#!/bin/bash

# Usage: $0 [-r]
# -r means dont refresh keys from keyservers
#
# See https://gluestick.office.fsf.org/checklists/person/crypto-keys/ for
# upload command.

shopt -s inherit_errexit 2>/dev/null ||: # ignore fail in bash < 4.4
set -eE -o pipefail
trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR

dos_attack_bytes=1000000

refresh-gpg-key() {

  key=$1

  error=999
  for keyserver in keyring.debian.org keyserver.ubuntu.com pgp.mit.edu; do
    echo "Trying $keyserver..."
    set +e
    cmd="gpg --keyserver $keyserver --recv-keys $key"
    # Keyservers are not very reliable, so retry a few times.
    for x in {1..3}; do
      $cmd &>/dev/null
      ret=$?
      if (( ret == 0 )); then
        break; fi
      sleep 1
    done
    set -e
    error=$(( ret < error ? ret : error )) # use lowest return
  done

  return $error
}

check-sig-dos() {
  if (( "$(stat -c %s "$1")" > "$dos_attack_bytes" )) ; then
    echo -e "\n\nerror: keyring is very large. did we get a signature DoS attack?\n\n"
    exit 1
  fi
}

refresh=true
if [[ $1 == -r ]]; then
  refresh=false
fi

KEYS+="67819B343B2AB70DED9320872C6464AF2A8E4C02 " #rms
KEYS+="A4626CBAFF376039D2D7554497BA9CE761A0963B " #johns
KEYS+="759C0A4A39A02A079712FB5061B826E87A80C8D6 " #johnh
KEYS+="1487E002421112A3B6C76B545FA66D3CA7518DBF " #andrew
KEYS+="8556112E9B88B1A8B3E3631B58A39239D50484E8 " #jeanne
KEYS+="B125F60B7B287FF6A2B7DF8F170AF0E2954295DF " #ian
KEYS+="36C9950D2F68254ED89C7C03F9C13A10581AB853 " #craigt
KEYS+="2C31130BF7D5A459AFF2A3F3C9DFFE4A33AA52D9 " #knauth
KEYS+="43372794C8ADD5CA8FCFFA6CD03759DAB600E3C0 " #michael
KEYS+="B102017CCF698F79423EF9CC069C04D206A59505 " #zoe
KEYS+="7CCC7ECD3D78EB384F6C02C8966951617A149C73 " #gregf
KEYS+="3D53198D2A8341B291BDD42893C0CF451883524B " #davis
KEYS+="2E0ECE75F8162B407D666767879738E6D6440D57 " #devinu
KEYS+="005D03724A11C08A5A353D2C906DB6E398AA6CF6 " #miriam
KEYS+="2D1304056F4F061DADEAE299A2C76C5425EF14E8 " #dawn
KEYS+="D86097B5E291BA771FA64D357014A6BE08494155"  #odile

if [[ -e fsf-keyring.gpg ]] ; then
  check-sig-dos fsf-keyring.gpg
  gpg --import fsf-keyring.gpg
else
  gpg --armor --export $KEYS > fsf-keyring.gpg
fi

for KEY in $KEYS ; do
  if $refresh; then
    echo "Key: $KEY"
    refresh-gpg-key $KEY || (echo "unable to download $KEY" >&2 ; exit 1)
  fi
done

gpg --export $KEYS > key-export
check-sig-dos key-export
mv key-export fsf-keyring.gpg

rm -f fsf-keyring.gpg.asc ./fsf-keyring.gpg~ key-export
gpg --armor --detach-sign ./fsf-keyring.gpg