rpm-sign/run.sh
paspo fbb1f10f08
All checks were successful
the build was successful
fix gpg import
2018-09-28 15:04:33 +02:00

55 lines
1.5 KiB
Bash
Executable File

#!/bin/bash
set -e
# setting defaults
PASSPHRASE=${PASSPHRASE:-"FALSE"}
PLUGIN_PASSPHRASE=${PLUGIN_PASSPHRASE:-${PASSPHRASE}}
GPG_KEY=${GPG_KEY:-"FALSE"}
PLUGIN_GPG_KEY=${PLUGIN_GPG_KEY:-${GPG_KEY}}
PLUGIN_FILES=${PLUGIN_FILES:-"*.rpm"}
# check if GPG_KEY is provided or not
if [[ $PLUGIN_GPG_KEY = "FALSE" ]]; then
echo GPG_KEY not provided
exit 1
fi
# we'll dump the key in our temp file
echo "${PLUGIN_GPG_KEY}" > /key.asc
# starting gpg agent daemon
eval $(gpg-agent --daemon --allow-preset-passphrase)
# retrieving key ID and GRIP
ID=$(gpg2 --with-colons /key.asc 2>/dev/null | grep "^pub" | head -n 1 | cut -d\: -f 5 )
GRIP=$(gpg2 --with-colons --import-options show-only --import /key.asc 2>/dev/null | grep '^grp' | head -n 1 | cut -d\: -f 10 )
echo Using GPG key with ID: ${ID} GRIP: ${GRIP}
# inject the passphrase
echo "${PLUGIN_PASSPHRASE}" | /usr/libexec/gpg-preset-passphrase --preset ${GRIP}
# import the key
gpg2 --batch --yes --import /key.asc
gpg2 --armor --export ${ID} >/key.pub.asc
rpm --import /key.pub.asc
# get key CN
NAME=$(gpg2 --with-colons /key.asc 2>/dev/null | grep "^uid" | head -n 1 | cut -d\: -f 10)
# and output it to rpmmacros
cat <<EOF >~/.rpmmacros
%_gpg_name ${NAME}
EOF
# parse required files
for f in ${PLUGIN_FILES} ; do
echo -n "Checking: $f - "
S=$(rpm -K $f | grep '\:.*signatures.*OK$')
if [ "a$S" = "a" ] ; then
rpmsign --addsign $f 2>&1 >/dev/null && echo "SIGNED SUCCESSFULLY" || echo "SIGNING FAILED"
else
echo "ALREADY SIGNED"
fi
done