49 lines
1.0 KiB
Bash
Executable File
49 lines
1.0 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
set -euo pipefail
|
|
|
|
if [[ $# -ne 1 ]]; then
|
|
echo "usage: omarchy-iso-sign [release/omarchy.iso]"
|
|
exit 1
|
|
fi
|
|
|
|
iso="$1"
|
|
key_ref="op://Shared/Omarchy GPG Private Key/omarchy-private.asc"
|
|
|
|
if [[ ! -f $iso ]]; then
|
|
echo "ISO not found: $iso" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! command -v op >/dev/null; then
|
|
echo "1Password CLI is required to retrieve the signing key." >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! pacman -Q gnupg >/dev/null 2>&1; then
|
|
sudo pacman -S --noconfirm --needed --quiet gnupg
|
|
fi
|
|
|
|
gnupg_home="$(mktemp -d)"
|
|
chmod 700 "$gnupg_home"
|
|
trap 'rm -rf "$gnupg_home"' EXIT
|
|
|
|
op read "$key_ref" --account Omarchy |
|
|
gpg --batch --homedir "$gnupg_home" --import >/dev/null
|
|
|
|
signing_key="$(
|
|
gpg --batch --homedir "$gnupg_home" --with-colons --list-secret-keys |
|
|
awk -F: '$1 == "fpr" { print $10; exit }'
|
|
)"
|
|
|
|
if [[ -z $signing_key ]]; then
|
|
echo "No private signing key found in $key_ref" >&2
|
|
exit 1
|
|
fi
|
|
|
|
gpg --batch --yes \
|
|
--homedir "$gnupg_home" \
|
|
--local-user "$signing_key" \
|
|
--output "$iso.sig" \
|
|
--detach-sig "$iso"
|