#!/bin/sh
# $Id$
# Public domain. Originally written 2016, Norbert Preining.
# Sign a file for release in TeX Live. Used in tl-update-images,
# tl-update-tlnet, et al. See tlpkg/gpg/tl-key-extension.txt for some info.

if test $# -ne 1; then
  echo "$0: Exactly one argument must be given, the file to sign." >&2
  exit 1
fi

# remove previous signature else gpg will bail out.
rm -f "$1.asc"

gpg_prog=gpg
gpg_opts="--batch --homedir /home/texlive/.gnupg  \
  --passphrase-file /home/texlive/.gnupg/passphrase \
  --local-user 0x06BAB6BC "
gpg_sign_opts="--armor --detach-sign"

# use the environment variables if set. This is for testing;
# we don't define them in normal usage.
if test -n "$TL_GNUPG"; then
  gpg_prog=$TL_GNUPG
fi
if test -n "$TL_GNUPGOPTS"; then
  gpg_opts=$TL_GNUPGOPTS
fi
if test -n "$TL_GNUPG_SIGN_OPTS"; then
  gpg_sign_opts=$TL_GNUPG_SIGN_OPTS
fi

# sign, check that result is valid and doesn't use something expired.
# both --detach-sign and --verify exit 0 even when something is expired.
if $gpg_prog $gpg_sign_opts $gpg_opts "$1"; then
  status_out=`mktemp`
  verify_out=`mktemp`
  verify_cmd="$gpg_prog $gpg_opts --status-file=$status_out --verify --verbose"
  if $verify_cmd "$1".asc >$verify_out 2>&1; then
    if grep EXPKEYSIG $status_out >/dev/null; then
      err="expired key"
    elif grep REVKEYSIG $status_out >/dev/null; then
      err="revoked key"
    else
      err= # ok we hope
    fi
  else
    err="other error ($?)"
  fi
  if test -n "$err"; then
    echo "$0: gpg verification failed." >&2
    if test -r "$1".asc; then
      echo "$0: moving $1.asc to $1.asc.badv." >&2
      mv "$1".asc "$1".asc.badv || exit 1
    else
      echo "$0: no file $1.asc" >&2
    fi      
    echo "$0: gpg verify command was:" >&2
    echo "$0: $verify_cmd" "$1" >&2
    echo "$0: STATUS FILE OUTPUT:" >&2
    cat $status_out >&2
    echo "$0: -------------------" >&2    
    echo "$0: STDOUT/STDERR:" >&2
    cat $verify_out >&2
    echo "$0: -------------------" >&2    
    echo "$0: goodbye and good luck." >&2
    rm -f $status_out $verify_out
    exit 1
  fi
  rm -f $status_out $verify_out

else # the original gpg run failed.
  echo "$0: gpg signing failed." >&2
  if test -r "$1".asc; then
    echo "$0: moving $1.asc to $1.asc.bads." >&2
    mv "$1".asc "$1".asc.bads || exit 1
  else
    echo "$0: no file $1.asc" >&2
  fi
  echo "$0: gpg command was:" >&2
  echo "$0: $gpg_prog $gpg_sign_opts $gpg_opts" "$1" >&2
  echo "$0: goodbye and good luck." >&2
  exit 1
fi

exit 0