Merge lp:~thomir-deactivatedaccount/canonical-identity-provider/trunk-add-gpg-key-management into lp:canonical-identity-provider/release

[Thomi Richards]

This branch adds GPG key handling to SSO:

* Everything is behind a gargoyle feature flag, so while this isn't done, it is merge-able (although I see no reason to merge it at present).

* The email templates were copied word-for-word from launchpad, but I think there's room for improvement there.

* This MP: https://code.launchpad.net/~thomir/canonical-identity-provider/dependencies/+merge/292105 contains an updated dependencies branch. You'll either need to land that first, or tweak Makefile in this branch to point to that dependency branch instead of the default.

THINGS DEFERRED FOR A LATER BRANCH:
======================================

* Test optimisations: don't restart gpgservice and keyserver every test. Ideally we'd be able to use testresources, but I'll need to find a way to make it play nicely with django tests.

* Fix help links in templates to be accordion sections with inline helps.

* Implement deactivation and reactivation workflows.

[Thomi Richards (thomir-deactivatedaccount)]

I've made a number of changes. A re-review would be much appreciated.

[Michael Nelson (michael.nelson)]

Bunch of things which we chatted about below, +1 with those changes, but we'll probably need to go over the form things.

[Thomi Richards (thomir-deactivatedaccount)]

I've made the changes we discussed, with the exception of talking to the front-end design folk about the style review. I think we can leave this until we have the whole workflow implemented?

Cheers,

[Michael Nelson (michael.nelson)]

Thanks Thomi. +1 with a few comments below. Land when ready :)

review: Approve

[Natalia Bidart (nataliabidart)]

Hello Michael, Thommy,

I was a little bit surprised with the adding of testtools' TestCase and testtools.matchers to these tests. I understand the difference in using matchers vs standard TestCase assertion methods, and leaving aside the discussion whether is something we want or not, I would like us to talk about adding them to SSO or any other existing big project.

SSO is a large project with a lot of code, and in many past conversations the OLS team have agreed that given the amount of people working in every project, and given the importance of being able to switch between projects easily and fast, one of the things we value the most is consistency (on top of things that may be a nice to have in other contexts).

Starting using testtools for our unit tests is something that breaks consistency, and wasn't agreed at team level in advanced. The testtools dependency was there only for the acceptance tests.

Even more, using multiple inheritance on different base TestCases is something that has been proven to be a complete disaster in the mid term, we suffered from this in the Ubuntu One code where we had the Twisted TestCase, the Django TestCase, and the testtools TestCase as multiple base test cases. All the benefits a particular TestCase can give, are lost and become a burden when combining more than one as base classes.

For our Django projects, the OLS decision was to use the Django TestCase with a few extra, custom helpers defined. After a quick look, most matchers usage can be replaced with perfectly valid assertion from the Django TestCase:

self.assertThat(keys, HasLength(1))
self.assertThat(resp.content.decode('utf8'), Not(Contains('GPG Keys')))
self.assertThat(resp.status_code, Equals(200))

self.assertEqual(len(keys), 1)
self.assertEqual(resp.status_code, 200)
self.assertNotContains(resp, 'GPG Keys')

(note that the usage of assertContains/assertNotContains will also be clever about decoding the reponse, grabbing the text content, etc, something that otherwise is being made by hand and is a more error prone).

For other more complex matchers, like these:

self.assertThat(email, EmailContainsPGPBlock())
self.assertThat(keys[0]['fingerprint'], FingerprintEquals(encryption_fingerprint))

the existing methodology is to create custom assert helpers that isolate the specific logic needed for each case:

def assert_gpg_block_in_email(self, email)
def assert_fingerprint_encryption_in keys(self, keys)

In summary, I would kindly ask you to maintain consistency in line within the existing project, or at least bring this issue to the whole OLS team and reach consensus and have a migration plan before landing this to trunk.

Thank you.

review: Needs Fixing

[Michael Nelson (michael.nelson)]

On Wed, Apr 20, 2016 at 11:39 PM Natalia Bidart <
<email address hidden>> wrote:

> Review: Needs Fixing
>
> Hello Michael, Thommy,
>

Hi Natalia,

>
> I was a little bit surprised with the adding of testtools' TestCase and
> testtools.matchers to these tests. I understand the difference in using
> matchers vs standard TestCase assertion methods, and leaving aside the
> discussion whether is something we want or not, I would like us to talk
> about adding them to SSO or any other existing big project.
>

I had assumed that using testtools here would be a non-issue given that it
was already a dependency of the project - that's my fault if anyone's. And
yes, we're happy to bring that up on the list, and not use testtools here
if that's better for the team - but note, this wasn't about using
testtools.matchers but rather avoiding adding more tech-debt in SSO when
testing the SSO<->GPGService interactions.

>
> SSO is a large project with a lot of code, and in many past conversations
> the OLS team have agreed that given the amount of people working in every
> project, and given the importance of being able to switch between projects
> easily and fast, one of the things we value the most is consistency (on top
> of things that may be a nice to have in other contexts).
>

+100 for consistency - I'd not seen this as breaking consistency at all.
Perhaps a silly example, but if you grep the current SSO codebase for
"assertEqual.*True" and "assertTrue" you'll see that there are many tests
using:

assertEqual(result, True)

and many others using:

assertTrue(result)

 - which is fine, I've never felt the need to make those consistent because
they read well and have clear intent, as does assertThat(result, Is(True))
. There are obviously lots of other benefits to testtools matchers, but I
don't want to derail the main point here, rather just highlight why I
didn't see this as a consistency issue at all.

It was not because of matchers that we started using the existing testtools
dependency here...

>
> Starting using testtools for our unit tests is something that breaks
> consistency, and wasn't agreed at team level in advanced.

As above, I'd not even thought of the use of matchers as a consistency
issue but am happy to accept that it is for some people, so that's
completely my fault for not recognising it as such and bringing that up
with the wider team. We'll do that, and remove the use of matchers if
that's the consensus - that's not an issue nor the reason we used testtools
here...

> The testtools dependency was there only for the acceptance tests.
>
> Even more, using multiple inheritance on different base TestCases is
> something that has been proven to be a complete disaster in the mid term,
> we suffered from this in the Ubuntu One code where we had the Twisted
> TestCase, the Django TestCase, and the testtools TestCase as multiple base
> test cases. All the benefits a particular TestCase can give, are lost and
> become a burden when combining more than one as base classes.
>

The only issue with test inheritance that I'm aware of and totally agree
with the issue, is when individual tests are re-used via inheritance of
test-cases ...

[Thomi Richards (thomir-deactivatedaccount)]

Hi Natalia,

I've removed the use of testtools matchers and assertThat statements. I no longer derive from testtools.TestCase, and I've re-implemented a less powerful version of testtools' useFixture (see use_fixture function) so we can get the benefits of testing against a real gpgservice without worsening the learning curve for new engineers.

Could you please re-review, if you have the time?

[Natalia Bidart (nataliabidart)]

Thanks for the re-work. Added some comments, hopefully you could map some of the comments to match all recurrences of the same type (such as the docstring formatting, the self.client usage, the line wrapping for lists, dicts and import parenthesis, etc).

I was also wondering if there may be any chance you could extract the 2fa login decorator work into a pre-requisite MP to ease the review and landing process. This way you could also add the missing test case for this new decorator.

Lastly, note that src/webui already has decorators module, so I would suggest moving the new one there.

[lp:~thomir-deactivatedaccount/canonical-identity-provider/trunk-add-gpg-key-management]

1426. By Thomi Richards on 2016-04-26

Fixes from code review.

1427. By Thomi Richards on 2016-04-26

Clean up generation of unknown_key message text generation.

[Thomi Richards (thomir-deactivatedaccount)]

Hi Natalia,

I've checked off most of the items from your review, and commented where I think there's room for discussion.

I haven't gotten to separate out the new twofactor decorator into a separate branch. I probably won't get a chance to finish that before the end of my day. Perhaps you'd be willing to re-review this branch on the understanding that I'm working on that separate branch?

Thanks,

[Natalia Bidart (nataliabidart)]

Re-reviewed. One nitpick I missed before is that we try to name all the testcases with the pattern

FooBarTestCase

(ie always use the TestCase prefix instead of Tests).

Thanks!

[lp:~thomir-deactivatedaccount/canonical-identity-provider/trunk-add-gpg-key-management]

1428. By Thomi Richards on 2016-04-27

Several fixes from code review.

1429. By Thomi Richards on 2016-04-27

Yet more changes from the code review.

[Thomi Richards (thomir-deactivatedaccount)]

I've made the changes you asked for, with one main exception. I've added diff comments where appropriate to explain my rationale.

Cheers,

[Natalia Bidart (nataliabidart)]

Hi Thomi, thanks for your changes. I will be reviewing them shortly.

Just wanted to share that my review process is iterative, particularly with branches this big, is very hard for me to pay the same level attention to all lines when there is so much to read.

If it helps, let me share how my review process works: first, I made a first quick pass correcting everything that is code style and try to pin point any important issues that may need early discussion (like the testtools multiple inheritance and matchers usage).

Once that's resolved, I do another pass more focused on the logic, where the code style issues are no longer a distraction and I can devote my whole attention to the content and semantics of the code.

Once that's completed, I focus on the tests, to ensure nothing has been left out once the logic is settled.

(a natural consequence is that when SSO-and-friend-projects code style and tools are unified, reviews happen faster, because usually there is no roundtrip required between phases 1 and 2)

I understand this can be a painful process (particularly in our case) because the timezone difference, so I will try to do my best on merging all the passes into the less amount possible (but this requires extra time and effort). For future reference, the process can also be speed up if the changes would be split in smaller, self-contained branches.

Thank you for your patience and understanding.

[Natalia Bidart (nataliabidart)]

Added minimal replies to try not to add confusion to the inline threads. Will branch now and test IRL and try to focus on logic and tests. Will add another general comment with my findings.

[Natalia Bidart (nataliabidart)]

Another trivial thing to fix while I review is the lint errors resulting from running "make lint".

[lp:~thomir-deactivatedaccount/canonical-identity-provider/trunk-add-gpg-key-management]

1430. By Thomi Richards on 2016-04-27

Fix lint errors.

[Natalia Bidart (nataliabidart)]

Just made it to the forms.py changes, but will try to complete this later today.

== Needs information ==

* Do we really need fingerprint = models.TextField(null=True, blank=True) to
allow null=True? In Django, is generally discouraged to use both null=True and
blank=True for char/text field, for documentation please see:

https://docs.djangoproject.com/en/1.9/ref/models/fields/#null

If this is because the need of not setting the default '' in every existing row,
is fine, but we really need to be aware that the code will need to handle
fingerprint being None or '' for the "not set" case.

== Needs fixing ==

* The strings in the send_gpg_validation_message should be marked for
translation (salutation, closing).

* validation_phrase has a non compliant with pep-257 docstring, and the phrase
returned in validation_phrase is not marked for translation.

* validation_phrase does not have tests that I could find, would you please add
some if that is the case?

* src/identityprovider/templates/email/gpg-cleartext-instructions.txt should
mark the blocks for translation. This should be checked for all user-facing
strings added in this branch (see also strings in src/webui/forms.py).

* help_text=mark_safe in ClaimOpenPGPKeyForm should use the to-be-added lazy
version in combination with string translation for the user facing message.

== The following may needs fixing but needs confirmation from Ricardo ==

* The current sso code base is deployed so it will serve under 2 prod domains:

login.ubuntu.com
login.launchpad.net

Is my understanding that the setting SSO_ROOT_URL will not return the correct
base url in all cases, so last time I checked, we really need to build absolute
urls using request.build_absolute_uri(path).

If my suspicions are correct, we need to move this method out from the Account
models to a view layer, so we can pass and use the request (we should never pass
a request to the models layer). So in this to-confirm scenario the helper could
live in src/webui/accounts.py module and look something like this:

    def get_openid_identity_url_for_user(request):
        """Get the full openid identity url for the logged in user."""
        return request.build_absolute_uri(request.user.get_absolute_url())

== Desired but optional ==

* The method validation_phrase added inside the AuthToken model feels like it
does not belong there because is just building a specific user-facing string,
and IMHO it has nothing to do with the model's business logic. In my opinion,
validation_phrase is really a helper method from VerifySignedTextForm, so the
context can be constructed with:

'validation_phrase': form.validation_phrase(atrequest)

* We usually name settings that point to other services with the pattern:
SERVICE_NAME_URL instead of SERVICE_NAME_ENDPOINT. So perhaps is worth
considering GPG_SERVICE_URL.

* I'm a little nervous about the asserts this branch adds to production code.
I really like we are being strict on preconditions, but my worry is that if for
some unexpected reason we fail the precondition, we are exploding in the user
face instead of doing something nicer. Anyways, given that we can catch this
soon if we keep a close ey...

[Thomi Richards (thomir-deactivatedaccount)]

> * Do we really need fingerprint = models.TextField(null=True, blank=True) to
> allow null=True? In Django, is generally discouraged to use both null=True and
> blank=True for char/text field, for documentation please see:
>
> https://docs.djangoproject.com/en/1.9/ref/models/fields/#null
>
> If this is because the need of not setting the default '' in every existing
> row,
> is fine, but we really need to be aware that the code will need to handle
> fingerprint being None or '' for the "not set" case.

I just copied all the other text-based fields in that model. I've changed it now to just have 'blank=True'.

> * The strings in the send_gpg_validation_message should be marked for
> translation (salutation, closing).

Fixed - thanks.

> * validation_phrase has a non compliant with pep-257 docstring, and the phrase
> returned in validation_phrase is not marked for translation.

I've fixed the docstring. The validation phrase wasn't marked for translation because I was worried that translating the string might break the validation workflow. I *think* it should be OK, but we need to be careful about security here: I'm not sure what controls we have over who can translate strings, who reviews translated strings etc. I need to think about this point some more. I'll talk to wgrant who may have some suggestions here.

> * validation_phrase does not have tests that I could find, would you please
> add
> some if that is the case?

Done.

> * src/identityprovider/templates/email/gpg-cleartext-instructions.txt should
> mark the blocks for translation. This should be checked for all user-facing
> strings added in this branch (see also strings in src/webui/forms.py).

Done, I think.

> * help_text=mark_safe in ClaimOpenPGPKeyForm should use the to-be-added lazy
> version in combination with string translation for the user facing message.

Done.

>
> == The following may needs fixing but needs confirmation from Ricardo ==
>
> * The current sso code base is deployed so it will serve under 2 prod domains:
>
> login.ubuntu.com
> login.launchpad.net
>
> Is my understanding that the setting SSO_ROOT_URL will not return the correct
> base url in all cases, so last time I checked, we really need to build
> absolute
> urls using request.build_absolute_uri(path).
>

I'm happy to make this change, and the one below (move validation phrase into the form) if this turns out to be correct. The important thing here is that this *always* returns the same URL. If someone comes via login.launchpad.net, this should *always* return 'login.ubuntu.com', regardless of the URL the user is visiting.

Given the above, please let me know which is more correct: settings.SSO_ROOT_URL or request.build_absolute_uri(...).

>
> == Desired but optional ==
>
> * The method validation_phrase added inside the AuthToken model feels like it
> does not belong there because is just building a specific user-facing string,
> and IMHO it has nothing to do with the model's business logic. In my opinion,
> validation_phrase is really a helper method from VerifySignedTextForm, so the
> context can be constructed with:
>
> 'validation_phrase': form.validation_phrase(atrequest)

As above, hap...

[lp:~thomir-deactivatedaccount/canonical-identity-provider/trunk-add-gpg-key-management]

1431. By Thomi Richards on 2016-04-28

Several fixes from code review.

1432. By Thomi Richards on 2016-04-28

Fix translation error.

[Natalia Bidart (nataliabidart)]

Adding a second batch of comments:

== Needs fixing ==

* The usual pattern in Django for managing forms is having the action being
represented by the form submission button from the template, and not by adding a
hidden field to the form class. If multiple actions are needed, many submit
buttons with different names are usually defined in the template. If you haven't
yet, I would advice reading:

https://docs.djangoproject.com/en/1.9/topics/forms/

So for the particular case of ClaimOpenPGPKeyForm, the class could be something
among these lines:

FINGERPRINT_CODE_EXAMPLE = (
    '<code>27E0 7815 B47C 0397 90D5&nbsp;&nbsp;8589 27D9 A27B F3F9 6058</code>'
)

class ClaimOpenPGPKeyForm(forms.Form):

    """A form to validate the claiming of an OpenPGP key."""

    fingerprint = forms.CharField(
        help_text=mark_lazy_safe(
            _("For example: ") + FINGERPRINT_CODE_EXAMPLE),
        error_messages={'required': gpg_messages.bad_fingerprint_format()},
    )

    def clean_fingerprint(self):
        # ...
        return sane_fingerprint

And the template should look something like this:

  <form name="gpg_actions" action="" method="POST">
    {% csrf_token %}
    {{ claim_form }}
    <input class="cta" type="submit" name="claim_gpg" value="{% 'Import Key' %}"/>
  </form>

And in the view just remove the code to check the action in the POST dict, given
the form submission itself represents the single available action. If you feel
strong about checking the action name, you still could do (but this is uncommon
in Django views when a single action can be POSTed):

    if request.method == 'POST' and 'claim_gpg' in request.POST:
        form = ...

* I've found more user facing strings missing translations, I trust you will
review all the new code to fix this? (label='Clearsigned Text', <p> block in
gpg_keys.html, etc).

* There are no tests that I could find for the newly added src/webui/forms.py
and its forms. We should add a src/webui/tests/test_forms.py with proper tests
for the fields and custom clean logic.
It may be worth splitting the adding of the form file and its tests into a new branch, it will
certainly help the review process (and this would also include the new GPG service dependencies, and perhaps the new fixture usage).

== Nice to have ==

* Generally, in Django views, after successful POST processing, when redirecting
the user to the succes URL the UI should also show a success message so the user
gets confirmation that all went well. See for example the account_edit view.

