// KeyRingAndId returns the GPG identity keyring path and the user's
// GPG keyID (TODO: length/case), if configured. TODO: which error
// value if not configured?
426758
func (c *Config) KeyRingAndId() (keyRing, keyId string, err error) {
	prefixes := c.jconf.RequiredObject("prefixes")
	if len(prefixes) == 0 {
		return "", "", fmt.Errorf("no prefixes object in config")
	}
	sighelper := prefixes.OptionalObject("/sighelper/")
	if len(sighelper) == 0 {
		return "", "", fmt.Errorf("no sighelper object in prefixes")
	}
	handlerArgs := sighelper.OptionalObject("handlerArgs")
	if len(handlerArgs) == 0 {
		return "", "", fmt.Errorf("no handlerArgs object in sighelper")
	}
	keyId = handlerArgs.OptionalString("keyId", "")
	if keyId == "" {
		return "", "", fmt.Errorf("no keyId in sighelper")
	}
	keyRing = handlerArgs.OptionalString("secretRing", "")
	if keyRing == "" {
		return "", "", fmt.Errorf("no secretRing in sighelper")
	}
	return keyRing, keyId, nil
}
64746
func getKeyringMembers(ctx context.Context, client *registry.Client,
	orgID *identity.ID) ([]keyringMember, error) {

	teams, err := client.Teams.GetByOrg(ctx, orgID)
	if err != nil {
		return nil, err
	}

	membersTeam, machinesTeam, err := findSystemTeams(teams)
	if err != nil {
		return nil, err
	}

	userMembers, err := client.Memberships.List(ctx, orgID, membersTeam.ID, nil)
	if err != nil {
		return nil, err
	}

	machineMembers, err := client.Memberships.List(ctx, orgID, machinesTeam.ID, nil)
	if err != nil {
		return nil, err
	}

	var members []keyringMember
	for _, membership := range userMembers {
		members = append(members, &userKeyringMember{id: membership.Body.OwnerID})
	}

	for _, membership := range machineMembers {
		machineID := membership.Body.OwnerID
		segment, err := client.Machines.Get(ctx, machineID)
		if err != nil {
			return nil, err
		}

		m := machineKeyringMember{Machine: segment.Machine}
		for _, token := range segment.Tokens {
			if token.Token.Body.State == primitive.MachineTokenActiveState {
				m.tokens = append(m.tokens, *token.Token.ID)
			}
		}
		members = append(members, &m)
	}

	return members, nil
}
435518
func (s *ParameterMetadata) SetKeyId(v string) *ParameterMetadata {
	s.KeyId = &v
	return s
}
1192670
func (o *Owner) KeyID() string {
	if o == nil || len(o.keyID) == 0 {
		return ""
	}
	return o.keyID[0]
}
566411
func (g *GlobalContext) GetPerUserKeyring(ctx context.Context) (ret *PerUserKeyring, err error) {
	defer g.Trace("G#GetPerUserKeyring", func() error { return err })()

	myUID := g.ActiveDevice.UID()
	if myUID.IsNil() {
		return nil, errors.New("PerUserKeyring unavailable with no UID")
	}

	// Don't do any operations under these locks that could come back and hit them again.
	// That's why GetMyUID up above is not under this lock.
	g.perUserKeyringMu.Lock()
	defer g.perUserKeyringMu.Unlock()

	makeNew := func() (*PerUserKeyring, error) {
		pukring, err := NewPerUserKeyring(g, myUID)
		if err != nil {
			g.Log.CWarningf(ctx, "G#GetPerUserKeyring -> failed: %s", err)
			g.perUserKeyring = nil
			return nil, err
		}
		g.Log.CDebugf(ctx, "G#GetPerUserKeyring -> new")
		g.perUserKeyring = pukring
		return g.perUserKeyring, nil
	}

