#!/bin/bash set -e # setting defaults PASSPHRASE=${PASSPHRASE:-"FALSE"} PLUGIN_PASSPHRASE=${PLUGIN_PASSPHRASE:-${PASSPHRASE}} GPG_KEY=${GPG_KEY:-"FALSE"} PLUGIN_GPG_KEY=${PLUGIN_GPG_KEY:-${GPG_KEY}} PLUGIN_SIGN_TYPE=${PLUGIN_SIGN_TYPE:-"origin"} PLUGIN_FILES=${PLUGIN_FILES:-"*.deb"} # check if GPG_KEY is provided or not if [[ $PLUGIN_GPG_KEY = "FALSE" ]]; then echo GPG_KEY not provided exit 1 fi # we'll dump the key in our temp file echo "${PLUGIN_GPG_KEY}" > /key.asc # starting gpg agent daemon eval $(gpg-agent --daemon --allow-preset-passphrase) # retrieving key ID and GRIP ID=$(gpg --with-colons /key.asc 2>/dev/null | grep "^pub" | head -n 1 | cut -d\: -f 5 ) GRIP=$(gpg --with-colons --import-options show-only --import /key.asc 2>/dev/null | grep '^grp' | head -n 1 | cut -d\: -f 10 ) echo Using GPG key with ID: ${ID} GRIP: ${GRIP} # inject the passphrase echo "${PLUGIN_PASSPHRASE}" | /usr/lib/gnupg2/gpg-preset-passphrase --preset ${GRIP} # import the key gpg --batch --yes --import /key.asc # sign the package dpkg-sig --sign ${PLUGIN_SIGN_TYPE} -k ${ID} ${PLUGIN_FILES}