# Template file for 'unos-keys'
pkgname=unos-keys
version=0.1.0
revision=2
short_desc="UNOS trust anchors - apk and installer verification keys"
maintainer="finwo <finwo@pm.me>"
license="GPL-2.0-only"
homepage="https://unos.finwo.dev"
# Key ceremony: private halves live in ~/.unos-keys/ (developer) or on the CI
# workers under the unos-sign-key feature, and never enter git. Public halves
# are committed here (public by design):
# files/apk/* -> /etc/apk/keys/, files/unos/* -> /etc/unos/keys/.
# Rotation = add the new .pub files and bump revision.
#
# EVERY CI worker's public key must be here. Each of the four workers holds a
# distinct keypair, and mk/build.sh names the signature record after whichever
# key signed it (.SIGN.RSA.<keyname>.rsa.pub), so the signer is decided by
# wherever the conductor happened to schedule the build. Ship fewer than all of
# them and verification fails for an arbitrary, run-to-run-varying subset of
# packages -- the failure looks like corruption, not like a missing key.
#
# Consequences worth knowing before adding a fifth worker:
#   - publish this package BEFORE that worker builds anything, or existing
#     installs cannot verify its output;
#   - any one worker can sign packages every client trusts, so these four are
#     jointly as trusted as the repo itself. The intended end state is a
#     release step that re-signs with a single key and merely *accepts* these
#     as inputs; that does not exist yet.
#
# unos-dev@finwo.dev-096b7b41 is the developer key, kept so locally built
# packages still install. It should be dropped once CI is publishing.
do_install() {
  for k in "${FILESDIR}"/apk/*; do
    [ -e "${k}" ] || break
    vinstall "${k}" 644 etc/apk/keys "$(basename "${k}")"
  done
  for k in "${FILESDIR}"/unos/*; do
    [ -e "${k}" ] || break
    vinstall "${k}" 644 etc/unos/keys "$(basename "${k}")"
  done
}
