minisign-rotate (1471B)
- #!/bin/sh
- set -e
- reldir="/srv/web/hacktivis.me/releases/signify/"
- path_key="${HOME}/.minisign/minisign.key"
- path_pub="${HOME}/.minisign/minisign.pub"
- path_old_key="$(realpath "${path_key}")"
- date_old_key="$(basename "${path_old_key%.key}")"
- path_old_pub="$(realpath "${path_pub}")"
- date_old_pub="$(basename "${path_old_pub%.pub}")"
- if [ "${date_old_key}" != "${date_old_pub}" ]; then
- echo "Date mismatch between private-key(${date_old_key}) and public-key(${date_old_pub}), exiting..."
- exit 1
- fi
- date_old="${date_old_key}"
- # Only generate once to be sure, releases at new year can happen
- date_new="$(date +%Y)"
- path_new_key="${HOME}/.minisign/${date_new}.key"
- path_new_pub="${HOME}/.minisign/${date_new}.pub"
- path_new_pub_sig="${HOME}/.minisign/${date_new}.pub.${date_old}.sig"
- if [ "${path_new_key}" = "${path_old_key}" ]; then
- echo "Signify key is up-to-date"
- else
- echo "${PS4}${path_new_key} != ${path_old_key}"
- echo "Updating signify key, press enter to continue"
- set -x
- read foo
- # Generate new keyset (password needs to be inserted twice for confirmation)
- (pass show minisign; pass show minisign) | minisign -G -p "${path_new_pub}" -s "${path_new_key}"
- # Sign new pubkey with still current old key
- pass show minisign | minisign -S -x "${path_new_pub_sig}" -m "${path_new_pub}"
- # Update keys
- ln -sf "${path_new_key}" "${path_key}"
- ln -sf "${path_new_pub}" "${path_pub}"
- # Publish
- cp "${path_new_pub}" "${path_new_pub_sig}" "${reldir}"
- fi