signify-snapshots

#!/bin/sh
# verify all snapshots, architectures and packages with signify

set -eu

if [ $# != 0 ]
then
	echo usage: signify-snapshots >&2
	exit 2
fi

debug="${debug:=debug}"
ftp="/data/mirror/openbsd/ftp"
tag="signify-snapshots[$$]"

logger -p daemon.info -t "$tag" "openbsd start"

# verify each architecture snapshot

for dir in $ftp/snapshots/*
do
	[ -d "$dir" ] || continue
	arch="${dir##*/}"
	case "$arch" in
		Changelogs|packages|tools) continue ;;
	esac
	logger -p daemon.info -t "$tag" "openbsd $arch start"

	base="`echo "$dir"/base??.tgz`"
	if ! [ -f "$base" ]
	then
		logger -p daemon.warning -s -t "$tag" \
		    "openbsd $dir.new no base tgz"
		continue
	fi
	version="${base##*/base}"
	version="${version%.tgz}"
	key="/etc/signify/openbsd-$version-base.pub"
	logger -p daemon.info -t "$tag" "openbsd $arch signify key $key"

	if ! ( cd "$dir" && signify -C -p $key -x SHA256.sig )
	then
		logger -p daemon.warning -s -t "$tag" "openbsd $dir fail"
	else
		logger -p daemon.notice -t "$tag" "openbsd $arch success"
	fi | logger -p "daemon.$debug" -t signify
done

# verify each architecture package

for dir in $ftp/snapshots/packages/*
do
	[ -d "$dir" ] || continue
	arch=${dir##*/}
	logger -p daemon.info -t "$tag" "openbsd package $arch start"

	if ! [ -f "$dir/SHA256.sig" ]
	then
		logger -p daemon.warning -s -t "$tag" \
		    "openbsd $dir no SHA256 sig"
		continue
	fi
	key=`sed -n '1s,^untrusted comment: verify with \(openbsd-..-pkg.pub\)$,/etc/signify/\1,p' "$dir/SHA256.sig"`
	if [ -z "$key" ]
	then
		logger -p daemon.warning -s -t "$tag" \
		    "openbsd $dir no key name in comment"
		continue
	fi

	if ! ( cd "$dir" && signify -C -p $key -x SHA256.sig )
	then
		logger -p daemon.warning -s -t "$tag" "openbsd $dir fail"
	else
		logger -p daemon.notice -t "$tag" \
		    "openbsd package $arch success"
	fi | logger -p "daemon.$debug" -t signify
done

logger -p daemon.notice -t "$tag" "openbsd finished"
exit 0