jaredallard · May 11, 2024 21:03 · May 11, 2024 · May 11, 2024 · May 11, 2024 · May 11, 2024
diff --git a/keyring.sh b/keyring.sh
@@ -71,7 +71,7 @@ if [[ ! -e "$binhostConfFile" ]]; then
   info "Creating $binhostConfFile"
   mkdir -p "$(dirname "$binhostConfFile")"
   cat <<EOF | tee -a "$binhostConfFile"
-[gentoobinhost]
+[rgst]
 priority = 1
 sync-uri = https://gentoo.rgst.io/t/arm64/asahi
 EOF

diff --git a/keyring.sh b/keyring.sh
@@ -73,7 +73,7 @@ if [[ ! -e "$binhostConfFile" ]]; then
   cat <<EOF | tee -a "$binhostConfFile"
 [gentoobinhost]
 priority = 1
-sync-uri = https://gentoo.rgst.io/t/arm64/asahi"
+sync-uri = https://gentoo.rgst.io/t/arm64/asahi
 EOF
 fi
 

diff --git a/keyring.sh b/keyring.sh
@@ -68,6 +68,7 @@ fi
 
 binhostConfFile="/etc/portage/binrepos.conf/rgst.conf"
 if [[ ! -e "$binhostConfFile" ]]; then
+  info "Creating $binhostConfFile"
   mkdir -p "$(dirname "$binhostConfFile")"
   cat <<EOF | tee -a "$binhostConfFile"
 [gentoobinhost]

diff --git a/keyring.sh b/keyring.sh
@@ -78,7 +78,7 @@ fi
 
 # If we don't have a PORTAGE_BINHOST in make.conf, add it.
 makeConf="/etc/portage/make.conf"
-if ! grep -q "FEATURES" "$makeConf" | grep -q "getbinpkg"; then
+if ! grep "FEATURES" "$makeConf" | grep -q "getbinpkg"; then
   info "Couldn't find PORTAGE_BINHOST in '$makeConf'"
   info "Would you like to add it? (y/N)"
   read -r -n 1 -s

diff --git a/keyring.sh b/keyring.sh
@@ -66,9 +66,19 @@ else
   info "Remote key '$KEY_ID' already exists in keyring"
 fi
 
+binhostConfFile="/etc/portage/binrepos.conf/rgst.conf"
+if [[ ! -e "$binhostConfFile" ]]; then
+  mkdir -p "$(dirname "$binhostConfFile")"
+  cat <<EOF | tee -a "$binhostConfFile"
+[gentoobinhost]
+priority = 1
+sync-uri = https://gentoo.rgst.io/t/arm64/asahi"
+EOF
+fi
+
 # If we don't have a PORTAGE_BINHOST in make.conf, add it.
 makeConf="/etc/portage/make.conf"
-if ! grep -q "PORTAGE_BINHOST" "$makeConf"; then
+if ! grep -q "FEATURES" "$makeConf" | grep -q "getbinpkg"; then
   info "Couldn't find PORTAGE_BINHOST in '$makeConf'"
   info "Would you like to add it? (y/N)"
   read -r -n 1 -s
@@ -79,9 +89,8 @@ if ! grep -q "PORTAGE_BINHOST" "$makeConf"; then
   info "Writing to '$makeConf'"
   cat <<EOF | tee -a "$makeConf"
 
-# Binaries packages from the gentoo.rgst.io binhost.
-PORTAGE_BINHOST="https://gentoo.rgst.io/t/arm64/asahi"
-FEATURES="getbinpkg binpkg-request-signature"
+# Fetch binpkgs with signature validation enabled.
+FEATURES="${FEATURES} getbinpkg binpkg-request-signature"
 EOF
 
   success "Successfully set up portage binhost GPG trust"

diff --git a/keyring.sh b/keyring.sh
@@ -5,8 +5,6 @@ set -eo pipefail
 
 # GPG_DIR is the directory to establish the trust in
 GPG_DIR="/etc/portage/gnupg"
-TRUST_FILE="${GPG_DIR}/trustdb.gpg"
-PASSWD_FILE="${GPG_DIR}/pass"
 
 # Key information.
 KEYFILE="https://gentoo.rgst.io/signing.gpg"
@@ -63,9 +61,6 @@ if ! gpg --list-keys "$KEY_ID" >/dev/null 2>&1; then
   gpg --list-keys
   echo "=== End signing keys ==="
 
-  # Ensure the trustdb is readable by portage
-  chmod ugo+r "$TRUST_FILE"
-
   success "Successfully imported remote key '$KEY_ID' from '$KEYFILE' into portage keyring"
 else
   info "Remote key '$KEY_ID' already exists in keyring"

diff --git a/keyring.sh b/keyring.sh
@@ -37,51 +37,25 @@ fi
 # Scope the GPGHOME to the GPG_DIR
 export GNUPGHOME="${GPG_DIR}"
 
