94 lines
3.3 KiB
Bash
Executable File
94 lines
3.3 KiB
Bash
Executable File
#!/bin/bash
|
|
set -exu
|
|
|
|
# GPG Signing key fingerprint table
|
|
#
|
|
# These GPG signing key fingerprints are accurate as of the
|
|
# dates below. These keys will be used for signing the packages
|
|
# that we ship. We will update this table as keys are changed.
|
|
#
|
|
# RPM SIGNING REQUIRES THE SIGNING SUBKEY, SO THESE ARE THE SIGNING SUBKEY
|
|
# FINGERPRINTS, NOT THE MASTER FINGERPRINTS. UNFORTUNATELY THIS IS A DIVERGENCE
|
|
# FROM THE APTLY SIGNING SCRIPT, WHICH USES SIGNING SUBKEYS.
|
|
#
|
|
#
|
|
# Date Channel Fingerprint Full Key
|
|
#
|
|
# NOT ACTIVE Release 0xA8580BDC82D3DC6C 9BD198A2D848C482E3550697A8580BDC82D3DC6C
|
|
# 06/26/2019 Release 0x4FE13824E3FFC656 E85FFA8E2E90B40B33ED39274FE13824E3FFC656
|
|
# 12/29/2018 Beta 0x0B31DBA06A8A26F9 9228DBCE20DDE5EC46488DE90B31DBA06A8A26F9
|
|
# 12/29/2018 Dev 0x0B31DBA06A8A26F9 9228DBCE20DDE5EC46488DE90B31DBA06A8A26F9
|
|
# 12/29/2018 Nightly 0x0B31DBA06A8A26F9 9228DBCE20DDE5EC46488DE90B31DBA06A8A26F9
|
|
|
|
S3_BUCKET=${1}
|
|
GPG_KEY_ID=${2}
|
|
GPG_KEY_SHORT_ID=${GPG_KEY_ID:(-8)}
|
|
TMP_REPO=$(mktemp -d)
|
|
# SNAP_TAG=$(date +'%s')
|
|
|
|
if [ -z "$S3_BUCKET" ]; then
|
|
echo "Error: Please pass the S3 bucket argument as the first argument"
|
|
exit 1
|
|
fi
|
|
|
|
if [ -z "$GPG_KEY_ID" ]; then
|
|
echo "Error: Please pass the full GPG Key ID as the second argument"
|
|
exit 1
|
|
fi
|
|
|
|
case "$GPG_KEY_ID" in
|
|
"D8BAD4DE7EE17AF52A834B2D0BB75829C2D4E821"|"9BD198A2D848C482E3550697A8580BDC82D3DC6C"|"E85FFA8E2E90B40B33ED39274FE13824E3FFC656") # Release keys
|
|
KEY_NAME=brave-core.asc
|
|
for pubkey in $(rpm -q gpg-pubkey --qf '%{NAME}-%{VERSION}-%{RELEASE}\t%{SUMMARY}\n'|grep "Brave Software <support@brave.com>"|awk '{ print $1 }'); do
|
|
sudo rpm -e $pubkey
|
|
done
|
|
gpg --export --armor "${GPG_KEY_ID}!" > $KEY_NAME
|
|
sudo rpm --import $KEY_NAME
|
|
;;
|
|
"9228DBCE20DDE5EC46488DE90B31DBA06A8A26F9") # Nightly key
|
|
KEY_NAME=brave-core-nightly.asc
|
|
for pubkey in $(rpm -q gpg-pubkey --qf '%{NAME}-%{VERSION}-%{RELEASE}\t%{SUMMARY}\n'|grep "Brave Core Nightly Key"|awk '{ print $1 }'); do
|
|
sudo rpm -e $pubkey
|
|
done
|
|
gpg --export --armor "${GPG_KEY_ID}!" > $KEY_NAME
|
|
sudo rpm --import $KEY_NAME
|
|
;;
|
|
*)
|
|
echo "Error! Unknown key passed in. Bailing out."
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
echo "%_signature gpg
|
|
%_gpg_path $HOME/.gnupg
|
|
%_gpg_name Brave Software
|
|
%_gpgbin /usr/bin/gpg" > ~/.rpmmacros
|
|
|
|
rm -rf "$TMP_REPO"
|
|
mkdir -pv "$TMP_REPO/x86_64"
|
|
for package in dist/*.rpm; do
|
|
if ! (rpm --checksig "$package" | grep "signatures OK$"); then
|
|
rpmsign --delsign "$package"
|
|
rpmsign --addsign --key-id="$GPG_KEY_ID!" "$package"
|
|
fi
|
|
done
|
|
|
|
# Ensure the rpm has the correct signature before continuing
|
|
# NOTE: rpm displays the short key id, all lower case
|
|
rpm -v -K dist/*.rpm | grep "key ID ${GPG_KEY_SHORT_ID,,}: OK"
|
|
|
|
cp dist/*.rpm "$TMP_REPO/x86_64/"
|
|
|
|
for arch in $TMP_REPO/x86_64 ; do
|
|
createrepo -v --deltas "$arch/"
|
|
createrepo -v --update --deltas "$arch/"
|
|
done
|
|
|
|
gpg --detach-sign --armor --local-user "${GPG_KEY_ID}!" ${TMP_REPO}/x86_64/repodata/repomd.xml
|
|
gpg --export --armor "${GPG_KEY_ID}!" | aws s3 cp --acl public-read - "s3://${S3_BUCKET}/${KEY_NAME}"
|
|
aws s3 sync --acl public-read "$TMP_REPO/" "s3://${S3_BUCKET}/"
|
|
|
|
# Remove temp dir
|
|
echo "Removing temp repository directory ${TMP_REPO}"
|
|
rm -rf ${TMP_REPO}
|