#!/bin/sh

# Create detached signatures for the signed documents in this repo
#
# Usage:  ./scripts/sign.sh [FILE...]
#
# FILE defaults to KEYS.md OPENPGP.md AGE.md
#
# Writes FILE.asc next to each FILE and verifies it

set -eu


# Internal [S] subkey; pinned with "!" below so `gpg` never picks another subkey
SIGNING_KEY='D6D1989DF1F6B23FD776293DB46EDB4DFC26805D'


REPO=$(cd "$(dirname "$0")/.." && pwd)


if [ $# -eq 0 ]; then
    set -- \
        "$REPO/KEYS.md" \
        "$REPO/OPENPGP.md" \
        "$REPO/AGE.md" \
        # Keep this list aligned with the documentation at the top
fi


for FILE; do

    if [ ! -f "$FILE" ]; then
        echo "Error: $FILE not found" >&2
        exit 1
    fi

    gpg --armor \
        --detach-sign \
        --digest-algo SHA512 \
        --local-user "${SIGNING_KEY}!" \
        --yes \
        --output "$FILE.asc" \
        "$FILE"

    gpg --verify "$FILE.asc" "$FILE"

    echo "Signed $FILE"
    echo ""

done