-if [[ ! -e "$TRUST_FILE" ]]; then
-  info "$TRUST_FILE does not exist. Generating a new trust key"
-
-  # PASS is the passphrase for the local key
-  PASS="$(openssl rand -base64 64 | tr -d '\n')"
-
-  # Generate the local key
-  KEY_CONFIG_FILE="$(mktemp)"
-  chmod 600 "$KEY_CONFIG_FILE"
-
-  cat >"$KEY_CONFIG_FILE" <<EOF
-%echo Generating Portage local OpenPGP trust key
-Key-Type: default
-Subkey-Type: default
-Name-Real: Portage Local Trust Key
-Name-Comment: local signing only
-Name-Email: portage@localhost
-Expire-Date: 0
-Passphrase: $PASS
-%commit
-%echo done
-EOF
-
-  mkdir -p "$GPG_DIR"
-  gpg --batch --generate-key "$KEY_CONFIG_FILE"
-  rm -f "$KEY_CONFIG_FILE" # Remove the key config file after generating the key
+if [[ ! -e "${GPG_DIR}" ]]; then
+  if ! command -v getuto &>/dev/null; then
+    echo "Error: getuto is required to run this script" >&2
+    exit 1
+  fi
 
-  # Store the passphrase in a file
-  touch "$PASSWD_FILE"
-  chmod 600 "$PASSWD_FILE"
-  echo -n "$PASS" >"$PASSWD_FILE"
+  getuto
+fi
 
-  success "Generated a new trust key"
-else
-  # Read the passphrase from the file
-  PASS="$(cat "$PASSWD_FILE")"
+if [[ -e "/etc/portage/binrepos.conf/gentoobinhost.conf" ]]; then
+  info "Removing existing binhost configuration"
+  rm -f "/etc/portage/binrepos.conf/gentoobinhost.conf"
 fi
 
 # Check if the key is already in the keyring
 if ! gpg --list-keys "$KEY_ID" >/dev/null 2>&1; then
   info "Importing remote key '$KEY_ID' from '$KEYFILE'"
   curl "$KEYFILE" | gpg --batch --import
 
-  info "Signing remote key '$KEY_ID' with local key"
-  gpg --batch --yes --pinentry-mode loopback --passphrase "$PASS" --sign-key "${KEY_ID}"
   info "Setting trust to ultimate for '$KEY_ID'"
   echo -e "5\ny\n" | gpg --command-fd 0 --edit-key "$KEY_ID" trust
 

diff --git a/keyring.sh b/keyring.sh
@@ -10,7 +10,7 @@ PASSWD_FILE="${GPG_DIR}/pass"
 
 # Key information.
 KEYFILE="https://gentoo.rgst.io/signing.gpg"
-KEY_ID="05928A7F667F4E8E2C92B7EA362F3E4FB06436A4"
+KEY_ID="51ADD5251CF9188631F8AFBF9BDB0A58AD3F6FEB"
 
 # info prints an info message in bold
 info() {

diff --git a/keyring.sh b/keyring.sh
@@ -111,7 +111,7 @@ if ! grep -q "PORTAGE_BINHOST" "$makeConf"; then
   cat <<EOF | tee -a "$makeConf"
 
 # Binaries packages from the gentoo.rgst.io binhost.
-PORTAGE_BINHOST="https://gentoo.rgst.io/t/arm64/m1"
+PORTAGE_BINHOST="https://gentoo.rgst.io/t/arm64/asahi"
 FEATURES="getbinpkg binpkg-request-signature"
 EOF
 

diff --git a/keyring.sh b/keyring.sh
@@ -10,7 +10,7 @@ PASSWD_FILE="${GPG_DIR}/pass"
 
 # Key information.
 KEYFILE="https://gentoo.rgst.io/signing.gpg"
-KEY_ID="28FFF28BEF43EF4AA7AEA9D8137F12BF7A47966B"
+KEY_ID="05928A7F667F4E8E2C92B7EA362F3E4FB06436A4"
 
 # info prints an info message in bold
 info() {

diff --git a/keyring.sh b/keyring.sh
@@ -1,9 +1,6 @@
 #!/usr/bin/env bash
 # Sets up a portage bin host GPG trust. Uses a local key
 # and signs the remote key with it to establish trust.
-#
-# Imports the KEY_ID into the local keyring and sets the trust
-# to ultimate.
 set -eo pipefail
 
 # GPG_DIR is the directory to establish the trust in

diff --git a/keyring.sh b/keyring.sh
@@ -114,7 +114,7 @@ if ! grep -q "PORTAGE_BINHOST" "$makeConf"; then
   cat <<EOF | tee -a "$makeConf"
 
 # Binaries packages from the gentoo.rgst.io binhost.
-PORTAGE_BINHOST="https://gentoo.rgst.io/packages"
+PORTAGE_BINHOST="https://gentoo.rgst.io/t/arm64/m1"
 FEATURES="getbinpkg binpkg-request-signature"
 EOF
 

diff --git a/keyring.sh b/keyring.sh
@@ -13,7 +13,7 @@ PASSWD_FILE="${GPG_DIR}/pass"
 