* I know that all views in account.py use render_to_response, so I can certainly
understand why you choose to use the same helper to maintain compatibility. But
we have tried to migrate as we go to the new render() helper which is the
recommended function to use, given render_to_response will be deprecated soon:

https://docs.djangoproject.com/en/1.9/topics/http/shortcuts/#render-to-response

So I think it can be a good idea to use render in the gpg new view instead of
render_to_response. In the same nitpick category, is a bit more friendly to
django developers that the dict context variable is called 'context' instead of
template_vars.

[Thomi Richards (thomir-deactivatedaccount)]

Just a note about translating the validation phrase: After talking to William about this, there are valid security concerns about not making this translatable.

An attacker could, for example, submit a translation that happened to match some signed text they'd received (in an email, perhaps) from a key they want to claim as their own.

I'd hope that we have something like reviews of translation messages, but I can easily imagine how such a change might get lost in the noise.

We might want to translate this in the future, but we should think very carefully about how we do this in a safe, secure manner.

[Thomi Richards (thomir-deactivatedaccount)]

Hi Natalia,

You're absolutely correct - this would be a lot easier for both of us if the diff was smaller. I think we should put this MP on hold for now (I won't delete it, so your current work isn't wasted, I'll look at your comments). Instead, I'll start preparing a series of much smaller branches for your review.

The first such branch is here:

https://code.launchpad.net/~thomir/canonical-identity-provider/trunk-add-mark-safe-lazy/+merge/293195

Sorry about that. I think this is the best way forwards though. I look forward to your review on these new, smaller, branches.

[Thomi Richards (thomir-deactivatedaccount)]

...and a second MP here:

https://code.launchpad.net/~thomir/canonical-identity-provider/trunk-add-gpgservice-test-fixture/+merge/293196

[Natalia Bidart (nataliabidart)]

> Hi Natalia,
>
> You're absolutely correct - this would be a lot easier for both of us if the
> diff was smaller. I think we should put this MP on hold for now (I won't
> delete it, so your current work isn't wasted, I'll look at your comments).
> Instead, I'll start preparing a series of much smaller branches for your
> review.

I very much agree and appreciate this extra effort. Thank you.

Unmerged revisions

1432. By Thomi Richards on 2016-04-28

Fix translation error.

1431. By Thomi Richards on 2016-04-28

Several fixes from code review.

1430. By Thomi Richards on 2016-04-27

Fix lint errors.

1429. By Thomi Richards on 2016-04-27

Yet more changes from the code review.

1428. By Thomi Richards on 2016-04-27

Several fixes from code review.

1427. By Thomi Richards on 2016-04-26

Clean up generation of unknown_key message text generation.

1426. By Thomi Richards on 2016-04-26

Fixes from code review.

1425. By Thomi Richards on 2016-04-22

Don't derive from testtools.TestCase either.

1424. By Thomi Richards on 2016-04-22

Remove use of testtools matchers from gpg unit tests.

1423. By Thomi Richards on 2016-04-21

Merged trunk.

=== modified file 'README'
--- README	2016-03-11 15:00:46 +0000
+++ README	2016-04-28 00:53:41 +0000
@@ -7,7 +7,7 @@
 
 0. The supported way to develop Canonical Identity Provider is using LXC's.
 There's some additional documentation on LXC gotchas in the following
-page (check there specially if you can't resolve the lxc address when 
+page (check there specially if you can't resolve the lxc address when
 ssh'ing and if you want to open GUI apps seeing them in your host machine):
 
    https://wiki.canonical.com/UbuntuOne/Developer/LXC
@@ -209,23 +209,30 @@
     Note: this is two separate steps as in Mojo specs we need to separate the
     dependency collect step from the build step, as the build step runs in an
     lxc with no internet access at all.
-    
-
-13. (Optional) Set up private/public keys to make macaroons work between 
-    projects 
+
+
+13. (Optional) Set up private/public keys to make macaroons work between
+    projects
 
     For some endpoints to work correctly, the system needs to decrypt keys
-    that were encrypted from other services (you'll need to use this 
+    that were encrypted from other services (you'll need to use this
     instructions, or the corresponding one in the other projects).
 
     So, create a pair of keys for this project:
 
        ssh-keygen -t rsa -N "" -f project_id_rsa
 
-    This will leave you with two files, move the private one into the 
+    This will leave you with two files, move the private one into the
     ``rsakeys`` directory, and the .pub one into this same dir in the
     other projects.
 
+14. (Optional) Configure the GPG service endpoint.
+
+    This is required if you want to use any of the gpg-related features in SSO.
+    You'll need to run a gpgservice instance somewhere (instructions are in
+    the project's root), and set the 'GPGSERVICE_ENDPOINT' setting in your
+    settings.py to point to the IP_address:tcp_port pair where the service is
+    running.
 
 BAZAAR
 ------
 
=== modified file 'django_project/settings_base.py'
--- django_project/settings_base.py	2016-04-25 18:31:45 +0000
+++ django_project/settings_base.py	2016-04-28 00:53:41 +0000
@@ -184,6 +184,8 @@
 GARGOYLE_SWITCH_DEFAULTS = {}
 GEOIP_PATH = '/usr/share/GeoIP'
 GOOGLE_ANALYTICS_ID = 'THE-GOOGLE-ID'
+GPGSERVICE_ENDPOINT = None
+GPGSERVICE_TIMEOUT = 5
 HANDLER_TIMEOUT_MILLIS = 2500
 HONEYPOT_FIELD_NAME = 'openid.usernamesecret'
 HOTP_BACKWARDS_DRIFT = 0
 
=== modified file 'django_project/settings_devel.py'
--- django_project/settings_devel.py	2016-04-04 15:38:38 +0000
+++ django_project/settings_devel.py	2016-04-28 00:53:41 +0000
@@ -26,6 +26,7 @@
     'CAPTCHA_NEW_ACCOUNT': {'is_active': False},
     'PREFLIGHT': {'is_active': True},
     'LOGIN_BY_TOKEN': {'is_active': True},
+    'GPG_SERVICE': {'is_active': True},
 }
 PASSWORD_HASHERS = [
     'django.contrib.auth.hashers.SHA1PasswordHasher',
 
=== modified file 'requirements.txt'
--- requirements.txt	2016-03-14 17:21:32 +0000
+++ requirements.txt	2016-04-28 00:53:41 +0000
@@ -33,3 +33,4 @@
 timeline==0.0.4
 timeline-django==0.0.4
 whitenoise==2.0.6
+gpgservice-client==0.0.3
 
=== modified file 'requirements_devel.txt'
--- requirements_devel.txt	2016-04-11 16:49:59 +0000
+++ requirements_devel.txt	2016-04-28 00:53:41 +0000
@@ -6,6 +6,7 @@
 extras==0.0.3
 fixtures==0.3.12
 flake8==2.4.0
+gpgservice==0.1.3
 junitxml==0.7
 localmail==0.3
 logilab-astng==0.24.3
@@ -24,6 +25,7 @@
 sst==0.2.5dev
 testscenarios==0.4
 testtools==0.9.39
+txfixtures==0.1.4
 u1-test-utils==0.5
 ucitests==0.4.1
 wsgi-intercept==0.5.1
 
=== modified file 'src/identityprovider/emailutils.py'
--- src/identityprovider/emailutils.py	2016-01-13 02:42:16 +0000
+++ src/identityprovider/emailutils.py	2016-04-28 00:53:41 +0000
@@ -10,7 +10,10 @@
 from django.template import RequestContext
 from django.template.loader import render_to_string
 from django.utils.timezone import now
-from django.utils.translation import ugettext_lazy as _
+from django.utils.translation import (
+    ugettext,
+    ugettext_lazy as _,
+)
 
 from identityprovider.models import AuthToken, EmailAddress
 from identityprovider.models.const import AuthTokenType, EmailStatus
@@ -381,3 +384,76 @@
     to = [format_address(e)
           for e in settings.TWOFACTOR_FAILURE_NOTIFICATION_EMAILS]
     return send_mail(subject, msg, from_email, to)
+
+
+def send_gpg_validation_message(root_url, key_details, token, requester,
+                                gpg_client):
+    """Craft the confirmation message that will be sent to the user.
+
+    There are two chunks of text that will be concatenated together into a
+    single text/plain part.  The first chunk will be the clear text
+    instructions providing some extra help for those people who cannot
+    read the encrypted chunk that follows.  The encrypted chunk will
+    have the actual confirmation token in it, however the ability to
+    read this is highly dependent on the mail reader being used, and how
+    that MUA is configured.
+
+    :param root_url: The root URL this instance of SSO is hosted at
+    :param key_details: A dictionary of PGP key details, as returned by
+                        SSOGPGClient.getKeyDetailsFromKeyServer(...)
+    :param token: The AuthToken instance that was generated when the GPG key
+                  was claimed.
+    :param requester: The Account instance that initiated the gpg claim.
+    :param gpg_client: An instance of SSOGPGClient.
+
+    :raises AssertionError: If the token's type is not either VALIDATEGPG or
+                            VALIDATESIGNONLYGPG.
+    """
+    assert token.token_type in (
+        AuthTokenType.VALIDATEGPG, AuthTokenType.VALIDATESIGNONLYGPG), (
+            "Cannot send gpg validation email for token type %d. Expected"
+            "VALIDATEGPG or VALIDATESIGNONLYGPG" % token.token_type)
+    separator = '\n    '
+    formatted_uids = '    ' + separator.join(key_details['emails'])
+
+    # Here are the instructions that need to be encrypted.
+    template = 'email/validate-gpg.txt'
+    context = {
+        'requester': requester.displayname,
+        'requesteremail': requester.preferredemail,
+        'displayname': key_details['displayname'],
+        'fingerprint': key_details['fingerprint'],
+        'uids': formatted_uids,
+        'token_url': urljoin(root_url, token.get_absolute_url()),
+    }
+
+    context = RequestContext(None, context)
+    token_text = render_to_string(template, context_instance=context)
+
+    # These strings aren't lazily translated since we need to render them
+    # just a few lines further down this function.
+    salutation = ugettext('Hello,\n\n')
+    instructions = ''
+    closing = ugettext('Thanks,\n\nThe Ubuntu One Team')
+
+    # Encrypt this part's content if requested.
+    if key_details['can_encrypt']:
+        token_text = gpg_client.encryptContent(
+            key_details['fingerprint'], token_text.encode('utf-8'))
+        # In this case, we need to include some clear text instructions
+        # for people who do not have an MUA that can decrypt the ASCII
+        # armored text.
+        instructions = render_to_string(
+            'email/gpg-cleartext-instructions.txt', context)
+
+    # Concatenate the message parts and send it.
+    text = salutation + instructions + token_text + closing
+    from_name = 'Ubuntu One OpenPGP Key Confirmation'
+    from_address = format_address(settings.NOREPLY_FROM_ADDRESS, from_name)
+    subject = 'Ubuntu One: Confirm your OpenPGP Key'
+    send_mail(
+        subject,
+        text,
+        from_address,
+        [format_address(requester.preferredemail.email)]
+    )
 
=== added file 'src/identityprovider/migrations/0009_authtoken_gpg_columns.py'
--- src/identityprovider/migrations/0009_authtoken_gpg_columns.py	1970-01-01 00:00:00 +0000
+++ src/identityprovider/migrations/0009_authtoken_gpg_columns.py	2016-04-28 00:53:41 +0000
@@ -0,0 +1,19 @@
+# -*- coding: utf-8 -*-
+from __future__ import unicode_literals
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('identityprovider', '0008_accountpassword_date_changed'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='authtoken',
+            name='fingerprint',
+            field=models.TextField(null=True, blank=True),
+        ),
+    ]
 
=== modified file 'src/identityprovider/models/account.py'
--- src/identityprovider/models/account.py	2016-03-23 15:57:01 +0000
+++ src/identityprovider/models/account.py	2016-04-28 00:53:41 +0000
@@ -213,6 +213,10 @@
     def get_absolute_url(self):
         return reverse('server-identity', args=[self.openid_identifier])
 
+    def get_openid_identity_url(self):
+        """Get the full openid identity url."""
+        return settings.SSO_ROOT_URL + self.get_absolute_url()
+
     @property
     def need_backup_device_warning(self):
         return self.warn_about_backup_device and self.devices.count() == 1
 
=== modified file 'src/identityprovider/models/authtoken.py'
--- src/identityprovider/models/authtoken.py	2016-03-14 20:44:58 +0000
+++ src/identityprovider/models/authtoken.py	2016-04-28 00:53:41 +0000
@@ -58,6 +58,8 @@
         AuthTokenType.INVALIDATEEMAIL,
         AuthTokenType.VALIDATEEMAIL,
         AuthTokenType.PASSWORDRECOVERY,
+        AuthTokenType.VALIDATEGPG,
+        AuthTokenType.VALIDATESIGNONLYGPG,
     ]
 
     def create(self, **kwargs):
@@ -108,6 +110,8 @@
     displayname = DisplaynameField(null=True, blank=True)
     password = PasswordField(null=True, blank=True)
 
+    fingerprint = models.TextField(blank=True)
+
     objects = AuthTokenManager()
 
     class Meta:
@@ -204,6 +208,25 @@
             token.date_consumed = right_now
             token.save()
 
+    @property
+    def validation_phrase(self):
+        """Get a validation phrase for this authtoken.
+
+        AuthToken objects for sign-only keys require the user to sign a text
+        phrase with the key they claim they own.
+
+        :raises AssertionError: if the token_type is not VALIDATESIGNONLYGPG.
+        """
+        assert self.token_type == AuthTokenType.VALIDATESIGNONLYGPG, \
+            "Invalid token type %d, expected VALIDATESIGNONLYGPG" \
+            % self.token_type
+        return ('Please register %s to the\n'
+                'Ubuntu One user with the email address %s.\n'
+                '%s') % (
+            self.fingerprint,
+            self.requester.preferredemail,
+            self.date_created.strftime('%Y-%m-%d %H:%M:%S'))
+
 
 def create_unique_token_for_table(token_length=AUTHTOKEN_LENGTH,
                                   obj=AuthToken, column='hashed_token'):
 
