64 lines
1.7 KiB
Bash
Executable File
64 lines
1.7 KiB
Bash
Executable File
#!/bin/sh
|
|
# gen-gpg-key.sh — Generate a passwordless GPG key and export to overlay/.
|
|
# Run this BEFORE alpine-make-vm-image on the build host.
|
|
set -eu
|
|
|
|
OVERLAY_DIR="$(dirname "$0")/overlay"
|
|
KEY_FILE="$OVERLAY_DIR/root/gpg-key.asc"
|
|
KEY_NAME="VM Builder"
|
|
KEY_EMAIL="builder@localhost"
|
|
|
|
if ! command -v gpg >/dev/null 2>&1; then
|
|
echo "ERROR: gpg (gnupg) is required on the build host" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Ensure the target directory exists
|
|
mkdir -p "$(dirname "$KEY_FILE")"
|
|
|
|
# Only generate if the key file doesn't already exist
|
|
if [ -f "$KEY_FILE" ]; then
|
|
echo "GPG key already exists: $KEY_FILE"
|
|
echo "Remove it first if you want to regenerate."
|
|
exit 0
|
|
fi
|
|
|
|
echo "=== Generating passwordless RSA 4096 GPG key ==="
|
|
|
|
# Create a batch specification for unattended key generation.
|
|
# %no-protection means no passphrase.
|
|
BATCH_FILE="$(mktemp /tmp/gpg-batch.XXXXXX)"
|
|
cat > "$BATCH_FILE" <<'GPGBATCH'
|
|
%echo Generating RSA 4096 key...
|
|
Key-Type: RSA
|
|
Key-Length: 4096
|
|
Subkey-Type: RSA
|
|
Subkey-Length: 4096
|
|
Name-Real: VM Builder
|
|
Name-Email: builder@localhost
|
|
Expire-Date: 0
|
|
%no-protection
|
|
%commit
|
|
%echo Done
|
|
GPGBATCH
|
|
|
|
gpg --batch --yes --pinentry-mode loopback --generate-key "$BATCH_FILE"
|
|
rm -f "$BATCH_FILE"
|
|
|
|
echo ""
|
|
echo "=== Exporting secret key to $KEY_FILE ==="
|
|
|
|
gpg --batch --yes --pinentry-mode loopback --export-secret-keys --armor "$KEY_EMAIL" > "$KEY_FILE"
|
|
|
|
# Also export just the public key for reference
|
|
gpg --batch --yes --pinentry-mode loopback --export --armor "$KEY_EMAIL" > "$OVERLAY_DIR/root/gpg-pubkey.asc"
|
|
|
|
echo ""
|
|
echo "=== GPG key generated ==="
|
|
echo "Public key : $OVERLAY_DIR/root/gpg-pubkey.asc"
|
|
echo "Secret key : $KEY_FILE"
|
|
echo ""
|
|
|
|
# Print fingerprint
|
|
gpg --batch --fingerprint "$KEY_EMAIL" || true
|