default, all key types are allowed.