diff options
| author | Allan McRae <allan@archlinux.org> | 2022-05-31 19:32:12 +1000 |
|---|---|---|
| committer | Allan McRae <allan@archlinux.org> | 2022-05-31 20:13:14 +1000 |
| commit | 84dc662d6527be261cf2288d5af2dd7f7e4207dd (patch) | |
| tree | 2fafa869e14f43a60c4ce512ac6d5bcb9a7f566e | |
| parent | fdf04cdac57f62dcfa4f2bc2b7dcc5a2dc140076 (diff) | |
makepkg: add source signing PGP keys to source package if available
Arch Linux is adding source signing PGP keys to their package source
tree alongside PKGBUILDs in the form keys/pgp/$fingerprint.asc. As the
PGP keyserver infrastructure is a mess, this helps other people validate
sources in a PKGBUILD.
Add the keys to source packages if found alongside the PKGBUILD.
Signed-off-by: Allan McRae <allan@archlinux.org>
| -rw-r--r-- | scripts/makepkg.sh.in | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 69757d03..bddcbe03 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -705,6 +705,16 @@ create_srcpackage() { done pkgname=(${pkgname_backup[@]}) + # add a copy of source PGP signing public keys if availabe in keys/pgp/<fingerprint>.asc + local key + for key in ${validpgpkeys[@]}; do + if [[ -f keys/pgp/$key.asc ]]; then + mkdir -p "${srclinks}/${pkgbase}/keys/pgp/" + ln -s "${startdir}/keys/pgp/$key.asc" "${srclinks}/${pkgbase}/keys/pgp/" + fi + done + + local fullver=$(get_full_version) local pkg_file="$SRCPKGDEST/${pkgbase}-${fullver}${SRCEXT}" |