#!/bin/sh

# Publish the current OpenPGP public key to the keyservers
#
# Usage:  ./scripts/publish.sh
#
# Run after every change to the key
#
# Notes:
#  - The SKS-style servers merge and never delete
#    => Every change must be pushed
#  - keys.openpgp.org strips UIDs until each address is verified
#    => Click the links mailed to all addresses after new or changed UIDs
#
# Exits non-zero if any keyserver rejected the upload

set -eu


# Internal [S] subkey; only used to look up the key
SIGNING_KEY='D6D1989DF1F6B23FD776293DB46EDB4DFC26805D'


KEYSERVERS='
    hkps://keys.openpgp.org
    hkps://keyserver.ubuntu.com
    hkps://pgpkeys.eu
    hkps://pgp.mit.edu
    hkps://keyserver.escomposlinux.org
'


# Notes:
#  - the first fingerprint line is the primary key's fingerprint
#  - a subkey resolves to it
FPR=$(gpg --list-keys --with-colons "$SIGNING_KEY" \
    | awk -F: '$1 == "fpr" { print $10; exit }')
if [ -z "$FPR" ]; then
    echo "Error: Key $SIGNING_KEY not found" >&2
    exit 1
fi


FAILED=0


for server in $KEYSERVERS; do

    if gpg --keyserver "$server" --send-keys "$FPR"; then
        echo "OK    $server"
    else
        echo "FAIL  $server" >&2
        FAILED=1
    fi

done


exit "$FAILED"