Skip to content

Commit 19e4358

Browse files
tlauriontlaurion
authored
Merge pull request #2078 from tlaurion/distro_keys_updater-keep_only_primary_signing_key-remove_expired_ones
Distro keys updater keep only primary signing key remove expired ones : reduces size of archilinx.key and tails.key
2 parents e36d84f + 348a306 commit 19e4358

7 files changed

Lines changed: 303 additions & 307 deletions

File tree

‎bin/update_distro_signing_key/archlinux.sh‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#! /usr/bin/env bash
2+
# Update the Arch Linux distro signing key (Pierre Schmitz, release engineer).
3+
# See bin/update_distro_signing_key/helper.sh for details.
4+
#
5+
# Key fingerprint: 3E80 CA1A 8B89 F69C BA57 D98A 76A5 EF90 5444 9A5C
6+
7+
set -eo pipefail
8+
9+
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
10+
11+
exec "$SCRIPT_DIR/lib/helper.sh" \
12+
"Arch Linux" \
13+
"https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x3E80CA1A8B89F69CBA57D98A76A5EF9054449A5C" \
14+
"pierre@archlinux.org" \
15+
"initrd/etc/distro/keys/archlinux.key"

‎bin/update_distro_signing_key/lib/helper.sh‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
#! /usr/bin/env bash
2+
# Shared helper: download, normalize, and update one distro signing key.
3+
# Called by per-distro wrapper scripts in bin/update_distro_signing_key/.
4+
#
5+
# Usage: update_distro_signing_key_helper.sh <label> <url> <uid> <key_relpath>
6+
#
7+
# <label> Human-readable distro name, used in log output (e.g. "Tails")
8+
# <url> URL to download the raw key bundle from
9+
# <uid> GPG UID to select for export (email or full name string)
10+
# <key_relpath> Repo-relative path to the key file to update
11+
# (e.g. initrd/etc/distro/keys/tails.key)
12+
#
13+
# Normalization applied:
14+
# --export-options export-minimal,export-clean
15+
# --export-filter drop-subkey=expired -gt 0 || usage !~ s
16+
#
17+
# Only the primary key and non-expired signing subkeys are kept — no
18+
# encryption, authentication, or expired subkeys.
19+
20+
set -eo pipefail
21+
22+
die() { echo "ERROR: $*" >&2; exit 1; }
23+
24+
[ $# -eq 4 ] || die "Usage: $(basename "$0") <label> <url> <uid> <key_relpath>"
25+
26+
LABEL="$1"
27+
KEY_URL="$2"
28+
KEY_UID="$3"
29+
KEY_RELPATH="$4"
30+
31+
REPO_ROOT="$(git -C "$(cd "$(dirname "$0")" && pwd)" rev-parse --show-toplevel)"
32+
KEY_FILE="$REPO_ROOT/$KEY_RELPATH"
33+
34+
[ -f "$KEY_FILE" ] || die "Key file not found in repo: $KEY_RELPATH"
35+
36+
# Temporary GPG home — cleaned up on exit
37+
GPGHOME="$(mktemp -d --tmpdir "update-distro-key-XXXXXX")"
38+
trap 'rm -rf -- "$GPGHOME"' EXIT
39+
40+
echo "[$LABEL] Downloading $KEY_URL ..."
41+
wget -q "$KEY_URL" -O "$GPGHOME/raw.key" \
42+
|| die "[$LABEL] Failed to download key from $KEY_URL"
43+
44+
echo "[$LABEL] Importing key into temporary keyring ..."
45+
gpg --homedir "$GPGHOME" --batch --import "$GPGHOME/raw.key" 2>/dev/null \
46+
|| die "[$LABEL] gpg --import failed"
47+
48+
echo "[$LABEL] Exporting normalized key for '$KEY_UID' ..."
49+
gpg --homedir "$GPGHOME" --batch \
50+
--export --armor \
51+
--export-options export-minimal,export-clean \
52+
--export-filter 'drop-subkey=expired -gt 0 || usage !~ s' \
53+
"$KEY_UID" > "$GPGHOME/normalized.key" \
54+
|| die "[$LABEL] gpg --export failed"
55+
56+
[ -s "$GPGHOME/normalized.key" ] \
57+
|| die "[$LABEL] Exported key is empty — is '$KEY_UID' present in the downloaded keyring?"
58+
59+
cp "$GPGHOME/normalized.key" "$KEY_FILE"
60+
echo "[$LABEL] Written to $KEY_RELPATH"
61+
62+
# Report primary key expiry; warn (in color) if expiring within 365 days
63+
WARN_DAYS=365
64+
WARN_SECS=$(( WARN_DAYS * 86400 ))
65+
NOW="$(date +%s)"
66+
RED='\033[0;31m'
67+
YELLOW='\033[0;33m'
68+
NC='\033[0m'
69+
echo ""
70+
gpg --homedir "$GPGHOME" --batch --list-keys --with-colons "$KEY_UID" 2>/dev/null \
71+
| awk -F: -v label="$LABEL" -v now="$NOW" -v warn_secs="$WARN_SECS" \
72+
-v red="$RED" -v yellow="$YELLOW" -v nc="$NC" '
73+
/^pub:/ {
74+
expiry = $7
75+
if (expiry != "") {
76+
cmd = "date -d @" expiry " +%Y-%m-%d"
77+
cmd | getline expdate
78+
close(cmd)
79+
days_left = int((expiry - now) / 86400)
80+
if (expiry <= now) {
81+
print red "WARNING: [" label "] Primary key EXPIRED on " expdate " -- update immediately!" nc
82+
} else if ((expiry - now) <= warn_secs) {
83+
print yellow "WARNING: [" label "] Primary key expires " expdate " (" days_left " days) -- update soon!" nc
84+
} else {
85+
print "[" label "] Primary key expires " expdate " (" days_left " days)"
86+
}
87+
} else {
88+
print "[" label "] Primary key: no expiry"
89+
}
90+
}
91+
'
92+
93+
# Report change status via git
94+
if git -C "$REPO_ROOT" diff --quiet -- "$KEY_RELPATH"; then
95+
echo "[$LABEL] No change — key is identical to the committed version."
96+
else
97+
echo ""
98+
echo "[$LABEL] Key has CHANGED since the last committed version:"
99+
echo ""
100+
git -C "$REPO_ROOT" diff --stat -- "$KEY_RELPATH"
101+
echo ""
102+
echo "Review the diff with:"
103+
echo " git diff -- $KEY_RELPATH"
104+
echo ""
105+
echo "If the change is expected, commit it with:"
106+
echo " git add $KEY_RELPATH"
107+
echo " git commit -s -S -m 'distro/keys: update $LABEL signing key'"
108+
fi

