rpm-sign/run.sh

49 lines
1.3 KiB
Bash
Raw Normal View History

2018-09-28 12:14:09 +00:00
#!/bin/bash
set -e
# setting defaults
PASSPHRASE=${PASSPHRASE:-"FALSE"}
PLUGIN_PASSPHRASE=${PLUGIN_PASSPHRASE:-${PASSPHRASE}}
GPG_KEY=${GPG_KEY:-"FALSE"}
PLUGIN_GPG_KEY=${PLUGIN_GPG_KEY:-${GPG_KEY}}
PLUGIN_FILES=${PLUGIN_FILES:-"*.rpm"}
# check if GPG_KEY is provided or not
if [[ $PLUGIN_GPG_KEY = "FALSE" ]]; then
echo GPG_KEY not provided
exit 1
fi
# we'll dump the key in our temp file
echo "${PLUGIN_GPG_KEY}" > /key.asc
# starting gpg agent daemon
eval $(gpg-agent --daemon --allow-preset-passphrase)
# retrieving key ID and GRIP
2018-09-28 12:52:24 +00:00
ID=$(gpg2 --with-colons /key.asc 2>/dev/null | grep "^pub" | head -n 1 | cut -d\: -f 5 )
GRIP=$(gpg2 --with-colons --import-options show-only --import /key.asc 2>/dev/null | grep '^grp' | head -n 1 | cut -d\: -f 10 )
2018-09-28 12:14:09 +00:00
echo Using GPG key with ID: ${ID} GRIP: ${GRIP}
# inject the passphrase
echo "${PLUGIN_PASSPHRASE}" | /usr/libexec/gpg-preset-passphrase --preset ${GRIP}
# import the key
2018-09-28 13:43:21 +00:00
gpg2 --batch --yes --import /key.asc
2018-09-28 13:04:33 +00:00
gpg2 --armor --export ${ID} >/key.pub.asc
rpm --import /key.pub.asc
2018-09-28 12:14:09 +00:00
# get key CN
2018-09-28 12:52:24 +00:00
NAME=$(gpg2 --with-colons /key.asc 2>/dev/null | grep "^uid" | head -n 1 | cut -d\: -f 10)
2018-09-28 12:14:09 +00:00
# and output it to rpmmacros
cat <<EOF >~/.rpmmacros
%_gpg_name ${NAME}
EOF
# parse required files
2018-09-28 13:43:21 +00:00
for f in ${PLUGIN_FILES} ; do
rpm -K $f | grep "\:.*signatures.*OK$" || rpmsign -v --addsign $f || exit 1
2018-09-28 12:14:09 +00:00
done