=== modified file 'src/identityprovider/static/css/all.css'
--- src/identityprovider/static/css/all.css	2015-12-15 13:05:44 +0000
+++ src/identityprovider/static/css/all.css	2016-04-28 00:53:41 +0000
@@ -1,1 +1,1 @@
-html{color:#000;background:#FFF}body,div,dl,dt{margin:0;padding:0}dd{margin:0}ul,ol,li,h1,h2,h3,h4,h5,h6,pre,code,form,fieldset,legend,input,textarea{margin:0;padding:0}p{padding:0}blockquote,th,td{margin:0;padding:0}table{border-spacing:0}fieldset,img{border:0}address,caption,cite,code,dfn{font-style:normal;font-weight:400}em{font-weight:400}strong,th,var{font-style:normal}th,var{font-weight:400}li{list-style:none}caption,th{text-align:left}q:before,q:after{content:''}abbr,acronym{border:0;font-variant:normal}sup{vertical-align:text-top}sub{vertical-align:text-bottom}input,textarea,select{font-size:inherit;font-weight:inherit;*font-size:100%}legend{color:#000}article,aside,details,figcaption,figure,footer,header,hgroup,menu,nav,section{display:block}html,body{background:#fff}iframe{border:0;background:#EFEDEC}.breadcrumb li{float:left;margin-right:.5em;font-size:16px}.breadcrumb li:after{content:" >"}.breadcrumb li.last:after{content:""}.show-nojs{display:block}.show-ib-nojs{display:inline-block}.show-i-nojs{display:inline}.js .show-nojs,.js .show-ib-nojs,.js .show-i-nojs,.hide-nojs,.hide-ib-nojs,.hide-i-nojs{display:none}.js .hide-nojs{display:block}.js .hide-ib-nojs{display:inline-block}.js .hide-i-nojs,.ie7 .js .hide-ib-nojs{display:inline}.hidden{display:none}.external:hover:after{content:" " url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKCAYAAACNMs+9AAAAAXNSR0IArs4c6QAAAAZiS0dEAN0ASAAU7HUIkgAAAAlwSFlzAAALEwAACxMBAJqcGAAAAAd0SU1FB9oLBAocL8fy1n0AAADESURBVBjThVAxD8FgFLyv9QMaJIJYEDMxk3TrbDayNNGfoNGfYDAZbUaLTcLMYpOySCWSp+lqqGewfF9L3PYul3t3J5AAOzrjCzLyEXQrfDbaMJy5Isp5BWgyUd5eRS1a4dlrpR19C6lXxdEQYYLTAMBYEIwFodbQwR0XoWkju5kpzpqcQxaJ3QSl5g3RdKCW4Y6Ly/GAKj6i8ylGfQ0RdPcstrGAb4GJiImIX0uP2dGZiDiZXWkdmjYe4zt+7hj18/iHN91rTR+X+JGpAAAAAElFTkSuQmCC")}.subtitle{font-size:13px}::-webkit-input-placeholder{color:#989898}:-moz-placeholder,::-moz-placeholder{color:#989898}:-ms-input-placeholder{color:#989898}.u1-list{margin:1em 0;padding:0}.u1-list li,.u1-list dt{margin:0 0 .3em;padding:0;list-style:inside;list-style-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAYAAAAHAgMAAABW/tR+AAAAAXNSR0IArs4c6QAAAAlQTFRFhwAFmZmZzMzMmHB+2AAAAAF0Uk5TAEDm2GYAAAABYktHRACIBR1IAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAB3RJTUUH2wIWFgMB/x6h+AAAABBJREFUCNdjYAADzgQQggEACZYA000oxv4AAAAASUVORK5CYII=)}dt{font-weight:700;display:list-item}dd{padding:0 0 1em}table{width:100%;border:0}table,.ie7 table{border-collapse:collapse}table.gen-listing{table-layout:fixed}.gen-listing th{background-color:#fff;border-top:none;border-bottom-style:solid}.gen-listing td,.gen-listing th{border-width:1px 0}.gen-listing tr:last-child td,.gen-listing tr:last-child th{border-bottom-style:solid}html,body{background:#E6E3E1;height:100%}#cont{max-width:59em;margin:0 auto;background:#fff;position:relative;min-height:100%}header,#content,footer{overflow:hidden}header{position:relative;border-bottom:3px solid #DD4814;padding:20px 15px 15px}@media all and (min-width:480px){header{padding:20px 20px 15px}#cont:after{padding-bottom:150px;display:block;content:" ";clear:both}footer{position:absolute;bottom:0;height:74px;left:0;right:0}}.sidebar #content,.sidebar #content header{padding:0}#content header{padding:5px 0 20px;border:none}#content header.leader{margin:20px -10px}.services #content header.leader,.home #content header.leader{margin-top:0}.services #content header.leader{margin-bottom:40px}.page-title{padding:20px 0 25px}.page-title :last-child{margin-bottom:0}.cta,.cta:link,.cta:visited{color:#fff;padding:.1em .75em;background:#dd4814;background:linear-gradient(#f39455 0%,#ef5e1f 5%,#dd4814 100%);border:1px solid #ad2e03;display:inline-block;text-decoration:none;font-size:108%;line-height:1.5em;border-radius:3px}button.cta{cursor:pointer}.cta:focus,.cta.secondary:focus{border-color:#333;-o-box-shadow:#f7f6f5 0 0 0 1px;box-shadow:#f7f6f5 0 0 0 1px}.cta:hover{background:#f28a45;background:linear-gradient(#f39455 0%,#f28a45 5%,#dd4814 100%)}.cta:focus,.cta:active{color:#fff;background:#dd4814;background:linear-gradient(#dd4814 0%,#bf3b0d 90%,#f39455 100%);border-color:#333}.cta:disabled,.cta.disabled{color:#f9dbd0;color:rgba(255,255,255,.6);border-color:#deab9a;background:#f8bd9d;background:linear-gradient(#f8bd9d 0%,#f6ad8e 5%,#eea489 100%)}.cta.secondary{color:#333;border-color:#aea79f;background:#e6e6e6;background:linear-gradient(#fff 0%,#f7f7f7 5%,#e6e6e6 100%)}.cta.secondary:hover{background:#f7f7f7;background:linear-gradient(#fff 0%,#fff 5%,#e6e6e6 100%)}.cta.secondary:focus,.cta.secondary:active{color:#333;background:#e6e6e6;background:linear-gradient(#e6e6e6 0%,#cdcdcd 90%,#fff 100%)}.cta.secondary.disabled:active,.cta.secondary:disabled{padding:0 10px;color:#b8b8b8;color:rgba(51,51,51,.3);border-color:#cac6c1;background:#fff;background:linear-gradient(#fff 0%,#f9f9f9 5%,#efefef 100%)}section table{border-top:1px solid #ccc;border-bottom:1px solid #ccc}section table tr{border-top:1px dotted #D1D1D1}section table td{padding:.5em 0}section table td:first-child{border-top:none}.yui3-g{*word-spacing:-.43em;text-rendering:optimizespeed}.opera-only :-o-prefocus,.yui3-g{word-spacing:-.43em}.yui3-u,.yui3-u-1,.yui3-u-1-2,.yui3-u-1-3,.yui3-u-2-3,.yui3-u-1-4,.yui3-u-3-4,.yui3-u-1-5,.yui3-u-2-5,.yui3-u-3-5,.yui3-u-4-5,.yui3-u-1-6,.yui3-u-5-6,.yui3-u-1-8,.yui3-u-3-8,.yui3-u-5-8,.yui3-u-7-8,.yui3-u-1-12,.yui3-u-5-12,.yui3-u-7-12,.yui3-u-11-12,.yui3-u-1-24,.yui3-u-5-24,.yui3-u-7-24,.yui3-u-11-24,.yui3-u-13-24,.yui3-u-17-24,.yui3-u-19-24,.yui3-u-23-24{display:inline-block;text-rendering:auto}.yui3-u-1{display:block}.yui3-g-r{letter-spacing:-.31em;*letter-spacing:normal;*word-spacing:-.43em}.opera-only :-o-prefocus,.yui3-g-r{word-spacing:-.43em}.yui3-g-r img{max-width:100%}@media(min-width:980px){.yui3-visible-phone,.yui3-visible-tablet,.yui3-hidden-desktop{display:none}}@media(max-width:480px){.yui3-g-r>[class^="yui3-u"]{width:100%}}@media(max-width:767px){.yui3-g-r>[class^="yui3-u"]{width:100%}.yui3-hidden-phone,.yui3-visible-desktop{display:none}}@media(min-width:768px) and (max-width:979px){.yui3-hidden-tablet,.yui3-visible-desktop{display:none}}#yui3-css-stamp.cssgrids-responsive{display:none}@font-face{font-family:"Ubuntu";src:url("/assets/fonts/Ubuntu-Light.woff") format('woff');font-weight:300}@font-face{font-family:"Ubuntu";src:url("/assets/fonts/Ubuntu-Regular.woff") format('woff');font-weight:400}@font-face{font-family:"Ubuntu";src:url("/assets/fonts/Ubuntu-Bold.woff") format('woff');font-weight:700}footer{background:#F7F6F6;clear:both;margin-top:2em;padding:1em}footer p{color:#676767;font-size:13px;font-weight:300}footer .title{margin-bottom:1em}footer .links{margin:0;font-size:13px;padding:0}footer .links a{color:#676767}footer .links a:hover{text-decoration:underline}footer .copyright{color:#bbb}@media all and (min-width:480px){footer{padding:1em 2em}}.yui3-g{letter-spacing:-.31em;*letter-spacing:normal;word-spacing:-.43em}.yui3-u,.yui3-u-1,.yui3-u-1-2,.yui3-u-1-3,.yui3-u-2-3,.yui3-u-1-4,.yui3-u-3-4,.yui3-u-1-5,.yui3-u-2-5,.yui3-u-3-5,.yui3-u-4-5,.yui3-u-1-6,.yui3-u-5-6,.yui3-u-1-8,.yui3-u-3-8,.yui3-u-5-8,.yui3-u-7-8,.yui3-u-1-12,.yui3-u-5-12,.yui3-u-7-12,.yui3-u-11-12,.yui3-u-1-24,.yui3-u-5-24,.yui3-u-7-24,.yui3-u-11-24,.yui3-u-13-24,.yui3-u-17-24,.yui3-u-19-24,.yui3-u-23-24{display:inline-block;zoom:1;*display:inline;letter-spacing:normal;word-spacing:normal;vertical-align:top}.yui3-u-1{display:block}.yui3-u-1-2{width:50%}.yui3-u-1-3{width:33.33333%}.yui3-u-2-3{width:66.66666%}.yui3-u-1-4{width:25%}.yui3-u-3-4{width:75%}.yui3-u-1-5{width:20%}.yui3-u-2-5{width:40%}.yui3-u-3-5{width:60%}.yui3-u-4-5{width:80%}.yui3-u-1-6{width:16.656%}.yui3-u-5-6{width:83.33%}.yui3-u-1-8{width:12.5%}.yui3-u-3-8{width:37.5%}.yui3-u-5-8{width:62.5%}.yui3-u-7-8{width:87.5%}.yui3-u-1-12{width:8.3333%}.yui3-u-5-12{width:41.6666%}.yui3-u-7-12{width:58.3333%}.yui3-u-11-12{width:91.6666%}.yui3-u-1-24{width:4.1666%}.yui3-u-5-24{width:20.8333%}.yui3-u-7-24{width:29.1666%}.yui3-u-11-24{width:45.8333%}.yui3-u-13-24{width:54.1666%}.yui3-u-17-24{width:70.8333%}.yui3-u-19-24{width:79.1666%}.yui3-u-23-24{width:95.8333%}#yui3-css-stamp.cssgrids{display:none}.tooltip-light{background-color:#F3F2F1;border:1px solid #888;color:#3F3F3F;min-width:280px;font-weight:lighter}.tooltip-light p{font-size:1.2em}.tooltip-light p:last-child{margin:0}.tooltip-light .tooltip-title{border-bottom:1px dotted #ccc;padding-bottom:4px;margin-bottom:10px;font-size:18px}.yui3-tooltip .tooltip-light:before{background-color:#F3F2F1}.tooltip{display:none}@media all and (min-width:768px){.tooltip{display:block}label.tooltip{max-width:50%}label.tooltip span{float:right}}select,input,button,textarea,body{font-family:Ubuntu,"Bitstream Vera Sans","DejaVu Sans",Tahoma,sans-serif;color:#333;line-height:1.5;font-weight:300}h1,h2,h3,h4,.u1-h-display,.u1-h-main,h1.main,.u1-h-med,.u1-h-light{font-weight:300;line-height:1.3}h5,h6,.u1-h-small,.u1-h-subhead{font-weight:700}.u1-h-pair{margin-bottom:12px}h1,.u1-h-display{font-size:32px}h2,.u1-h-main,h1.main{font-size:23px}h3,.u1-h-med,.faq-q{font-size:20px}h4,.u1-h-light{font-size:16px}h5,.u1-h-small{font-size:13px}h6,.u1-h-subhead{font-size:12px;text-transform:uppercase}@media all and (min-width:480px){h1,.u1-h-display{font-size:45px}h2,.u1-h-main,h1.main{font-size:32px}h3,.u1-h-med,.faq-q{font-size:23px}h4,.u1-h-light{font-size:20px}h5,.u1-h-small{font-size:16px}h6,.u1-h-subhead{font-size:13px}}p{font-size:16px;margin:0 0 .75em}a,a:link,a:active,a:hover,a:visited{color:#dd4814;text-decoration:none}em,i{font-style:italic}strong,b{font-weight:700}.box{background:0 0 #F7F6F5;border-radius:4px;margin-bottom:3em;padding:0 1em 1em}.box .title{border-bottom:1px dotted #ccc;margin:0 -1em 1em;padding:.5em 1em}.info-items{margin:2em}th.cookie,th.cookie-name{width:15%}th.purpose{width:30%}.legal th,.legal td{padding:.5em;border:1px dotted #ccc}header .wrapper{background:url(../identityprovider/img/dots.png) no-repeat 100% -10px;min-height:34px;overflow:visible}@media all and (min-width:768px){header .wrapper{background:url(../identityprovider/img/dots.png) no-repeat 100% 8px;min-height:64px}}header .wrapper h1{float:left}#ac-status{text-align:right;float:right;margin-top:-10px}#u1-logo{top:-10px;float:left;text-indent:-999em;background:url(../identityprovider/img/u1-small.png) no-repeat left;width:91px;height:33px;position:relative;z-index:1}#u1-logo,.user-name{display:block}@media all and (min-width:480px){#ac-status{margin-bottom:20px;max-width:50%}.user-name{display:inline}}.strapline{margin:0 0 1em;color:#676767}.message:last-child{margin-bottom:1em}.message{border-radius:4px;padding:5px;margin-top:1em;background:#f3f2f1}#missing_backup_device,.unverified-email-warning{margin-bottom:1em}@media all and (min-width:768px){.message{padding:.6em 1em}}.message p:last-child{margin:0}.error{background:#DF382C;color:#fff}.error a{color:#fff;text-decoration:underline}.form-box{background:#F7F7F7;border-top:1px solid #CDCDCD;border-bottom:1px solid #CDCDCD;padding:20px 15px;margin:0 -15px}.form-box .title{border-bottom:1px dotted #D1D1D1;padding-bottom:18px;margin-bottom:1em;line-height:1}.action-title:before{content:" → ";display:inline}a.trusted-rp-name:link,a.trusted-rp-name:active,a.trusted-rp-name:hover,a.trusted-rp-name:focus,a.trusted-rp-name:visited{color:inherit}a.trusted-rp-name:hover{text-decoration:underline}.form-box .input-row,.edit-account-details .input-row{width:inherit}.input-row{width:290px;margin-bottom:20px}.radio-label-row input[type=radio],.radio-label-row input[type=checkbox]{display:inline-block;margin-right:.5em}.radio-label-row label{display:inline-block}input[type=text],input[type=tel],input[type=email],input[type=password]{border:1px solid #AEA79F;padding:.3em;display:block;width:100%;box-sizing:border-box}input[type="text"]:focus,input[type="password"]:focus,input[type="email"]:focus,input[type="url"]:focus,input[type="date"]:focus,input[type="month"]:focus,input[type="time"]:focus,input[type="datetime"]:focus,input[type="datetime-local"]:focus,input[type="week"]:focus,input[type="number"]:focus,input[type="search"]:focus,input[type="tel"]:focus,input[type="color"]:focus,select:focus,textarea:focus{outline:0;outline:thin dotted \9;border-color:#129FEA}.ie8 input[type=text],.ie8 input[type=email]{line-height:1}.ie8 input[type=password]{line-height:1;font-family:Arial,sans-serif}.haserrors input[type=text],.haserrors input[type=email],.haserrors input[type=password]{border:1px solid #DF382C}form .error{color:#DF382C;font-weight:700;font-size:14px;background:0 0}label{display:block;margin-bottom:12px;line-height:1}p>label{line-height:inherit}.form-box .actions{border-top:1px dotted #D1D1D1;padding-top:20px;margin-top:20px}.captcha{margin-top:20px}.accept-tos-input{margin-top:30px;position:relative}.accept-tos-input input{position:absolute;top:5px}.accept-tos-input label{margin-left:20px;line-height:1.5em}.accept-tos-input .error{display:block}.yui3-passwordmeter-indicatorNode div{margin:1em 0 0}.yui3-passwordmeter-indicatorNode p{text-shadow:1px 1px 0 #fff}@media all and (min-width:480px){.form-box{border:1px solid #CDCDCD;border-radius:4px;margin:0 0 1em;padding:18px 22px}}@media all and (min-width:768px){.form-box{margin:0 1em 1em 0;min-width:315px}}.login .cta{margin-right:1em}.new-user,.returning-user{margin-bottom:20px}.readonly .new-user{color:#ccc}.login .forgot-password{display:inline-block;margin-bottom:0}.related-information{margin-top:1em}.recaptcha-noscript{width:100%}.recaptcha-challenge-field{width:100%;box-sizing:border-box}.recaptcha_input_area input{display:inline}.captcha .recaptcha_only_if_privacy{margin-top:-5px}.captchaError #recaptcha_response_field{border:2px solid #c00!important}@media all and (min-width:768px){.recaptcha-noscript{height:330px}}.create-form .input-row{margin-bottom:12px}.create-form .email-input{margin-bottom:20px}.js .create-form.show-no-js{display:none}.dual-forms{position:relative}.js .user-intention i{font-style:normal;display:none}.js .selected-login .login-form{display:block}.js .selected-login .create-form{position:absolute;top:0;right:0;left:0;display:none}.js .selected-login i{display:inline}.selected-login .create-title,.selected-create .login-title{display:none}.js .selected-create .create-form{position:relative;display:block}.js .selected-create .login-form{display:none}.no-js-create-account{border-top:1px dotted #ccc;border-bottom:1px dotted #ccc;padding:1em 0;margin:3em 0;text-align:center;color:#666;text-shadow:1px 1px #fff;font-size:13px}.user-intention span{cursor:pointer}.user-intention input{vertical-align:top}@media all and (min-width:768px){.related-information{margin-left:3em;margin-top:0;border-left:1px dotted #ccc;padding:0 1em}.js .login .returning-user span{display:inline}}.edit-account-details{margin-bottom:2em}.site-date{text-align:right}.listing-section .subtitle{float:right}@media all and (min-width:768px){.edit-account-details input,.edit-account-details select,.edit-account-details .yui3-passwordmeter-content{max-width:50%}.edit-account-details .yui3-passwordmeter-content input{max-width:none}.listing-section{max-width:70%}.listing-section .subtitle{line-height:32px}}.manage-email-adresses{padding-bottom:2em;margin-bottom:2em;border-bottom:1px dotted #ccc}.preferred-email-input select{width:100%}.device-prefs .legend{margin-top:15px;margin-bottom:10px}.delete-button{float:right}.backupdevice-warn-input label{display:inline}.devices-you-added{margin-bottom:2em}.codelist{background-color:#F9F9F9;text-align:center;margin:2em 0}.codelist li{color:#444;font-family:monospace;text-shadow:1px 1px 0 #fff}.codelist li:first-child{padding-top:1em}.codelist li:last-child{padding-bottom:1em}.device-name{font-weight:700}.print-new-codes{float:right}.device-types dt{font-weight:700;list-style:none}.device-types dd{margin-left:18px}.used-applications .subtitle{float:right;position:relative;top:1em}.application-date,.application-date+td{text-align:right}.account-activity table.listing{table-layout:fixed;width:100%}.account-activity thead td{font-weight:700;padding-right:1em}.account-activity tbody td{font-size:80%}.account-activity td.time-date{width:30%;white-space:nowrap;padding-right:1em}.account-activity td.log-type{width:20%;padding-right:1em}.account-activity td.ip-address{width:18%;padding-right:1em}.account-activity td.user-agent{width:42%;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.account-activity td.user-agent:hover{overflow:visible;white-space:normal}.preferred-email .email{font-weight:700}.preferred-label{font-style:italic;color:#999}.verified-emails,.unverified-emails{margin-bottom:2em}.menu li span{display:block;border-bottom:1px dotted #ccc;line-height:2.5em;color:#333;padding:0 23px}.menu li .active{background-color:#F7F6F5}.menu li .active:after{content:'▶';font-size:10px;float:right}@media all and (min-width:768px){.menu{width:15em;border-right:1px dotted #ccc;position:absolute;bottom:0;top:102px}.menu li span{padding:0 1em}.with-menu #content{padding-bottom:2em;margin-left:15em}.with-menu footer{margin-top:0}}.account-information{font-weight:300}.account-information h2,.account-information h3{margin-bottom:.5em}.account-faq{float:right}.account-faq li{margin-bottom:.5em}.benefits{border:1px solid #D3D3D3;padding:1.5em;border-radius:4px;margin:40px 0}.benefits .apps,.benefits .music,.benefits .photos,.benefits .cloud{margin-bottom:1em;padding-left:60px;background:url("../identityprovider/img/icons.png") no-repeat 0 50%;height:40px;display:table;line-height:1.2em}.benefits p{display:table-cell;vertical-align:middle}.benefits .apps{background-position:0 -160px}.benefits .music{background-position:0 -200px}.benefits .photos{background-position:0 -240px}.benefits .cloud{background-position:0 -280px}.benefits li:last-child{margin-bottom:0}.questions{margin:0 0 0 1em}.questions li{list-style:disc outside none;margin-bottom:.5em}.more-help{margin:.5em 0 1px}.password-reset-advice{margin-top:5em}.legal h2,.legal h3{margin-bottom:.6em}.legal .content-updates{border-left:2px solid #ccc;padding:2em;margin-bottom:2em}.legal .section{margin-bottom:2em}.legal .account-faq{min-width:350px;margin-left:3em}.faq-q{margin:2em 0 1em}.faq-q::before{content:"Q. "}.faq .faq-q:first-child{margin-top:0}.faq-body ol,.faq-body ul{margin:1em 0;padding:0 0 0 40px}.faq-body ol li{list-style:decimal outside}.faq-body ul li{list-style:circle outside}@media screen and (max-width:756px){.legal .account-faq{min-width:100%;margin-left:0;float:none}}.language-select{margin-bottom:1em}.language-select p{border-bottom:1px dotted #ccc;margin-bottom:.5em;padding-bottom:.5em}.language-select label{display:inline-block;cursor:pointer;margin:0}.language-select button{margin-top:1em}.cannot-find-language{float:right}@media all and (min-width:768px){.readonly{margin-top:56px}.readonly-message{position:fixed;top:0;left:0;right:0;text-align:center;z-index:10;padding:.25em;border-radius:0;margin-top:0}.readonly .readonly-message p{margin:0 auto;max-width:700px}}.question-mark{background-color:#AEA79F;border-radius:100px 100px 100px 100px;color:#fff;cursor:pointer;font-size:1em;font-weight:700;line-height:1.1em;padding:0 .3em}.yui3-hastooltip{cursor:default}.yui3-tooltip{position:absolute;opacity:1;transition:opacity 750ms ease-in-out;padding:10px;max-width:10em}.yui3-tooltip-content{position:relative;background:rgba(30,30,30,1);border-color:rgba(30,30,30,1);border-radius:4px;padding:8px 15px 2px;color:#c8c8c8;font-size:14px;line-height:1.4}div.yui3-tooltip-hidden{opacity:0;visibility:hidden;display:block}.yui3-tooltip .yui3-tooltip-content::before{content:"";position:absolute}.yui3-tooltip-position-north .yui3-tooltip-content::before{bottom:-4px;left:50%;margin-left:-4px;border-top:4px solid #000;border-top-color:inherit;border-left:4px solid transparent;border-right:4px solid transparent}.yui3-tooltip-position-east .yui3-tooltip-content::before{top:50%;left:-4px;margin-top:-4px;border-right:4px solid #000;border-right-color:inherit;border-top:4px solid transparent;border-bottom:4px solid transparent}.yui3-tooltip-position-south .yui3-tooltip-content::before{top:-4px;left:50%;margin-left:-4px;border-bottom:4px solid #000;border-bottom-color:inherit;border-left:4px solid transparent;border-right:4px solid transparent}.yui3-tooltip-position-west .yui3-tooltip-content::before{top:50%;right:-4px;margin-top:-4px;border-left:4px solid #000;border-left-color:inherit;border-top:4px solid transparent;border-bottom:4px solid transparent}td.actions{text-align:right}table.listing{margin:0 0 2em}#content{padding:0 15px}.teams-list{margin:0 0 0 1em}@media all and (min-width:480px){#cont{border:4px solid #E6E3E1;border-width:0 4px}}@media all and (min-width:768px){#cont{border-width:0 16px}#u1-logo{background:url(../identityprovider/img/u1_logo_med.png) no-repeat left;height:60px;width:167px}#content{padding:0 20px}}