‎bin/update_distro_signing_key/qubes.sh‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#! /usr/bin/env bash
2+
# Update all Qubes OS distro signing keys (release 4.2, 4.3, weekly builds).
3+
# See bin/update_distro_signing_key/helper.sh for details.
4+
#
5+
# Key fingerprints:
6+
# Qubes 4.2: 9C88 4DF3 F810 64A5 69A4 A9FA E022 E58F 8E34 D89F
7+
# Qubes 4.3: F3FA 3F99 D628 1F7B 3A3E 5E87 1C3D 9B62 7F3F ADA4
8+
# Qubes weekly: 9B7E 61D3 BB70 C4B1 335C E5B6 7B72 A119 CCCA 57BB
9+
10+
set -eo pipefail
11+
12+
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
13+
HELPER="$SCRIPT_DIR/lib/helper.sh"
14+
15+
rc=0
16+
run() { "$HELPER" "$@" || { local e=$?; [ $e -gt $rc ] && rc=$e; }; }
17+
18+
run "Qubes OS 4.2" \
19+
"https://keys.qubes-os.org/keys/qubes-release-4.2-signing-key.asc" \
20+
"Qubes OS Release 4.2 Signing Key" \
21+
"initrd/etc/distro/keys/qubes-4.2.key"
22+
23+
run "Qubes OS 4.3" \
24+
"https://keys.qubes-os.org/keys/qubes-release-4.3-signing-key.asc" \
25+
"Qubes OS Release 4.3 Signing Key" \
26+
"initrd/etc/distro/keys/qubes-4.3.key"
27+
28+
run "Qubes OS weekly builds" \
29+
"https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x9B7E61D3BB70C4B1335CE5B67B72A119CCCA57BB" \
30+
"Qubes OS Weekly Builds Signing Key" \
31+
"initrd/etc/distro/keys/qubes-weekly-builds-signing-key.asc"
32+
33+
exit "$rc"

‎bin/update_distro_signing_key/tails.sh‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#! /usr/bin/env bash
2+
# Update the Tails distro signing key.
3+
# See bin/update_distro_signing_key/helper.sh for details.
4+
5+
set -eo pipefail
6+
7+
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
8+
9+
exec "$SCRIPT_DIR/lib/helper.sh" \
10+
"Tails" \
11+
"https://tails.boum.org/tails-signing.key" \
12+
"tails@boum.org" \
13+
"initrd/etc/distro/keys/tails.key"

‎bin/update_distro_signing_keys.sh‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
#! /usr/bin/env bash
2+
# Update all distro signing keys in initrd/etc/distro/keys/.
3+
# Auto-discovers and runs every script in bin/update_distro_signing_key/
4+
# except helper.sh. Adding a new distro only requires adding a new script
5+
# in that directory — this meta script needs no changes.
6+
#
7+
# Exit codes:
8+
# 0 — all keys up to date, no action needed
9+
# 1 — one or more keys changed (review with git diff, then commit)
10+
# 2 — one or more per-distro scripts failed (download/import error)
11+
12+
set -eo pipefail
13+
14+
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
15+
SUBDIR="$SCRIPT_DIR/update_distro_signing_key"
16+
17+
failed=()
18+
19+
for script in "$SUBDIR"/*.sh; do
20+
if ! "$script"; then
21+
failed+=("$(basename "$script")")
22+
fi
23+
echo ""
24+
done
25+
26+
echo "========================================"
27+
28+
# Summarize git-changed key files
29+
mapfile -t changed < <(git -C "$SCRIPT_DIR/.." diff --name-only -- initrd/etc/distro/keys/)
30+
31+
if [ ${#failed[@]} -gt 0 ]; then
32+
echo "FAILED: ${failed[*]}"
33+
fi
34+
35+
if [ ${#changed[@]} -gt 0 ]; then
36+
echo "Keys that changed:"
37+
for f in "${changed[@]}"; do echo " $f"; done
38+
echo ""
39+
echo "Commit all changes with:"
40+
echo " git add initrd/etc/distro/keys/"
41+
echo " git commit -s -S -m 'distro/keys: update distro signing keys'"
42+
[ ${#failed[@]} -gt 0 ] && exit 2
43+
exit 1
44+
else
45+
echo "All keys are up to date."
46+
[ ${#failed[@]} -gt 0 ] && exit 2
47+
exit 0
48+
fi

