fsf-keyring.sh

   1 #!/bin/bash -l
   2
   3 set -e
   4 set -x
   5
   6 refresh-gpg-key() {
   7
   8   key=$1
   9
  10   error=999
  11   # This is the only safe keyserver we know of as of 2019-06-09,
  12   # https://lwn.net/Articles/792366/
  13   for keyserver in keys.openpgp.org; do
  14     set +e
  15     cmd="gpg --keyserver $keyserver --recv-keys $key"
  16     # keyservers are not very reliable, so retry
  17     for x in {1..3}; do
  18       $cmd &>/dev/null
  19       ret=$?
  20       if (( ret == 0 )); then break; fi
  21       sleep 1
  22     done
  23     set -e
  24     error=$(( ret < error ? ret : error )) # use lowest return
  25   done
  26
  27   return $error
  28 }
  29
  30 refresh=true
  31 if [[ $1 == -r ]]; then
  32   refresh=false
  33 fi
  34
  35 KEYS+="67819B343B2AB70DED9320872C6464AF2A8E4C02 " #rms
  36 KEYS+="A4626CBAFF376039D2D7554497BA9CE761A0963B " #johns
  37 KEYS+="759C0A4A39A02A079712FB5061B826E87A80C8D6 " #johnh
  38 KEYS+="CEA951DB865D0D257BB0A14DCEB69E6F9B36C195 " #andrew
  39 KEYS+="13A0851D6307FC54FCCB81BA2C1008316F3E89B7 " #donald
  40 KEYS+="EF6643D6E1F115D1A9B7D59C92D16583E1E7C532 " #jeanne
  41 KEYS+="04C45B4E3AF05E9EB140FD148B10E9C6407BD6E1 " #matt
  42 KEYS+="318C679D94F17700CC847DE646A70073E4E50D4E " #ruben
  43 KEYS+="0CCB3494C13CCD8F6EC73AA06DA6B7D151C7643E " #dana
  44 KEYS+="B125F60B7B287FF6A2B7DF8F170AF0E2954295DF " #ian
  45 KEYS+="ECE5B5BF952A3AEA92C137F9C9230A4849ACE0DB " #molly
  46 KEYS+="36C9950D2F68254ED89C7C03F9C13A10581AB853 " #craigt
  47 KEYS+="E9A271C071964891AA57663D9EA33414F5852F4E " #mako
  48 KEYS+="A2F4F1966D9E35C673EC30D5B6F1D83E9ACD9EBB " #bkuhn
  49 KEYS+="2C31130BF7D5A459AFF2A3F3C9DFFE4A33AA52D9 " #knauth
  50 KEYS+="43372794C8ADD5CA8FCFFA6CD03759DAB600E3C0 " #michael
  51 KEYS+="B102017CCF698F79423EF9CC069C04D206A59505 " #zoe
  52 KEYS+="7CCC7ECD3D78EB384F6C02C8966951617A149C73 " #gregf
  53
  54
  55 rm -f /tmp/keys.asc ./fsf-keyring.gpg
  56
  57 for KEY in $KEYS ; do
  58   if $refresh; then
  59     refresh-gpg-key $KEY
  60   fi
  61   gpg --export --armor $KEY >> /tmp/keys.asc
  62 done
  63
  64 # note: this doesn't work with gpg2. i dunno what the equivalent is in
  65 # gpg2, likely just exporting all the keys.
  66 command gpg --trust-model always --no-default-keyring --keyring ./fsf-keyring.gpg --import /tmp/keys.asc
  67 gpg --sign ./fsf-keyring.gpg
  68 mv fsf-keyring.gpg.gpg fsf-keyring.gpg
  69 rm fsf-keyring.gpg~