 \ No newline at end of file
+html{color:#000;background:#FFF}body,div,dl,dt{margin:0;padding:0}dd{margin:0}ul,ol,li,h1,h2,h3,h4,h5,h6,pre,code,form,fieldset,legend,input,textarea{margin:0;padding:0}p{padding:0}blockquote,th,td{margin:0;padding:0}table{border-spacing:0}fieldset,img{border:0}address,caption,cite,code,dfn{font-style:normal;font-weight:400}em{font-weight:400}strong,th,var{font-style:normal}th,var{font-weight:400}li{list-style:none}caption,th{text-align:left}q:before,q:after{content:''}abbr,acronym{border:0;font-variant:normal}sup{vertical-align:text-top}sub{vertical-align:text-bottom}input,textarea,select{font-size:inherit;font-weight:inherit;*font-size:100%}legend{color:#000}article,aside,details,figcaption,figure,footer,header,hgroup,menu,nav,section{display:block}html,body{background:#fff}iframe{border:0;background:#EFEDEC}.breadcrumb li{float:left;margin-right:.5em;font-size:16px}.breadcrumb li:after{content:" >"}.breadcrumb li.last:after{content:""}.show-nojs{display:block}.show-ib-nojs{display:inline-block}.show-i-nojs{display:inline}.js .show-nojs,.js .show-ib-nojs,.js .show-i-nojs,.hide-nojs,.hide-ib-nojs,.hide-i-nojs{display:none}.js .hide-nojs{display:block}.js .hide-ib-nojs{display:inline-block}.js .hide-i-nojs,.ie7 .js .hide-ib-nojs{display:inline}.hidden{display:none}.external:hover:after{content:" " url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKCAYAAACNMs+9AAAAAXNSR0IArs4c6QAAAAZiS0dEAN0ASAAU7HUIkgAAAAlwSFlzAAALEwAACxMBAJqcGAAAAAd0SU1FB9oLBAocL8fy1n0AAADESURBVBjThVAxD8FgFLyv9QMaJIJYEDMxk3TrbDayNNGfoNGfYDAZbUaLTcLMYpOySCWSp+lqqGewfF9L3PYul3t3J5AAOzrjCzLyEXQrfDbaMJy5Isp5BWgyUd5eRS1a4dlrpR19C6lXxdEQYYLTAMBYEIwFodbQwR0XoWkju5kpzpqcQxaJ3QSl5g3RdKCW4Y6Ly/GAKj6i8ylGfQ0RdPcstrGAb4GJiImIX0uP2dGZiDiZXWkdmjYe4zt+7hj18/iHN91rTR+X+JGpAAAAAElFTkSuQmCC")}.subtitle{font-size:13px}::-webkit-input-placeholder{color:#989898}:-moz-placeholder,::-moz-placeholder{color:#989898}:-ms-input-placeholder{color:#989898}.u1-list{margin:1em 0;padding:0}.u1-list li,.u1-list dt{margin:0 0 .3em;padding:0;list-style:inside;list-style-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAYAAAAHAgMAAABW/tR+AAAAAXNSR0IArs4c6QAAAAlQTFRFhwAFmZmZzMzMmHB+2AAAAAF0Uk5TAEDm2GYAAAABYktHRACIBR1IAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAB3RJTUUH2wIWFgMB/x6h+AAAABBJREFUCNdjYAADzgQQggEACZYA000oxv4AAAAASUVORK5CYII=)}dt{font-weight:700;display:list-item}dd{padding:0 0 1em}table{width:100%;border:0}table,.ie7 table{border-collapse:collapse}table.gen-listing{table-layout:fixed}.gen-listing th{background-color:#fff;border-top:none;border-bottom-style:solid}.gen-listing td,.gen-listing th{border-width:1px 0}.gen-listing tr:last-child td,.gen-listing tr:last-child th{border-bottom-style:solid}html,body{background:#E6E3E1;height:100%}#cont{max-width:59em;margin:0 auto;background:#fff;position:relative;min-height:100%}header,#content,footer{overflow:hidden}header{position:relative;border-bottom:3px solid #DD4814;padding:20px 15px 15px}@media all and (min-width:480px){header{padding:20px 20px 15px}#cont:after{padding-bottom:150px;display:block;content:" ";clear:both}footer{position:absolute;bottom:0;height:74px;left:0;right:0}}.sidebar #content,.sidebar #content header{padding:0}#content header{padding:5px 0 20px;border:none}#content header.leader{margin:20px -10px}.services #content header.leader,.home #content header.leader{margin-top:0}.services #content header.leader{margin-bottom:40px}.page-title{padding:20px 0 25px}.page-title :last-child{margin-bottom:0}.cta,.cta:link,.cta:visited{color:#fff;padding:.1em .75em;background:#dd4814;background:linear-gradient(#f39455 0%,#ef5e1f 5%,#dd4814 100%);border:1px solid #ad2e03;display:inline-block;text-decoration:none;font-size:108%;line-height:1.5em;border-radius:3px}button.cta{cursor:pointer}.cta:focus,.cta.secondary:focus{border-color:#333;-o-box-shadow:#f7f6f5 0 0 0 1px;box-shadow:#f7f6f5 0 0 0 1px}.cta:hover{background:#f28a45;background:linear-gradient(#f39455 0%,#f28a45 5%,#dd4814 100%)}.cta:focus,.cta:active{color:#fff;background:#dd4814;background:linear-gradient(#dd4814 0%,#bf3b0d 90%,#f39455 100%);border-color:#333}.cta:disabled,.cta.disabled{color:#f9dbd0;color:rgba(255,255,255,.6);border-color:#deab9a;background:#f8bd9d;background:linear-gradient(#f8bd9d 0%,#f6ad8e 5%,#eea489 100%)}.cta.secondary{color:#333;border-color:#aea79f;background:#e6e6e6;background:linear-gradient(#fff 0%,#f7f7f7 5%,#e6e6e6 100%)}.cta.secondary:hover{background:#f7f7f7;background:linear-gradient(#fff 0%,#fff 5%,#e6e6e6 100%)}.cta.secondary:focus,.cta.secondary:active{color:#333;background:#e6e6e6;background:linear-gradient(#e6e6e6 0%,#cdcdcd 90%,#fff 100%)}.cta.secondary.disabled:active,.cta.secondary:disabled{padding:0 10px;color:#b8b8b8;color:rgba(51,51,51,.3);border-color:#cac6c1;background:#fff;background:linear-gradient(#fff 0%,#f9f9f9 5%,#efefef 100%)}section table{border-top:1px solid #ccc;border-bottom:1px solid #ccc}section table tr{border-top:1px dotted #D1D1D1}section table td{padding:.5em 0}section table td:first-child{border-top:none}.yui3-g{*word-spacing:-.43em;text-rendering:optimizespeed}.opera-only :-o-prefocus,.yui3-g{word-spacing:-.43em}.yui3-u,.yui3-u-1,.yui3-u-1-2,.yui3-u-1-3,.yui3-u-2-3,.yui3-u-1-4,.yui3-u-3-4,.yui3-u-1-5,.yui3-u-2-5,.yui3-u-3-5,.yui3-u-4-5,.yui3-u-1-6,.yui3-u-5-6,.yui3-u-1-8,.yui3-u-3-8,.yui3-u-5-8,.yui3-u-7-8,.yui3-u-1-12,.yui3-u-5-12,.yui3-u-7-12,.yui3-u-11-12,.yui3-u-1-24,.yui3-u-5-24,.yui3-u-7-24,.yui3-u-11-24,.yui3-u-13-24,.yui3-u-17-24,.yui3-u-19-24,.yui3-u-23-24{display:inline-block;text-rendering:auto}.yui3-u-1{display:block}.yui3-g-r{letter-spacing:-.31em;*letter-spacing:normal;*word-spacing:-.43em}.opera-only :-o-prefocus,.yui3-g-r{word-spacing:-.43em}.yui3-g-r img{max-width:100%}@media(min-width:980px){.yui3-visible-phone,.yui3-visible-tablet,.yui3-hidden-desktop{display:none}}@media(max-width:480px){.yui3-g-r>[class^="yui3-u"]{width:100%}}@media(max-width:767px){.yui3-g-r>[class^="yui3-u"]{width:100%}.yui3-hidden-phone,.yui3-visible-desktop{display:none}}@media(min-width:768px) and (max-width:979px){.yui3-hidden-tablet,.yui3-visible-desktop{display:none}}#yui3-css-stamp.cssgrids-responsive{display:none}@font-face{font-family:"Ubuntu";src:url("/assets/fonts/Ubuntu-Light.woff") format('woff');font-weight:300}@font-face{font-family:"Ubuntu";src:url("/assets/fonts/Ubuntu-Regular.woff") format('woff');font-weight:400}@font-face{font-family:"Ubuntu";src:url("/assets/fonts/Ubuntu-Bold.woff") format('woff');font-weight:700}footer{background:#F7F6F6;clear:both;margin-top:2em;padding:1em}footer p{color:#676767;font-size:13px;font-weight:300}footer .title{margin-bottom:1em}footer .links{margin:0;font-size:13px;padding:0}footer .links a{color:#676767}footer .links a:hover{text-decoration:underline}footer .copyright{color:#bbb}@media all and (min-width:480px){footer{padding:1em 2em}}.yui3-g{letter-spacing:-.31em;*letter-spacing:normal;word-spacing:-.43em}.yui3-u,.yui3-u-1,.yui3-u-1-2,.yui3-u-1-3,.yui3-u-2-3,.yui3-u-1-4,.yui3-u-3-4,.yui3-u-1-5,.yui3-u-2-5,.yui3-u-3-5,.yui3-u-4-5,.yui3-u-1-6,.yui3-u-5-6,.yui3-u-1-8,.yui3-u-3-8,.yui3-u-5-8,.yui3-u-7-8,.yui3-u-1-12,.yui3-u-5-12,.yui3-u-7-12,.yui3-u-11-12,.yui3-u-1-24,.yui3-u-5-24,.yui3-u-7-24,.yui3-u-11-24,.yui3-u-13-24,.yui3-u-17-24,.yui3-u-19-24,.yui3-u-23-24{display:inline-block;zoom:1;*display:inline;letter-spacing:normal;word-spacing:normal;vertical-align:top}.yui3-u-1{display:block}.yui3-u-1-2{width:50%}.yui3-u-1-3{width:33.33333%}.yui3-u-2-3{width:66.66666%}.yui3-u-1-4{width:25%}.yui3-u-3-4{width:75%}.yui3-u-1-5{width:20%}.yui3-u-2-5{width:40%}.yui3-u-3-5{width:60%}.yui3-u-4-5{width:80%}.yui3-u-1-6{width:16.656%}.yui3-u-5-6{width:83.33%}.yui3-u-1-8{width:12.5%}.yui3-u-3-8{width:37.5%}.yui3-u-5-8{width:62.5%}.yui3-u-7-8{width:87.5%}.yui3-u-1-12{width:8.3333%}.yui3-u-5-12{width:41.6666%}.yui3-u-7-12{width:58.3333%}.yui3-u-11-12{width:91.6666%}.yui3-u-1-24{width:4.1666%}.yui3-u-5-24{width:20.8333%}.yui3-u-7-24{width:29.1666%}.yui3-u-11-24{width:45.8333%}.yui3-u-13-24{width:54.1666%}.yui3-u-17-24{width:70.8333%}.yui3-u-19-24{width:79.1666%}.yui3-u-23-24{width:95.8333%}#yui3-css-stamp.cssgrids{display:none}.tooltip-light{background-color:#F3F2F1;border:1px solid #888;color:#3F3F3F;min-width:280px;font-weight:lighter}.tooltip-light p{font-size:1.2em}.tooltip-light p:last-child{margin:0}.tooltip-light .tooltip-title{border-bottom:1px dotted #ccc;padding-bottom:4px;margin-bottom:10px;font-size:18px}.yui3-tooltip .tooltip-light:before{background-color:#F3F2F1}.tooltip{display:none}@media all and (min-width:768px){.tooltip{display:block}label.tooltip{max-width:50%}label.tooltip span{float:right}}select,input,button,textarea,body{font-family:Ubuntu,"Bitstream Vera Sans","DejaVu Sans",Tahoma,sans-serif;color:#333;line-height:1.5;font-weight:300}h1,h2,h3,h4,.u1-h-display,.u1-h-main,h1.main,.u1-h-med,.u1-h-light{font-weight:300;line-height:1.3}h5,h6,.u1-h-small,.u1-h-subhead{font-weight:700}.u1-h-pair{margin-bottom:12px}h1,.u1-h-display{font-size:32px}h2,.u1-h-main,h1.main{font-size:23px}h3,.u1-h-med,.faq-q{font-size:20px}h4,.u1-h-light{font-size:16px}h5,.u1-h-small{font-size:13px}h6,.u1-h-subhead{font-size:12px;text-transform:uppercase}@media all and (min-width:480px){h1,.u1-h-display{font-size:45px}h2,.u1-h-main,h1.main{font-size:32px}h3,.u1-h-med,.faq-q{font-size:23px}h4,.u1-h-light{font-size:20px}h5,.u1-h-small{font-size:16px}h6,.u1-h-subhead{font-size:13px}}p{font-size:16px;margin:0 0 .75em}a,a:link,a:active,a:hover,a:visited{color:#dd4814;text-decoration:none}em,i{font-style:italic}strong,b{font-weight:700}.box{background:0 0 #F7F6F5;border-radius:4px;margin-bottom:3em;padding:0 1em 1em}.box .title{border-bottom:1px dotted #ccc;margin:0 -1em 1em;padding:.5em 1em}.info-items{margin:2em}th.cookie,th.cookie-name{width:15%}th.purpose{width:30%}.legal th,.legal td{padding:.5em;border:1px dotted #ccc}header .wrapper{background:url(../identityprovider/img/dots.png) no-repeat 100% -10px;min-height:34px;overflow:visible}@media all and (min-width:768px){header .wrapper{background:url(../identityprovider/img/dots.png) no-repeat 100% 8px;min-height:64px}}header .wrapper h1{float:left}#ac-status{text-align:right;float:right;margin-top:-10px}#u1-logo{top:-10px;float:left;text-indent:-999em;background:url(../identityprovider/img/u1-small.png) no-repeat left;width:91px;height:33px;position:relative;z-index:1}#u1-logo,.user-name{display:block}@media all and (min-width:480px){#ac-status{margin-bottom:20px;max-width:50%}.user-name{display:inline}}.strapline{margin:0 0 1em;color:#676767}.message:last-child{margin-bottom:1em}.message{border-radius:4px;padding:5px;margin-top:1em;background:#f3f2f1}#missing_backup_device,.unverified-email-warning{margin-bottom:1em}@media all and (min-width:768px){.message{padding:.6em 1em}}.message p:last-child{margin:0}.error{background:#DF382C;color:#fff}.error a{color:#fff;text-decoration:underline}.form-box{background:#F7F7F7;border-top:1px solid #CDCDCD;border-bottom:1px solid #CDCDCD;padding:20px 15px;margin:0 -15px}.form-box .title{border-bottom:1px dotted #D1D1D1;padding-bottom:18px;margin-bottom:1em;line-height:1}.action-title:before{content:" → ";display:inline}a.trusted-rp-name:link,a.trusted-rp-name:active,a.trusted-rp-name:hover,a.trusted-rp-name:focus,a.trusted-rp-name:visited{color:inherit}a.trusted-rp-name:hover{text-decoration:underline}.form-box .input-row,.edit-account-details .input-row{width:inherit}.input-row{width:290px;margin-bottom:20px}.radio-label-row input[type=radio],.radio-label-row input[type=checkbox]{display:inline-block;margin-right:.5em}.radio-label-row label{display:inline-block}input[type=text],input[type=tel],input[type=email],input[type=password]{border:1px solid #AEA79F;padding:.3em;display:block;width:100%;box-sizing:border-box}input[type="text"]:focus,input[type="password"]:focus,input[type="email"]:focus,input[type="url"]:focus,input[type="date"]:focus,input[type="month"]:focus,input[type="time"]:focus,input[type="datetime"]:focus,input[type="datetime-local"]:focus,input[type="week"]:focus,input[type="number"]:focus,input[type="search"]:focus,input[type="tel"]:focus,input[type="color"]:focus,select:focus,textarea:focus{outline:0;outline:thin dotted \9;border-color:#129FEA}.ie8 input[type=text],.ie8 input[type=email]{line-height:1}.ie8 input[type=password]{line-height:1;font-family:Arial,sans-serif}.haserrors input[type=text],.haserrors input[type=email],.haserrors input[type=password]{border:1px solid #DF382C}form .error{color:#DF382C;font-weight:700;font-size:14px;background:0 0}label{display:block;margin-bottom:12px;line-height:1}p>label{line-height:inherit}.form-box .actions{border-top:1px dotted #D1D1D1;padding-top:20px;margin-top:20px}.captcha{margin-top:20px}.accept-tos-input{margin-top:30px;position:relative}.accept-tos-input input{position:absolute;top:5px}.accept-tos-input label{margin-left:20px;line-height:1.5em}.accept-tos-input .error{display:block}.yui3-passwordmeter-indicatorNode div{margin:1em 0 0}.yui3-passwordmeter-indicatorNode p{text-shadow:1px 1px 0 #fff}@media all and (min-width:480px){.form-box{border:1px solid #CDCDCD;border-radius:4px;margin:0 0 1em;padding:18px 22px}}@media all and (min-width:768px){.form-box{margin:0 1em 1em 0;min-width:315px}}.login .cta{margin-right:1em}.new-user,.returning-user{margin-bottom:20px}.readonly .new-user{color:#ccc}.login .forgot-password{display:inline-block;margin-bottom:0}.related-information{margin-top:1em}.recaptcha-noscript{width:100%}.recaptcha-challenge-field{width:100%;box-sizing:border-box}.recaptcha_input_area input{display:inline}.captcha .recaptcha_only_if_privacy{margin-top:-5px}.captchaError #recaptcha_response_field{border:2px solid #c00!important}@media all and (min-width:768px){.recaptcha-noscript{height:330px}}.create-form .input-row{margin-bottom:12px}.create-form .email-input{margin-bottom:20px}.js .create-form.show-no-js{display:none}.dual-forms{position:relative}.js .user-intention i{font-style:normal;display:none}.js .selected-login .login-form{display:block}.js .selected-login .create-form{position:absolute;top:0;right:0;left:0;display:none}.js .selected-login i{display:inline}.selected-login .create-title,.selected-create .login-title{display:none}.js .selected-create .create-form{position:relative;display:block}.js .selected-create .login-form{display:none}.no-js-create-account{border-top:1px dotted #ccc;border-bottom:1px dotted #ccc;padding:1em 0;margin:3em 0;text-align:center;color:#666;text-shadow:1px 1px #fff;font-size:13px}.user-intention span{cursor:pointer}.user-intention input{vertical-align:top}@media all and (min-width:768px){.related-information{margin-left:3em;margin-top:0;border-left:1px dotted #ccc;padding:0 1em}.js .login .returning-user span{display:inline}}.edit-account-details{margin-bottom:2em}.site-date{text-align:right}.listing-section .subtitle{float:right}@media all and (min-width:768px){.edit-account-details input,.edit-account-details select,.edit-account-details .yui3-passwordmeter-content{max-width:50%}.edit-account-details .yui3-passwordmeter-content input{max-width:none}.listing-section{max-width:70%}.listing-section .subtitle{line-height:32px}}.manage-email-adresses{padding-bottom:2em;margin-bottom:2em;border-bottom:1px dotted #ccc}.preferred-email-input select{width:100%}.device-prefs .legend{margin-top:15px;margin-bottom:10px}.delete-button{float:right}.backupdevice-warn-input label{display:inline}.devices-you-added{margin-bottom:2em}.codelist{background-color:#F9F9F9;text-align:center;margin:2em 0}.codelist li{color:#444;font-family:monospace;text-shadow:1px 1px 0 #fff}.codelist li:first-child{padding-top:1em}.codelist li:last-child{padding-bottom:1em}.device-name{font-weight:700}.print-new-codes{float:right}.device-types dt{font-weight:700;list-style:none}.device-types dd{margin-left:18px}.used-applications .subtitle{float:right;position:relative;top:1em}.application-date,.application-date+td{text-align:right}.account-activity table.listing{table-layout:fixed;width:100%}.account-activity thead td{font-weight:700;padding-right:1em}.account-activity tbody td{font-size:80%}.account-activity td.time-date{width:30%;white-space:nowrap;padding-right:1em}.account-activity td.log-type{width:20%;padding-right:1em}.account-activity td.ip-address{width:18%;padding-right:1em}.account-activity td.user-agent{width:42%;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.account-activity td.user-agent:hover{overflow:visible;white-space:normal}.preferred-email .email{font-weight:700}.preferred-label{font-style:italic;color:#999}.verified-emails,.unverified-emails{margin-bottom:2em}.menu li span{display:block;border-bottom:1px dotted #ccc;line-height:2.5em;color:#333;padding:0 23px}.menu li .active{background-color:#F7F6F5}.menu li .active:after{content:'▶';font-size:10px;float:right}@media all and (min-width:768px){.menu{width:15em;border-right:1px dotted #ccc;position:absolute;bottom:0;top:102px}.menu li span{padding:0 1em}.with-menu #content{padding-bottom:2em;margin-left:15em}.with-menu footer{margin-top:0}}.account-information{font-weight:300}.account-information h2,.account-information h3{margin-bottom:.5em}.account-faq{float:right}.account-faq li{margin-bottom:.5em}.benefits{border:1px solid #D3D3D3;padding:1.5em;border-radius:4px;margin:40px 0}.benefits .apps,.benefits .music,.benefits .photos,.benefits .cloud{margin-bottom:1em;padding-left:60px;background:url("../identityprovider/img/icons.png") no-repeat 0 50%;height:40px;display:table;line-height:1.2em}.benefits p{display:table-cell;vertical-align:middle}.benefits .apps{background-position:0 -160px}.benefits .music{background-position:0 -200px}.benefits .photos{background-position:0 -240px}.benefits .cloud{background-position:0 -280px}.benefits li:last-child{margin-bottom:0}.questions{margin:0 0 0 1em}.questions li{list-style:disc outside none;margin-bottom:.5em}.more-help{margin:.5em 0 1px}.password-reset-advice{margin-top:5em}.legal h2,.legal h3{margin-bottom:.6em}.legal .content-updates{border-left:2px solid #ccc;padding:2em;margin-bottom:2em}.legal .section{margin-bottom:2em}.legal .account-faq{min-width:350px;margin-left:3em}.faq-q{margin:2em 0 1em}.faq-q::before{content:"Q. "}.faq .faq-q:first-child{margin-top:0}.faq-body ol,.faq-body ul{margin:1em 0;padding:0 0 0 40px}.faq-body ol li{list-style:decimal outside}.faq-body ul li{list-style:circle outside}@media screen and (max-width:756px){.legal .account-faq{min-width:100%;margin-left:0;float:none}}.language-select{margin-bottom:1em}.language-select p{border-bottom:1px dotted #ccc;margin-bottom:.5em;padding-bottom:.5em}.language-select label{display:inline-block;cursor:pointer;margin:0}.language-select button{margin-top:1em}.cannot-find-language{float:right}@media all and (min-width:768px){.readonly{margin-top:56px}.readonly-message{position:fixed;top:0;left:0;right:0;text-align:center;z-index:10;padding:.25em;border-radius:0;margin-top:0}.readonly .readonly-message p{margin:0 auto;max-width:700px}}.question-mark{background-color:#AEA79F;border-radius:100px 100px 100px 100px;color:#fff;cursor:pointer;font-size:1em;font-weight:700;line-height:1.1em;padding:0 .3em}.yui3-hastooltip{cursor:default}.yui3-tooltip{position:absolute;opacity:1;transition:opacity 750ms ease-in-out;padding:10px;max-width:10em}.yui3-tooltip-content{position:relative;background:rgba(30,30,30,1);border-color:rgba(30,30,30,1);border-radius:4px;padding:8px 15px 2px;color:#c8c8c8;font-size:14px;line-height:1.4}div.yui3-tooltip-hidden{opacity:0;visibility:hidden;display:block}.yui3-tooltip .yui3-tooltip-content::before{content:"";position:absolute}.yui3-tooltip-position-north .yui3-tooltip-content::before{bottom:-4px;left:50%;margin-left:-4px;border-top:4px solid #000;border-top-color:inherit;border-left:4px solid transparent;border-right:4px solid transparent}.yui3-tooltip-position-east .yui3-tooltip-content::before{top:50%;left:-4px;margin-top:-4px;border-right:4px solid #000;border-right-color:inherit;border-top:4px solid transparent;border-bottom:4px solid transparent}.yui3-tooltip-position-south .yui3-tooltip-content::before{top:-4px;left:50%;margin-left:-4px;border-bottom:4px solid #000;border-bottom-color:inherit;border-left:4px solid transparent;border-right:4px solid transparent}.yui3-tooltip-position-west .yui3-tooltip-content::before{top:50%;right:-4px;margin-top:-4px;border-left:4px solid #000;border-left-color:inherit;border-top:4px solid transparent;border-bottom:4px solid transparent}td.actions{text-align:right}table.listing{margin:0 0 2em}#content{padding:0 15px}.teams-list{margin:0 0 0 1em}@media all and (min-width:480px){#cont{border:4px solid #E6E3E1;border-width:0 4px}}@media all and (min-width:768px){#cont{border-width:0 16px}#u1-logo{background:url(../identityprovider/img/u1_logo_med.png) no-repeat left;height:60px;width:167px}#content{padding:0 20px}}div.separated{margin-bottom:2em}h3.separated{margin-bottom:.75em}p.note-separated{margin-top:.5em}div.error blockquote{margin:.5em}
 \ No newline at end of file
 