 # Key information.
 KEYFILE="https://gentoo.rgst.io/signing.gpg"
-KEY_ID="F0B90B352D189E92AB077CE241EF55D8818FB20B"
+KEY_ID="28FFF28BEF43EF4AA7AEA9D8137F12BF7A47966B"
 
 # info prints an info message in bold
 info() {

diff --git a/keyring.sh b/keyring.sh
@@ -0,0 +1,124 @@
+#!/usr/bin/env bash
+# Sets up a portage bin host GPG trust. Uses a local key
+# and signs the remote key with it to establish trust.
+#
+# Imports the KEY_ID into the local keyring and sets the trust
+# to ultimate.
+set -eo pipefail
+
+# GPG_DIR is the directory to establish the trust in
+GPG_DIR="/etc/portage/gnupg"
+TRUST_FILE="${GPG_DIR}/trustdb.gpg"
+PASSWD_FILE="${GPG_DIR}/pass"
+
+# Key information.
+KEYFILE="https://gentoo.rgst.io/signing.gpg"
+KEY_ID="F0B90B352D189E92AB077CE241EF55D8818FB20B"
+
+# info prints an info message in bold
+info() {
+  echo -e "\e[1m[INFO] $1\e[0m"
+}
+
+# success prints a success message in green
+success() {
+  echo -e "\e[1;32m[SUCCESS] $1 \e[0m"
+}
+
+# Ensure we're running as root
+if [[ "${EUID}" -ne 0 ]]; then
+  echo "This script must be run as root" >&2
+  exit 1
+fi
+
+# Ensure we have no arguments
+if [[ "$#" -ne 0 ]]; then
+  echo "Usage: $(basename "$0")" >&2
+  exit 1
+fi
+
+# Scope the GPGHOME to the GPG_DIR
+export GNUPGHOME="${GPG_DIR}"
+
+if [[ ! -e "$TRUST_FILE" ]]; then
+  info "$TRUST_FILE does not exist. Generating a new trust key"
+
+  # PASS is the passphrase for the local key
+  PASS="$(openssl rand -base64 64 | tr -d '\n')"
+
+  # Generate the local key
+  KEY_CONFIG_FILE="$(mktemp)"
+  chmod 600 "$KEY_CONFIG_FILE"
+
+  cat >"$KEY_CONFIG_FILE" <<EOF
+%echo Generating Portage local OpenPGP trust key
+Key-Type: default
+Subkey-Type: default
+Name-Real: Portage Local Trust Key
+Name-Comment: local signing only
+Name-Email: portage@localhost
+Expire-Date: 0
+Passphrase: $PASS
+%commit
+%echo done
+EOF
+
+  mkdir -p "$GPG_DIR"
+  gpg --batch --generate-key "$KEY_CONFIG_FILE"
+  rm -f "$KEY_CONFIG_FILE" # Remove the key config file after generating the key
+
+  # Store the passphrase in a file
+  touch "$PASSWD_FILE"
+  chmod 600 "$PASSWD_FILE"
+  echo -n "$PASS" >"$PASSWD_FILE"
+
+  success "Generated a new trust key"
+else
+  # Read the passphrase from the file
+  PASS="$(cat "$PASSWD_FILE")"
+fi
+
+# Check if the key is already in the keyring
+if ! gpg --list-keys "$KEY_ID" >/dev/null 2>&1; then
+  info "Importing remote key '$KEY_ID' from '$KEYFILE'"
+  curl "$KEYFILE" | gpg --batch --import
+
+  info "Signing remote key '$KEY_ID' with local key"
+  gpg --batch --yes --pinentry-mode loopback --passphrase "$PASS" --sign-key "${KEY_ID}"
+  info "Setting trust to ultimate for '$KEY_ID'"
+  echo -e "5\ny\n" | gpg --command-fd 0 --edit-key "$KEY_ID" trust
+
+  echo "=== Signing keys ==="
+  gpg --list-keys
+  echo "=== End signing keys ==="
+
+  # Ensure the trustdb is readable by portage
+  chmod ugo+r "$TRUST_FILE"
+
+  success "Successfully imported remote key '$KEY_ID' from '$KEYFILE' into portage keyring"
+else
+  info "Remote key '$KEY_ID' already exists in keyring"
+fi
+
+# If we don't have a PORTAGE_BINHOST in make.conf, add it.
+makeConf="/etc/portage/make.conf"
+if ! grep -q "PORTAGE_BINHOST" "$makeConf"; then
+  info "Couldn't find PORTAGE_BINHOST in '$makeConf'"
+  info "Would you like to add it? (y/N)"
+  read -r -n 1 -s
+  if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+    exit 0
+  fi
+
+  info "Writing to '$makeConf'"
+  cat <<EOF | tee -a "$makeConf"
+
+# Binaries packages from the gentoo.rgst.io binhost.
+PORTAGE_BINHOST="https://gentoo.rgst.io/packages"
+FEATURES="getbinpkg binpkg-request-signature"
+EOF
+
+  success "Successfully set up portage binhost GPG trust"
+else
+  info "Already have PORTAGE_BINHOST in '$makeConf'"
+fi
No results found