blob: 6dc3601e59172fd1cf8150fdbd252389262de370 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
|
#!/bin/bash
export LANG=C
TMPDIR=$(mktemp -d)
trap "rm -rf '${TMPDIR}'" EXIT
KEYSERVER='hkp://keys.gnupg.net'
GPG_OPTIONS='--quiet --batch --no-tty --no-permission-warning'
GPG="gpg ${GPG_OPTIONS} --keyserver "${KEYSERVER}" --homedir ${TMPDIR}"
pushd "$(dirname "$0")" >/dev/null
$GPG --gen-key <<EOF
%echo Generating Arch Linux 32 Keyring keychain master key...
Key-Type: RSA
Key-Length: 1024
Key-Usage: sign
Name-Real: Arch Linux 32 Keyring Keychain Master Key
Name-Email: archlinux32-keyring@localhost
Expire-Date: 0
%no-protection
%no-ask-passphrase
%commit
%echo Done
EOF
rm -rf master master-revoked packager packager-revoked archlinux32-trusted archlinux32-revoked
mkdir master master-revoked packager packager-revoked
while read -ra data; do
keyid="${data[0]}"
username="${data[@]:1}"
${GPG} --recv-keys ${keyid} &>/dev/null
gpg ${GPG_OPTIONS} -a --export ${keyid} </dev/null | \
${GPG} --import &>/dev/null
ssh buildmaster "gpg ${GPG_OPTIONS} -a --export ${keyid}" </dev/null | \
${GPG} --import &>/dev/null
printf 'minimize\nquit\ny\n' | \
${GPG} --command-fd 0 --edit-key ${keyid}
${GPG} --yes --lsign-key ${keyid} &>/dev/null
${GPG} --armor --no-emit-version --export ${keyid} >> master/${username}.asc
echo "${keyid}:4:" >> archlinux32-trusted
done < master-keyids
${GPG} --import-ownertrust < archlinux32-trusted 2>/dev/null
while read -ra data; do
keyid="${data[0]}"
${GPG} --recv-keys ${keyid} &>/dev/null
gpg ${GPG_OPTIONS} -a --export ${keyid} | \
${GPG} --import &>/dev/null
ssh buildmaster "gpg ${GPG_OPTIONS} -a --export ${keyid}" | \
${GPG} --import &>/dev/null
done < packager-keyids
while read -ra data; do
keyid="${data[0]}"
username="${data[@]:1}"
printf 'clean\nquit\ny\n' | \
${GPG} --command-fd 0 --edit-key ${keyid}
if ! ${GPG} --list-keys --with-colons ${keyid} 2>/dev/null | grep -q '^pub:f:'; then
echo "key is not fully trusted: ${keyid} ${username}"
else
${GPG} --armor --no-emit-version --export ${keyid} >> packager/${username}.asc
fi
done < packager-keyids
touch archlinux32-revoked
while read -ra data; do
keyid="${data[0]}"
username="${data[2]}"
${GPG} --recv-keys ${keyid} &>/dev/null
gpg ${GPG_OPTIONS} -a --export ${keyid} | \
${GPG} --import &>/dev/null
ssh buildmaster "gpg ${GPG_OPTIONS} -a --export ${keyid}" | \
${GPG} --import &>/dev/null
printf 'clean\nquit\ny\n' | \
${GPG} --command-fd 0 --edit-key ${keyid}
if ! ${GPG} --list-keys --with-colons ${keyid} 2>/dev/null | grep -q '^pub:f:'; then
${GPG} --armor --no-emit-version --export ${keyid} >> packager-revoked/${username}.asc
echo "${keyid}" >> archlinux32-revoked
else
echo "key is still fully trusted: ${keyid} ${username}"
fi
done < packager-revoked-keyids
while read -ra data; do
keyid="${data[0]}"
username="${data[2]}"
${GPG} --recv-keys ${keyid} &>/dev/null
gpg ${GPG_OPTIONS} -a --export ${keyid} | \
${GPG} --import &>/dev/null
ssh buildmaster "gpg ${GPG_OPTIONS} -a --export ${keyid}" | \
${GPG} --import &>/dev/null
printf 'clean\nquit\ny\n' | \
${GPG} --command-fd 0 --edit-key ${keyid}
if ! ${GPG} --list-keys --with-colons ${keyid} 2>/dev/null | grep -q '^pub:f:'; then
${GPG} --armor --no-emit-version --export ${keyid} >> master-revoked/${username}.asc
echo "${keyid}" >> archlinux32-revoked
else
echo "key is still fully trusted: ${keyid} ${username}"
fi
done < master-revoked-keyids
cat master/*.asc master-revoked/*.asc packager/*.asc packager-revoked/*.asc > archlinux32.gpg
popd >/dev/null
|