sign

#!/bin/sh -e
#
# Do a DOSS signing with a container from GHCR.
#
#BEGIN-HELP
# Usage:  sign [ OPTIONS ] REPO-PATH [ KEY-NAME ]
#
# Arguments (see README.md for more information):
#     REPO-PATH is the path to a built repository
#     KEY_NAME is the name of the key to use in signing
#
# Options:
#     --keyring K       Use the GPG keyring in directory K (default is
#                       (~/.gnupg)
#     --passphrase P    Path to a file containing key passphrase.  If not
#                       provided, it will be assumed that the key has no
#                       passphrase.
#
#END-HELP
#

set -e

WHOAMI=$(basename "$0")

die()
{
    echo "$@" 1>&2
    exit 1
}


self_help()
{
    sed -e '1,/^#BEGIN-HELP/d ; /^#END-HELP/,$d ; s/^#\s\{0,1\}//' "$0"
    exit ${1:-0}
}


# Gargle the arguments

KEYRING_DIR="${HOME}/.gnupg"
PASSPHRASE=
while echo "$1" | egrep -q -e '^--'
do
    OPTION=$1
    shift

    case "${OPTION}" in

	--help)
	    self_help
	    ;;

	--keyring)
	    KEYRING_DIR=$1
	    shift
	    ;;

	--passphrase)
	    PASSPHRASE=$1
	    shift
	    ;;

	# These are for debug.

	--command)
	    ECHO=echo
	    ;;

	--container)
	    CONTAINER=$1
	    shift
	    ;;

	--name)
	    NAME_ARG="--name $1"
	    shift
	    ;;

	--no-halt)
	    NO_HALT="--env BUILD_NO_HALT=1"
	    ;;

	--*)
	    die "Unknown option ${OPTION}."
	    ;;
    esac
done

[ "$#" -eq 1 -o "$#" -eq 2 ] \
    || self_help 1

# Repository directory

REPO_DIR_ARG="$1"
REPO_DIR="$1"
[ -d "$1" -a -w "$1" ] \
    || die "${REPO_DIR} is not a writable directory."
echo "${REPO_DIR}" | fgrep -q ':' \
    && die "Build directory cannot contain colons."
REPO_DIR=$(cd "${REPO_DIR}" && pwd)

# Key Name

if [ $# -eq 2 ]
then
    KEY_NAME=$2
fi


# Work directory (created within the repository directory)

WORK="${REPO_DIR}/DOSS"
rm -rf "${WORK}"
mkdir -p "${WORK}"
chmod 700 "${WORK}"

cleanup()
{
    rm -rf "${WORK}" "${STATUS_FILE}"
}
trap cleanup EXIT


# GPG passphrase and keys

PASSPHRASE_FILE="${WORK}/gpg-passphrase"
touch "${PASSPHRASE_FILE}"
chmod 600 "${PASSPHRASE_FILE}"
cat "${PASSPHRASE}" > "${PASSPHRASE_FILE}"

PUBLIC_KEY_FILE="${WORK}/gpg-public-key"
touch "${PUBLIC_KEY_FILE}"
chmod 600 "${PUBLIC_KEY_FILE}"
gpg --export -a ${KEY_NAME} > "${PUBLIC_KEY_FILE}"

# Need a GPG agent running to export keys.

GPG_AGENT_SOCKET=$(gpgconf --list-dirs agent-socket | head -1)
if [ ! -S "${GPG_AGENT_SOCKET}" ]
then
    echo "No GPG agent running.  Starting one."
    gpg-agent --daemon
    STARTED_AGENT=1
fi

SECRET_KEY_FILE="${WORK}/gpg-secret-key"
touch "${SECRET_KEY_FILE}"
chmod 600 "${SECRET_KEY_FILE}"
gpg --export-secret-key -a --pinentry-mode loopback  --passphrase-file "${PASSPHRASE_FILE}" > "${SECRET_KEY_FILE}"


# Figure out what kind of packages we're signing and which container
# to use.

if [ -d "${REPO_DIR}/repodata" ]
then
    REPO_TYPE=rpm
# TODO: Identify Debian repositories
elif false
then
    REPO_TYPE=deb
else
    die "${REPO_DIR_ARG}: Unable to identify repository type."
fi


if [ -z "${CONTAINER}" ]
then
    CONTAINER="ghcr.io/perfsonar/docker-oneshot-signer/${REPO_TYPE}:latest"
    PULL_ARG="--pull always"
else
    PULL_ARG="--pull never"
fi


# Permission args

OS=$(uname -s)
case "${OS}" in
    Linux)
	if [ -d '/sys/fs/cgroup/cgroup.controllers' ]
	then
	    # Cgroups v2
	    PERM_ARGS="--volume /sys/fs/cgroup:/sys/fs/cgroup:ro"
	else
	    PERM_ARGS="--privileged"
	fi
	;;
    Darwin)
	PERM_ARGS="--privileged"
	;;
    *)
	die "No support for ${OS}" 1>&2
	exit 1
esac


# Make it happen

if [ "$(id -u)" -ne 0 ]
then
    SUDO=sudo
fi

STATUS=0
${ECHO} ${SUDO} docker run \
	${NAME_ARG} \
	${PERM_ARGS} \
	${PULL_ARG} \
	${NO_HALT} \
	--tty \
	--tmpfs /tmp \
	--tmpfs /run \
	--volume "${REPO_DIR}:/sign:rw" \
	--rm \
	"${CONTAINER}" \
    || STATUS=$?

# Docker exits with a 130 when systemd is stopped with SIGINT (halt).
# Anything else was a container problem, not a result of the build.
[ $STATUS -eq 0 -o $STATUS -eq 130 ] || false

# Check on the status of the signing
STATUS_FILE="${REPO_DIR}/.doss-status"

[ -e "${STATUS_FILE}" ] || die "Signing produced no status."

BUILD_STATUS=$(cat "${STATUS_FILE}")
if [ "${BUILD_STATUS}" -ne 0 ]
then
    echo "Build failed" 1>&2
    exit "${BUILD_STATUS}"
fi