#!/bin/sh

# Set up a machine's keyring to verify everything in this repo
#
# Usage:  ./scripts/bootstrap.sh
#
# Imports the current public key and all historical keys,
# trusts them ultimately, and runs ./scripts/verify.sh
#
# Notes:
#  - Idempotent => Safe to re-run at any time
#  - Touches public material only; the deployed secret subkeys
#    come from Vaultwarden, see OPENPGP.md

set -eu


# Internal [S] subkey; only used to look up the key
SIGNING_KEY='D6D1989DF1F6B23FD776293DB46EDB4DFC26805D'


REPO=$(cd "$(dirname "$0")/.." && pwd)



gpg --quiet \
    --import "$REPO/public-key.asc"
echo "Imported public-key.asc"

gpg --quiet \
    --import "$REPO"/history/*.asc
echo "Imported history/*.asc"



# Notes:
#  - The first "fpr" line is the primary key's fingerprint
#  - A subkey resolves to it
FPR=$(gpg --list-keys --with-colons "$SIGNING_KEY" \
    | awk -F: '$1 == "fpr" { print $10; exit }')
if [ -z "$FPR" ]; then
    echo "Error: Key $SIGNING_KEY not found" >&2
    exit 1
fi



# Notes:
#  - One "--import-ownertrust" call
#    => `gpg` checks the trustdb only once
#  - "--show-keys" reads a file without importing
#    => Its warnings about revoked keys are expected and silenced

TRUST=$(mktemp)
trap 'rm -f "$TRUST"' EXIT

echo "$FPR:6:" > "$TRUST"
for FILE in "$REPO"/history/*.asc; do
    gpg --show-keys --with-colons "$FILE" 2>/dev/null \
        | awk -F: '$1 == "fpr" { print $10 ":6:"; exit }' >> "$TRUST"
done

gpg --quiet --import-ownertrust "$TRUST"
sed 's/^/Trusted /; s/:6:$/ ultimately/' "$TRUST"



gpg --check-signatures "$FPR" >&2

echo ""

"$REPO/scripts/verify.sh"