max / audiofiles

2.8 KB · 74 lines History Blame Raw

1	#!/usr/bin/env bash
2	# Sign release artifacts with the Make Creative release key (minisign).
3	#
4	# Every Linux artifact we publish gets a detached `.minisig` beside it so a
5	# download can be checked against the public key in dist/makecreative.pub (also
6	# printed in README.md). Nothing in the app auto-applies an update, so a user
7	# running the verify command is the only thing between a compromised dist host
8	# and a bad binary on their machine.
9	#
10	# dist/sign-artifacts.sh <artifact> [<artifact>...]
11	#
12	# Key material, present on every Linux build host (fw13, astra):
13	#
14	# ~/.minisign/makecreative.key encrypted secret key, mode 0600
15	# ~/.minisign/password.env exports MINISIGN_PASSWORD
16	#
17	# Neither is in git. Generation, storage, and rotation are in
18	# _private/docs/meta/ota-release-runbook.md.
19	#
20	# Signatures are verified against dist/makecreative.pub before this script
21	# exits, so a build host holding the wrong key fails the release rather than
22	# shipping artifacts nobody can verify.
23
24	set -euo pipefail
25
26	SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
27
28	KEY="${MINISIGN_KEY:-$HOME/.minisign/makecreative.key}"
29	PASSWORD_ENV="${MINISIGN_PASSWORD_ENV:-$HOME/.minisign/password.env}"
30	PUBKEY="${MINISIGN_PUBKEY:-$SCRIPT_DIR/makecreative.pub}"
31
32	die() { echo "sign-artifacts: $*" >&2; exit 1; }
33
34	[ "$#" -gt 0 ] \|\| die "usage: $0 <artifact> [<artifact>...]"
35
36	command -v minisign >/dev/null 2>&1 \
37	\|\| die "minisign is not on PATH (Debian/Ubuntu: apt install minisign)"
38
39	[ -f "$KEY" ] \|\| die "no signing key at $KEY (see the OTA release runbook)"
40	[ -f "$PUBKEY" ] \|\| die "no public key at $PUBKEY"
41	if grep -q '^PLACEHOLDER' "$PUBKEY"; then
42	die "$PUBKEY is still a placeholder: install the real public key (see the OTA release runbook)"
43	fi
44
45	if [ -z "${MINISIGN_PASSWORD:-}" ]; then
46	[ -f "$PASSWORD_ENV" ] \
47	\|\| die "MINISIGN_PASSWORD is unset and $PASSWORD_ENV does not exist"
48	# shellcheck disable=SC1090
49	. "$PASSWORD_ENV"
50	fi
51	[ -n "${MINISIGN_PASSWORD:-}" ] \|\| die "MINISIGN_PASSWORD is empty"
52
53	for artifact in "$@"; do
54	[ -f "$artifact" ] \|\| die "no such artifact: $artifact"
55	done
56
57	# One invocation for the whole set: the password is read once, and minisign
58	# still writes a per-file trusted comment (timestamp, filename, prehashed), so
59	# a signature cannot be transplanted onto a different artifact.
60	printf '%s\n' "$MINISIGN_PASSWORD" \| minisign -S \
61	-s "$KEY" \
62	-c "Make Creative, LLC release artifact" \
63	-m "$@" >/dev/null
64
65	for artifact in "$@"; do
66	if ! minisign -V -q -p "$PUBKEY" -m "$artifact" >/dev/null; then
67	# Leave nothing behind that a later collect could mistake for a good
68	# signature.
69	rm -f "${artifact}.minisig"
70	die "signature for $artifact does not verify against $PUBKEY"
71	fi
72	echo "signed: ${artifact}.minisig"
73	done
74