diff --git a/repo-main.sh b/repo-main.sh index 2f1119d..4cdd1a5 100755 --- a/repo-main.sh +++ b/repo-main.sh @@ -67,7 +67,7 @@ mkdir -p keys chmod 600 keys export GNUPGHOME="${PWD}/keys" -./repo-sign.sh "${TEMP_DIR}" +./repo-sign.sh "${TEMP_DIR}" "${REPO_PATH}"/key.pub.asc echo "Committing changes..." mv "${TEMP_DIR}"/* "${REPO_PATH}"/ diff --git a/repo-sign.sh b/repo-sign.sh index 3035bb1..590333d 100755 --- a/repo-sign.sh +++ b/repo-sign.sh @@ -8,7 +8,7 @@ if [ $# -eq 0 ]; then fi if [ "$1" = "-h" ] || [ "$1" = "--help" ]; then - echo "usage: ./repo-sign.sh [-h] [REPO_PATH GPG_SUBKEY_ID] + echo "usage: ./repo-sign.sh [-h] [REPO_PATH PUB_KEY_FULLPATH GPG_SUBKEY_ID] Deploys packages for you. @@ -22,8 +22,14 @@ Dependencies: - exit 0 fi +if [ $# -lt 2 ]; then + echo "Mandatory arguments: 'REPO_PATH', 'PUB_KEY_FULLPATH'. Aborting..." + exit 1 +fi + REPO_PATH="${1}" -[ -n "${2+x}" ] && GPG_SUBKEY_ID="${2}" +PUB_KEY_FULLPATH="${1}" +[ -n "${3+x}" ] && GPG_SUBKEY_ID="${3}" if [ ! -f "${GNUPGHOME}/pubring.kbx" ]; then echo "The file 'pubring.kbx' file has not been found. Generating automatically a new one with a new set of keys..." @@ -57,9 +63,19 @@ if [ -z "${GPG_SUBKEY_ID+x}" ]; then GPG_SUBKEY_ID="$(gpg --list-secret-key --with-subkey-fingerprint --with-colons | awk -F: '$1 == "fpr" {print $10;}' | sed -n '2 p')" fi -if [ ! -f "${REPO_PATH}"/key.pub.asc ];then +# - Generate the armored pub key (NEW_KEY) that has to be published; +# - If the key does not exists in PUB_KEY_FULLPATH, place NEW_KEY; +# - If PUB_KEY_FULLPATH exixts but is not identical to NEW_KEY, then backup +# the old key (PUB_KEY_FULLPATH) and replace it with the new one (NEW_KEY). +# - Else do nothing. +NEW_KEY="$(mktemp)" +gpg --armor --export "${GPG_SUBKEY_ID}" > "${NEW_KEY}" +if [ ! -f "${PUB_KEY_FULLPATH}" ];then echo "Public key not published. Generating and publishing it..." - gpg --armor --export "${GPG_SUBKEY_ID}" > "${REPO_PATH}"/key.pub.asc + mv "${NEW_KEY}" "${PUB_KEY_FULLPATH}" +elif [ -f "${PUB_KEY_FULLPATH}" ] && ! cmp --silent "${PUB_KEY_FULLPATH}" "${NEW_KEY}"; then + mv "${PUB_KEY_FULLPATH}" "${PUB_KEY_FULLPATH}".bak + mv "${NEW_KEY}" "${PUB_KEY_FULLPATH}" fi echo "Signing the repo..."