update-keys 2.71 KB
Newer Older
1
#!/bin/bash
David Runge's avatar
David Runge committed
2
3
#
# SPDX-License-Identifier: GPL-3.0-or-later
4

Christian Hesse's avatar
Christian Hesse committed
5
6
set -e

7
8
export LANG=C

9
10
11
TMPDIR=$(mktemp -d)
trap "rm -rf '${TMPDIR}'" EXIT

12
KEYSERVER='hkp://pool.sks-keyservers.net'
13
14
15
16
17
18
19
GPG=(gpg --homedir "${TMPDIR}")

cat << __EOF__ > "${TMPDIR}"/gpg.conf
quiet
batch
no-tty
no-permission-warning
20
export-options no-export-attributes,export-clean
21
keyserver ${KEYSERVER}
22
keyserver-options no-self-sigs-only
23
24
armor
no-emit-version
25
__EOF__
26

27
cd "$(dirname "$0")"
28

Eli Schwartz's avatar
Eli Schwartz committed
29
"${GPG[@]}" --gen-key <<EOF
30
%echo Generating Arch Linux keyring temporary master key...
31
Key-Type: RSA
32
Key-Length: 2048
33
Key-Usage: sign
34
Name-Real: Arch Linux keyring temporary master key
35
36
Name-Email: archlinux-keyring@localhost
Expire-Date: 0
Pierre Schmitz's avatar
Pierre Schmitz committed
37
%no-protection
38
39
40
41
%commit
%echo Done
EOF

Eli Schwartz's avatar
Eli Schwartz committed
42
"${GPG[@]}" --import < archlinux.gpg
43

Bartłomiej Piotrowski's avatar
Bartłomiej Piotrowski committed
44
45
rm -rf master{,-revoked} packager{,-revoked} archlinux-{trusted,revoked}
mkdir master packager master-revoked packager-revoked
46

Christian Hesse's avatar
Christian Hesse committed
47
# refresh/receive all keys
48
49
50
while read -ra data; do
	keyid="${data[0]}"
	username="${data[@]:1}"
Eli Schwartz's avatar
Eli Schwartz committed
51
52
	if "${GPG[@]}" --list-keys ${keyid} >/dev/null &>/dev/null; then
		"${GPG[@]}" --refresh-keys ${keyid} &>/dev/null
Christian Hesse's avatar
Christian Hesse committed
53
	else
Eli Schwartz's avatar
Eli Schwartz committed
54
		"${GPG[@]}" --recv-keys ${keyid} &>/dev/null
Christian Hesse's avatar
Christian Hesse committed
55
56
57
58
59
60
61
	fi
done < <(cat master-keyids master-revoked-keyids packager-keyids packager-revoked-keyids)

# master-keyids
while read -ra data; do
	keyid="${data[0]}"
	username="${data[@]:1}"
Eli Schwartz's avatar
Eli Schwartz committed
62
	"${GPG[@]}" --yes --lsign-key ${keyid} &>/dev/null
Christian Hesse's avatar
Christian Hesse committed
63
	"${GPG[@]}" --comment "master-key: ${username} (${keyid})" --export ${keyid} >> master/${username}.asc
64
	echo "${keyid}:4:" >> archlinux-trusted
65
done < master-keyids
Eli Schwartz's avatar
Eli Schwartz committed
66
"${GPG[@]}" --import-ownertrust < archlinux-trusted 2>/dev/null
67

Christian Hesse's avatar
Christian Hesse committed
68
# master-revoked-keyids
Bartłomiej Piotrowski's avatar
Bartłomiej Piotrowski committed
69
70
71
while read -ra data; do
	keyid="${data[0]}"
	username="${data[1]}"
Christian Hesse's avatar
Christian Hesse committed
72
	"${GPG[@]}" --comment "revoked master-key: ${username} (${keyid})" --export ${keyid} >> master-revoked/${username}.asc
Christian Hesse's avatar
Christian Hesse committed
73
	echo "${keyid}" >> archlinux-revoked
Bartłomiej Piotrowski's avatar
Bartłomiej Piotrowski committed
74
75
done < master-revoked-keyids

Christian Hesse's avatar
Christian Hesse committed
76
# packager-keyids
77
78
79
while read -ra data; do
	keyid="${data[0]}"
	username="${data[@]:1}"
Eli Schwartz's avatar
Eli Schwartz committed
80
	if ! "${GPG[@]}" --list-keys --with-colons ${keyid} 2>/dev/null | grep -q '^pub:f:'; then
81
82
		echo "WARNING: key is not fully trusted: ${keyid} ${username}"
		"${GPG[@]}" --comment "marginal trust: ${username} (${keyid})" --export ${keyid} >> packager/${username}.asc
83
	else
Christian Hesse's avatar
Christian Hesse committed
84
		"${GPG[@]}" --comment "packager: ${username} (${keyid})" --export ${keyid} >> packager/${username}.asc
85
86
87
	fi
done < packager-keyids

Christian Hesse's avatar
Christian Hesse committed
88
# packager-revoked-keyids
Pierre Schmitz's avatar
Pierre Schmitz committed
89
90
91
while read -ra data; do
	keyid="${data[0]}"
	username="${data[1]}"
Christian Hesse's avatar
Christian Hesse committed
92
	"${GPG[@]}" --comment "revoked packager: ${username} (${keyid})" --export ${keyid} >> packager-revoked/${username}.asc
Christian Hesse's avatar
Christian Hesse committed
93
	echo "${keyid}" >> archlinux-revoked
Pierre Schmitz's avatar
Pierre Schmitz committed
94
95
done < packager-revoked-keyids

Bartłomiej Piotrowski's avatar
Bartłomiej Piotrowski committed
96
cat master/*.asc master-revoked/*.asc packager/*.asc packager-revoked/*.asc > archlinux.gpg