=== modified file 'src/identityprovider/static_src/css/ubuntuone.css'
--- src/identityprovider/static_src/css/ubuntuone.css	2015-09-15 23:16:51 +0000
+++ src/identityprovider/static_src/css/ubuntuone.css	2016-04-28 00:53:41 +0000
@@ -986,3 +986,21 @@
 
 
 }
+
+/* GPG Keys ------------------------------------------------------------------*/
+
+div.separated {
+  margin-bottom: 2em;
+}
+
+h3.separated {
+  margin-bottom: 0.75em;
+}
+
+p.note-separated {
+  margin-top: 0.5em;
+}
+
+div.error blockquote {
+  margin: 0.5em;
+}
 
=== added file 'src/identityprovider/templates/email/gpg-cleartext-instructions.txt'
--- src/identityprovider/templates/email/gpg-cleartext-instructions.txt	1970-01-01 00:00:00 +0000
+++ src/identityprovider/templates/email/gpg-cleartext-instructions.txt	2016-04-28 00:53:41 +0000
@@ -0,0 +1,17 @@
+{% load i18n %}
+{% blocktrans %}
+This message contains the instructions for confirming registration of an
+OpenPGP key for use in Ubuntu One.  The confirmation instructions have been
+encrypted with the OpenPGP key you have attempted to register.  If you cannot
+read the unencrypted instructions below, it may be because your mail reader
+does not support automatic decryption of "ASCII armored" encrypted text.
+
+Exact instructions for enabling this depends on the specific mail reader you
+are using.  Please see this support page for more information:{% endblocktrans %}
+
+    https://help.launchpad.net/ReadingOpenPgpMail
+
+{% blocktrans %}For more general information on OpenPGP and related tools such as Gnu Privacy
+Guard (GPG), please see:{% endblocktrans %}
+
+    https://help.ubuntu.com/community/GnuPrivacyGuardHowto
 
=== added file 'src/identityprovider/templates/email/validate-gpg.txt'
--- src/identityprovider/templates/email/validate-gpg.txt	1970-01-01 00:00:00 +0000
+++ src/identityprovider/templates/email/validate-gpg.txt	2016-04-28 00:53:41 +0000
@@ -0,0 +1,18 @@
+{% load i18n %}{% blocktrans %}
+Here are the instructions for confirming the OpenPGP key registration that we
+received for use in Ubuntu One.
+
+Requester email address: {{requesteremail}}
+
+Key details:
+
+    Fingerprint : {{fingerprint}}
+    Key type/ID : {{displayname}}
+
+UIDs:
+{{uids}}
+
+Please go here to finish adding the key to your Ubuntu One account:
+
+    {{token_url}}
+{% endblocktrans %}
 
=== modified file 'src/identityprovider/tests/factory.py'
--- src/identityprovider/tests/factory.py	2015-11-03 21:20:49 +0000
+++ src/identityprovider/tests/factory.py	2016-04-28 00:53:41 +0000
@@ -231,16 +231,25 @@
 
     def make_authtoken(self, token_type=None, email=None, redirection_url=None,
                        displayname=None, password=None, requester=None,
-                       requester_email=None, date_created=None):
+                       requester_email=None, date_created=None,
+                       fingerprint=None):
         if token_type is None:
             token_type = AuthTokenType.VALIDATEEMAIL
+        token_types_with_fingerprints = (
+            AuthTokenType.VALIDATEGPG,
+            AuthTokenType.VALIDATESIGNONLYGPG,
+        )
+        if token_type in token_types_with_fingerprints:
+            assert fingerprint is not None, \
+                "Fingerprint must not be None for this token type."
         if date_created is None:
             date_created = now()
         token = AuthToken.objects.create(
             token_type=token_type, email=email,
             redirection_url=redirection_url, displayname=displayname,
             password=password, requester=requester,
-            requester_email=requester_email, date_created=date_created)
+            requester_email=requester_email, date_created=date_created,
+            fingerprint=fingerprint)
         return token
 
     def make_leaked_credential(self, email, password, source='source',
 
=== modified file 'src/identityprovider/tests/test_models_authtoken.py'
--- src/identityprovider/tests/test_models_authtoken.py	2015-11-10 23:02:07 +0000
+++ src/identityprovider/tests/test_models_authtoken.py	2016-04-28 00:53:41 +0000
@@ -18,6 +18,7 @@
     authtoken,
     verify_token_string
 )
+from identityprovider.models.authtoken import AuthTokenManager
 from identityprovider.models.const import AuthTokenType
 from identityprovider.tests.utils import SSOBaseTestCase
 from identityprovider.utils import generate_random_string
@@ -47,7 +48,10 @@
     def test_token_invalid_type(self):
         good_types = [AuthTokenType.PASSWORDRECOVERY,
                       AuthTokenType.VALIDATEEMAIL,
-                      AuthTokenType.INVALIDATEEMAIL]
+                      AuthTokenType.INVALIDATEEMAIL,
+                      AuthTokenType.VALIDATEGPG,
+                      AuthTokenType.VALIDATESIGNONLYGPG,
+                      ]
         for token_type in good_types:
             token = AuthToken.objects.create(email='[e-mail]',
                                              token_type=token_type)
@@ -398,3 +402,44 @@
         token.hashed_token = "unhashedtoken"
         token.save()
         self.assertEqual("unhashedtoken", token.short_token)
+
+    def test_validation_phrase_for_signonly_token(self):
+        current_timestamp = now()
+        fingerprint = 'A' * 40
+        token = AuthToken.objects.create(
+            token_type=AuthTokenType.VALIDATESIGNONLYGPG,
+            requester=self.account,
+            email=self.email,
+            date_created=current_timestamp,
+            fingerprint=fingerprint,
+        )
+
+        expected = (
+            'Please register %s to the\n'
+            'Ubuntu One user with the email address %s.\n'
+            '%s') % (
+            fingerprint,
+            self.email,
+            current_timestamp.strftime('%Y-%m-%d %H:%M:%S'))
+
+        self.assertEqual(expected, token.validation_phrase)
+
+    def test_validation_phrase_raises_for_invalid_token_types(self):
+        current_timestamp = now()
+        fingerprint = 'A' * 40
+        bad_types = [t for t in AuthTokenManager.valid_types
+                     if t != AuthTokenType.VALIDATESIGNONLYGPG]
+
+        for token_type in bad_types:
+            token = AuthToken.objects.create(
+                token_type=token_type,
+                requester=self.account,
+                email=self.email,
+                date_created=current_timestamp,
+                fingerprint=fingerprint,
+            )
+            expected_message = (
+                "Invalid token type %d, expected VALIDATESIGNONLYGPG"
+                % token_type)
+            with self.assertRaisesMessage(AssertionError, expected_message):
+                token.validation_phrase
 
