49 lines
931 B
Shell
49 lines
931 B
Shell
|
#!/bin/sh
|
||
|
|
|
||
|
|
# Create detached signatures for the signed documents in this repo
|
||
|
|
#
|
||
|
|
# Usage: ./scripts/sign.sh [FILE...]
|
||
|
|
#
|
||
|
|
# FILE defaults to KEYS.md OPENPGP.md
|
||
|
|
#
|
||
|
|
# Writes FILE.asc next to each FILE and verifies it
|
||
|
|
|
||
|
|
set -eu
|
||
|
|
|
||
|
|
|
||
|
|
# Internal [S] subkey; pinned with "!" below so `gpg` never picks another subkey
|
||
|
|
SIGNING_KEY='D6D1989DF1F6B23FD776293DB46EDB4DFC26805D'
|
||
|
|
|
||
|
|
|
||
|
|
REPO=$(cd "$(dirname "$0")/.." && pwd)
|
||
|
|
|
||
|
|
|
||
|
|
if [ $# -eq 0 ]; then
|
||
|
|
set -- \
|
||
|
|
"$REPO/KEYS.md" \
|
||
|
|
"$REPO/OPENPGP.md" \
|
||
|
|
# Keep this list aligned with the documentation at the top
|
||
|
|
fi
|
||
|
|
|
||
|
|
|
||
|
|
for FILE; do
|
||
|
|
|
||
|
|
if [ ! -f "$FILE" ]; then
|
||
|
|
echo "Error: $FILE not found" >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
gpg --armor \
|
||
|
|
--detach-sign \
|
||
|
|
--digest-algo SHA512 \
|
||
|
|
--local-user "${SIGNING_KEY}!" \
|
||
|
|
--yes \
|
||
|
|
--output "$FILE.asc" \
|
||
|
|
"$FILE"
|
||
|
|
|
||
|
|
gpg --verify "$FILE.asc" "$FILE"
|
||
|
|
|
||
|
|
echo "Signed $FILE"
|
||
|
|
echo ""
|
||
|
|
|
||
|
|
done
|