condorcore-keyring/update-keys

65 lines
1.6 KiB
Plaintext
Raw Normal View History

#!/bin/bash
export LANG=C
TMPDIR=$(mktemp -d)
trap "rm -rf '${TMPDIR}'" EXIT
KEYSERVER='hkp://keys.gnupg.net'
GPG="gpg --quiet --batch --no-tty --no-permission-warning --keyserver "${KEYSERVER}" --homedir ${TMPDIR}"
pushd "$(dirname "$0")" >/dev/null
$GPG --gen-key <<EOF
%echo Generating Arch Linux Keyring keychain master key...
Key-Type: RSA
2012-03-31 10:40:22 -06:00
Key-Length: 1024
Key-Usage: sign
Name-Real: Arch Linux Keyring Keychain Master Key
Name-Email: archlinux-keyring@localhost
Expire-Date: 0
%commit
%echo Done
EOF
rm -rf master packager archlinux-trusted
mkdir master packager
while read -ra data; do
keyid="${data[0]}"
username="${data[@]:1}"
${GPG} --recv-keys ${keyid} &>/dev/null
printf 'minimize\nquit\ny\n' | \
${GPG} --command-fd 0 --edit-key ${keyid}
2012-03-31 10:40:22 -06:00
${GPG} --yes --lsign-key ${keyid} &>/dev/null
${GPG} --armor --output master/${username}.asc --export ${keyid}
echo "${keyid}:4:" >> archlinux-trusted
done < master-keyids
2012-03-31 10:40:22 -06:00
${GPG} --import-ownertrust < archlinux-trusted 2>/dev/null
while read -ra data; do
keyid="${data[0]}"
username="${data[@]:1}"
${GPG} --recv-keys ${keyid} &>/dev/null
printf 'clean\nquit\ny\n' | \
${GPG} --command-fd 0 --edit-key ${keyid}
FD=$(mktemp)
exec 4>"${FD}"
if ! ${GPG} --list-keys --with-colons ${keyid} 2>/dev/null | grep -q '^pub:f:'; then
echo "key is not fully trusted: ${keyid} ${username}"
else
${GPG} --armor --output packager/${username}.asc --export ${keyid}
fi
done < packager-keyids
cat master/*.asc packager/*.asc > archlinux.gpg
for s in archlinux{.gpg,-trusted,-revoked}; do
if ! ${GPG} --verify ${s}.sig; then
rm -f ${s}.sig
gpg --detach-sign --use-agent ${s}
fi
done
popd >/dev/null