X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/25af913afa0c279dac709ea6cf7f6a0231d655f8..376fa78ab65917689a9eb5d4bcd44ce6e41feb35:/release-process/scripts/sign_exim_packages?ds=inline diff --git a/release-process/scripts/sign_exim_packages b/release-process/scripts/sign_exim_packages index 4ed614f19..e76840996 100755 --- a/release-process/scripts/sign_exim_packages +++ b/release-process/scripts/sign_exim_packages @@ -1,17 +1,76 @@ -#!/bin/sh +#!/bin/sh -eu + +# gpg signs all *.tar.* files under the release directory. +# Invoke from that dir, or let the script try to figure it out for you. + +# Key used is from env var EXIM_KEY; if git config finds user.signingkey, then +# that is the default. You can set this per-repo with: +# git config --local user.signingkey SOME_IDENTIFIER # -# gpg signs all *.tar.* files under a given directory -# key used set from env var EXIM_KEY, script defaults that to Nigel's. +# If not set in git config then you _MUST_ set the env var. + # woe betide the poor sod who does not use a gpg agent, so has # to enter their password for every file... + +prog="$(basename "$0")" +warn() { printf >&2 "%s: %s\n" "$prog" "$*" ; } + +: "${GPG_COMMAND:=gpg}" +umask 022 + +# We've always expected an explicit key for signing, instead of just using the +# gnupg config. It make sense to honor the git config value. It makes sense +# to honor env. But git doesn't allow specifying multiple subkeys, it only +# passes one -u option. +# UID specs explicitly allow whitespace in several formats. +# We have one scalar value, we're sh, we're not going to try using an array. # +# So if you want to sign with multiple subkeys, then set it up with multiple +# local-user directives in ~/.gnupg/gpg.conf & set EXIM_KEY=default in environ. -dir=${1:?start directory} +if repo_signing_key="$(git config user.signingkey)"; then + : "${EXIM_KEY:=$repo_signing_key}" +else + if [ ".${EXIM_KEY:-}" = "." ]; then + warn "no EXIM_KEY found, trusting local gpg config" + fi +fi -: ${EXIM_KEY:=nigel@exim.org} +case "${EXIM_KEY:-default}" in +default|DEFAULT) + gpg_sign() { ${GPG_COMMAND} --detach-sig --armor "${1:?}" ; } + ;; +*) + gpg_sign() { ${GPG_COMMAND} --local-user "${EXIM_KEY}" --detach-sig --armor "${1:?}" ; } + ;; +esac -umask 022 +cd_to() { echo "Working in: $1"; cd "$1"; } + +#okay=false +#if [ -d ../../release-process ] && [ "${PWD##*/}" = "pkgs" ]; then +# okay=true # we are in right dir +#elif [ -d release-process ]; then +# b="$(find . -maxdepth 1 -name 'exim-packaging-*' | sort | tail -n 1)" +# if [ ".$b" != "." ]; then +# cd_to "$b/pkgs" +# okay=true +# fi +#fi +#if ! $okay; then + if [ -d "${1:?need a directory to look in}" ]; then + cd_to "$1" + shift + else + printf "%s: %s\n" >&2 "$(basename "$0")" "where should I be looking" + exit 1 + fi +#fi -find "$dir" \ - -type f -name '*.tar.*' \ - -exec gpg --local-user ${EXIM_KEY} --detach-sig --armor {} \; +# Assumes no whitespace (strictly, $IFS) in filenames, which we're okay with +set $(find . -name '*.asc' -prune -o -type f -print | cut -c 3- | sort) +for FILE +do + echo "Signing: $FILE" + gpg_sign "$FILE" +done