	if g.perUserKeyring == nil {
		return makeNew()
	}
	pukUID := g.perUserKeyring.GetUID()
	if pukUID.Equal(myUID) {
		return g.perUserKeyring, nil
	}
	return makeNew()
}
373398
func KeyIdFromRing(secRing string) (keyID string, err error) {
	f, err := wkfs.Open(secRing)
	if err != nil {
		return "", fmt.Errorf("Could not open secret ring file %v: %v", secRing, err)
	}
	defer f.Close()
	el, err := openpgp.ReadKeyRing(f)
	if err != nil {
		return "", fmt.Errorf("Could not read secret ring file %s: %v", secRing, err)
	}
	if len(el) != 1 {
		return "", fmt.Errorf("Secret ring file %v contained %d identities; expected 1", secRing, len(el))
	}
	ent := el[0]
	return ent.PrimaryKey.KeyIdString(), nil
}
90390
func (s *ReEncryptOutput) SetKeyId(v string) *ReEncryptOutput {
	s.KeyId = &v
	return s
}
987983
func (s *EncryptionConfig) SetKeyId(v string) *EncryptionConfig {
	s.KeyId = &v
	return s
}
39833
func (g *GPG) Fingerprint(ctx context.Context, id string) string {
	return g.findKey(ctx, id).Fingerprint
}
1235625
func WithKeyID(keyID int) ProviderOpts {
	return func(p *Provider) error {
		p.KeyID = keyID
		return nil
	}
}
627334
func ParseUIDGID(str string) (uid uint32, gid uint32, err error) {
	if str == "" {
		return 0, 0, nil
	}
	parts := strings.SplitN(str, ":", 2)
	if len(parts) == 1 {
		return 0, 0, errors.New("groups ID is not provided")
	}
	if uid, err = parseUID(parts[0]); err != nil {
		return 0, 0, err
	}
	if gid, err = parseUID(parts[1]); err != nil {
		return 0, 0, err
	}
	return
}
523912
func (s *Store) OurKeyID(ctx context.Context) string {
	for _, r := range s.Recipients(ctx) {
		kl, err := s.crypto.FindPrivateKeys(ctx, r)
		if err != nil || len(kl) < 1 {
			continue
		}
		return kl[0]
	}
	return ""
}
235237
func (s *ScanKeys) KeysById(id uint64, fp []byte) []openpgp.Key {
	m := s.M()
	primaries := s.unlockByID(m, id)
	memres := primaries.KeysById(id, fp)
	m.Debug("ScanKeys:KeysById(%016x) => %d keys match in memory", id, len(memres))
	if len(memres) > 0 {
		m.Debug("ScanKeys:KeysById(%016x) => owner == me (%s)", id, s.me.GetName())
		s.Lock()
		s.keyOwners[id] = s.me
		s.Unlock()
		return memres
	}

	// KeysById is only used for decryption, so getting public keys from
	// API server via s.scan(id) is pointless, so just returning nil.
	return nil
}
607
func (s *StreamDescription) SetKeyId(v string) *StreamDescription {
	s.KeyId = &v
	return s
}
613117
func CanonicalKeyID(k data.PublicKey) (string, error) {
	if k == nil {
		return "", errors.New("public key is nil")
	}
	switch k.Algorithm() {
	case data.ECDSAx509Key, data.RSAx509Key:
		return X509PublicKeyID(k)
	default:
		return k.ID(), nil
	}
}
1140472
func (w handledIters) markItersWithKeyAsHandled(startIdx int, key uint64) {
	for i := startIdx; i < len(w); i++ {
		wrapped := w[i]
		currKey, _ := wrapped.iter.Value()
		if currKey == key {
			w[i].handled = true
		}
	}
}
217851
func (c *Cert) genAndWriteKey(path string) error {
	c.Log.Infof("Generating new RSA key")
	if err := c.generateKey(); err != nil {
		return fmt.Errorf("error generating key: %v", err)
	}

	if err := c.writeKeyToFile(path); err != nil {
		return fmt.Errorf("error saving key to file '%s': %v", path, err)
	}
	c.Log.Infof("Key written to file: %s", path)

	return nil
}