Skip to content

Commit

Permalink
getuto: Get keys from remote keyservers in parallel
Browse files Browse the repository at this point in the history
Signed-off-by: Zen <[email protected]>
  • Loading branch information
desultory committed Oct 23, 2024
1 parent 7567ba5 commit 98dc8c1
Showing 1 changed file with 7 additions and 2 deletions.
9 changes: 7 additions & 2 deletions getuto
Original file line number Diff line number Diff line change
Expand Up @@ -162,14 +162,19 @@ if [[ ! -d ${GNUPGHOME} ]] ; then

# TODO: keys.openpgp.org lacks a UID for our keys, need to verify email
for keyserver in "${mykeyservers[@]}" ; do
gpg ${QUIET_GPG} --batch --keyserver "${keyserver}" --recv-keys ${myrelkeys} || true
einfo "Importing release engineering keys from: ${keyserver}"
gpg ${QUIET_GPG} --batch --keyserver "${keyserver}" --recv-keys ${myrelkeys} || true &
done
# We only sign (-> ultimate trust) the keys we originally import, so this is fine and
# just serves as an additional refresh method.
gpg ${QUIET_GPG} --auto-key-locate=clear,nodefault,wkd --locate-key [email protected] [email protected] [email protected] || true
einfo "Importing release engineering keys using WKD"
gpg ${QUIET_GPG} --auto-key-locate=clear,nodefault,wkd --locate-key [email protected] [email protected] [email protected] || true &

wait

# Locally sign all release engineering keys.
for relkeyid in ${myrelkeys} ; do
einfo "Signing key: ${relkeyid}"
# We have to use --quick-lsign-key for this to work with batch: https://dev.gnupg.org/T1606
if ! gpg ${QUIET_GPG} --batch --yes --no-tty --passphrase-file="${GNUPGHOME}/pass" --pinentry-mode loopback --quick-lsign-key "${relkeyid}" ; then
# But that won't work for subkeys, so fallback to a hackier method.
Expand Down

0 comments on commit 98dc8c1

Please sign in to comment.