bryson/pacman
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

makepkg: add source signing PGP keys to source package if available

Browse source 
Arch Linux is adding source signing PGP keys to their package source
tree alongside PKGBUILDs in the form keys/pgp/$fingerprint.asc. As the
PGP keyserver infrastructure is a mess, this helps other people validate
sources in a PKGBUILD.

Add the keys to source packages if found alongside the PKGBUILD.

Signed-off-by: Allan McRae <allan@archlinux.org>
This commit is contained in:
Allan McRae 2022-05-31 19:32:12 +10:00
parent fdf04cdac5
commit 84dc662d65
1 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
scripts/makepkg.sh.in
View file

@ -705,6 +705,16 @@ create_srcpackage() {
done done
pkgname=(${pkgname_backup[@]}) pkgname=(${pkgname_backup[@]})
# add a copy of source PGP signing public keys if availabe in keys/pgp/<fingerprint>.asc
local key
for key in ${validpgpkeys[@]}; do
if [[ -f keys/pgp/$key.asc ]]; then
mkdir -p "${srclinks}/${pkgbase}/keys/pgp/"
ln -s "${startdir}/keys/pgp/$key.asc" "${srclinks}/${pkgbase}/keys/pgp/"
fi
done
local fullver=$(get_full_version) local fullver=$(get_full_version)
local pkg_file="$SRCPKGDEST/${pkgbase}-${fullver}${SRCEXT}" local pkg_file="$SRCPKGDEST/${pkgbase}-${fullver}${SRCEXT}"