1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
|
#!/bin/bash
# Copyright (c) 2008 Jonathan McDowell <noodles@earth.li>
# GNU GPL; v2 or later
# Adds a new key to a keyring directory
set -e
if [ -z "$1" ] || [ -z "$2" ]; then
echo "Usage: add-key keyfile dir" >&2
echo "Or: add-key fingerprint dir" >&2
exit 1
fi
# avoid gnupg touching ~/.gnupg
GNUPGHOME=$(mktemp -d -t jetring.XXXXXXXX)
export GNUPGHOME
trap cleanup exit
cleanup () {
rm -rf "$GNUPGHOME"
}
if echo -n "$1" | egrep -q '^[[:xdigit:]]{40}$'; then
fpr=$1
keyserver=${KEYSERVER:=pool.sks-keyservers.net}
keyfile=$(mktemp -p $GNUPGHOME newkyXXXXXX)
echo "Retrieving key $fpr from keyserver $keyserver"
gpg --keyserver $keyserver --recv-key "$fpr"
gpg --export "$fpr" > $keyfile
else
keyfile=$(readlink -f "$1") # gpg works better with absolute keyring paths
fi
keydir="$2"
basename=$(basename "$keyfile")
date=`date -R`
if [ -f $keyfile ]; then
keyid=$(gpg --with-colons --keyid long --options /dev/null --no-auto-check-trustdb < $keyfile | grep '^pub' | cut -d : -f 5)
else
keyid=${1: -16:16}
fi
for keyring in *-pgp/; do
if [ -e $keyring/0x$keyid ]; then
echo "0x$keyid already exists in $keyring - existing key or error."
exit 1
fi
done
# Check we have our keyrings available for checking the signatures
if [ ! -e output/keyrings/debian-keyring.pgp ]; then
make
fi
if [ -f $keyfile ]; then
gpg --quiet --import $keyfile
else
gpg --quiet --keyserver the.earth.li --recv-key $1 || true
gpg --quiet --keyserver pgp.mit.edu --recv-key $1 || true
gpg --quiet --keyserver keyserver.ubuntu.com --recv-key $1 || true
gpg --quiet --keyserver the.earth.li --send-key $1
fi
gpg --keyring output/keyrings/debian-keyring.pgp \
--keyring output/keyrings/debian-nonupload.pgp --check-sigs \
--with-fingerprint --keyid-format 0xlong 0x$keyid | \
sensible-pager
echo "We want signatures from at least two other DDs."
echo "If this is a key transition, we also want a signature from the DD's old key."
echo "Are you sure you want to update this key? (y/n)"
read n
if ( echo $keydir | egrep -q '^(\./)?debian-keyring-pgp/?$' ); then
dest=DD
elif ( echo $keydir | egrep -q '^(\./)?debian-nonupload-pgp/?$' ); then
dest=DN
elif ( echo $keydir | egrep -q '^(\./)?debian-maintainers-pgp/?$' ); then
dest=DM
fi
if [ "x$n" = "xy" -o "x$n" = "xY" ]; then
gpg --no-auto-check-trustdb --options /dev/null \
--keyring output/keyrings/debian-keyring.pgp \
--keyring output/keyrings/debian-nonupload.pgp \
--keyring output/keyrings/debian-maintainers.pgp \
--export-options export-clean,no-export-attributes \
--export $keyid > $keydir/0x$keyid
git add $keydir/0x$keyid
echo -n "Enter full name of new key: "
read name
echo -n 'RT issue ID this change closes, if any: '
read rtid
if [ "$dest" = DD -o "$dest" = DN ]; then
echo -n "Enter Debian login of new key: "
read login
echo "0x$keyid $name <$login>" >> keyids
sort keyids > keyids.$$ && mv keyids.$$ keyids
git add keyids
fi
log="Add new $dest key 0x${fpr:24:16} ($name) (RT #$rtid)"
VERSION=$(head -1 debian/changelog | awk '{print $2}' | sed 's/[\(\)]//g')
RELEASE=$(head -1 debian/changelog | awk '{print $3}' | sed 's/;$//')
case $RELEASE in
UNRELEASED)
dch --multimaint-merge -D UNRELEASED -a "$log"
;;
unstable)
NEWVER=$(date +%Y.%m.xx)
if [ "$VERSION" = "$NEWVER" ]
then
echo '* Warning: New version and previous released version are'
echo " the same: $VERSION. This should not be so!"
echo ' Check debian/changelog'
fi
dch -D UNRELEASED -v $NEWVER "$log"
;;
*)
echo "Last release $VERSION for unknown distribution «$RELEASE»."
echo "Not calling dch, do it manually."
;;
esac
git add debian/changelog
cat > git-commit-template <<EOF
$log
Action: add
Subject: $name
Username: $login
Role: $dest
Key: $fpr
Key-type:
RT-Ticket: $rtid
Request-signed-by:
Key-certified-by:
Details:
EOF
else
echo "Not adding key."
exit 1
fi
|
