Download public keys by fingerprint in travis
The uid and fingerprint are more legible than the full key, which should make future changes easier to review. The keys are used by Travis only to validate that a git tag was signed with a recognised key. The results of the build are signed separately. You can confirm the fingerprints in .travis.yml match the ones in the by running this on the old packaging/gpg.keys: gpg --import-options show-only --import packaging/gpg.keys
Philip Whineray committed
Aug 12, 2018 at 10:13 UTC
e60274499c794f56b961459f8777f5e024921f31
4 files changed
+69
-69
.travis.yml
+4
-1
@@ -31,10 +31,13 @@ before_install:
31
- if [[ "$TRAVIS_OS_NAME" == "osx" ]]; then brew install fakeroot; fi
32
- if [[ "$TRAVIS_OS_NAME" == "osx" ]]; then brew install ossp-uuid; fi
33
- if [[ "$TRAVIS_OS_NAME" == "osx" ]]; then brew install xz; fi
34
+ - export KEYSERVER=ipv4.pool.sks-keyservers.net
35
#
36
# Run
37
before_script:
37
- - gpg --import packaging/gpg.keys
38
+ # Download keys - builds of tags check for a recognised signature
39
+ - ./packaging/gpg-recv-key phil@firehol.org "9CCE 9A8D 5328 FBD6 CE29 6DCC 63DF 1E44 D829 797E"
40
+ - ./packaging/gpg-recv-key costa@tsaousis.gr "4DFF 624A E564 3B51 2872 1F40 29CA 3358 89B9 A863"
41
# Run the commit hooks in case the developer didn't
42
- git diff 4b825dc642cb6eb9a060e54bf8d69288fbee4904 | ./packaging/check-files -
43
script:
packaging/README.md
-3
@@ -18,9 +18,6 @@ and post-release update.
18
Programs and packages with specific needs should create extra
19
`whatever.functions` and supporting scripts in a subdirectory.
20
21
-The `gpg.keys` file is a list of keys that can be expected to sign
22
-tags and packages.
23
-
21
Making a release
22
----------------
23
`
packaging/gpg-recv-key
new
+65
@@ -0,0 +1,65 @@
1
+#!/bin/sh
2
+
3
+if [ ! "$KEYSERVER" ]
4
+then
5
+ echo "No KEYSERVER environment set, e.g.:"
6
+ echo " export KEYSERVER=hkps://hkps.pool.sks-keyservers.net"
7
+ exit 1
8
+fi
9
+
10
+debug=""
11
+if [ "$debug" ]
12
+then
13
+ if [ ! "$GNUPGHOME" ]
14
+ then
15
+ echo "No GNUPGHOME environment set, e.g.:"
16
+ echo " export GNUPGHOME=$HOME/.gnupg"
17
+ exit 1
18
+ fi
19
+
20
+ if [ ! -d "$GNUPGHOME" ]
21
+ then
22
+ mkdir -p "$GNUPGHOME"
23
+ chmod 700 "$GNUPGHOME"
24
+ fi
25
+fi
26
+
27
+keyuid="$1"
28
+fingerprint="$2"
29
+
30
+# Modern GPG can import key by fingerprint but the version available
31
+# within travis currently does not, so we extract the short version and
32
+# check it matches manually
33
+key=`echo $fingerprint | cut -f7-10 -d' ' | tr -d ' '`
34
+
35
+gpg --keyserver "$KEYSERVER" --recv-key "$key" || exit 1
36
+gpg --fingerprint "$key" > /tmp/keystatus.$$
37
+status=$?
