summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorbill-auger <mr.j.spam.me@gmail.com>2019-02-08 05:52:47 -0500
committerbill-auger <mr.j.spam.me@gmail.com>2021-01-03 13:08:19 -0500
commit1b4128f20618af6468fc941d051db6264dc81df1 (patch)
tree09bdf8a0ecf87e1e6b2f2efd2561b01257101920
parent09ed805539c142398b4ec58bd9550eed1a2f2f94 (diff)
[parabola-keys]: initial script
-rwxr-xr-xsrc/maintenance-tools/parabola-keys100
1 files changed, 100 insertions, 0 deletions
diff --git a/src/maintenance-tools/parabola-keys b/src/maintenance-tools/parabola-keys
new file mode 100755
index 0000000..45ebe22
--- /dev/null
+++ b/src/maintenance-tools/parabola-keys
@@ -0,0 +1,100 @@
+#!/bin/bash
+
+readonly KEYS_FILE=/usr/share/pacman/keyrings/parabola-trusted
+readonly WARNING_N_DAYS=30
+readonly AUTOBUILDER_KEY='D3EAD7F9D076EB9AF650149DA170D6A0B669E21A'
+
+readonly SHOULD_SHOW_ALL=$( [[ "$1" == '--all' ]] && echo 1 || echo 0 )
+readonly KEYS=$(cat $KEYS_FILE)
+readonly JOIN_CHAR='~'
+# readonly EMAIL_REGEX='.*key \([^ ,]*\), .*'
+# readonly KEY_REGEX='.*key \([^ ,]*\), .*'
+readonly EXPIRY_REGEX='.* expires: \([0-9-]*\).*'
+readonly NOW=$(date +%s)
+readonly WARNING_DURATION=$(( 86400 * ${WARNING_N_DAYS} ))
+
+declare -A all_keys
+declare -A warning_keys
+declare -A valid_keys
+declare -A expired_keys
+declare -A revoked_keys
+
+
+FetchKey() # (fingerprint)
+{
+ gpg --batch --search-keys $1 2> /dev/null | tr "\n" "${JOIN_CHAR}" | sed -E 's|^\([0-9+]\)\s+||'
+}
+
+ParseExpiry() # (key_data)
+{
+ expiry=$(echo $1 | grep 'expires:' | sed "s|.*${EXPIRY_REGEX}|\1|")
+
+ [ "${expiry} " ] && echo ${expiry} || echo 'EXPIRY_INFINITE'
+}
+
+IsValid() # (key_data)
+{
+ echo $1 | grep -Ev '(expired)|(revoked)' > /dev/null
+}
+
+IsExpired() # (key_data)
+{
+ echo $1 | grep -E '(expired)' > /dev/null
+}
+
+IsRevoked() # (key_data)
+{
+ echo $1 | grep -E '(revoked)' > /dev/null
+}
+
+
+# collect results
+echo -n "($(echo $KEYS | wc -w)) keys to consider "
+for key in ${KEYS}
+do [[ "${key%%:*}" != ${AUTOBUILDER_KEY} ]] && echo -n '.' || continue
+
+ # fetch and parse key data
+ key=${key%%:*}
+ key_data="$(FetchKey ${key})"
+
+ # detect expiry warning period
+ expiry=$(ParseExpiry "${key_data}")
+ expiry_ts=$(date --date ${expiry} +%s 2> /dev/null)
+ expiry_duration=$(( ${expiry_ts} - $NOW ))
+ (( ${expiry_duration} <= ${WARNING_DURATION} )) && \
+ (( ${expiry_duration} > 0 )) && should_warn=1 || \
+ should_warn=0
+
+ # cache key data (mutually exclusive states)
+ all_keys[${key}]="${key_data}"
+ (( ${should_warn} )) && warning_keys[${key}]="${expiry}" && continue
+ IsValid "${key_data}" && valid_keys[${key}]="${expiry}" && continue
+ IsExpired "${key_data}" && expired_keys[${key}]="${expiry}" && continue
+ IsRevoked "${key_data}" && revoked_keys[${key}]="${expiry}" && continue
+done ; echo ;
+
+# display results
+if (( ${#valid_keys[@]} * ${SHOULD_SHOW_ALL} ))
+then echo -e "\n== valid_keys ==\n"
+ for key in "${!valid_keys[@]}"
+ do echo ${all_keys[${key}]} | tr "${JOIN_CHAR}" "\n"
+ done
+fi
+if (( ${#warning_keys[@]} ))
+then echo -e "\n== warning_keys ==\n"
+ for key in "${!warning_keys[@]}"
+ do echo ${all_keys[${key}]} | tr "${JOIN_CHAR}" "\n"
+ done
+fi
+if (( ${#expired_keys[@]} ))
+then echo -e "\n== expired_keys ==\n"
+ for key in "${!expired_keys[@]}"
+ do echo ${all_keys[${key}]} | tr "${JOIN_CHAR}" "\n"
+ done
+fi
+if (( ${#revoked_keys[@]} ))
+then echo -e "\n== revoked_keys ==\n"
+ for key in "${!revoked_keys[@]}"
+ do echo ${all_keys[${key}]} | tr "${JOIN_CHAR}" "\n"
+ done
+fi