Alexander Hess
8ece401276
- Make OpenPGP only one of many protocols + KEYS.md only holds the current keys + OPENPGP.md describes all OpenPGP details - Make the current public key available at the root - Add scripts/ to automate the various steps: + bootstrap.sh + publish.sh + sign.sh + snapshot.sh + verify.sh
59 lines
1.2 KiB
Shell
Executable file
59 lines
1.2 KiB
Shell
Executable file
#!/bin/sh
|
|
|
|
# Publish the current OpenPGP public key to the keyservers
|
|
#
|
|
# Usage: ./scripts/publish.sh
|
|
#
|
|
# Run after every change to the key
|
|
#
|
|
# Notes:
|
|
# - The SKS-style servers merge and never delete
|
|
# => Every change must be pushed
|
|
# - keys.openpgp.org strips UIDs until each address is verified
|
|
# => Click the links mailed to all addresses after new or changed UIDs
|
|
#
|
|
# Exits non-zero if any keyserver rejected the upload
|
|
|
|
set -eu
|
|
|
|
|
|
# Internal [S] subkey; only used to look up the key
|
|
SIGNING_KEY='D6D1989DF1F6B23FD776293DB46EDB4DFC26805D'
|
|
|
|
|
|
KEYSERVERS='
|
|
hkps://keys.openpgp.org
|
|
hkps://keyserver.ubuntu.com
|
|
hkps://pgpkeys.eu
|
|
hkps://pgp.mit.edu
|
|
hkps://keyserver.escomposlinux.org
|
|
'
|
|
|
|
|
|
# Notes:
|
|
# - the first fingerprint line is the primary key's fingerprint
|
|
# - a subkey resolves to it
|
|
FPR=$(gpg --list-keys --with-colons "$SIGNING_KEY" \
|
|
| awk -F: '$1 == "fpr" { print $10; exit }')
|
|
if [ -z "$FPR" ]; then
|
|
echo "Error: Key $SIGNING_KEY not found" >&2
|
|
exit 1
|
|
fi
|
|
|
|
|
|
FAILED=0
|
|
|
|
|
|
for server in $KEYSERVERS; do
|
|
|
|
if gpg --keyserver "$server" --send-keys "$FPR"; then
|
|
echo "OK $server"
|
|
else
|
|
echo "FAIL $server" >&2
|
|
FAILED=1
|
|
fi
|
|
|
|
done
|
|
|
|
|
|
exit "$FAILED"
|