MT#58014 Replace GnuPG usage with Stateless OpenPGP CLI

The usage patterns are more ergonomic, part of an IETF draft [S], and
this moves us away from GnuPG where its upstream has declared[D] it will
not be following the upcoming OpenPGP RFC [R] standards going forward.

We add support for sqop (Sequoia-PGP), gosop (GopenPGP) and
pgpainless-cli (PGPainless), but we only depend on sqop to get a
reproducible installation. This leave open the door to switch to other
implementations very easily.

As a bonus this also avoids the noise from GnuPG about creating stuff
under the user directory.

[S] https://datatracker.ietf.org/doc/draft-dkg-openpgp-stateless-cli/
[D] https://mailarchive.ietf.org/arch/msg/openpgp/Ek9SvwdsWJ_j4C7SWVoCSKwfo8Y/
[R] https://datatracker.ietf.org/doc/draft-ietf-openpgp-crypto-refresh/

Change-Id: I8a582ba1269aca3b9db6de8ddbae525c7298194c

debian/control

@@ -88,8 +88,8 @@ Description: central and templated based Configuration Management System for NGC
 Package: ngcp-ngcpcfg-locker
 Architecture: all
 Depends:
- gnupg,
  ngcp-ngcpcfg,
+ sqop,
  ${misc:Depends},
 Description: Encrypt and decrypt feature for ngcp-ngcpcfg
  This package provides the encrypt and decrypt options for

functions/openpgp

@@ -5,31 +5,53 @@
 
 # OpenPGP subsystem initialization functions {{{
 openpgp_setup() {
-  if ! type -p gpg &>/dev/null ; then
-    log_error "gpg binary not found, exiting."
-    exit 1
-  fi
+  declare -a sop_cmds=(sqop gosop pgpainless-cli)
+
+  for SOP in "${sop_cmds[@]}"; do
+    if type -p "${SOP}" &>/dev/null ; then
+      declare -g SOP
+      return
+    fi
+  done
+
+  unset SOP
+
+  log_error "Cannot find any SOP implementation (from ${sop_cmds[*]}), exiting."
+  exit 1
 }
 
 openpgp_prompt_password() {
+  local pass_a pass_b
+
   if ! tty -s; then
     log_error "Cannot request OpenPGP password (no tty). Aborting."
     exit 1
   fi
 
-  GPG_TTY=$(tty)
-  export GPG_TTY
+  read -r -p "Type password: " -s pass_a
+  echo
+  read -r -p "Re-type password: " -s pass_b
+  echo
+
+  if [ "${pass_a}" != "${pass_b}" ]; then
+    log_error "Passwords do not match. Aborting."
+    exit 1
+  fi
+
+  SOP_PASS="${pass_a}"
+  declare -g SOP_PASS
 }
 
 openpgp_reset_password() {
-  :
+  SOP_PASS=0000000000000000000000000000000000000000
+  unset SOP_PASS
 }
 
 openpgp_encrypt() {
-  gpg --symmetric
+  $SOP encrypt --with-password @FD:10 10<<<"${SOP_PASS}" --no-armor
 }
 
 openpgp_decrypt() {
-  gpg --decrypt
+  $SOP decrypt --with-password @FD:10 10<<<"${SOP_PASS}"
 }
 ## }}}