From bc7d3a2ed7ffd7d2be25710c703eb1eda342f919 Mon Sep 17 00:00:00 2001 From: Erik Arvstedt Date: Wed, 15 Dec 2021 15:27:57 +0100 Subject: [PATCH] fetch-release: check that only one key is imported Co-authored-by: nixbitcoin --- helper/fetch-release | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/helper/fetch-release b/helper/fetch-release index dce8a16..7875766 100755 --- a/helper/fetch-release +++ b/helper/fetch-release @@ -1,9 +1,11 @@ #!/usr/bin/env nix-shell -#!nix-shell -i bash -p bash coreutils curl jq gnupg +#!nix-shell -i bash -p bash coreutils curl jq gnupg gnugrep set -euo pipefail scriptDir=$(cd "${BASH_SOURCE[0]%/*}" && pwd) +trap 'echo "Error at ${BASH_SOURCE[0]}, line $LINENO"' ERR + repo=fort-nix/nix-bitcoin if [[ ! -v version ]]; then version=$(curl -s --show-error "https://api.github.com/repos/$repo/releases/latest" | jq -r '.tag_name' | tail -c +2) @@ -17,6 +19,8 @@ mkdir -p -m 700 "$GPG_HOME" # Import key gpg --homedir $GPG_HOME --import "$scriptDir/key-jonasnick.bin" &> /dev/null +# Check that exactly one key was imported +(($(gpg --list-keys --with-colons | grep -c pub) == 1)) # Verify key fingerprint gpg --homedir $GPG_HOME --list-keys "36C7 1A37 C9D9 88BD E825 08D9 B1A7 0E4F 8DCD 0366" > /dev/null