72 lines
1.5 KiB
Shell
72 lines
1.5 KiB
Shell
|
#!/bin/sh
|
||
|
|
|
||
|
|
# Export the current OpenPGP public key as a yearly snapshot
|
||
|
|
#
|
||
|
|
# Usage: ./scripts/snapshot.sh [YEAR]
|
||
|
|
#
|
||
|
|
# YEAR defaults to the current UTC year
|
||
|
|
#
|
||
|
|
# Writes snapshots/<KEYID>-public-<YEAR>.asc and refreshes public-key.asc
|
||
|
|
|
||
|
|
set -eu
|
||
|
|
|
||
|
|
|
||
|
|
# Internal [S] subkey; only used to look up the key
|
||
|
|
SIGNING_KEY='D6D1989DF1F6B23FD776293DB46EDB4DFC26805D'
|
||
|
|
|
||
|
|
|
||
|
|
REPO=$(cd "$(dirname "$0")/.." && pwd)
|
||
|
|
YEAR=${1:-$(date -u +%Y)}
|
||
|
|
|
||
|
|
# Notes:
|
||
|
|
# - the first "fpr" line is the primary key's fingerprint
|
||
|
|
# - a subkey resolves to it
|
||
|
|
FPR=$(gpg --list-keys --with-colons "$SIGNING_KEY" \
|
||
|
|
| awk -F: '$1 == "fpr" { print $10; exit }')
|
||
|
|
if [ -z "$FPR" ]; then
|
||
|
|
echo "Error: Key $SIGNING_KEY not found" >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
# The last 16 hex chars, as used in OPENPGP.md
|
||
|
|
KEYID=${FPR#"${FPR%????????????????}"}
|
||
|
|
|
||
|
|
OUT="$REPO/snapshots/$KEYID-public-$YEAR.asc"
|
||
|
|
|
||
|
|
|
||
|
|
mkdir -p "$REPO/snapshots"
|
||
|
|
|
||
|
|
|
||
|
|
# Merge the repo copy in first, so a lagging keyring cannot shrink the export
|
||
|
|
gpg --quiet \
|
||
|
|
--import "$REPO/public-key.asc"
|
||
|
|
|
||
|
|
# The retired keys must be present,
|
||
|
|
# or "export-clean" below drops their certifications as unverifiable
|
||
|
|
gpg --quiet \
|
||
|
|
--import "$REPO"/history/*.asc
|
||
|
|
|
||
|
|
|
||
|
|
gpg --armor \
|
||
|
|
--export-options export-clean \
|
||
|
|
--export "$FPR" \
|
||
|
|
> "$OUT" \
|
||
|
|
|| {
|
||
|
|
rm -f "$OUT"
|
||
|
|
exit 1
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
if [ ! -s "$OUT" ]; then
|
||
|
|
rm -f "$OUT"
|
||
|
|
echo "Error: Nothing exported for $FPR" >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
|
||
|
|
cp "$OUT" "$REPO/public-key.asc"
|
||
|
|
|
||
|
|
|
||
|
|
gpg --show-keys "$OUT" >&2
|
||
|
|
|
||
|
|
|
||
|
|
echo "Wrote snapshots/$KEYID-public-$YEAR.asc and public-key.asc"
|