blob: fe127a8b20e4a4450b6321b5106a2ff529cc3efd (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
|
#!/bin/sh
set -e
errx() {
printf '%s\n' "$*" >&2
exit 1
}
usage() {
errx 'usage: git sign-for-cgit [-f format] <object>\n'
}
seckey=${SIGNIFY_SECKEY:-$HOME/.signify/release.sec}
format="$(git config --get package.format)"
: "${format:=tar.gz}"
while getopts f: opt; do
case $opt in
f) format=$OPTARG;;
?) usage;;
esac
done
shift $((OPTIND - 1))
test $# -eq 1 || usage
git archive -l | grep -Fqx "$format" || errx "fatal: unknown format"
name=$(basename "$(git rev-parse --show-toplevel)")
object=$1
tmpdir=$(mktemp -d --suffix .sign-for-cgit)
# We do want to expand tmpdir now rather than later,
# and mktemp should give us a path without spaces.
# shellcheck disable=SC2064
trap "{ rm -r $tmpdir; }" EXIT
archive_base=$name-$object.$format
archive_path=$tmpdir/$archive_base
git archive --prefix="$name-$object/" -o "$archive_path" -- "$object"
(
cd "$tmpdir"
sha256sum --tag "$archive_base" > "${archive_base}.SHA256"
signify -Ses "$seckey" -m "${archive_base}.SHA256"
)
id=$(git hash-object -w "${archive_path}.SHA256.sig")
# do not use exec here because otherwise the EXIT trap will not fire
git notes --ref="refs/notes/signatures/$format" add -C "$id" "$object"
|