38
+
39
+cat /tmp/keystatus.$$
40
+if [ $status -ne 0 ]
41
+then
42
+ rm -f /tmp/keystatus.$$
43
+ exit 2
44
+fi
45
+
46
+if ! grep -q "^uid.*<$keyuid>" /tmp/keystatus.$$
47
+then
48
+ rm -f /tmp/keystatus.$$
49
+ echo "Did not find expected uid $keyuid"
50
+ exit 3
51
+fi
52
+
53
+echo "uid looks good"
54
+
55
+if ! grep -q " $fingerprint$" /tmp/keystatus.$$
56
+then
57
+ rm -f /tmp/keystatus.$$
58
+ echo "Did not find expected fingerprint $fingerprint"
59
+ exit 3
60
+fi
61
+
62
+echo "Fingerprint looks good"
63
+
64
+rm -f /tmp/keystatus.$$
65
+exit 0
packaging/gpg.keys
deleted
-65
@@ -1,65 +0,0 @@
1
------BEGIN PGP PUBLIC KEY BLOCK-----
2
-
3
-mQENBE/SZE8BCAC2tGkIFG2jYmtO7X/SFzqAlgWd4iW3ZSpjAki5Z9PGMIkaOFgL
4
-fnNrQV/il4mMUzmvetgV9ShA288JT6KLT4lnL/lHCgxY9dJgzXfOrHxxlXQNU7i4
5
-XWRO+96aNysFjVJPsjRv+51836OV+w+TvE495zG7YNUUcWVAqsc49WPyt1Bm4Bsw
6
-X8fG7NggsV7wA+bMV/CzRAbiXSkJYKVn+GQk1wRYwR6YlpsZ22EKR2rEUxCc4CwN
7
-75mo9nY3cUKJfFvR7xg1rG6tLwLgv4/SSXbtHPfdKce6dmNWJjwTv8iAZxJUGM1D
8
-lhAWCl/ZnGIRBf7KDsxk6NCODenDEZvOoxKTABEBAAG0IVBoaWwgV2hpbmVyYXkg
9
-PHBoaWxAc2FuZXdhbGwub3JnPokBOAQTAQIAIgUCT9JkTwIbAwYLCQgHAwIGFQgC
10
-CQoLBBYCAwECHgECF4AACgkQY98eRNgpeX4//QgAtCvArmgn/Mt6IJmx8mowPpJz
11
-Rv6ErwYgBkVRxd87yFHZDV2DX+BjhuD5k8e3/z+1GqwrUCR/+svLsb5e6s9ISSES
12
-A68xlBNLG8sfZHm4CMEN63lqZsoiMposNUTOa2NY53qYNy8oDmNkjrfIkeKdTeUB
13
-w8atfFGWe8PZMhaxFox/acQfleyTKPIjfzHGoFvgs7nmYdfFHiFBh5hc+mEI+S+z
14
-Ao9CVoT3MzyANhJJLINGcQVdexRfvv4210euHQIH2NClRv3qo5cZmeo9DyLdGU9T
15
-wkAosRNflxciap5hyQvK/Z9pRAPzOR5SnpJj+Daa+Xslq5j61uUdEeMsI2dTv7Qg
16
-UGhpbCBXaGluZXJheSA8cGhpbEBmaXJlaG9sLm9yZz6JATgEEwECACIFAlZIrFYC
17
-GwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEGPfHkTYKXl+Hh4H/RkLQui0
18
-mKwLAq4+aLEJu3yCgFdpQPYFZFYw7fGKcrw92g8pnoY5V43yNaJMiJFkYrHv/UqN
19
-k0A2v/JIOKBXfe1YWakSIirrNMBMFwBUup4X7losPcAxF8K3Vtuo8PR/c2QF8UZB
20
-xkB3oPr/4DCBUKKYnk1g+yozfnqut7UNFKPZLWcNCcfy+ueLTmfzGg2CDGvsuY7m
21
-uXARkY7/h3YptJrRXkmBM8A1g3+Pia90RaJASR9W1LRiPVVb8M0pqVPeeccw1FNq
22
-yxrZzJl967T5gIWzRZ8ASvhJc/RMxeA6BCfqGp6ehGUgGVb2dlOHQkU9fu6l+4NG
23
-9sNAzAEkFe2Gdfq5AQ0ET9JkTwEIAOfdWdtPzHRgRLw0uEegoocn47exFoacgEGP
24
-xi5OFSnDY1IxckvpNap1bshvPQGPtA/p/K33NvX8hZzhk6YGgPzHh0b04GRFQFRC
25
-TspjjDk8poSuX8JiWnL1jzluFpriV8X7j1pos9fdIS0gQMBAHFTeGJooAfopZAoy
26
-8GycXUNBOiuLG4Eihbqq3E1BnDVdr5HIJKrMV2RisyukL5GYNbSp0l1DIAurYEbN
27
-AoUMK/9qe/6iSiX0VMgpXJpVZyFJhI6Z+/7Na0WPN4jjLgva+6g/eo8HPzKZOTak
