72 lines
1.6 KiB
Shell
72 lines
1.6 KiB
Shell
|
#!/bin/sh
|
||
|
|
|
||
|
|
# Set up a machine's keyring to verify everything in this repo
|
||
|
|
#
|
||
|
|
# Usage: ./scripts/bootstrap.sh
|
||
|
|
#
|
||
|
|
# Imports the current public key and all historical keys,
|
||
|
|
# trusts them ultimately, and runs ./scripts/verify.sh
|
||
|
|
#
|
||
|
|
# Notes:
|
||
|
|
# - Idempotent => Safe to re-run at any time
|
||
|
|
# - Touches public material only; the deployed secret subkeys
|
||
|
|
# come from Vaultwarden, see OPENPGP.md
|
||
|
|
|
||
|
|
set -eu
|
||
|
|
|
||
|
|
|
||
|
|
# Internal [S] subkey; only used to look up the key
|
||
|
|
SIGNING_KEY='D6D1989DF1F6B23FD776293DB46EDB4DFC26805D'
|
||
|
|
|
||
|
|
|
||
|
|
REPO=$(cd "$(dirname "$0")/.." && pwd)
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
gpg --quiet \
|
||
|
|
--import "$REPO/public-key.asc"
|
||
|
|
echo "Imported public-key.asc"
|
||
|
|
|
||
|
|
gpg --quiet \
|
||
|
|
--import "$REPO"/history/*.asc
|
||
|
|
echo "Imported history/*.asc"
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
# Notes:
|
||
|
|
# - The first "fpr" line is the primary key's fingerprint
|
||
|
|
# - A subkey resolves to it
|
||
|
|
FPR=$(gpg --list-keys --with-colons "$SIGNING_KEY" \
|
||
|
|
| awk -F: '$1 == "fpr" { print $10; exit }')
|
||
|
|
if [ -z "$FPR" ]; then
|
||
|
|
echo "Error: Key $SIGNING_KEY not found" >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
# Notes:
|
||
|
|
# - One "--import-ownertrust" call
|
||
|
|
# => `gpg` checks the trustdb only once
|
||
|
|
# - "--show-keys" reads a file without importing
|
||
|
|
# => Its warnings about revoked keys are expected and silenced
|
||
|
|
|
||
|
|
TRUST=$(mktemp)
|
||
|
|
trap 'rm -f "$TRUST"' EXIT
|
||
|
|
|
||
|
|
echo "$FPR:6:" > "$TRUST"
|
||
|
|
for FILE in "$REPO"/history/*.asc; do
|
||
|
|
gpg --show-keys --with-colons "$FILE" 2>/dev/null \
|
||
|
|
| awk -F: '$1 == "fpr" { print $10 ":6:"; exit }' >> "$TRUST"
|
||
|
|
done
|
||
|
|
|
||
|
|
gpg --quiet --import-ownertrust "$TRUST"
|
||
|
|
sed 's/^/Trusted /; s/:6:$/ ultimately/' "$TRUST"
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
gpg --check-signatures "$FPR" >&2
|
||
|
|
|
||
|
|
echo ""
|
||
|
|
|
||
|
|
"$REPO/scripts/verify.sh"
|