dotfiles

minisign-rotate (1471B)

#!/bin/sh
set -e
reldir="/srv/web/hacktivis.me/releases/signify/"
path_key="${HOME}/.minisign/minisign.key"
path_pub="${HOME}/.minisign/minisign.pub"
path_old_key="$(realpath "${path_key}")"
date_old_key="$(basename "${path_old_key%.key}")"
path_old_pub="$(realpath "${path_pub}")"
date_old_pub="$(basename "${path_old_pub%.pub}")"
if [ "${date_old_key}" != "${date_old_pub}" ]; then
	echo "Date mismatch between private-key(${date_old_key}) and public-key(${date_old_pub}), exiting..."
	exit 1
fi
date_old="${date_old_key}"
# Only generate once to be sure, releases at new year can happen
date_new="$(date +%Y)"
path_new_key="${HOME}/.minisign/${date_new}.key"
path_new_pub="${HOME}/.minisign/${date_new}.pub"
path_new_pub_sig="${HOME}/.minisign/${date_new}.pub.${date_old}.sig"
if [ "${path_new_key}" = "${path_old_key}" ]; then
	echo "Signify key is up-to-date"
else
	echo "${PS4}${path_new_key} != ${path_old_key}"
	echo "Updating signify key, press enter to continue"
	set -x
	read foo
	# Generate new keyset (password needs to be inserted twice for confirmation)
	(pass show minisign; pass show minisign) | minisign -G -p "${path_new_pub}" -s "${path_new_key}"
	# Sign new pubkey with still current old key
	pass show minisign | minisign -S -x "${path_new_pub_sig}" -m "${path_new_pub}"
	# Update keys
	ln -sf "${path_new_key}" "${path_key}"
	ln -sf "${path_new_pub}" "${path_pub}"
	# Publish
	cp "${path_new_pub}" "${path_new_pub_sig}" "${reldir}"
fi