mirror of
https://github.com/kuhyx/screen-locker.git
synced 2026-11-10 20:27:13 +01:00
Krzysztof kuhy Rudnicki
a826cfa166
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018RHwVPyiiQMPh4M3JQwQku
88 lines
2.1 KiB
Bash
Executable File
88 lines
2.1 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# ============================================================================
|
|
# Create the phone -> PC workout poke key if it does not exist yet.
|
|
#
|
|
# The key is 32 random bytes as 64 hex characters in
|
|
# ~/.config/workout_poke/key (mode 600, dir 700). workout-poke.service verifies
|
|
# each poke's HMAC with it and refuses to start without it; pair_phone.sh
|
|
# copies it to the phone. An existing key is NEVER overwritten: a new key
|
|
# would silently unpair the phone. Prints the path, never the key.
|
|
#
|
|
# Usage: workout_poke_keygen.sh [--key-file PATH]
|
|
# ============================================================================
|
|
|
|
set -euo pipefail
|
|
|
|
KEY_FILE="${HOME}/.config/workout_poke/key"
|
|
readonly SCRIPT_NAME="${0##*/}"
|
|
readonly KEY_HEX_LENGTH=64
|
|
|
|
usage() {
|
|
echo "Usage: $SCRIPT_NAME [--key-file PATH]"
|
|
exit 0
|
|
}
|
|
|
|
# An existing key must still be well-formed and private, or the daemon will
|
|
# refuse it; say so here rather than let the unit fail later.
|
|
check_existing_key() {
|
|
local key mode
|
|
mode="$(stat -c '%a' "$KEY_FILE")"
|
|
if [[ $mode != "600" ]]; then
|
|
echo "Error: $KEY_FILE has mode $mode; run: chmod 600 $KEY_FILE" >&2
|
|
exit 1
|
|
fi
|
|
key="$(<"$KEY_FILE")"
|
|
if [[ ! $key =~ ^[0-9a-f]{$KEY_HEX_LENGTH}$ ]]; then
|
|
echo "Error: $KEY_FILE is not $KEY_HEX_LENGTH lowercase hex characters;" \
|
|
"move it aside and re-run (the phone must then be re-paired)" >&2
|
|
exit 1
|
|
fi
|
|
echo "Key already present: $KEY_FILE (left unchanged)"
|
|
}
|
|
|
|
create_key() {
|
|
local dir key
|
|
dir="$(dirname "$KEY_FILE")"
|
|
mkdir -p "$dir"
|
|
chmod 700 "$dir"
|
|
key="$(od -An -N32 -tx1 /dev/urandom | tr -d ' \n')"
|
|
if [[ ! $key =~ ^[0-9a-f]{$KEY_HEX_LENGTH}$ ]]; then
|
|
echo "Error: could not read 32 random bytes from /dev/urandom" >&2
|
|
exit 1
|
|
fi
|
|
# umask + noclobber: the file is born 600 and a racing creator loses.
|
|
(
|
|
umask 077
|
|
set -o noclobber
|
|
printf '%s\n' "$key" >"$KEY_FILE"
|
|
)
|
|
echo "Created key: $KEY_FILE (mode 600)"
|
|
}
|
|
|
|
main() {
|
|
if [[ -e $KEY_FILE ]]; then
|
|
check_existing_key
|
|
else
|
|
create_key
|
|
fi
|
|
}
|
|
|
|
while [[ $# -gt 0 ]]; do
|
|
case $1 in
|
|
--key-file)
|
|
KEY_FILE="$2"
|
|
shift 2
|
|
;;
|
|
-h | --help)
|
|
usage
|
|
;;
|
|
*)
|
|
echo "Unknown option: $1" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
done
|
|
|
|
main
|