=== modified file 'src/identityprovider/tests/utils.py'
--- src/identityprovider/tests/utils.py	2016-04-15 03:27:25 +0000
+++ src/identityprovider/tests/utils.py	2016-04-28 00:53:41 +0000
@@ -203,6 +203,23 @@
             service_location, random_key, info_encrypted)
         return root_macaroon, macaroon_random_key
 
+    def use_fixture(self, fixture):
+        """Set up 'fixture' to be used with 'test'.
+
+        A poor-man's backport of testtools useFixture for environments where
+        testtools cannot be used.
+
+        Note that this will discard any details the fixture provides, so debug
+        logs won't be preserved.
+        """
+        try:
+            fixture.setUp()
+            self.addCleanup(fixture.cleanUp)
+        except:
+            fixture.cleanUp()
+            raise
+        return fixture
+
 
 class SSOBaseTestCase(SSOBaseTestCaseMixin, TestCase):
 
 
=== added file 'src/webui/forms.py'
--- src/webui/forms.py	1970-01-01 00:00:00 +0000
+++ src/webui/forms.py	2016-04-28 00:53:41 +0000
@@ -0,0 +1,102 @@
+# Copyright 2016 Canonical Ltd.  This software is licensed under
+# the GNU Affero General Public License version 3 (see the file
+# LICENSE).
+
+from django import forms
+from django.utils.translation import ugettext_lazy as _
+from gpgservice_client import (
+    sanitize_fingerprint,
+    GPGServiceException,
+)
+
+from webui.gpg import SSOGPGClient
+from webui.views import gpg_messages
+from webui.utils import mark_safe_lazy
+
+
+class ClaimOpenPGPKeyForm(forms.Form):
+
+    """A form to validate the claiming of an OpenPGP key."""
+
+    fingerprint = forms.CharField(
+        help_text=mark_safe_lazy(
+            _("For example: {key}").format(
+                key="<code>27E0 7815 B47C 0397 90D5&nbsp;&nbsp;8589 "
+                "27D9 A27B F3F9 6058</code>")),
+        error_messages={'required': gpg_messages.bad_fingerprint_format()},
+    )
+    action = forms.CharField(
+        initial="claim_gpg",
+        widget=forms.HiddenInput(),
+    )
+
+    def clean_fingerprint(self):
+        client = SSOGPGClient()
+        fingerprint = self.cleaned_data['fingerprint']
+
+        sane_fingerprint = sanitize_fingerprint(fingerprint)
+        if sane_fingerprint is None:
+            raise forms.ValidationError(gpg_messages.bad_fingerprint_format())
+        if client.getKeyByFingerprint(sane_fingerprint) is not None:
+            raise forms.ValidationError(
+                gpg_messages.key_already_imported(fingerprint))
+
+        key_details = client.getKeyDetailsFromKeyServer(
+            sane_fingerprint)
+        if key_details is None:
+            raise forms.ValidationError(gpg_messages.unknown_key())
+        if key_details['expired']:
+            raise forms.ValidationError(gpg_messages.key_expired(fingerprint))
+        if key_details['revoked']:
+            raise forms.ValidationError(gpg_messages.key_revoked(fingerprint))
+        # The view needs a copy of key_details. To save ourselves an expensive
+        # round-trip, we expose it here:
+        self.cleaned_data['key_details'] = key_details
+        return sane_fingerprint
+
+
+class VerifySignedTextForm(forms.Form):
+
+    clearsigned = forms.CharField(
+        label='Clearsigned Text',
+        widget=forms.Textarea(),
+        error_messages={'required': _("Error: Missing signed text.")}
+    )
+
+    def __init__(self, data=None, token=None):
+        """Validate form based on 'data'.
+
+        'token' should be the authtoken we're claiming.
+        """
+        if data and not token:
+            raise ValueError("'token' must be supplied with 'data'")
+        super(VerifySignedTextForm, self).__init__(data)
+        self._token = token
+
+    def clean_clearsigned(self):
+        signed_text = self.cleaned_data['clearsigned'].strip()
+        if not signed_text:
+            raise forms.ValidationError(gpg_messages.missing_signed_text())
+
+        gpg_client = SSOGPGClient()
+        try:
+            fingerprint, content = gpg_client.verifySignedContent(signed_text)
+            token = self._token
+            if not compare_gpg_fingerprints(fingerprint, token.fingerprint):
+                raise forms.ValidationError(
+                    gpg_messages.signing_key_mismatch(fingerprint))
+
+            if content.split() != token.validation_phrase.split():
+                raise forms.ValidationError(
+                    gpg_messages.validation_phrase_mismatch())
+        except GPGServiceException as e:
+            raise forms.ValidationError(str(e))
+        return signed_text
+
+
+def compare_gpg_fingerprints(lhs, rhs):
+    """Compare two GPG tokens for equality.
+
+    Returns True if they are equal, false otherwise.
+    """
+    return lhs.replace(' ', '').lower() == rhs.replace(' ', '').lower()
 
=== added file 'src/webui/gpg.py'
--- src/webui/gpg.py	1970-01-01 00:00:00 +0000
+++ src/webui/gpg.py	2016-04-28 00:53:41 +0000
@@ -0,0 +1,15 @@
+# Copyright 2016 Canonical Ltd.  This software is licensed under
+# the GNU Affero General Public License version 3 (see the file
+# LICENSE).
+
+"""SSO GPGService Client Implementation."""
+
+from gpgservice_client import GPGClient
+from django.conf import settings
+
+
+class SSOGPGClient(GPGClient):
+
+    def __init__(self):
+        super(SSOGPGClient, self).__init__(
+            settings.GPGSERVICE_ENDPOINT, settings.GPGSERVICE_TIMEOUT)
 
=== added file 'src/webui/templates/account/confirm_new_gpg.html'
--- src/webui/templates/account/confirm_new_gpg.html	1970-01-01 00:00:00 +0000
+++ src/webui/templates/account/confirm_new_gpg.html	2016-04-28 00:53:41 +0000
@@ -0,0 +1,33 @@
+{% extends "base.html" %}
+{% load i18n %}
+
+{% comment %}
+Copyright 2016 Canonical Ltd.  This software is licensed under the
+GNU Affero General Public License version 3 (see the file  LICENSE).
+{% endcomment %}
+
+{% block html_extra %}data-qa-id="confirm_gpg"{% endblock %}
+
+{% block title %}{% trans "Complete OpenPGP key validation" %}{% endblock %}
+
+{% block text_title %}<h1 class="u1-h-main">{% blocktrans %}Validate OpenPGP Key {{ fingerprint }}?{% endblocktrans %}</h1>{% endblock %}
+
+{% block content_id %}auth{% endblock %}
+
+{% block content %}
+<p>{% blocktrans %}Are you sure you want to confirm and validate this OpenPGP key?{% endblocktrans %}</p>
+
+<div class="actions">
+  <form action="" method="post">
+    {% csrf_token %}
+    <p>
+      <input type="hidden" name="post" value="yes" />
+      <button type="submit" name="continue" class="btn cta" data-qa-id="confirm_gpg">
+        <span>{% trans "Yes, I'm sure" %}</span>
+      </button>
+    </p>
+  </form>
+</div>
+
+<br style="clear: both" />
+{% endblock %}
 
=== added file 'src/webui/templates/account/confirm_new_signonly_gpg.html'
--- src/webui/templates/account/confirm_new_signonly_gpg.html	1970-01-01 00:00:00 +0000
+++ src/webui/templates/account/confirm_new_signonly_gpg.html	2016-04-28 00:53:41 +0000
@@ -0,0 +1,47 @@
+{% extends "base.html" %}
+{% load i18n %}
+
+{% comment %}
+Copyright 2016 Canonical Ltd.  This software is licensed under the
+GNU Affero General Public License version 3 (see the file  LICENSE).
+{% endcomment %}
+
+{% block html_extra %}data-qa-id="confirm_gpg"{% endblock %}
+
+{% block title %}{% trans "Complete OpenPGP key validation" %}{% endblock %}
+
+{% block text_title %}<h1 class="u1-h-main">{% blocktrans %}Validate OpenPGP Key {{ fingerprint }}?{% endblocktrans %}</h1>{% endblock %}
+
+{% block content_id %}auth{% endblock %}
+
+{% block content %}
+<p>{% blocktrans %}Thanks for adding your OpenPGP key to Ubuntu One. So we can confirm that the key is yours, we need you to use the key to sign some text.{% endblocktrans %}</p>
+<p>
+  <strong>{% blocktrans %}Your key's fingerprint:{% endblocktrans %}</strong> <code>{{fingerprint}}</code>
+</p>
+<div>
+  <p>{% blocktrans %}
+    Please paste a clear-signed copy of the following paragraph
+    into the box beneath it.{% endblocktrans %}
+    (<a href="/+help-registry/pgp-key-clearsign.html" target="help">{% trans "How do I do that?" %}</a>)
+  </p>
+
+  <pre>
+    {{validation_phrase}}
+  </pre>
+</div>
+
+<div class="actions">
+  <form action="" method="post">
+    {% csrf_token %}
+    <p>
+      {{ form }}
+      <button type="submit" name="continue" class="btn cta" data-qa-id="confirm_gpg">
+        <span>{% trans "Submit Signed Text" %}</span>
+      </button>
+    </p>
+  </form>
+</div>
+
+<br style="clear: both" />
+{% endblock %}
 
=== added file 'src/webui/templates/account/gpg_keys.html'
--- src/webui/templates/account/gpg_keys.html	1970-01-01 00:00:00 +0000
+++ src/webui/templates/account/gpg_keys.html	2016-04-28 00:53:41 +0000
@@ -0,0 +1,97 @@
+{% extends "base.html" %}
+{% load i18n %}
+{% comment %}
+Copyright 2016 Canonical Ltd.  This software is licensed under the
+GNU Affero General Public License version 3 (see the file LICENSE).
+{% endcomment %}
+
+{% block title %}{% trans "GPG Keys" %}{% endblock %}
+
+{% block text_title %}
+  <h1 class="u1-h-main">{% trans "GPG Keys" %}</h1>
+{% endblock %}
+
+{% block content %}
+<div class="separated">
+  <h3 class="separated">{% trans "Import an OpenPGP key" %}</h3>
+  <p>{% blocktrans %}
+    To start using an OpenPGP key, simply
+    paste its fingerprint below. The key must be registered with the
+    Ubuntu key server.
+    {% endblocktrans %}
+    {# (<a href="/+help-registry/import-pgp-key.html" target="help">How to get the fingerprint</a>) #}
+  </p>
+  <form name="gpg_actions" action="" method="POST">
+    {% csrf_token %}
+    {{ claim_form }}
+    <br />
+    <p>
+      Next, Ubuntu One will send email to you at
+      <code>{{ preferred_email }}</code> with instructions
+      on finishing the process.
+    </p>
+    <input class="cta" type="submit" name="import" value="Import Key"/>
+  </form>
+
+</div>
+{% if enabled_keys %}
+  <div class="separated">
+    <form method="post">
+      <input type="hidden" name="action" value="deactivate_gpg" />
+      {% csrf_token %}
+      <h3 class="separated">{% trans "Your Enabled Keys" %}</h3>
+      {% for key in enabled_keys %}
+      <div>
+        <label>
+          <input type="checkbox" name="DEACTIVATE_GPGKEY" value="{{key.fingerprint}}"/>
+            <span>{{key.id}} {% if not key.can_encrypt %}(sign only){% endif %}</span>
+        </label>
+      </div>
+      {% endfor %}
+      <p class="note-separated">{% blocktrans %}
+        Disabling a key here disables that key for all
+        Ubuntu services but does not alter the key outside of
+        Ubuntu One.
+        {% endblocktrans %}
+      </p>
+      <div><input type="submit" class="cta" value="Disable Key" /></div>
+    </form>
+  </div>
+{% endif %}
+{% if pending_keys %}
+<form method="post">
+  <input type="hidden" name="action" value="remove_gpgtoken" />
+  {% csrf_token %}
+  <h2>Keys pending validation</h2>
+  <div>
+    {% for token in pending_keys %}
+    <label>
+      <input type="checkbox" name="REMOVE_GPGTOKEN" value="{{token.fingerprint}}"/>
+      <span>{{token.fingerprint}}</span>
+    </label>
+    {% endfor %}
+  </div>
+  <input type="submit" value="Cancel Validation for Selected Keys" />
+</form>
+{% endif %}
+{% if disabled_keys %}
+  <div class="separated">
+    <form method="post">
+      <input type="hidden" name="action" value="reactivate_gpg" />
+      {% csrf_token %}
+      <h3 class="separated">{% trans "Your Disabled Keys" %}</h3>
+      {% for key in disabled_keys %}
+      <div>
+        <label>
+          <input type="checkbox" name="REACTIVATE_GPGKEY" value="{{key.fingerprint}}"/>
+            <span>{{key.id}} {% if not key.can_encrypt %}(sign only){% endif %}</span>
+        </label>
+      </div>
+      {% endfor %}
+      <p>{% trans "You can reactivate any of these keys for use in Ubuntu One whenever you choose." %}</p>
+      <div><input type="submit" class="cta" value="Enable Key" /></div>
+    </form>
+  </div>
+{% endif %}
+
+{% endblock %}
 
=== modified file 'src/webui/templates/widgets/personal-menu.html'
--- src/webui/templates/widgets/personal-menu.html	2015-09-04 21:04:12 +0000
+++ src/webui/templates/widgets/personal-menu.html	2016-04-28 00:53:41 +0000
@@ -24,6 +24,10 @@
   {% endifswitch %}
   {% url 'applications' as applications_url %}
   {% menu_item "applications" _("Applications") applications_url %}
+  {% ifswitch GPG_SERVICE %}
+    {% url 'gpg_keys' as gpg_url %}
+    {% menu_item "gpg_keys" _("GPG Keys") gpg_url %}
+  {% endifswitch %}
   {% url 'auth_log' as auth_log_url %}
   {% menu_item "auth_log" _("Account Activity") auth_log_url %}
 {% endif %}
 
