#!/usr/bin/env bash

# This script signs a given binary using GPG.
# It expects the binary to be signed as the first argument.
#
# Usage: ./sign_with_gpg.sh path/to/binary
#
# On success, the input file will be signed using the GPG key and the signature output file will moved to /site/out/bin/ (happens in the Makefile)
#
# Depends on the GPG utility. Requires the following environment variables to be set:
#  - $CODER_GPG_RELEASE_KEY_BASE64: The base64 encoded private key to use.

set -euo pipefail
# shellcheck source=scripts/lib.sh
source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"

requiredenvs CODER_GPG_RELEASE_KEY_BASE64

FILE_TO_SIGN="$1"

if [[ -z "$FILE_TO_SIGN" ]]; then
	error "Usage: $0 <file_to_sign>"
fi

if [[ ! -f "$FILE_TO_SIGN" ]]; then
	error "File not found: $FILE_TO_SIGN"
fi

# Import the GPG key.
old_gnupg_home="${GNUPGHOME:-}"
gnupg_home_temp="$(mktemp -d)"
export GNUPGHOME="$gnupg_home_temp"

# Ensure GPG uses the temporary directory
echo "$CODER_GPG_RELEASE_KEY_BASE64" | base64 -d | gpg --homedir "$gnupg_home_temp" --import 1>&2

# Mark the imported key as ultimately trusted so GPG does not emit an
# "untrusted key" warning during signature verification. We derive the
# fingerprint from the keyring rather than hard-coding it so this works
# regardless of which key is supplied.
fingerprint="$(gpg --homedir "$gnupg_home_temp" --with-colons --fingerprint | awk -F: '/^fpr/ { print $10; exit }')"
echo "${fingerprint}:6:" | gpg --homedir "$gnupg_home_temp" --import-ownertrust 1>&2

# Sign the binary. This generates a file in the same directory and
# with the same name as the binary but ending in ".asc".
#
# We pipe `true` into `gpg` so that it never tries to be interactive (i.e.
# ask for a passphrase). The key we import above is not password protected.
true | gpg --homedir "$gnupg_home_temp" --detach-sign --armor "$FILE_TO_SIGN" 1>&2

# Verify the signature and capture the exit status
gpg --homedir "$gnupg_home_temp" --verify "${FILE_TO_SIGN}.asc" "$FILE_TO_SIGN" 1>&2
verification_result=$?

# Clean up the temporary GPG home
rm -rf "$gnupg_home_temp"
unset GNUPGHOME
if [[ "$old_gnupg_home" != "" ]]; then
	export GNUPGHOME="$old_gnupg_home"
fi

if [[ $verification_result -eq 0 ]]; then
	echo "${FILE_TO_SIGN}.asc"
else
	error "Signature verification failed!"
fi