root/build-tools/sign_iso_formal.sh
Paul-Emile Element 2f9d9a5672 cleanup signing scripts
the scripts contained hardcoded references to resources
that are not visible outside of the environment
where the scripts were originally created and used

The scripts sign-rpms was also updated with the original version
that was intended to be submitted. The initial submission contained
the wrong version.

Closes-Bug: #1791343

Change-Id: I8ce5884ad75156d3730cf30a451051d32445e136
Signed-off-by: Paul-Emile Element <Paul-Emile.Element@windriver.com>
2018-09-07 14:44:37 -04:00

62 lines
2.0 KiB
Bash
Executable File

#!/bin/bash
# This script makes a request to the signing server to sign a .iso with the
# formal key. It will only work for users authorized to access the signing
# server. The detached signature is placed in the same path as the .iso as
# the file bootimage.sig
#
# Script written to be quite simple
if [ "x$1" == "x" ]; then
echo "You must specify an ISO file to sign"
exit 1
fi
ISO_FILE_PATH=$1
ISO_FILE_NAME=$(basename ${ISO_FILE_PATH})
ISO_FILE_ROOT=$(dirname ${ISO_FILE_PATH})
ISO_FILE_NOEXT="${ISO_FILE_NAME%.*}"
GET_UPLOAD_PATH="sudo /opt/signing/sign.sh -r"
REQUEST_SIGN="sudo /opt/signing/sign_iso.sh"
SIGNATURE_FILE="$ISO_FILE_NOEXT.sig"
# Make a request for an upload path
# Output is a path where we can upload stuff, of the form
# "Upload: /tmp/sign_upload.5jR11pS0"
UPLOAD_PATH=`ssh ${SIGNING_USER}@${SIGNING_SERVER} ${GET_UPLOAD_PATH}`
if [ $? -ne 0 ]; then
echo "Could not get upload path. Do you have permissions on the signing server?"
exit 1
fi
UPLOAD_PATH=`echo ${UPLOAD_PATH} | cut -d ' ' -f 2`
echo "Uploading file"
scp -q ${ISO_FILE_PATH} ${SIGNING_USER}@${SIGNING_SERVER}:${UPLOAD_PATH}
if [ $? -ne 0 ]; then
echo "Could not upload ISO"
exit 1
fi
echo "File uploaded to signing server -- signing"
# Make the signing request.
# Output is path of detached signature
RESULT=`ssh ${SIGNING_USER}@${SIGNING_SERVER} ${REQUEST_SIGN} ${UPLOAD_PATH}/${ISO_FILE_NAME}`
if [ $? -ne 0 ]; then
echo "Could not perform signing -- output $RESULT"
ssh ${SIGNING_USER}@${SIGNING_SERVER} rm -f ${UPLOAD_PATH}/${ISO_FILE_NAME}
exit 1
fi
echo "Signing complete. Downloading detached signature"
scp -q ${SIGNING_USER}@${SIGNING_SERVER}:${RESULT} ${ISO_FILE_ROOT}/${SIGNATURE_FILE}
if [ $? -ne 0 ]; then
echo "Could not download newly signed file"
ssh ${SIGNING_USER}@${SIGNING_SERVER} rm -f ${UPLOAD_PATH}/${ISO_FILE_NAME}
exit 1
fi
# Clean up (ISOs are big)
ssh ${SIGNING_USER}@${SIGNING_SERVER} rm -f ${UPLOAD_PATH}/${ISO_FILE_NAME}
echo "${ISO_FILE_ROOT}/${SIGNATURE_FILE} detached signature"