sign-key.inc (1547B)
1 # mk/sign-key.inc - resolve_sign_key(): print the RSA package-signing key. 2 # 3 # Precedence: 4 # $UNOS_KEY_APK_RSA_PRI the CI worker's unos-sign-key feature sets this 5 # $UNOS_SIGN_KEY manual override 6 # $ROOT/.sign-key local developer selection (mk/keymgmt.sh use) 7 # single *.rsa in ~/.unos-keys/ 8 # 9 # CI comes first because a worker that mounted a key intends that key to be 10 # used; a stale .sign-key checked into a runner image should not be able to 11 # quietly outrank it. 12 # 13 # Note each worker carries its own distinct keypair, so KEYNAME (and therefore 14 # the .SIGN.RSA.<name>.rsa.pub record in every .apk) varies with scheduling. 15 # packages/unos-keys must ship every worker's public half or verification 16 # fails for whichever packages happened to land elsewhere. 17 # 18 # Source this file ($ROOT must be set), then: KEY=$(resolve_sign_key). 19 resolve_sign_key() { 20 _k="${UNOS_KEY_APK_RSA_PRI:-}" 21 [ -n "${_k}" ] || _k="${UNOS_SIGN_KEY:-}" 22 if [ -z "${_k}" ] && [ -n "${ROOT:-}" ] && [ -f "${ROOT}/.sign-key" ]; then 23 _k=$(cat "${ROOT}/.sign-key") 24 fi 25 if [ -z "${_k}" ]; then 26 set -- ~/.unos-keys/*.rsa 27 if [ $# = 1 ] && [ -f "$1" ]; then 28 _k=$1 29 else 30 echo "sign-key: no key. Set UNOS_KEY_APK_RSA_PRI (CI: the unos-sign-key 31 worker feature provides it) or UNOS_SIGN_KEY, or write one to 32 ${ROOT}/.sign-key, or keep a single *.rsa in ~/.unos-keys (mk/keymgmt.sh)" >&2 33 return 1 34 fi 35 fi 36 [ -f "${_k}" ] || { echo "sign-key: key not found: ${_k}" >&2; return 1; } 37 printf '%s\n' "${_k}" 38 }