#!/bin/bash set -e # setting defaults PASSPHRASE=${PASSPHRASE:-"FALSE"} PLUGIN_PASSPHRASE=${PLUGIN_PASSPHRASE:-${PASSPHRASE}} GPG_KEY=${GPG_KEY:-"FALSE"} PLUGIN_GPG_KEY=${PLUGIN_GPG_KEY:-${GPG_KEY}} PLUGIN_FILES=${PLUGIN_FILES:-"*.rpm"} # check if GPG_KEY is provided or not if [[ $PLUGIN_GPG_KEY = "FALSE" ]]; then echo GPG_KEY not provided exit 1 fi # we'll dump the key in our temp file echo "${PLUGIN_GPG_KEY}" > /key.asc # starting gpg agent daemon eval $(gpg-agent --daemon --allow-preset-passphrase) # retrieving key ID and GRIP ID=$(gpg --with-colons /key.asc 2>/dev/null | grep "^sec" | head -n 1 | cut -d\: -f 5 ) GRIP=$(gpg --with-colons --import-options show-only --import /key.asc 2>/dev/null | grep '^grp' | head -n 1 | cut -d\: -f 10 ) echo Using GPG key with ID: ${ID} GRIP: ${GRIP} # inject the passphrase echo "${PLUGIN_PASSPHRASE}" | /usr/libexec/gpg-preset-passphrase --preset ${GRIP} # import the key gpg2 --batch --yes --import /key.asc rpm --import /key.asc # get key CN NAME=$(gpg --with-colons /key.asc 2>/dev/null | grep "^uid" | head -n 1 | cut -d\: -f 10) # and output it to rpmmacros cat <~/.rpmmacros %_gpg_name ${NAME} EOF # parse required files for f in ${PLUGIN_FILES} ; do echo -n "Checking: $f - " S=$(rpm -K $f | grep '\:.*signatures.*OK$') if [ "a$S" = "a" ] ; then rpmsign --addsign $f 2>&1 >/dev/null && echo "SIGNED SUCCESSFULLY" || echo "SIGNING FAILED" else echo "ALREADY SIGNED" fi done