X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/00f7a87b04290db615ec29584e0554928fca81c7..c0c781e2cabb7746a49edc88043db91f9e869c0b:/release-process/scripts/sign_exim_packages?ds=sidebyside diff --git a/release-process/scripts/sign_exim_packages b/release-process/scripts/sign_exim_packages index bd02d1183..e76840996 100755 --- a/release-process/scripts/sign_exim_packages +++ b/release-process/scripts/sign_exim_packages @@ -12,28 +12,52 @@ # woe betide the poor sod who does not use a gpg agent, so has # to enter their password for every file... +prog="$(basename "$0")" +warn() { printf >&2 "%s: %s\n" "$prog" "$*" ; } + +: "${GPG_COMMAND:=gpg}" +umask 022 + +# We've always expected an explicit key for signing, instead of just using the +# gnupg config. It make sense to honor the git config value. It makes sense +# to honor env. But git doesn't allow specifying multiple subkeys, it only +# passes one -u option. +# UID specs explicitly allow whitespace in several formats. +# We have one scalar value, we're sh, we're not going to try using an array. +# +# So if you want to sign with multiple subkeys, then set it up with multiple +# local-user directives in ~/.gnupg/gpg.conf & set EXIM_KEY=default in environ. + if repo_signing_key="$(git config user.signingkey)"; then : "${EXIM_KEY:=$repo_signing_key}" else - : "${EXIM_KEY:?Need a PGP key uid to sign with}" + if [ ".${EXIM_KEY:-}" = "." ]; then + warn "no EXIM_KEY found, trusting local gpg config" + fi fi -: "${GPG_COMMAND:=gpg}" -umask 022 +case "${EXIM_KEY:-default}" in +default|DEFAULT) + gpg_sign() { ${GPG_COMMAND} --detach-sig --armor "${1:?}" ; } + ;; +*) + gpg_sign() { ${GPG_COMMAND} --local-user "${EXIM_KEY}" --detach-sig --armor "${1:?}" ; } + ;; +esac cd_to() { echo "Working in: $1"; cd "$1"; } -okay=false -if [ -d ../../release-process ] && [ "${PWD##*/}" = "pkgs" ]; then - okay=true # we are in right dir -elif [ -d release-process ]; then - b="$(find . -maxdepth 1 -name 'exim-packaging-*' | sort | tail -n 1)" - if [ ".$b" != "." ]; then - cd_to "$b/pkgs" - okay=true - fi -fi -if ! $okay; then +#okay=false +#if [ -d ../../release-process ] && [ "${PWD##*/}" = "pkgs" ]; then +# okay=true # we are in right dir +#elif [ -d release-process ]; then +# b="$(find . -maxdepth 1 -name 'exim-packaging-*' | sort | tail -n 1)" +# if [ ".$b" != "." ]; then +# cd_to "$b/pkgs" +# okay=true +# fi +#fi +#if ! $okay; then if [ -d "${1:?need a directory to look in}" ]; then cd_to "$1" shift @@ -41,13 +65,12 @@ if ! $okay; then printf "%s: %s\n" >&2 "$(basename "$0")" "where should I be looking" exit 1 fi -fi +#fi # Assumes no whitespace (strictly, $IFS) in filenames, which we're okay with set $(find . -name '*.asc' -prune -o -type f -print | cut -c 3- | sort) - for FILE do echo "Signing: $FILE" - ${GPG_COMMAND} --local-user "${EXIM_KEY}" --detach-sig --armor "$FILE" + gpg_sign "$FILE" done