abuild/abuild-sign.in

111 lines
2.4 KiB
Plaintext
Raw Normal View History

#!/bin/sh
# abuild-sign - sign indexes
# Copyright (c) 2009 Natanael Copa <ncopa@alpinelinux.org>
#
# Distributed under GPL-2
#
program_version=@VERSION@
datadir=@datadir@
if ! [ -f "$datadir/functions.sh" ]; then
echo "$datadir/functions.sh: not found" >&2
exit 1
fi
. "$datadir/functions.sh"
2013-07-05 04:21:15 +00:00
do_sign() {
2013-07-05 04:21:22 +00:00
local f i keyname repo
local openssl=$(command -v openssl || echo libressl)
2013-07-05 04:21:22 +00:00
2013-07-05 04:21:15 +00:00
# we are actually only interested in the name, not the file itself
keyname=${pubkey##*/}
for f; do
i=$(readlink -f $f)
[ -d "$i" ] && i="$i/APKINDEX.tar.gz"
repo="${i%/*}"
trap 'die "failed to sign $i"' EXIT
set -e
cd "$repo"
2013-07-05 04:21:15 +00:00
sig=".SIGN.RSA.$keyname"
$openssl dgst -sha1 -sign "$privkey" -out "$sig" "$i"
2013-07-05 04:21:15 +00:00
tmptargz=$(mktemp)
2017-06-23 07:45:41 +00:00
tar -f - -c "$sig" | abuild-tar --cut | gzip -9 > "$tmptargz"
2013-07-05 04:21:15 +00:00
tmpsigned=$(mktemp)
cat "$tmptargz" "$i" > "$tmpsigned"
rm -f "$tmptargz" "$sig"
2013-07-05 04:21:24 +00:00
chmod 644 "$tmpsigned"
2013-07-05 04:21:15 +00:00
mv "$tmpsigned" "$i"
msg "Signed $i"
set +e
trap - EXIT
2013-07-05 04:21:15 +00:00
done
}
usage() {
2016-08-20 13:16:48 +00:00
cat >&2 <<-__EOF__
$program $program_version - sign indexes
Usage: $program [-k PRIVKEY] [-p PUBKEY] INDEXFILE...
$program -e
Options:
-e, --installed Check only of there exist a private key for signing
-k, --private KEY The private key to use for signing
-p, --public KEY The name of public key. apk add will look for
/etc/apk/keys/KEY
-q, --quiet
-h, --help Show this help
__EOF__
}
check_installed=false
privkey="$PACKAGER_PRIVKEY"
pubkey=
quiet=
args=$(getopt -o ek:p:qh --long installed,private:,public:,quiet,help -n "$program" -- "$@")
if [ $? -ne 0 ]; then
usage
exit 2
fi
eval set -- "$args"
while true; do
case $1 in
-e|--installed) check_installed=true;;
-k|--private) privkey=$2; shift;;
-p|--public) pubkey=$2; shift;;
-q|--quiet) quiet=1;; # suppresses msg
-h|--help) usage; exit;;
--) shift; break;;
*) exit 1;; # getopt error
esac
shift
done
if [ $# -eq 0 ] && ! $check_installed; then
usage
exit 2
fi
if [ -z "$privkey" ]; then
2016-11-23 20:59:12 +00:00
cat >&2 <<-__EOF__
No private key found. Use 'abuild-keygen' to generate the keys.
Then you can either:
* set the PACKAGER_PRIVKEY in $ABUILD_USERCONF
('abuild-keygen -a' does this for you)
* set the PACKAGER_PRIVKEY in $ABUILD_CONF
* specify the key with the -k option to $program
2013-07-05 04:21:21 +00:00
2016-11-23 20:59:12 +00:00
__EOF__
exit 1
fi
if [ -z "$pubkey" ]; then
pubkey=${PACKAGER_PUBKEY:-"${privkey}.pub"}
fi
if ! $check_installed; then
do_sign "$@"
fi