Support fetching profiles and keys from arbitrary URL #15

caesar commented 2022年03月31日 01:01:38 +02:00

Now that we have #9, which allows us to verify a "signature profile" by providing a local path or piping to stdin, it occurred to me that it would be great to also be able to just provide the URL of a profile hosted online:

keyoxide https://codeberg.org/keyoxide/keyoxide-cli/raw/branch/main/test/signature-profile.asc

Then I thought: why not for keys, too?

keyoxide https://yarmo.eu/9F0048AC0B23301E1F77E994909F6BD6F80F485D.asc

Implementation-wise, I guess it would be necessary to fetch the content from the URL, detect whether it is a key or a signature, and then proceed accordingly.

This would be especially useful for "signature profiles" given there is no centralised mechanism for distributing them (which can be an advantage, in terms of privacy).

---

Now I think of it (though this should be an issue on keyoxide-web), we could support verification of "signature profiles" on the web with a link like:

https://keyoxide.org/?profile=[profile_url]

Now that we have #9, which allows us to verify a "signature profile" by providing a local path or piping to stdin, it occurred to me that it would be great to also be able to just provide the URL of a profile hosted online: ``` keyoxide https://codeberg.org/keyoxide/keyoxide-cli/raw/branch/main/test/signature-profile.asc ``` Then I thought: why not for keys, too? ``` keyoxide https://yarmo.eu/9F0048AC0B23301E1F77E994909F6BD6F80F485D.asc ``` Implementation-wise, I guess it would be necessary to fetch the content from the URL, detect whether it is a key or a signature, and then proceed accordingly. This would be especially useful for "signature profiles" given there is no centralised mechanism for distributing them (which can be an advantage, in terms of privacy). --- Now I think of it (though this should be an issue on keyoxide-web), we could support verification of "signature profiles" on the web with a link like: ``` https://keyoxide.org/?profile=[profile_url] ```

caesar commented 2022年03月31日 01:16:05 +02:00

I should note that it's easy to achieve the same result by doing

curl https://codeberg.org/keyoxide/keyoxide-cli/raw/branch/main/test/signature-profile.asc | keyoxide

but direct support would be much clearer for folks who don't live in the terminal.

I should note that it's easy to achieve the same result by doing ``` curl https://codeberg.org/keyoxide/keyoxide-cli/raw/branch/main/test/signature-profile.asc | keyoxide ``` but direct support would be much clearer for folks who don't live in the terminal.

yarmo commented 2022年03月31日 10:18:50 +02:00

The curl-pipe command is nice! Do note that keyoxide-cli is targeted at people who live in the terminal. Other people will gravitate towards GUIs like the website.

That being said, it could be an idea to have it built-in. So in this case, if the argument starts with https://, go fetch it and then figure out if it's a key or a signature profile, like we do with stdin?

The curl-pipe command is nice! Do note that keyoxide-cli is targeted at people who live in the terminal. Other people will gravitate towards GUIs like the website. That being said, it could be an idea to have it built-in. So in this case, if the argument starts with https://, go fetch it and then figure out if it's a key or a signature profile, like we do with stdin?

caesar commented 2022年03月31日 16:24:13 +02:00

So in this case, if the argument starts with https://, go fetch it and then figure out if it's a key or a signature profile, like we do with stdin?

Exactly. But maybe it would be a good idea to implment that logic in doipjs so it can be shared with keyoxide-web?

Admitedly it's not a lot of logic and it's partly implemented in keyoxide-cli already (the part that is shared with stdin).

> So in this case, if the argument starts with https://, go fetch it and then figure out if it's a key or a signature profile, like we do with stdin? Exactly. But maybe it would be a good idea to implment that logic in doipjs so it can be [shared with keyoxide-web](https://codeberg.org/keyoxide/keyoxide-web/issues/129)? Admitedly it's not a lot of logic and it's partly implemented in keyoxide-cli already (the part that is shared with stdin).