starred/certbot
1
0
Fork 0
mirror of https://github.com/certbot/certbot.git synced 2026-08-01 18:56:55 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add better error handling around release signatures (#6353)

Browse Source 
* Better error handling around sig after offline-sig

* Add error handling around first sig with git.

* Don't fail if offline-sig fails.
This commit is contained in:
Brad Warren
2018-09-11 15:44:26 -07:00
committed by ohemorange
parent 85a859d63f
commit 251355cade
1 changed files with 15 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/_release.sh
+15 -13
View File
@@ -15,8 +15,7 @@ RELEASE_BRANCH="candidate-$version"
if [ "$RELEASE_OPENSSL_PUBKEY" = "" ] ; then if [ "$RELEASE_OPENSSL_PUBKEY" = "" ] ; then
RELEASE_OPENSSL_PUBKEY="`realpath \`dirname $0\``/eff-pubkey.pem" RELEASE_OPENSSL_PUBKEY="`realpath \`dirname $0\``/eff-pubkey.pem"
fi fi
DEFAULT_GPG_KEY="A2CFB51FA275A7286234E7B24D17C995CD9775F2" RELEASE_GPG_KEY=${RELEASE_GPG_KEY:-A2CFB51FA275A7286234E7B24D17C995CD9775F2}
RELEASE_GPG_KEY=${RELEASE_GPG_KEY:-"$DEFAULT_GPG_KEY"}
# Needed to fix problems with git signatures and pinentry # Needed to fix problems with git signatures and pinentry
export GPG_TTY=$(tty) export GPG_TTY=$(tty)
@@ -185,7 +184,7 @@ fi
letsencrypt-auto-source/build.py letsencrypt-auto-source/build.py
# and that it's signed correctly # and that it's signed correctly
tools/offline-sigrequest.sh tools/offline-sigrequest.sh || true
while ! openssl dgst -sha256 -verify $RELEASE_OPENSSL_PUBKEY -signature \ while ! openssl dgst -sha256 -verify $RELEASE_OPENSSL_PUBKEY -signature \
letsencrypt-auto-source/letsencrypt-auto.sig \ letsencrypt-auto-source/letsencrypt-auto.sig \
letsencrypt-auto-source/letsencrypt-auto ; do letsencrypt-auto-source/letsencrypt-auto ; do
@@ -193,21 +192,19 @@ while ! openssl dgst -sha256 -verify $RELEASE_OPENSSL_PUBKEY -signature \
read -p "Would you like this script to try and sign it again [Y/n]?" response read -p "Would you like this script to try and sign it again [Y/n]?" response
case $response in case $response in
[yY][eE][sS]|[yY]|"") [yY][eE][sS]|[yY]|"")
tools/offline-sigrequest.sh;; tools/offline-sigrequest.sh || true;;
*) *)
;; ;;
esac esac
done done
if [ "$RELEASE_GPG_KEY" = "$DEFAULT_GPG_KEY" ]; then
while ! gpg2 --card-status >/dev/null 2>&1; do
echo gpg cannot find your OpenPGP card
read -p "Please take the card out and put it back in again."
done
fi
# This signature is not quite as strong, but easier for people to verify out of band # This signature is not quite as strong, but easier for people to verify out of band
gpg2 -u "$RELEASE_GPG_KEY" --detach-sign --armor --sign --digest-algo sha256 letsencrypt-auto-source/letsencrypt-auto while ! gpg2 -u "$RELEASE_GPG_KEY" --detach-sign --armor --sign --digest-algo sha256 letsencrypt-auto-source/letsencrypt-auto; do
echo "Unable to sign letsencrypt-auto using $RELEASE_KEY."
echo "Make sure your OpenPGP card is in your computer if you are using one."
echo "You may need to take the card out and put it back in again."
read -p "Press enter to try signing again."
done
# We can't rename the openssl letsencrypt-auto.sig for compatibility reasons, # We can't rename the openssl letsencrypt-auto.sig for compatibility reasons,
# but we can use the right name for certbot-auto.asc from day one # but we can use the right name for certbot-auto.asc from day one
mv letsencrypt-auto-source/letsencrypt-auto.asc letsencrypt-auto-source/certbot-auto.asc mv letsencrypt-auto-source/letsencrypt-auto.asc letsencrypt-auto-source/certbot-auto.asc
@@ -218,7 +215,12 @@ cp -p letsencrypt-auto-source/letsencrypt-auto letsencrypt-auto
git add certbot-auto letsencrypt-auto letsencrypt-auto-source docs/cli-help.txt git add certbot-auto letsencrypt-auto letsencrypt-auto-source docs/cli-help.txt
git diff --cached git diff --cached
git commit --gpg-sign="$RELEASE_GPG_KEY" -m "Release $version" while ! git commit --gpg-sign="$RELEASE_GPG_KEY" -m "Release $version"; do
echo "Unable to sign the release commit using git."
echo "You may have to configure git to use gpg2 by running:"
echo 'git config --global gpg.program $(command -v gpg2)'
read -p "Press enter to try signing again."
done
git tag --local-user "$RELEASE_GPG_KEY" --sign --message "Release $version" "$tag" git tag --local-user "$RELEASE_GPG_KEY" --sign --message "Release $version" "$tag"
cd .. cd ..