init

gen-gpg-key.sh

@@ -0,0 +1,63 @@
+#!/bin/sh
+# gen-gpg-key.sh — Generate a passwordless GPG key and export to overlay/.
+# Run this BEFORE alpine-make-vm-image on the build host.
+set -eu
+
+OVERLAY_DIR="$(dirname "$0")/overlay"
+KEY_FILE="$OVERLAY_DIR/root/gpg-key.asc"
+KEY_NAME="VM Builder"
+KEY_EMAIL="builder@localhost"
+
+if ! command -v gpg >/dev/null 2>&1; then
+	echo "ERROR: gpg (gnupg) is required on the build host" >&2
+	exit 1
+fi
+
+# Ensure the target directory exists
+mkdir -p "$(dirname "$KEY_FILE")"
+
+# Only generate if the key file doesn't already exist
+if [ -f "$KEY_FILE" ]; then
+	echo "GPG key already exists: $KEY_FILE"
+	echo "Remove it first if you want to regenerate."
+	exit 0
+fi
+
+echo "=== Generating passwordless RSA 4096 GPG key ==="
+
+# Create a batch specification for unattended key generation.
+# %no-protection means no passphrase.
+BATCH_FILE="$(mktemp /tmp/gpg-batch.XXXXXX)"
+cat > "$BATCH_FILE" <<'GPGBATCH'
+%echo Generating RSA 4096 key...
+Key-Type: RSA
+Key-Length: 4096
+Subkey-Type: RSA
+Subkey-Length: 4096
+Name-Real: VM Builder
+Name-Email: builder@localhost
+Expire-Date: 0
+%no-protection
+%commit
+%echo Done
+GPGBATCH
+
+gpg --batch --yes --pinentry-mode loopback --generate-key "$BATCH_FILE"
+rm -f "$BATCH_FILE"
+
+echo ""
+echo "=== Exporting secret key to $KEY_FILE ==="
+
+gpg --batch --yes --pinentry-mode loopback --export-secret-keys --armor "$KEY_EMAIL" > "$KEY_FILE"
+
+# Also export just the public key for reference
+gpg --batch --yes --pinentry-mode loopback --export --armor "$KEY_EMAIL" > "$OVERLAY_DIR/root/gpg-pubkey.asc"
+
+echo ""
+echo "=== GPG key generated ==="
+echo "Public key : $OVERLAY_DIR/root/gpg-pubkey.asc"
+echo "Secret key : $KEY_FILE"
+echo ""
+
+# Print fingerprint
+gpg --batch --fingerprint "$KEY_EMAIL" || true