28
-lhInBr9+5rl9uA8P1LqYwg0oshK/2LYF+STqfrzcRGldXajd6G0AEQEAAYkBHwQY
29
-AQIACQUCT9JkTwIbDAAKCRBj3x5E2Cl5frptB/4z7KzQV9X0vR6NdRVHWFnaAuFW
30
-gzIefG+XZR9xS4Wgc9pEMRs5ZR1bRbHWd2yNiBckajHOOSYdRD2ECMlCYrBhmH0M
31
-ep3vS9ly2rJRlgeFeNUdXtu0+XVdZGFsULlW2Kcb2Pv/UvOnmEppL1caAfEAMMjw
32
-Nc2QIKPYEyMLVQ/x7x61/RRqIuwSZL4xVAjrMic9m/gpsnwB+pxwmT2h3+BDF/gY
33
-jOz4YFWYV1HDYu1EFRmtpsnpuSC7xiMN92RNkBsdXLeXSkNqxLbqEISx37NFxcCy
34
-5pz0AytWpZNyYql2RWfiWWQa8TDjPeufxxd0+87OpJ6eHrRtpTRMsbdnC21s
35
-=fY8a
36
------END PGP PUBLIC KEY BLOCK-----
37
------BEGIN PGP PUBLIC KEY BLOCK-----
38
-
39
-mQENBFbxoXsBCADm7C+gJkjU10vpMkmB9LP2HuJrzzvCuOLeaFKB0wM0y3seNvKJ
40
-VSeNg76Db4gCZ0Fw8eBk3V49cnjPqtHqB6fBlx3zyu9jcN6RQLO+sLZy7xrqwZkx
41
-Lox+D/iBU97wXDudVE3Li4J04goBH8NsQ/bf41H6ZEhLWO3xM4mrwb1BNhyC7+Hm
42
-O0wkCNHe2P+Vf7Vss3FZ6ZPAynLOvFHHE2W0mAV0fA79Pe/nbA7kP6CueyxKLsFR
43
-xGavRir+19WSFq19xzMg1S4pDGOqm4PBnJvwlwjFz/4yIn0uSoaFtuJIfDvYTgFh
44
-XZJFR8sV/0AbZLybKsCv9pEgYlm1oeiQSk77ABEBAAG0IkNvc3RhIFRzYW91c2lz
45
-IDxjb3N0YUB0c2FvdXNpcy5ncj6JATkEEwEIACMFAlbxoXsCGwMHCwkIBwMCAQYV
46
-CAIJCgsEFgIDAQIeAQIXgAAKCRApyjNYibmoY1RPB/9o8azh6siD7VsHWjaMStBU
47
-alSa9nyGIinZzmb2u94VzdPUF0ZW08HI++I37HoAIQmXEa1oUtNK4D6pUYhrJpL6
48
-NnOVVhfFbJH1Siwl1v0dqpNqKmcJ0oUvHEHsKfGWBGqqQCFE4bnDmyayedunzoUV
49
-aXnUt+3dTD8hwOcicKQ1CID2rT8QvEoSv4jIGqks8t+Dnvp0Gx8bKvxF2CYfEQlr
50
-LxZbXrjloXQR4IaAjv/Wxpghl0RXslXIx6yRiHYu4QavBDYvL9iZ2168eIUiRiUD
51
-xkT38N6Itj/YfhBjW+ZXHF73UeGwFlYjagJM7YG3dKrB31OsUdch9leBcw2satmA
52
-uQENBFbxoXsBCADC+y/ZuxxKn742DYoXX6BvedjNwdrs5swEWrg4JnzdXRAW8g5D
53
-6YkPlfQ56ov7yXuOAjTgU4vMA0OjI0JN1DrR9ZmsyvmOtQq9+mZMZLFeFSPYXDRa
54
-0EuBFs6m2V0kq5sfFqcsItC6RSQu0mTu+1HmOmrat2o4XZXhT5Jr/QXQ6ShHkWmm
55
-823y4XBOxHzDRD6NfZKJbiWfLkmS5Ojza2pOp6otxlLmsknQrEe8V2mHNjiJntMv
56
-cSv9tJO6EnN613eo/IDejz9mrGJURbu/hTWHX00ONYmwfOmCtF4nPMyh85B3NSTF
57
-JhORjziEGt4lnOPV6G0vK1hlD2kwmZ48tLy3ABEBAAGJAR8EGAEIAAkFAlbxoXsC
58
-GwwACgkQKcozWIm5qGPD7Af+Pg398YBVnYW/ze5pGDd/IEPhmUp/mSRu2nU9pZXa
59
-k30eItf3Cd5JfYIKBFgeOlEx8hb0bXU2OReb1bUpT9aAW7h7YW2F9tjm1gBPdtD4
60
-iO9jBiNbI6wvUwPsW95f7BMKlh9tO71MmFpghKD5Dougl9X8LmXUa35PDrJxcXAi
61
-BaLXcrdqjxB/6r+0RFHYzr/JgMCgenu7DQMHUi0P7P+uMbhZwMuVvAtUIgbb8Vw3
62
-WQ6cJBbrwiAWwVjF1JauFdB8Oy/fm7k1TTein9nWXF1tZ/OTdUDriqktHbkSVjvN
63
-SKW3nD2RpZ4F5Pa3uNcK9lcbBfM126HCzybjZHZntcyvSA==
64
-=7nny
65
------END PGP PUBLIC KEY BLOCK-----