jmq/Documentation
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

pkgmeek: tidy up the get_repo_key routine

Browse Source
This commit is contained in:
John McQuah 2023-02-24 08:56:27 -05:00
parent 0ddcfa250e
commit d3b4219e80
1 changed files with 16 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
scripts/pkgmeek
View File

@ -13,7 +13,7 @@ local errDL=0; local errUZ=0; local BSDTAR="/usr/bin/bsdtar --format=gnutar"
parse_options "$@" parse_options "$@"
# Exit early if refreshing an existing sha256 manifest was requested # Exit early if refreshing an existing sha256 manifest was requested
[ "$PKGMK_REFRESH_SIG" = "yes" ] && { make_signature refresh ; exit $?; } [ "$PKGMK_REFRESH_SIG" = "yes" ] && { make_signature refresh && info "signature refreshed."; exit $?; }
# #
# Read the Pkgfile to determine what to do next. But first ensure that # Read the Pkgfile to determine what to do next. But first ensure that
# it came from a trusted source (FS#1851) # it came from a trusted source (FS#1851)
@ -109,7 +109,7 @@ if [ "$PKGMK_UPDATE_FOOTPRINT" = "yes" ]; then
fi fi
# Updating signatures (option -us) requires only sources and footprint, not a built package. # Updating signatures (option -us) requires only sources and footprint, not a built package.
# As with -uf, exit after fulfilling the explicit request for a manifest. # As with -uf, exit after fulfilling the explicit request for a manifest.
[ "$PKGMK_UPDATE_SIG" = "yes" ] && { make_signature new; cleanup_work; exit $?; } [ "$PKGMK_UPDATE_SIG" = "yes" ] && { make_signature new && info "signature created."; cleanup_work; exit $?; }
# All the sources should be here by now, let's verify that we can trust them. # All the sources should be here by now, let's verify that we can trust them.
readonly cs_fail_msg="Use '--ignore-signature' to override, if you have determined integrity by other means." readonly cs_fail_msg="Use '--ignore-signature' to override, if you have determined integrity by other means."
@ -456,7 +456,7 @@ check_signature() { # called from $PKGMK_ROOT in the case "when"="pre-Pkgfile",
local reqfiles=(Pkgfile); local s=0; local when="$1"; local reqfiles=(Pkgfile); local s=0; local when="$1";
local SIGNIFY_ARGS=(-C -x "$PKGMK_ROOT/.signature") local SIGNIFY_ARGS=(-C -x "$PKGMK_ROOT/.signature")
[ "$PKGMK_PUBLICKEY" ] || PKGMK_PUBLICKEY=$(get_repo_key public) [ -n "$PKGMK_PUBLICKEY" ] || PKGMK_PUBLICKEY="$(get_repo_key public)"
if [ -f "$PKGMK_ROOT/.signature" ]; then if [ -f "$PKGMK_ROOT/.signature" ]; then
[ "$when" = "pre-Pkgfile" ] || reqfiles=(.footprint) [ "$when" = "pre-Pkgfile" ] || reqfiles=(.footprint)
while [ "$when" = "pre-build" ] && (( s < ${#_local_[@]} )); do while [ "$when" = "pre-build" ] && (( s < ${#_local_[@]} )); do
@ -466,7 +466,7 @@ check_signature() { # called from $PKGMK_ROOT in the case "when"="pre-Pkgfile",
for FILE in "${reqfiles[@]}"; do for FILE in "${reqfiles[@]}"; do
[ -e "$FILE" ] || ln -sf "$PKGMK_ROOT/$FILE" . [ -e "$FILE" ] || ln -sf "$PKGMK_ROOT/$FILE" .
done done
[ -f "$PKGMK_PUBLICKEY" ] && SIGNIFY_ARGS+=(-p "$PKGMK_PUBLICKEY") [ -r "$PKGMK_PUBLICKEY" ] && SIGNIFY_ARGS+=(-p "$PKGMK_PUBLICKEY")
/usr/bin/signify "${SIGNIFY_ARGS[@]}" "${reqfiles[@]}" 2>&1 /usr/bin/signify "${SIGNIFY_ARGS[@]}" "${reqfiles[@]}" 2>&1
else else
[ "$when" = "pre-Pkgfile" ] && echo "Pkgfile verification failed" [ "$when" = "pre-Pkgfile" ] && echo "Pkgfile verification failed"
@ -475,23 +475,23 @@ check_signature() { # called from $PKGMK_ROOT in the case "when"="pre-Pkgfile",
} }
get_repo_key() { get_repo_key() {
local typ="${1:0:3}" local typ="${1:0:3}"; local REPO;
for key in "/etc/ports/*.$typ" "$HOME/.ssh/*.$typ"; do REPO=$(dirname "$PKGMK_ROOT"); REPO=$(basename -s .git "$REPO");
[ -e "$key" ] || continue ls "/etc/ports/$REPO.$typ" 2>/dev/null \
REPO="$(dirname "$PWD")"; REPO="$(basename -s .git "$REPO")"; || ls "$HOME/.ssh/$REPO.$typ" 2>/dev/null
[ "$REPO" = "$(basename -s ".$typ" "$key")" ] && { echo "$key"; break; }
done
} }
make_signature() { make_signature() {
local ordered si pub local ordered si pub
[ -w "$PKGMK_ROOT/.signature" ] || { error ".signature not writable."; return $E_DIRPERM; } [ -w "$PKGMK_ROOT/.signature" ] || { error ".signature not writable."; return $E_DIRPERM; }
[ "$PKGMK_PRIVATEKEY" ] || PKGMK_PRIVATEKEY="$(get_repo_key secret)" [ -n "$PKGMK_PRIVATEKEY" ] || PKGMK_PRIVATEKEY="$(get_repo_key secret)"
[ -r "$PKGMK_PRIVATEKEY" ] && \ if [ -n "$PKGMK_PRIVATEKEY" ]; then
pub="/etc/ports/$(basename -s ".sec" "$PKGMK_PRIVATEKEY").pub" || \ pub="/etc/ports/$(basename -s .sec "$PKGMK_PRIVATEKEY").pub"
{ error "No suitable secret key found. Specify one explicitly with '-sk'."; else
return $E_SIGNATURE; } error "No suitable secret key found. Specify one explicitly with '-sk'."
return $E_SIGNATURE
fi
# create a new .signature, or refresh an existing manifest? # create a new .signature, or refresh an existing manifest?
case "$1" in case "$1" in
@ -516,7 +516,7 @@ make_signature() {
{ error "missing .signature, cannot refresh."; return $E_SIGNATURE; } { error "missing .signature, cannot refresh."; return $E_SIGNATURE; }
if tail -n +3 ".signature" | /usr/bin/signify -S -e -x - -q \ if tail -n +3 ".signature" | /usr/bin/signify -S -e -x - -q \
-s "$PKGMK_PRIVATEKEY" -m - > .signature.tmp; then -s "$PKGMK_PRIVATEKEY" -m - > .signature.tmp; then
mv .signature.tmp .signature; info "Signature refreshed." mv .signature.tmp .signature
else else
rm .signature.tmp; return $E_SIGNATURE rm .signature.tmp; return $E_SIGNATURE
fi fi