#!/bin/bash
# wren-key-gpg: written by Wren Linux extras/signing-key.sh
# What git runs as gpg in a repository wren-key git-setup set up
# (gpg.program). Signing goes to Wren Linux's signer (its own user, with no
# network; sudo asks for your password now and then); checking a signature is
# done here, as you, with the public key only. Anything else is refused.
set -uo pipefail
die() { printf 'wren-key-gpg: %s\n' "$*" >&2; exit 2; }

# (a test points these at a pretend sudo and a copy of the signer)
SUDO=${WREN_SUDO:-sudo}
SIGNER=${WREN_SIGNER:-/usr/local/libexec/wren-signer}
STATE=${XDG_DATA_HOME:-$HOME/.local/share}/wren/signing-key

f=$(cat "$STATE/fingerprint" 2>/dev/null) || die "there is no signing key here: run wren-key"

# git checks a signature: gpg ... --verify SIGFILE -
for a; do
    if [ "$a" = --verify ]; then
        exec gpg --homedir "$STATE/public" --no-auto-key-retrieve --no-auto-key-locate "$@"
    fi
done

# git signs: gpg --status-fd=2 -bsau KEY (data on stdin, the signature on stdout)
key=
while [ $# -gt 0 ]; do
    case $1 in
        --status-fd=2) shift ;;
        -bsau) key=${2:-}; shift 2 || die "no key after -bsau." ;;
        *) die "only signing (as git does it) and checking are done here, not \"$1\"." ;;
    esac
done
[ -n "$key" ] || die "only signing (as git does it) and checking are done here."
# the key git was told to sign with must be this one (user.signingkey)
[ "$key" = "$f" ] || die "git asked for the key $key; Wren Linux's is $f (wren-key git-setup)."
until=$(cat "$STATE/expires" 2>/dev/null || echo 0)
if [ "$until" != 0 ] && [ $(((until - $(date +%s)) / 86400)) -lt 90 ]; then
    printf 'wren-key: the signing subkey stops signing in %s days: wren-key renew BACKUP\n' $(((until - $(date +%s)) / 86400)) >&2
fi
exec "$SUDO" -u wren-signer "$SIGNER" sign