Restructure the repository

- Make OpenPGP only one of many protocols
  + KEYS.md only holds the current keys
  + OPENPGP.md describes all OpenPGP details
- Make the current public key available at the root
- Add scripts/ to automate the various steps:
  + bootstrap.sh
  + publish.sh
  + sign.sh
  + snapshot.sh
  + verify.sh

scripts/verify.sh

@@ -0,0 +1,103 @@
+#!/bin/sh
+
+# Verify the signed files in this repo against the pinned [S] subkey
+#
+# Usage:  ./scripts/verify.sh [FILE...]
+#
+# FILE defaults to KEYS.md OPENPGP.md ceremonies/*.md
+#
+# A FILE with a FILE.asc next to it is checked as a detached signature,
+# any other FILE as a clearsigned document
+#
+# Also checks the key's expiry
+#
+# Exits non-zero if any file lacks a valid signature from the pinned key,
+# or if the key has expired
+
+set -eu
+
+
+# Internal [S] subkey; every file must carry a valid signature from this key
+SIGNING_KEY='D6D1989DF1F6B23FD776293DB46EDB4DFC26805D'
+
+
+# Warn when the key expires within this many days
+WARN_DAYS=60
+
+
+REPO=$(cd "$(dirname "$0")/.." && pwd)
+
+
+if [ $# -eq 0 ]; then
+    set -- \
+        "$REPO/KEYS.md" \
+        "$REPO/OPENPGP.md" \
+        "$REPO"/ceremonies/*.md \
+        # Keep this list aligned with the documentation at the top
+fi
+
+
+# Print the fingerprints of all keys that made a valid signature, one per line
+signers() {
+    gpg \
+        --status-fd 1 \
+        --verify "$@" \
+        2>/dev/null \
+        | awk '$2 == "VALIDSIG" { print $3 }'
+}
+
+
+FAILED=0
+
+
+for FILE; do
+
+    if [ ! -f "$FILE" ]; then
+        echo "Error: $FILE not found" >&2
+        exit 1
+    fi
+
+    if [ -f "$FILE.asc" ]; then
+        SIGNERS=$(signers "$FILE.asc" "$FILE")
+    else
+        SIGNERS=$(signers "$FILE")
+    fi
+
+    if printf '%s\n' "$SIGNERS" | grep -qx "$SIGNING_KEY"; then
+        echo "OK    $FILE"
+    else
+        echo "FAIL  $FILE (signed by: $(printf '%s' "${SIGNERS:-nobody}" | tr '\n' ' '))" >&2
+        FAILED=1
+    fi
+
+done
+
+
+# Notes:
+#  - The 7th field of the pub line is the primary key's expiry in epoch seconds
+#  - A subkey resolves to the primary key
+
+EXPIRY=$(gpg --list-keys --with-colons "$SIGNING_KEY" \
+         | awk -F: '$1 == "pub" { print $7; exit }')
+
+if [ -z "$EXPIRY" ]; then
+    echo "Error: No expiry found for key $SIGNING_KEY" >&2
+    exit 1
+fi
+
+NOW=$(date -u +%s)
+
+DAYS_LEFT=$(( (EXPIRY - NOW) / 86400 ))
+
+
+if [ "$EXPIRY" -le "$NOW" ]; then
+    echo "FAIL  Key expired $(( (NOW - EXPIRY) / 86400 )) days ago" >&2
+    FAILED=1
+elif [ "$DAYS_LEFT" -lt "$WARN_DAYS" ]; then
+    echo "WARN  Key expires in $DAYS_LEFT days" >&2
+else
+    echo "OK    Key expires in $DAYS_LEFT days"
+fi
+
+
+exit "$FAILED"