‎initrd/etc/distro/keys/archlinux.key‎

Lines changed: 10 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,14 @@
11
-----BEGIN PGP PUBLIC KEY BLOCK-----
22

33
mDMEY1+RVxYJKwYBBAHaRw8BAQdAd3XdZwOmmiALePwd26Bu3hPblAfHflGN+Lud
4-
gE2Qyby0JFBpZXJyZSBTY2htaXR6IDxwaWVycmVAYXJjaGxpbnV4LmRlPoiWBBMW
5-
CAA+AhsDBQkcMgSABQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAFiEEPoDKGouJ9py6
6-
V9mKdqXvkFREmlwFAmNfk2gACgkQdqXvkFREmlzdiwD9Hf7TDfxBrJ1YwpD9lLtU
7-
VI4Kpze3P5deOb5REsGE5ocBAPn7WymPFoTUfrrxfmlsqZtSz+2D5GdXEWQYOTqU
8-
vu0MtCVQaWVycmUgU2NobWl0eiA8cGllcnJlQGFyY2hsaW51eC5vcmc+iJkEExYI
9-
AEECGwMFCRwyBIAFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AWIQQ+gMoai4n2nLpX
10-
2Yp2pe+QVESaXAUCY1+TaAIZAQAKCRB2pe+QVESaXLQPAQCFeOXY4m9LPfMDNzrO
11-
IElLyh+w9p9PBa80AsAsjXGC1gEAy9Ymc3jnAj2MJDnby3b5WyNzDbjBMKVhv2Cv
12-
mDln0Aq4MwRjX5HTFgkrBgEEAdpHDwEBB0DjSWuxVrnVYEIcJlRJPmn54ReBGvqP
13-
+EYB2BVx5ZFPv4h+BBgWCAAmFiEEPoDKGouJ9py6V9mKdqXvkFREmlwFAmNfkdMC
14-
GyAFCRwyBIAACgkQdqXvkFREmlzEGwEAwvDuiUn1Mgw0x7/m0hXzveAAgLVdJWD+
15-
0/YiepxE9GoA/jCgNca2AuWyi416FYQkFtqtlIjWUb56hY5WlBvpNZIOuDgEY1+R
16-
VxIKKwYBBAGXVQEFAQEHQIhe0t8UMpN+G4c24ByW/Y1vu1m3C62KsvlRPzw/R0AN
17-
AwEIB4h+BBgWCAAmFiEEPoDKGouJ9py6V9mKdqXvkFREmlwFAmNfkVcCGwwFCRwy
18-
BIAACgkQdqXvkFREmlynZgD+PlibATlapVxz6EprGMfnktevUlfWQwShRJ+w/x8I
19-
zyAA/0nOvoE7j4sdvg4QoW/s2nPYaDy8EK/XAMRT15eScYIH
20-
=FFYH
4+
gE2Qyby0JVBpZXJyZSBTY2htaXR6IDxwaWVycmVAYXJjaGxpbnV4Lm9yZz6ImQQT
5+
FggAQQIbAwUJHDIEgAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgBYhBD6AyhqLifac
6+
ulfZinal75BURJpcBQJjX5NoAhkBAAoJEHal75BURJpctA8BAIV45djib0s98wM3
7+
Os4gSUvKH7D2n08FrzQCwCyNcYLWAQDL1iZzeOcCPYwkOdvLdvlbI3MNuMEwpWG/
8+
YK+YOWfQCrQkUGllcnJlIFNjaG1pdHogPHBpZXJyZUBhcmNobGludXguZGU+iJYE
9+
ExYIAD4CGwMFCRwyBIAFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AWIQQ+gMoai4n2
10+
nLpX2Yp2pe+QVESaXAUCY1+TaAAKCRB2pe+QVESaXN2LAP0d/tMN/EGsnVjCkP2U
11+
u1RUjgqnN7c/l145vlESwYTmhwEA+ftbKY8WhNR+uvF+aWypm1LP7YPkZ1cRZBg5
12+
OpS+7Qw=
13+
=6aX0
2114
-----END PGP PUBLIC KEY BLOCK-----

0 commit comments

Comments
 (0)