From 0c8892871bdff12908c3dd23bd878d6f5daa83c3 Mon Sep 17 00:00:00 2001
From: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
Date: Mon, 16 Jan 2023 08:22:36 +0100
Subject: [PATCH] Add salt-keydiff.sh

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
---
 scripts/sh/salt-keydiff.sh | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100755 scripts/sh/salt-keydiff.sh

diff --git a/scripts/sh/salt-keydiff.sh b/scripts/sh/salt-keydiff.sh
new file mode 100755
index 0000000..d0f1d98
--- /dev/null
+++ b/scripts/sh/salt-keydiff.sh
@@ -0,0 +1,32 @@
+#!/bin/sh
+# Simple way to ensure a Salt minion's key matches before accepting it
+# Run `salt-call --local key.finger` on the minion and paste the output once prompted (this script should be run on the Salt master)
+# Georg Pfuetzenreuter <georg@lysergic.dev>
+set -Ceu
+
+minion="${1:-null}"
+NOCOLOR=`tput sgr0`
+
+if [ "$minion" = 'null' ]
+then
+        printf 'Please specify the minion to diff on\n'
+        exit 1
+fi
+
+key_salt=`salt-key --out json -f "$minion" | jq --arg minion "$minion" -r '.minions_pre[$minion]'`
+
+printf 'Enter fingerprint to diff against\n'
+read key_user
+
+
+if [ "$key_salt" = "$key_user" ]
+then
+        GREEN=`tput setaf 2`
+        printf '%sMatches%s\n' "$GREEN" "$NOCOLOR"
+        salt-key -a "$minion"
+elif [ ! "$key_salt" = "$key_user" ]
+then
+        RED=`tput setaf 1`
+        printf '%sMismatch%s\n' "$RED" "$NOCOLOR"
+        exit 2
+fi
-- 
2.35.3