mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 09:14:00 +00:00
CyberMind-FR
3b99bcf4ec
Pins GPG_HOME=~/.gnupg/secubox (persistent), invokes existing generate-gpg-key.sh, and writes the long fingerprint to FINGERPRINT.txt for downstream consumption by reprepro SignWith. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
48 lines
1.6 KiB
Bash
Executable File
48 lines
1.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# scripts/stage-gpg-bootstrap.sh
|
|
# Initialize the SecuBox package signing key in ~/.gnupg/secubox/.
|
|
# Writes:
|
|
# ~/.gnupg/secubox/ - persistent gnupg home (chmod 700)
|
|
# $OUT_DIR/secubox-keyring.gpg - public key, ASCII-armored
|
|
# $OUT_DIR/secubox-keyring.gpg.bin - public key, binary
|
|
# $OUT_DIR/FINGERPRINT.txt - long fingerprint (no spaces)
|
|
#
|
|
# Idempotent: skips key creation if a key for packages@secubox.in already exists.
|
|
|
|
set -euo pipefail
|
|
|
|
OUT_DIR="${1:-output/repo}"
|
|
KEY_EMAIL="packages@secubox.in"
|
|
export GPG_HOME="${HOME}/.gnupg/secubox"
|
|
export EXPORT_DIR="$OUT_DIR"
|
|
|
|
mkdir -p "$OUT_DIR" "$GPG_HOME"
|
|
chmod 700 "$GPG_HOME"
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
REPO="$(dirname "$SCRIPT_DIR")"
|
|
|
|
bash "$REPO/repo/scripts/generate-gpg-key.sh"
|
|
|
|
# The underlying script exits early (without exporting) when the key already
|
|
# exists. Always export here so the wrapper is idempotent end-to-end.
|
|
gpg --homedir "$GPG_HOME" --armor --export "$KEY_EMAIL" \
|
|
> "$OUT_DIR/secubox-keyring.gpg"
|
|
gpg --homedir "$GPG_HOME" --export "$KEY_EMAIL" \
|
|
> "$OUT_DIR/secubox-keyring.gpg.bin"
|
|
|
|
# Extract long fingerprint (no spaces) — used in reprepro conf/distributions SignWith.
|
|
gpg --homedir "$GPG_HOME" \
|
|
--list-keys --with-colons "$KEY_EMAIL" \
|
|
| awk -F: '/^fpr:/ {print $10; exit}' \
|
|
> "$OUT_DIR/FINGERPRINT.txt"
|
|
|
|
if [[ ! -s "$OUT_DIR/FINGERPRINT.txt" ]]; then
|
|
echo "ERROR: failed to extract fingerprint" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "GPG ready. Fingerprint: $(cat "$OUT_DIR/FINGERPRINT.txt")"
|
|
echo "Public key (armored): $OUT_DIR/secubox-keyring.gpg"
|
|
echo "Public key (binary): $OUT_DIR/secubox-keyring.gpg.bin"
|