keys/scripts/snapshot.sh

#!/bin/sh

# Export the current OpenPGP public key as a dated snapshot
#
# Usage:  ./scripts/snapshot.sh [DATE]
#
# DATE defaults to the current UTC date (YYYY-MM-DD)
#
# Writes snapshots/<KEYID>-public_<DATE>.asc and refreshes public-key.asc

set -eu


# Internal [S] subkey; only used to look up the key
SIGNING_KEY='D6D1989DF1F6B23FD776293DB46EDB4DFC26805D'


REPO=$(cd "$(dirname "$0")/.." && pwd)
DATE=${1:-$(date -u +%F)}

# Notes:
#  - the first "fpr" line is the primary key's fingerprint
#  - a subkey resolves to it
FPR=$(gpg --list-keys --with-colons "$SIGNING_KEY" \
    | awk -F: '$1 == "fpr" { print $10; exit }')
if [ -z "$FPR" ]; then
    echo "Error: Key $SIGNING_KEY not found" >&2
    exit 1
fi
# The last 16 hex chars, as used in OPENPGP.md
KEYID=${FPR#"${FPR%????????????????}"}

OUT="$REPO/snapshots/${KEYID}-public_$DATE.asc"


mkdir -p "$REPO/snapshots"


# Merge the repo copy in first, so a lagging keyring cannot shrink the export
gpg --quiet \
    --import "$REPO/public-key.asc"

# The retired keys must be present,
# or "export-clean" below drops their certifications as unverifiable
gpg --quiet \
    --import "$REPO"/history/*.asc


gpg --armor \
    --export-options export-clean \
    --export "$FPR" \
    > "$OUT" \
    || {
        rm -f "$OUT"
        exit 1
    }


if [ ! -s "$OUT" ]; then
    rm -f "$OUT"
    echo "Error: Nothing exported for $FPR" >&2
    exit 1
fi


cp "$OUT" "$REPO/public-key.asc"


gpg --show-keys "$OUT" >&2


echo "Wrote snapshots/${KEYID}-public_$DATE.asc and public-key.asc"