git-sig/siglog

211 lines
4.8 KiB
Plaintext
Raw Normal View History

2020-11-12 22:56:38 +00:00
#! /usr/bin/env bash
set -e
2020-11-13 02:31:26 +00:00
MIN_BASH_VERSION=4
MIN_GPG_VERSION=2.2
MIN_OPENSSL_VERSION=1.1
2020-11-12 22:56:38 +00:00
die() {
echo "$@" >&2
exit 1
}
2020-11-13 02:31:26 +00:00
check_version(){
[[ $2 == $3 ]] && return 0
local IFS=.
local i ver1=($2) ver2=($3)
for ((i=${#ver1[@]}; i<${#ver2[@]}; i++));
do ver1[i]=0;
done
for ((i=0; i<${#ver1[@]}; i++)); do
[[ -z ${ver2[i]} ]] && ver2[i]=0
((10#${ver1[i]} > 10#${ver2[i]})) && return 0
((10#${ver1[i]} < 10#${ver2[i]})) && die \
"Error: ${1} ${3}+ not found"
done
}
check_tools(){
if [ -z "${BASH_VERSINFO}" ] \
|| [ -z "${BASH_VERSINFO[0]}" ] \
|| [ ${BASH_VERSINFO[0]} -lt ${MIN_BASH_VERSION} ]; then
die "Error: bash ${MIN_BASH_VERSION}+ not found";
fi
2020-11-12 23:02:19 +00:00
for cmd in "$@"; do
2020-11-13 02:31:26 +00:00
command -v "$1" >/dev/null || die "Error: $cmd not found"
case $cmd in
gpg)
version=$(gpg --version | head -n1 | cut -d" " -f3)
check_version "gpg" "${version}" "${MIN_GPG_VERSION}"
;;
openssl)
version=$(openssl version | cut -d" " -f2 | sed 's/[a-z]//g')
check_version "openssl" "${version}" "${MIN_OPENSSL_VERSION}"
;;
esac
2020-11-12 23:02:19 +00:00
done
}
2020-11-13 02:31:26 +00:00
get_temp(){
echo "$(
mktemp \
--quiet \
--directory \
-t "$(basename "$0").XXXXXX" 2>/dev/null
|| mktemp \
--quiet \
--directory
)"
}
2020-11-12 22:56:38 +00:00
gpg_env(){
2020-11-13 02:31:26 +00:00
GNUPGHOME=$(get_temp); export GNUPGPHOME
2020-11-12 22:56:38 +00:00
killall gpg-agent 2> /dev/null
gpg-agent --daemon --extra-socket "$GNUPGHOME/S.gpg-agent" 2> /dev/null
echo "export PATH=$GNUPGHOME:$PATH \
export GNUPGHOME=$GNUPGHOME; \
export GPG_AGENT_INFO=$GNUPGHOME/S.gpg-agent"
}
gpg_cleanup(){
gpgconf --kill gpg-agent
rm -rf "$GNUPGHOME"
}
verify_file() {
2020-11-13 02:31:26 +00:00
local filename="${1?}"
local sig_count=0
local seen_fingerprints=""
local fingerprint
local signer
2020-11-12 22:56:38 +00:00
for sig_filename in "${filename%.*}".*.asc; do
gpg --verify "${sig_filename}" "${filename}" >/dev/null 2>&1 || {
echo "Invalid signature: ${sig_filename}";
exit 1;
}
fingerprint=$( \
gpg --list-packets "${sig_filename}" \
| grep keyid \
| sed 's/.*keyid //g'
)
signer=$( \
gpg \
--list-keys \
--with-colons "${fingerprint}" 2>&1 \
| awk -F: '$1 == "uid" {print $10}' \
| head -n1 \
)
[[ "${seen_fingerprints}" == *"${fingerprint}"* ]] && {
echo "Duplicate signature: ${sig_filename}";
exit 1;
}
echo "Verified signature by \"${signer}\""
seen_fingerprints="${seen_fingerprints} ${fingerprint}"
((sig_count=sig_count+1))
done
[[ "$sig_count" -ge "$threshold" ]] || {
echo "Minimum number of signatures not met: ${sig_count}/${threshold}";
exit 1;
}
}
2020-11-13 02:31:26 +00:00
verify_files() {
2020-11-12 22:56:38 +00:00
[ $# -lt 3 ] || die \
2020-11-13 02:31:26 +00:00
"Usage: verify-files <threshold> <pubkey_dir> <file> (, <file, ...)"