=== added file 'src/webui/tests/test_views_account_gpg.py'
--- src/webui/tests/test_views_account_gpg.py	1970-01-01 00:00:00 +0000
+++ src/webui/tests/test_views_account_gpg.py	2016-04-28 00:53:41 +0000
@@ -0,0 +1,460 @@
+# Copyright 2010 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+from __future__ import unicode_literals
+
+import random
+import string
+import sys
+import os
+import re
+from datetime import datetime
+from textwrap import dedent
+
+from django.core import mail
+from django.core.urlresolvers import reverse
+from django.test import override_settings
+from django.utils.safestring import mark_safe
+from fixtures import (
+    EnvironmentVariable,
+    Fixture,
+)
+from gargoyle.testutils import switches
+from gpgservice_client import (
+    GPGKeyServiceFixture,
+    TestKeyServerFixture,
+)
+from gpgservice_client.testing.gpg_utils import decrypt_content
+from gpgservice_client.testing.keyserver.tests.keys import SampleDataKeys
+
+from identityprovider.tests.utils import SSOBaseTransactionTestCase
+from identityprovider.models.authtoken import AuthToken
+from identityprovider.models.const import AuthTokenType
+from webui.gpg import SSOGPGClient
+from webui.views import gpg_messages
+from webui.forms import compare_gpg_fingerprints
+
+
+def make_form_error_message(text):
+    """Convert 'text' it to the display format for django's form error message.
+
+    Django's assertContains and friends require a complete html fragment,
+    and there's no easy way to match partial fragments. We have the actual
+    messages nicely separated in the gpg_messages module, but we can't
+    test for their existance while they're partial fragments. This
+    function is a bit of a hack, but makes testing easier.
+    """
+    return mark_safe('<li>%s</li>' % text)
+
+
+def make_user_message(text):
+    """Same as above, but for user messages rather than form error messages."""
+    return mark_safe('<p>%s</p>' % text)
+
+
+def extract_encrypted_block(text):
+    """Extract a PGP encrypted block from a larger body of text."""
+    regex = (
+        "-----BEGIN PGP MESSAGE-----\n"
+        "Version: GnuPG v1\n\n"
+        ".*?"
+        "-----END PGP MESSAGE-----"
+        )
+    match = re.search(regex, text, re.DOTALL)
+    return text[match.start():match.end()] if match else None
+
+
+def extract_url_from_text(text):
+    return re.search("(?P<url>https?://[^\s]+)", text).group("url")
+
+
+class SSOGPGServiceFixture(Fixture):
+
+    """A fixture to set up and run a test key server and the gpgservice."""
+
+    def setUp(self):
+        super(SSOGPGServiceFixture, self).setUp()
+        twistd_path = os.path.join(
+            os.path.dirname(sys.executable), 'twistd')
+
+        self.useFixture(EnvironmentVariable('TWISTD_PATH', twistd_path))
+        self.keyserver = self.useFixture(TestKeyServerFixture())
+        self.gpgservice = self.useFixture(
+            GPGKeyServiceFixture(
+                self.keyserver.bind_host, self.keyserver.daemon_port))
+        new_settings = override_settings(
+            GPGSERVICE_ENDPOINT=self.gpgservice.root_url)
+        new_settings.enable()
+        self.addCleanup(new_settings.disable)
+
+
+class GPGTestCase(SSOBaseTransactionTestCase):
+
+    def assert_fingerprints_are_equal(self, lhs, rhs):
+        self.assertTrue(compare_gpg_fingerprints(lhs, rhs))
+
+    def assert_email_contains_pgp_block(self, email):
+        self.assertIsNotNone(extract_encrypted_block(email.body))
+
+    def assert_email_does_not_contain_pgp_block(self, email):
+        self.assertIsNone(extract_encrypted_block(email.body))
+
+    def create_user_and_login(self, name='person-2'):
+        password = ''.join(
+            random.choice(string.ascii_letters) for i in range(16))
+        account = self.factory.make_account(
+            password=password,
+            email='[e-mail]')
+        assert self.client.login(
+            username=account.preferredemail.email, password=password)
+        return account
+
+    def test_can_contact_service(self):
+        self.use_fixture(SSOGPGServiceFixture())
+        client = SSOGPGClient()
+        keys = client.getKeysForOwner('name16_oid')['keys']
+        self.assertEqual(1, len(keys))
+
+    @switches(GPG_SERVICE=False)
+    def test_gpg_keys_menu_item_not_rendered_without_feature_flag(self):
+        self.create_user_and_login()
+        resp = self.client.get(reverse('account-index'))
+
+        self.assertNotContains(resp, '<span>GPG Keys</span>', html=True)
+
+    @switches(GPG_SERVICE=True)
+    def test_gpg_keys_menu_item_is_rendered_with_feature_flag(self):
+        self.create_user_and_login()
+
+        resp = self.client.get(reverse('account-index'))
+
+        self.assertContains(resp, '<span>GPG Keys</span>', html=True)
+
+    @switches(GPG_SERVICE=False)
+    def test_gpg_keys_view_returns_404_without_feature_flag(self):
+        self.use_fixture(SSOGPGServiceFixture())
+        self.create_user_and_login()
+
+        resp = self.client.get(reverse('gpg_keys'))
+        self.assertEqual(404, resp.status_code)
+
+    @switches(GPG_SERVICE=True)
+    def test_gpg_keys_view_returns_200_with_feature_flag(self):
+        self.use_fixture(SSOGPGServiceFixture())
+        self.create_user_and_login()
+
+        resp = self.client.get(reverse('gpg_keys'))
+        self.assertEqual(200, resp.status_code)
+
+    @switches(GPG_SERVICE=True)
+    def test_import_with_no_key_errors(self):
+        self.use_fixture(SSOGPGServiceFixture())
+        self.create_user_and_login()
+
+        resp = self.client.post(
+            reverse('gpg_keys'),
+            dict(action='claim_gpg', fingerprint=''))
+        msg = make_form_error_message(gpg_messages.bad_fingerprint_format())
+        self.assertContains(resp, msg, html=True)
+
+    @switches(GPG_SERVICE=True)
+    def test_import_with_bad_key_errors(self):
+        self.use_fixture(SSOGPGServiceFixture())
+        self.create_user_and_login()
+
+        bad_fingerprint = 'A' * 13
+        resp = self.client.post(
+            reverse('gpg_keys'),
+            dict(action='claim_gpg', fingerprint=bad_fingerprint))
+        msg = make_form_error_message(gpg_messages.bad_fingerprint_format())
+        self.assertContains(resp, msg, html=True)
+
+    @switches(GPG_SERVICE=True)
+    def test_import_existing_key_errors(self):
+        self.use_fixture(SSOGPGServiceFixture())
+        user = self.create_user_and_login()
+        gpg_client = SSOGPGClient()
+        key_id = '4C4834CF'
+        fingerprint = '8C470B2A0B31568E110D432516281F2E007C98D2'
+        keysize = 4096
+        algorithm = 'D'
+        enabled = True
+        can_encrypt = True
+        gpg_client.addKeyForTest(
+            user.get_openid_identity_url(), key_id, fingerprint, keysize,
+            algorithm, enabled, can_encrypt)
+
+        resp = self.client.post(
+            reverse('gpg_keys'),
+            dict(action='claim_gpg', fingerprint=fingerprint))
+        msg = make_form_error_message(
+            gpg_messages.key_already_imported(fingerprint))
+        self.assertContains(resp, msg, html=True)
+
+    @switches(GPG_SERVICE=True)
+    def test_import_missing_key_errors(self):
+        self.use_fixture(SSOGPGServiceFixture())
+        self.create_user_and_login()
+        fingerprint = '8C470B2A0B31568E110D432516281F2E007C98D2'
+        resp = self.client.post(
+            reverse('gpg_keys'),
+            dict(action='claim_gpg', fingerprint=fingerprint))
+        msg = make_form_error_message(gpg_messages.unknown_key())
+        self.assertContains(resp, msg, html=True)
+
+    @switches(GPG_SERVICE=True)
+    def test_import_expired_key_errors(self):
+        self.use_fixture(SSOGPGServiceFixture())
+        self.create_user_and_login()
+        expired_fingerprint = 'ECA5B797586F2E27381A16CFDE6C9167046C6D63'
+        resp = self.client.post(
+            reverse('gpg_keys'),
+            dict(action='claim_gpg', fingerprint=expired_fingerprint))
+        msg = make_form_error_message(
+            gpg_messages.key_expired(expired_fingerprint))
+        self.assertContains(resp, msg, html=True)
+
+    @switches(GPG_SERVICE=True)
+    def test_import_revoked_key_errors(self):
+        self.use_fixture(SSOGPGServiceFixture())
+        self.create_user_and_login()
+        revoked_fingerprint = '84D205F03E1E67096CB54E262BE83793AACCD97C'
+        resp = self.client.post(
+            reverse('gpg_keys'),
+            dict(action='claim_gpg', fingerprint=revoked_fingerprint))
+        msg = make_form_error_message(
+            gpg_messages.key_revoked(revoked_fingerprint))
+        self.assertContains(resp, msg, html=True)
+
+    @switches(GPG_SERVICE=True)
+    def test_claim_encryption_key_workflow(self):
+        self.use_fixture(SSOGPGServiceFixture())
+        user = self.create_user_and_login()
+        encryption_fingerprint = SampleDataKeys.regular_key
+        resp = self.client.post(
+            reverse('gpg_keys'),
+            dict(action='claim_gpg', fingerprint=encryption_fingerprint),
+            follow=True)
+        condensed_fingerprint = encryption_fingerprint.replace(' ', '')
+
+        self.assertEqual(200, resp.status_code)
+        self.assertEqual(1, len(mail.outbox))
+        email = mail.outbox[0]
+        self.assert_email_contains_pgp_block(email)
+
+        pending_tokens = AuthToken.objects.filter(
+            fingerprint=condensed_fingerprint)
+        self.assertEqual(1, len(pending_tokens))
+
+        encrypted_block = extract_encrypted_block(email.body)
+        plain_text = decrypt_content(encrypted_block.encode('ascii'))
+        token_activation_url = extract_url_from_text(plain_text)
+
+        resp = self.client.get(token_activation_url, follow=True)
+        self.assertContains(
+            resp,
+            "<p>Are you sure you want to confirm and validate this "
+            "OpenPGP key?</p>",
+            html=True)
+
+        resp = self.client.post(resp.wsgi_request.get_full_path(), follow=True)
+        msg = make_user_message(
+            gpg_messages.key_added_to_account(condensed_fingerprint))
+        self.assertContains(resp, msg, html=True)
+        keys = SSOGPGClient().getKeysForOwner(
+            user.get_openid_identity_url())['keys']
+        self.assertEqual(1, len(keys))
+        self.assert_fingerprints_are_equal(
+            keys[0]['fingerprint'], encryption_fingerprint)
+
+    @switches(GPG_SERVICE=True)
+    def test_claim_signonly_key_workflow(self):
+        self.use_fixture(SSOGPGServiceFixture())
+        user = self.create_user_and_login()
+        encryption_fingerprint = SampleDataKeys.sign_only_key
+        resp = self.client.post(
+            reverse('gpg_keys'),
+            dict(action='claim_gpg', fingerprint=encryption_fingerprint),
+            follow=True)
+        condensed_fingerprint = encryption_fingerprint.replace(' ', '')
+
+        self.assertEqual(200, resp.status_code)
+        self.assertEqual(1, len(mail.outbox))
+        email = mail.outbox[0]
+        self.assert_email_does_not_contain_pgp_block(email)
+
+        # Sign-only tokens create the validation phrase from the key
+        # fingerprint, name of the person requesting the key, and the
+        # datestamp at which the token was created. That last piece of
+        # information is unknowable within a test, so let's retrieve the
+        # token and change it's creation date:
+        token = AuthToken.get_token(
+            fingerprint=condensed_fingerprint)
+        token.date_created = datetime(2016, 4, 12, 16, 0, 0)
+        token.save()
+
+        token_activation_url = extract_url_from_text(email.body)
+
+        resp = self.client.get(token_activation_url, follow=True)
+        self.assertContains(
+            resp,
+            "<p>Thanks for adding your OpenPGP key to Ubuntu One. So we can "
+            "confirm that the key is yours, we need you to use the key to "
+            "sign some text.",
+            html=True)
+        self.assertContains(
+            resp,
+            '<pre>Please register 447DBF38C4F9C4ED752246B77D88913717B05A8F to '
+            'the Ubuntu One user with the email address '
+            '[e-mail]. 2016-04-12 16:00:00</pre>',
+            html=True)
+
+        url = resp.wsgi_request.get_full_path()
+        resp = self.client.post(
+            url,
+            dict(clearsigned=CORRECT_TEXT_SIGNED_WITH_CORRECT_KEY),
+            follow=True)
+
+        msg = make_user_message(
+            gpg_messages.key_added_to_account(condensed_fingerprint))
+        self.assertContains(resp, msg, html=True)
+        keys = SSOGPGClient().getKeysForOwner(
+            user.get_openid_identity_url())['keys']
+        self.assertEqual(1, len(keys))
+        self.assert_fingerprints_are_equal(
+            keys[0]['fingerprint'], encryption_fingerprint)
+
+    def create_signonly_authtoken(self, user, fingerprint):
+        return self.factory.make_authtoken(
+            token_type=AuthTokenType.VALIDATESIGNONLYGPG,
+            email=user.preferredemail.email,
+            fingerprint=fingerprint,
+            date_created=datetime(2016, 4, 12, 16, 0, 0),
+            requester=user,
+        )
+
+    def create_signonly_gpg_token_and_sign(self, fingerprint, signed_text):
+        """Create an auth token for a sign-only key, and sign it with 'text'.
+
+        :param fingerprint: The fingerprint of the GPG key you want to
+            register.
+        :param signed_text: THe signed text to use when claiming the gpg key.
+        :returns: The final reponse object after submitting the claim form.
+        """
+        self.use_fixture(SSOGPGServiceFixture())
+        user = self.create_user_and_login()
+        token = self.create_signonly_authtoken(user, fingerprint)
+
+        args = {
+            'fingerprint': fingerprint,
+            'authtoken': token.raw_token,
+        }
+        return self.client.post(
+            reverse('confirm_signonly_gpg_key', kwargs=args),
+            dict(clearsigned=signed_text))
+
+    def test_claiming_signonly_key_fails_without_signed_text(self):
+        resp = self.create_signonly_gpg_token_and_sign(
+            SampleDataKeys.sign_only_key, '')
+        msg = make_form_error_message(gpg_messages.missing_signed_text())
+        self.assertContains(resp, msg, html=True)
+
+    def test_claiming_signonly_key_fails_when_signed_with_different_key(self):
+        resp = self.create_signonly_gpg_token_and_sign(
+            SampleDataKeys.sign_only_key,
+            CORRECT_TEXT_SIGNED_WITH_DIFFERENT_KEY)
+        condensed_key = SampleDataKeys.regular_key.replace(' ', '')
+        msg = make_form_error_message(
+            gpg_messages.signing_key_mismatch(condensed_key))
+        self.assertContains(resp, msg, html=True)
+
+    def test_claiming_signonly_key_fails_when_signed_text_is_modified(self):
+        resp = self.create_signonly_gpg_token_and_sign(
+            SampleDataKeys.sign_only_key,
+            MODIFIED_TEXT_SIGNED_WITH_CORRECT_KEY)
+        msg = make_form_error_message(
+            gpg_messages.validation_phrase_mismatch())
+        self.assertContains(resp, msg, html=True)
+
+    def test_claiming_signonly_key_fails_when_signing_with_unknown_key(self):
+        resp = self.create_signonly_gpg_token_and_sign(
+            SampleDataKeys.sign_only_key, CORRECT_TEXT_SIGNED_WITH_UNKNOWN_KEY)
+        self.assertContains(
+            resp,
+            'Error: Could not find GPG public key.')
+
+
+# The correct text, signed with the correct key:
+CORRECT_TEXT_SIGNED_WITH_CORRECT_KEY = dedent("""\
+    -----BEGIN PGP SIGNED MESSAGE-----
+    Hash: SHA1
+
+    Please register 447DBF38C4F9C4ED752246B77D88913717B05A8F to
+    the Ubuntu One user with the email address
+    [e-mail]. 2016-04-12 16:00:00
+    -----BEGIN PGP SIGNATURE-----
+    Version: GnuPG v1
+
+    iEYEARECAAYFAlcVoAcACgkQfYiRNxewWo8MXQCfVGKwjchBRvzio8Kgpoz7SuDo
+    zh0An1Fvx5KP1IEt1ODlPujW9YCENnBT
+    =ewCw
+    -----END PGP SIGNATURE-----
+    """)
+
+# Correct text signed with a different key (that we know about)
+CORRECT_TEXT_SIGNED_WITH_DIFFERENT_KEY = dedent("""\
+    -----BEGIN PGP SIGNED MESSAGE-----
+    Hash: SHA1
+
+    Please register 447DBF38C4F9C4ED752246B77D88913717B05A8F
+    to the Ubuntu One user person-2.  2016-04-12 16:00:00
+    -----BEGIN PGP SIGNATURE-----
+    Version: GnuPG v1
+
+    iEYEARECAAYFAlcNxBAACgkQ2yWXVgK6Xva0awCgmer6hs4htHQZwNcwns4UsEV9
+    fh8AoKmMneOkzItHwpju9fDXtP93aAUX
+    =ZIGA
+    -----END PGP SIGNATURE-----
+""")
+
+# signed with the correct key, but the text was changed:
+MODIFIED_TEXT_SIGNED_WITH_CORRECT_KEY = dedent("""\
+    -----BEGIN PGP SIGNED MESSAGE-----
+    Hash: SHA1
+
+    Please do not register 447DBF38C4F9C4ED752246B77D88913717B05A8F
+    to the Ubuntu One user person-2.  2016-04-12 16:00:00
+    -----BEGIN PGP SIGNATURE-----
+    Version: GnuPG v1
+
+    iEYEARECAAYFAlcQGMQACgkQfYiRNxewWo9L6ACgspzv2dOa+HFjxZRXe33cgKyH
+    WTUAnRtrZUIULJ9MA3q+G4whKWZ5DW7R
+    =BCHM
+    -----END PGP SIGNATURE-----
+""")
+
+# The text is correct, but it's signed with an unknown key:
+CORRECT_TEXT_SIGNED_WITH_UNKNOWN_KEY = dedent("""\
+    -----BEGIN PGP SIGNED MESSAGE-----
+    Hash: SHA1
+
+    Please register 447DBF38C4F9C4ED752246B77D88913717B05A8F
+    to the Ubuntu One user person-2.  2016-04-12 16:00:00
+    -----BEGIN PGP SIGNATURE-----
+    Version: GnuPG v1
+
+    iQIcBAEBAgAGBQJXEBtaAAoJELCMjm0FjU8pOwQP/18G/Bfezxa1NMaOl4salaR+
+    xklj5TASP5hEsbE9etoJlaangsyIDS7b5NLnNX1kz9GfK9K6NIjDpBZGidPMPu6P
+    qZ9rnlM1Mi0pxce0a9GJRc65ap3ycMBjeCQBX2cETjkMi5ODGw5R/HZ1Jg0cvM/J
+    h8veZ9trdcNN+uUjbpSgti5Q6FswvrxJ10hAadPJCYkSid3pOjSTFDJ9+YoXbLqQ
+    bFsq3REaVO1I+aDzEgPUcdOYEuzyE0XK51Z8tYxfwgsHJbxpup0EfzQYvnpUzAYg
+    xv5IdDhxhRlT9whcO8TcGvkU3rHch4JIImGe/Tcmf+ftPdemVkiak2O3559g3di+
+    UGtvsW7jgKp6z4cZFoPyR0ihW9QU2DH4bDfQ7kl4PS0X9Xmby5Fcr4Dci+iBz/Z+
+    g4oeiPvAqIAMRMQu5hgEFNIOOeSNxrTawrDPxZAHYt2Fg/ubF5SW9/0qrWd6AqYQ
+    LpCClOQkc7NtL2dXzy37UvDL5ZTrCXicrs4e8JXYtrZTo+chedeDfYk1p1oxiiB8
+    X9/USTEMgngdQOpbm2f4nViTK6zLSecMiKLxvzRhuYGKKMXuaPw+qB6+bs7XA590
+    4BP/x7hKGpBJCaBWd/XQStk557PC29EXJVW8e+6N0c8S0hyAhbxoU5KqKuPZvscZ
+    5Sk98yrCrlj23u0vfIhw
+    =QwsT
+    -----END PGP SIGNATURE-----
+""")
 
