scripts/update/sign_release.sh

#!/bin/sh

set -e

usage() {
	_exit_code=${1-1}
	echo "usage: $0 [-o RELEASEDIR] -s SECKEY"
	exit ${_exit_code}
}

unset DESTDIR RELEASEDIR
while getopts "ho:s:" c; do
	case "$c" in
		h) usage 0
			;;
		o) RELEASEDIR=$OPTARG
			;;
		s) SECKEY=$OPTARG
			;;
	esac
done

# Only root
_uid=$(id -u)
if [ ${_uid} -ne 0 ]; then
        echo "Requires root credentials to go on..." >&2
        exit 1
fi

# Find system sources
if [ -e /etc/mk.conf ]; then
	BSDSRCDIR=$(make -f /etc/mk.conf -V BSDSRCDIR)
fi
BSDSRCDIR=${BSDSRCDIR:=/usr/src}

# Find out which release directory we are going to use
_release=$(uname -r)
# Must be on a snapshot if no Tag file exists in CVS
if [ \! -e "${BSDSRCDIR}/CVS/Tag" ]; then
        _release=snapshots
fi

_arch=$(uname -m)
RELEASEDIR=${RELEASEDIR-/var/www/htdocs/pub/OpenBSD/${_release}/${_arch}}
test -f "${SECKEY}" || {
	echo "Private key ${SECKEY} not found";
	exit 1;
}

test -f "${RELEASEDIR}"/SHA256.base || {
	echo "SHA256.base not found in ${RELEASEDIR}";
	exit 1;
}

test -f "${RELEASEDIR}"/SHA256.xenocara || {
	echo "SHA256.xenocara not found in ${RELEASEDIR}";
	exit 1;
}

cat ${RELEASEDIR}/SHA256.{base,xenocara} > ${RELEASEDIR}/SHA256
signify -S -s "${SECKEY}" -e -x "${RELEASEDIR}"/SHA256.sig -m "${RELEASEDIR}"/SHA256