2020-11-12 22:56:38 +00:00
2020-11-13 02:31:26 +00:00
local threshold="${1}"
local pubkey_dir="${2}"
local target_files="${*:3}"
2020-11-12 22:56:38 +00:00
eval "$(gpg_env)"
gpg --import "${pubkey_dir}"/*.asc 2>/dev/null
for target_file in ${target_files}; do
verify_file "${target_file}"
done
gpg_cleanup
}
2020-11-13 02:31:26 +00:00
get_files(){
if command -v git >/dev/null; then
2020-11-13 02:37:06 +00:00
git ls-files | grep -v ".${PROGRAM}"
2020-11-13 02:31:26 +00:00
else
find . \
-type f \
-not -path "./.git/*" \
2020-11-13 02:37:06 +00:00
-not -path "./.${PROGRAM}/*"
2020-11-13 02:31:26 +00:00
fi
}
cmd_manifest() {
2020-11-13 02:37:06 +00:00
mkdir -p ".${PROGRAM}"
2020-11-13 02:31:26 +00:00
printf "$(get_files | xargs openssl sha256 -r)" \
| sed -e 's/ \*/ /g' -e 's/ \.\// /g' \
| LC_ALL=C sort -k2 \
2020-11-13 02:37:06 +00:00
> ".${PROGRAM}/manifest.txt"
2020-11-13 02:31:26 +00:00
}
2020-11-12 22:56:38 +00:00
cmd_verify() {
2020-11-13 02:31:26 +00:00
( [ -d ".${PROGRAM}" ] && ls .${PROGRAM}/*.asc >/dev/null 2>&1 ) \
|| die "Error: No signatures"
2020-11-12 22:56:38 +00:00
cmd_manifest
2020-11-13 02:31:26 +00:00
for file in .${PROGRAM}/*.asc; do
gpg --verify "$file" .${PROGRAM}/manifest.txt
2020-11-12 22:56:38 +00:00
done
}
2020-11-13 02:31:26 +00:00
cmd_sign(){
cmd_manifest
gpg --armor --detach-sig .${PROGRAM}/manifest.txt
local fingerprint=$( \
gpg --list-packets .${PROGRAM}/manifest.txt.asc \
| grep "issuer key ID" \
| sed 's/.*\([A-Z0-9]\{16\}\).*/\1/g' \
)
mv .${PROGRAM}/manifest.{"txt.asc","${fingerprint}.asc"}
}
2020-11-12 22:56:38 +00:00
cmd_version() {
cat <<-_EOF
============================================
= siglog: simple multisig trust toolchain =
= =
= v0.0.1 =
= =
= https://gitlab.com/pchq/siglog =
============================================
_EOF
}
cmd_usage() {
cmd_version
cat <<-_EOF
Usage:
$PROGRAM verify
Verify all signing policies for this directory are met
$PROGRAM sign
Add signature to manifest for this directory
2020-11-13 02:31:26 +00:00
$PROGRAM manifest
Generate hash manifest for this directory
2020-11-12 22:56:38 +00:00
$PROGRAM help
Show this text.
$PROGRAM version
Show version information.
_EOF
}
PROGRAM="${0##*/}"
COMMAND="$1"
2020-11-13 02:31:26 +00:00
check_tools head cut find sort sed gpg openssl
2020-11-12 22:56:38 +00:00
case "$1" in
2020-11-12 22:59:26 +00:00
verify) shift; cmd_verify "$@" ;;
sign) shift; cmd_sign "$@" ;;
2020-11-13 02:31:26 +00:00
manifest) shift; cmd_manifest "$@" ;;
2020-11-12 22:59:26 +00:00
version|--version) shift; cmd_version "$@" ;;
help|--help) shift; cmd_usage "$@" ;;
*) cmd_usage "$@" ;;
2020-11-12 22:56:38 +00:00
esac
exit 0