Merge ~brodock/ssh-import-id:add-gitlab-support into ssh-import-id:master

[Gabriel Mazetto]

add support for gl:username (GitLab)

add "gl" protocol to retrieve keys from GitLab.com REST API

[Dustin Kirkland  (kirkland)]

Thanks for this. I've incorporated and tested a modified version of this, and proposed it for merging to the upstream maintainers. Cheers, Dustin

[Scott Moser (smoser)]

Dustin's PR is at https://code.launchpad.net/~kirkland/ssh-import-id/+git/ssh-import-id/+merge/445392

Unmerged commits

89f087f... by Gabriel Mazetto on 2022-02-17

add support for gl:username (GitLab)

diff --git a/debian/links b/debian/links
index 1ad132a..a76f9d9 100644
--- a/debian/links
+++ b/debian/links
@@ -1,2 +1,3 @@
 usr/share/man/man1/ssh-import-id.1 usr/share/man/man1/ssh-import-id-lp.1
 usr/share/man/man1/ssh-import-id.1 usr/share/man/man1/ssh-import-id-gh.1
+usr/share/man/man1/ssh-import-id.1 usr/share/man/man1/ssh-import-id-gl.1
 \ No newline at end of file
diff --git a/ssh_import_id/__init__.py b/ssh_import_id/__init__.py
index 034adda..d5b0ffc 100644
--- a/ssh_import_id/__init__.py
+++ b/ssh_import_id/__init__.py
@@ -224,6 +224,8 @@ def fetch_keys(proto, username, useragent):
         return fetch_keys_lp(username, useragent)
     if proto == "gh":
         return fetch_keys_gh(username, useragent)
+    if proto == "gl":
+        return fetch_keys_gl(username, useragent)
 
     die("ssh-import-id protocol handler %s: not found or cannot execute" %
         (proto))
@@ -355,6 +357,31 @@ def fetch_keys_gh(ghid, useragent):
         die(str(e))
     return keys
 
+def fetch_keys_gl(glid, useragent):
+    ratelimit_remaining = 'ratelimit-remaining'
+    help_url = 'https://docs.gitlab.com/ee/user/gitlab_com/index.html#gitlabcom-specific-rate-limits'
+    keys = ""
+    try:
+        url = "https://gitlab.com/api/v4/users/%s/keys" % (quote_plus(glid))
+        headers = {'User-Agent': user_agent(useragent)}
+        try:
+            with urlopen(Request(url, headers=headers),
+                         timeout=DEFAULT_TIMEOUT) as resp:
+                data = json.load(resp)
+        except urllib.error.HTTPError as e:
+            msg = 'Requesting GitLab keys failed.'
+            if e.code == 404:
+                msg = 'Username "%s" not found at GitLab API.' % glid
+            elif e.hdrs.get(ratelimit_remaining) == "0":
+                msg = ('GitLab REST API rate-limited this IP address. See %s .'
+                       % help_url)
+            die(msg + " status_code=%d user=%s" % (e.code, glid))
+        for gl_keys in data:
+            keys += "%s %s@gitlab/%s %s\n" % (gl_keys['key'], glid, gl_keys['id'], gl_keys['title'])
+    # pylint: disable=broad-except
+    except Exception as e:
+        die(str(e))
+    return keys
 
 def main():
     errors = []
diff --git a/usr/bin/ssh-import-id-gl b/usr/bin/ssh-import-id-gl
 new file mode 100755
index 0000000..bbca300
--- /dev/null
+++ b/usr/bin/ssh-import-id-gl
@@ -0,0 +1,23 @@
+#!/bin/sh
+#
+# ssh-import-id - Authorize SSH public keys from trusted online identities.
+#
+# Copyright (c) 2016 Dustin Kirkland <[e-mail]>
+#
+# ssh-import-id is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3.
+#
+# ssh-import-id is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with ssh-import-id.  If not, see <http://www.gnu.org/licenses/>.
+
+set -e
+
+for i in $@; do
+    ssh-import-id gl:$i
+done
diff --git a/usr/share/man/man1/ssh-import-id.1 b/usr/share/man/man1/ssh-import-id.1
index 6d26fa7..540cbe5 100644
--- a/usr/share/man/man1/ssh-import-id.1
+++ b/usr/share/man/man1/ssh-import-id.1
@@ -9,12 +9,14 @@
 
 .BI "ssh\-import\-id\-gh USER_ID_1 [USER_ID_2] ... [USER_ID_n]
 
+.BI "ssh\-import\-id\-gl USER_ID_1 [USER_ID_2] ... [USER_ID_n]
+
 .SH OPTIONS
  \-h | \-\-help		usage
  \-o | \-\-output F	write output to file 'F' (default ~/.ssh/authorized_keys, use "\-" for standard out)
  \-r | \-\-remove  	remove keys from authorized keys file 'F'
  \-u | \-\-useragent U	append U to the user agent string
- PROTO:USER_ID		Protocol can be 'lp' for Launchpad.net, or 'gh' for Github.com
+ PROTO:USER_ID		Protocol can be 'lp' for Launchpad.net, 'gh' for Github.com, or 'gl' for GitLab.com
 
 .SH DESCRIPTION
 This utility will securely contact a public keyserver and retrieve one or more user's public keys, and append these to the current user's \fI~/.ssh/authorized_keys\fP file, standard output or any other specified output file.
@@ -23,6 +25,7 @@ User IDs can be prepended by a protocol:
 
  - \fBlp:\fP to use \fIhttps://launchpad.net/~%s/+sshkeys\fP
  - \fBgh:\fP to use \fIhttps://api.github.com/users/%s/keys\fP
+ - \fBgl:\fP to use \fIhttps://gitlab.com/users/%s/keys\fP
 
 If the protocol is not explicitly specified, then \fBssh-import-id\fP will read a URL variable string from \fI/etc/ssh/ssh_import_id\fP as installed by your package manager and configured by your system administrator.  You can override this locally by exporting the string you want in a URL environment variable.  If all of these are empty, then the protocol is assumed to be "lp:", which was the original target implementation of this tool.