From d00a28ea0ed981d47634504c3eb67c5b8870bc62 Mon Sep 17 00:00:00 2001
From: Allan McRae <allan@archlinux.org>
Date: Tue, 29 Mar 2022 19:36:16 +1000
Subject: Export source PGPs from PKGBUILD on commit

Provide a tool to export keys listed in the PKGBUILDs validpgpkeys to
keys/pgp/$fingerprint.asc.

The presense of the "keys" directory alongside the PKGBUILD in trunk/
is tested during commitpkg.  If the directory is abscent, keys are
exported and added to the commit.  If the directory is present, a
check is made to ensure all valid PGP keys are provided.

Signed-off-by: Allan McRae <allan@archlinux.org>
Signed-off-by: Levente Polyak <anthraxx@archlinux.org>
---
 export-pkgbuild-keys.in | 68 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)
 create mode 100644 export-pkgbuild-keys.in

(limited to 'export-pkgbuild-keys.in')

diff --git a/export-pkgbuild-keys.in b/export-pkgbuild-keys.in
new file mode 100644
index 0000000..f392f4c
--- /dev/null
+++ b/export-pkgbuild-keys.in
@@ -0,0 +1,68 @@
+#!/bin/bash
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+m4_include(lib/common.sh)
+
+usage() {
+	cat <<- _EOF_
+		Usage: ${BASH_SOURCE[0]##*/}
+
+		Export the PGP keys from a PKGBUILDs validpgpkeys array into the keys/pgp/
+		subdirectory. Useful for distributing packager validated source signing
+		keys alongside PKGBUILDs.
+
+		OPTIONS
+		    -h, --help      Show this help text
+_EOF_
+}
+
+# option checking
+while (( $# )); do
+	case $1 in
+		-h|--help)
+			usage
+			exit 0
+			;;
+		*)
+			die "invalid argument: %s" "$1"
+			;;
+	esac
+done
+
+if [[ ! -f PKGBUILD ]]; then
+	die "This must be run a directory containing a PKGBUILD."
+fi
+
+mapfile -t validpgpkeys < <(
+	# shellcheck source=PKGBUILD.proto
+	. ./PKGBUILD
+	printf "%s\n" "${validpgpkeys[@]}"
+)
+
+if (( ${#validpgpkeys[@]} == 0 )); then
+	exit 0
+fi
+
+mkdir -p keys/pgp
+error=0
+
+for key in "${validpgpkeys[@]}"; do
+	gpg --output "keys/pgp/$key.asc.tmp" --armor --export --export-options export-minimal "$key" 2>/dev/null
+
+	# gpg does not give a non-zero return value if it fails to export...
+	if [[ -f keys/pgp/$key.asc.tmp ]]; then
+		mv "keys/pgp/$key.asc.tmp" "keys/pgp/$key.asc"
+	else
+		if [[ -f keys/pgp/$key.asc ]]; then
+			warning "Failed to update key: $key"
+		else
+			error "Key unavailable: $key"
+			error=1
+		fi
+	fi
+done
+
+if (( error )); then
+	die "Failed to export all \'validpgpkeys\' entries."
+fi
-- 
cgit v1.2.3-54-g00ecf