deb-sign/run.sh

38 lines
1.1 KiB
Bash
Executable File

#!/bin/bash
set -e
# setting defaults
PASSPHRASE=${PASSPHRASE:-"FALSE"}
PLUGIN_PASSPHRASE=${PLUGIN_PASSPHRASE:-${PASSPHRASE}}
GPG_KEY=${GPG_KEY:-"FALSE"}
PLUGIN_GPG_KEY=${PLUGIN_GPG_KEY:-${GPG_KEY}}
PLUGIN_SIGN_TYPE=${PLUGIN_SIGN_TYPE:-"origin"}
PLUGIN_FILES=${PLUGIN_FILES:-"*.deb"}
# check if GPG_KEY is provided or not
if [[ $PLUGIN_GPG_KEY = "FALSE" ]]; then
echo GPG_KEY not provided
exit 1
fi
# we'll dump the key in our temp file
echo "${PLUGIN_GPG_KEY}" > /key.asc
# starting gpg agent daemon
eval $(gpg-agent --daemon --allow-preset-passphrase)
# retrieving key ID and GRIP
ID=$(gpg --with-colons /key.asc 2>/dev/null | grep "^pub" | head -n 1 | cut -d\: -f 5 )
GRIP=$(gpg --with-colons --import-options show-only --import /key.asc 2>/dev/null | grep '^grp' | head -n 1 | cut -d\: -f 10 )
echo Using GPG key with ID: ${ID} GRIP: ${GRIP}
# inject the passphrase
echo "${PLUGIN_PASSPHRASE}" | /usr/lib/gnupg2/gpg-preset-passphrase --preset ${GRIP}
# import the key
gpg --batch --yes --import /key.asc
# sign the package
dpkg-sig --sign ${PLUGIN_SIGN_TYPE} -k ${ID} ${PLUGIN_FILES}