=== modified file 'src/webui/urls.py'
--- src/webui/urls.py	2016-03-10 17:11:43 +0000
+++ src/webui/urls.py	2016-04-28 00:53:41 +0000
@@ -10,7 +10,8 @@
 repls = {
     'token': '(?P<token>[A-Za-z0-9]{16})',
     'authtoken': '(?P<authtoken>%s)' % AUTHTOKEN_PATTERN,
-    'email_address': '(?P<email_address>.+)'
+    'email_address': '(?P<email_address>.+)',
+    'fingerprint': '(?P<fingerprint>.+)',
 }
 
 urlpatterns = patterns(
@@ -51,6 +52,10 @@
         'confirm_email', name='confirm_email'),
     url(r'^%(token)s/token/%(authtoken)s/\+newemail/%(email_address)s$' %
         repls, 'confirm_email', name='confirm_email'),
+    url(r'^token/%(authtoken)s/\+newgpgkey/%(fingerprint)s$' % repls,
+        'confirm_gpg_key', name='confirm_gpg_key'),
+    url(r'^token/%(authtoken)s/\+newsignonlygpgkey/%(fingerprint)s$' % repls,
+        'confirm_signonly_gpg_key', name='confirm_signonly_gpg_key'),
     url(r'^\+bad-token', 'bad_token', name='bad_token'),
     url(r'^\+logout-to-confirm', 'logout_to_confirm',
         name='logout_to_confirm'),
@@ -126,6 +131,7 @@
         name='account_deactivate'),
     url(r'^\+delete$', 'delete_account', name='delete_account'),
     url(r'^activity$', 'auth_log', name='auth_log'),
+    url(r'^gpg-keys$', 'gpg_keys', name='gpg_keys'),
 )
 # TODO: Support the login-tokens, if it makes sense.
 urlpatterns += patterns(
 
=== added file 'src/webui/utils.py'
--- src/webui/utils.py	1970-01-01 00:00:00 +0000
+++ src/webui/utils.py	2016-04-28 00:53:41 +0000
@@ -0,0 +1,10 @@
+# Copyright 2016 Canonical Ltd.  This software is licensed under
+# the GNU Affero General Public License version 3 (see the file
+# LICENSE).
+from django.utils import six
+from django.utils.functional import lazy
+from django.utils.safestring import mark_safe
+
+# https://docs.djangoproject.com/en/1.7/topics/i18n/translation/
+# other-uses-of-lazy-in-delayed-translations
+mark_safe_lazy = lazy(mark_safe, six.text_type)
 
=== modified file 'src/webui/views/account.py'
--- src/webui/views/account.py	2016-02-17 22:52:46 +0000
+++ src/webui/views/account.py	2016-04-28 00:53:41 +0000
@@ -17,7 +17,9 @@
 from django.template import RequestContext
 from django.template.loader import render_to_string
 from django.template.response import TemplateResponse
+from django.utils.timezone import now
 from django.views.decorators.vary import vary_on_headers
+from gargoyle.decorators import switch_is_active
 
 from openid.yadis.constants import YADIS_HEADER_NAME, YADIS_CONTENT_TYPE
 
@@ -26,6 +28,7 @@
     send_invalidation_email_notice,
     send_notification_to_invalidated_email_address,
     send_validation_email_request,
+    send_gpg_validation_message,
 )
 from identityprovider.forms import (
     DeleteAccountForm,
@@ -59,6 +62,8 @@
 
 from webui.constants import EMAIL_EXISTS_ERROR, VERIFY_EMAIL_MESSAGE
 from webui.decorators import check_readonly, sso_login_required
+from webui.forms import ClaimOpenPGPKeyForm
+from webui.gpg import SSOGPGClient
 from webui.views.const import (
     DETAILS_UPDATED,
     EMAIL_DELETED,
@@ -464,3 +469,55 @@
         'auth_log': auth_log_items,
         'full_auth_log_length': full_auth_log_length})
     return render_to_response('account/auth_log.html', context)
+
+
+@switch_is_active('GPG_SERVICE')
+@sso_login_required
+@check_readonly
+def gpg_keys(request):
+    client = SSOGPGClient()
+    template_vars = dict(current_section='gpg_keys')
+    if request.method == 'POST':
+        action = request.POST['action']
+        form = ClaimOpenPGPKeyForm(request.POST)
+        if action == 'claim_gpg':
+            if form.is_valid():
+                key_details = form.cleaned_data['key_details']
+                if key_details['can_encrypt']:
+                    token_type = AuthTokenType.VALIDATEGPG
+                else:
+                    token_type = AuthTokenType.VALIDATESIGNONLYGPG
+                token = AuthToken.objects.create(
+                    token_type=token_type,
+                    email=request.user.preferredemail.email,
+                    fingerprint=form.cleaned_data['fingerprint'],
+                    date_created=now(),
+                    requester=request.user,
+                )
+                send_gpg_validation_message(
+                    settings.SSO_ROOT_URL, key_details, token,
+                    request.user, client)
+                return HttpResponseRedirect(reverse('gpg_keys'))
+    else:
+        form = ClaimOpenPGPKeyForm()
+    template_vars['claim_form'] = form
+    user_keys = client.getKeysForOwner(
+        request.user.get_openid_identity_url())['keys']
+    template_vars['pending_keys'] = AuthToken.objects.filter(
+        requester=request.user,
+        token_type__in=[
+            AuthTokenType.VALIDATEGPG,
+            AuthTokenType.VALIDATESIGNONLYGPG,
+        ]
+    )
+    template_vars['enabled_keys'] = []
+    template_vars['disabled_keys'] = []
+    for key in user_keys:
+        if key['enabled']:
+            template_vars['enabled_keys'].append(key)
+        else:
+            template_vars['disabled_keys'].append(key)
+    template_vars['preferred_email'] = request.user.preferredemail
+
+    context = RequestContext(request, template_vars)
+    return render_to_response('account/gpg_keys.html', context)
 
=== added file 'src/webui/views/gpg_messages.py'
--- src/webui/views/gpg_messages.py	1970-01-01 00:00:00 +0000
+++ src/webui/views/gpg_messages.py	2016-04-28 00:53:41 +0000
@@ -0,0 +1,100 @@
+# Copyright 2016 Canonical Ltd.  This software is licensed under
+# the GNU Affero General Public License version 3 (see the file
+# LICENSE).
+
+"""Build GPG-related error messages for user consumption."""
+
+from django.utils.html import (
+    escape,
+    format_html,
+)
+from django.utils.translation import ugettext_lazy as _
+
+from webui.utils import mark_safe_lazy
+
+
+def bad_fingerprint_format():
+    intro = _("""There seems to be a problem with the fingerprint you
+        submitted. You can get your gpg fingerprint by opening a
+        terminal and typing:
+        {instructions}
+        Please try again.
+        """)
+    html = """
+        <blockquote>
+          <kbd>gpg --fingerprint</kbd>
+        </blockquote>"""
+    return mark_safe_lazy(intro.format(instructions=html))
+
+
+def key_already_imported(fingerprint):
+    return mark_safe_lazy(
+        _('The key {fingerprint} has already been imported.').format(
+            fingerprint='<code>%s</code>' % escape(fingerprint)))
+
+
+def unknown_key():
+    intro = _("Ubuntu One could not import your OpenPGP key")
+    question = _("Did you enter your complete fingerprint correctly?")
+    fingerprint_help = _("Help with fingerprints")
+    body_text = _(
+        "Is your key in the Ubuntu keyserver yet? You may have to wait"
+        "between ten minutes (if you pushed directly to the Ubuntu key"
+        "server) and one hour (if you pushed your key to another server)."
+    )
+    publishing_help = _("Help with publishing keys")
+
+    return format_html(
+        """
+        <strong>{intro}</strong>
+          <ul>
+            <li>{question}
+            (<a href="http://launchpad.net/+help-registry/import-pgp-key.html">
+            {fingerprint_help}</a>)</li>
+
+            <li>{body_text}
+            (<a href="http://launchpad.net/+help-registry/openpgp-keys.html"
+            >{publishing_help}</a>)
+            </li>
+          </ul>
+        """,
+        intro=intro,
+        question=question,
+        fingerprint_help=fingerprint_help,
+        body_text=body_text,
+        publishing_help=publishing_help,
+    )
+
+
+def key_expired(fingerprint):
+    return mark_safe_lazy(
+        _('The key {fingerprint} has expired, and cannot be used.').format(
+            fingerprint='<code>%s</code>' % escape(fingerprint)))
+
+
+def key_revoked(fingerprint):
+    return mark_safe_lazy(
+        _('The key {fingerprint} has been revoked, '
+          'and cannot be used.').format(
+            fingerprint='<code>%s</code>' % escape(fingerprint)))
+
+
+def signing_key_mismatch(fingerprint):
+    return _(
+        'The key used to sign the content ({fingerprint}) is not the '
+        'key you were registering').format(fingerprint=fingerprint)
+
+
+def validation_phrase_mismatch():
+    return _('Error: The signed text does not match the '
+             'validation phrase.')
+
+
+def key_added_to_account(fingerprint):
+    return _(
+        'The GPG Key {fingerprint} has been added to your account').format(
+            fingerprint=fingerprint)
+
+
+def missing_signed_text():
+    return _("Error: Missing signed text.")
 
=== modified file 'src/webui/views/registration.py'
--- src/webui/views/registration.py	2016-04-26 18:08:15 +0000
+++ src/webui/views/registration.py	2016-04-28 00:53:41 +0000
@@ -117,7 +117,6 @@
             data['creation_source'] = WEB_CREATION_SOURCE
 
             url = redirection_url_for_token(token)
-
             try:
                 api = get_api_client(request)
                 api.register(**data)
 
=== modified file 'src/webui/views/ui.py'
--- src/webui/views/ui.py	2016-03-16 13:04:24 +0000
+++ src/webui/views/ui.py	2016-04-28 00:53:41 +0000
@@ -82,8 +82,13 @@
     requires_cookies,
     require_twofactor_enabled,
 )
-from webui.views.utils import add_captcha_settings
-from webui.views import registration
+from webui.forms import VerifySignedTextForm
+from webui.gpg import SSOGPGClient
+from webui.views.utils import add_captcha_settings, require_twofactor
+from webui.views import (
+    gpg_messages,
+    registration,
+    )
 
 
 ACCOUNT_CREATED = _("Your account was created successfully")
@@ -433,35 +438,42 @@
 def claim_token(request, authtoken):
     try:
         token = AuthToken.get_token(raw_token=authtoken)
-        return _handle_confirmation(confirmation_type=token.token_type,
-                                    confirmation_code=authtoken,
-                                    email=token.email)
+        return _handle_confirmation(confirmation_code=authtoken,
+                                    token=token)
     except AuthToken.DoesNotExist:
         raise Http404()
 
 
-def _handle_confirmation(
-        confirmation_type, confirmation_code, email, token=None):
-    """Handle a confirmation for an action requested on 'email'.
+def _handle_confirmation(confirmation_code, token):
+    """Handle a confirmation for an action based on 'token'.
 
     Either finish the work in this view, or redirect to a view that can. Also
     accepts an optional OpenID-transaction token.
 
     """
-
+    confirmation_type = token.token_type
+    # The 'authtoken' argument is used by all validation views:
     args = {
         'authtoken': confirmation_code,
-        'email_address': email
     }
-    if token is not None:
-        args['token'] = token
 
+    # If the view we are directing to requires arguments other than 'authtoken'
+    # they should be extracted below:
     if confirmation_type == AuthTokenType.PASSWORDRECOVERY:
         view = 'reset_password'
+        args['email_address'] = token.email
     elif confirmation_type == AuthTokenType.VALIDATEEMAIL:
         view = 'confirm_email'
+        args['email_address'] = token.email
     elif confirmation_type == AuthTokenType.INVALIDATEEMAIL:
         view = 'invalidate_email'
+        args['email_address'] = token.email
+    elif confirmation_type == AuthTokenType.VALIDATEGPG:
+        view = 'confirm_gpg_key'
+        args['fingerprint'] = token.fingerprint
+    elif confirmation_type == AuthTokenType.VALIDATESIGNONLYGPG:
+        view = 'confirm_signonly_gpg_key'
+        args['fingerprint'] = token.fingerprint
     else:
         msg = ('Unknown type %s for confirmation code "%s"' %
                (confirmation_type, confirmation_code))
@@ -501,16 +513,11 @@
             'captcha_required': True}))
 
 
+@require_twofactor
 def confirm_email(request, authtoken, email_address, token=None):
     captcha_error_message = ''
     captcha_required = gargoyle.is_active('CAPTCHA', request)
 
-    if not twofactor.is_authenticated(request):
-        messages.warning(request,
-                         _('Please log in to use this confirmation code'))
-        next_url = urlquote(request.get_full_path())
-        return HttpResponseRedirect('%s?next=%s' % (settings.LOGIN_URL,
-                                                    next_url))
     atrequest = verify_token_string(authtoken, email_address)
     if (atrequest is None or
             atrequest.token_type != AuthTokenType.VALIDATEEMAIL):
@@ -572,6 +579,96 @@
     return render(request, 'account/confirm_new_email.html', context)
 
 
+@require_twofactor
+def confirm_gpg_key(request, authtoken, fingerprint):
+    atrequest = AuthToken.get_token(
+        fingerprint=fingerprint,
+        raw_token=authtoken,
+        token_type=AuthTokenType.VALIDATEGPG,
+        requester=request.user)
+    if atrequest is None:
+        return HttpResponseRedirect('/+bad-token')
+
+    email = get_object_or_404(EmailAddress, email__iexact=atrequest.email)
+    if request.user.id != email.account.id:
+        # The user is authenticated to a different account.
+        # Potentially, the token was leaked or intercepted.  Let's
+        # delete it just in case.  The real user can generate another
+        # token easily enough.
+        atrequest.delete()
+        # return a 404 response instead of raising so that
+        # the TransactionMiddleware will not rollback the dirty transaction
+        return HttpResponseNotFound()
+
+    if request.method == 'POST':
+        gpg_client = SSOGPGClient()
+        # only confirm the email address if the form was submitted
+        gpg_client.addKeyForOwner(
+            request.user.get_openid_identity_url(),
+            fingerprint
+        )
+        atrequest.consume()
+        messages.success(
+            request, gpg_messages.key_added_to_account(fingerprint))
+        return HttpResponseRedirect(
+            atrequest.redirection_url or reverse('gpg_keys')
+        )
+
+    # form was not submitted
+    context = {
+        'fingerprint': fingerprint,
+    }
+    return render(request, 'account/confirm_new_gpg.html', context)
+
+
+@require_twofactor
+def confirm_signonly_gpg_key(request, authtoken, fingerprint):
+    atrequest = AuthToken.get_token(
+        fingerprint=fingerprint,
+        raw_token=authtoken,
+        token_type=AuthTokenType.VALIDATESIGNONLYGPG,
+        requester=request.user)
+    # atrequest = verify_token_string(authtoken, email_address)
+    if atrequest is None:
+        return HttpResponseRedirect('/+bad-token')
+
+    email = get_object_or_404(EmailAddress, email__iexact=atrequest.email)
+    if request.user.id != email.account.id:
+        # The user is authenticated to a different account.
+        # Potentially, the token was leaked or intercepted.  Let's
+        # delete it just in case.  The real user can generate another
+        # token easily enough.
+        atrequest.delete()
+        # return a 404 response instead of raising so that
+        # the TransactionMiddleware will not rollback the dirty transaction
+        return HttpResponseNotFound()
+
+    if request.method == 'POST':
+        form = VerifySignedTextForm(request.POST, atrequest)
+        if form.is_valid():
+            gpg_client = SSOGPGClient()
+            gpg_client.addKeyForOwner(
+                request.user.get_openid_identity_url(),
+                fingerprint
+            )
+            atrequest.consume()
+            messages.success(
+                request, gpg_messages.key_added_to_account(fingerprint))
+            return HttpResponseRedirect(
+                atrequest.redirection_url or reverse('gpg_keys')
+            )
+    else:
+        form = VerifySignedTextForm()
+
+    # form was not submitted
+    context = {
+        'fingerprint': fingerprint,
+        'validation_phrase': atrequest.validation_phrase,
+        'form': form,
+    }
+    return render(request, 'account/confirm_new_signonly_gpg.html', context)
+
+
 def bad_token(request):
     return TemplateResponse(request, 'bad_token.html')
 
 
=== modified file 'src/webui/views/utils.py'
--- src/webui/views/utils.py	2015-05-08 19:25:27 +0000
+++ src/webui/views/utils.py	2016-04-28 00:53:41 +0000
@@ -7,8 +7,13 @@
 from functools import wraps
 
 from django.conf import settings
+from django.contrib import messages
 from django.http import HttpResponseNotAllowed, HttpResponseRedirect
 from django.template.response import TemplateResponse
+from django.utils.http import urlquote
+from django.utils.translation import ugettext_lazy as _
+
+from identityprovider.models import twofactor
 
 
 class HttpResponseSeeOther(HttpResponseRedirect):
@@ -50,3 +55,43 @@
          'CAPTCHA_API_URL_SECURE': settings.CAPTCHA_API_URL_SECURE}
     d.update(context)
     return d
+
+
+def require_twofactor(view_fn):
+    """A view decorator that requires that the user be authenticated with 2fa.
+
+    For a given view function like this::
+
+        def my_view(request, some, other, optional, args):
+            ...
+
+    You can use this decorator like so::
+
+        @require_twofactor
+        def my_view(request, some, other, optional, args):
+            ...
+
+    This is exactly equivilent to writing the following::
+
+        def my_view(request, some, other, optional, args):
+            if not twofactor.is_authenticated(request):
+                messages.warning(
+                    request,
+                    _('Please log in to use this confirmation code'))
+                next_url = urlquote(request.get_full_path())
+                return HttpResponseRedirect(
+                    '%s?next=%s' % (settings.LOGIN_URL, next_url))
+
+    Since this is a pattern used in several places, it's worth abstracting into
+    a re-usable decorator.
+    """
+    @wraps(view_fn)
+    def wrapper(request, *args, **kwargs):
+        if not twofactor.is_authenticated(request):
+            messages.warning(request,
+                             _('Please log in to use this confirmation code'))
+            next_url = urlquote(request.get_full_path())
+            return HttpResponseRedirect('%s?next=%s' % (settings.LOGIN_URL,
+                                                        next_url))
+        return view_fn(request, *args, **kwargs)
+    return wrapper