upstream/certbot
1
0
Fork 0
mirror of https://github.com/certbot/certbot.git synced 2026-06-09 00:32:12 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

Modify release script to support yubikey sig (#8574)

Browse source 
Using `tools/offline-sigrequest.sh` is annoying. A while ago I looked into how we could use our yubikeys for our Windows code signing signatures and in the process of doing that learned how to use them for the certbot-auto signature. The certbot-auto signature won't be needed once https://github.com/certbot/certbot/issues/8526 is resolved and we've implemented that plan which will hopefully be in 2-3 months, but despite that, doing this still felt worth it to me.

The script still defaults to using `tools/offline-sign.sh`, but you can set an environment variable to use the yubikey instead. I tested both branches here and it worked.
This commit is contained in:
Brad Warren 2021-01-11 15:41:55 -08:00 committed by GitHub
parent 42f20455cd
commit 7a02deeeba
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 16 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
tools/_release.sh
View file

@ -216,8 +216,21 @@ fi
# ensure we have the latest built version of leauto
letsencrypt-auto-source/build.py
# and that it's signed correctly
tools/offline-sigrequest.sh || true
# Now we have to sign the built version of leauto. If
# RELEASE_OPENSSL_WITH_YUBIKEY is set, try to use the yubikey to sign
# letsencrypt-auto, otherwise, use tools/offline-sigrequest.sh.
if [ -n "$RELEASE_OPENSSL_WITH_YUBIKEY" ]; then
SignLEAuto() {
yubico-piv-tool -a verify-pin --sign -s 9c -i letsencrypt-auto-source/letsencrypt-auto -o letsencrypt-auto-source/letsencrypt-auto.sig
}
else
SignLEAuto() {
tools/offline-sigrequest.sh
}
fi
# Loop until letsencrypt-auto is signed correctly.
SignLEAuto || true
while ! openssl dgst -sha256 -verify $RELEASE_OPENSSL_PUBKEY -signature \
letsencrypt-auto-source/letsencrypt-auto.sig \
letsencrypt-auto-source/letsencrypt-auto ; do
@ -225,7 +238,7 @@ while ! openssl dgst -sha256 -verify $RELEASE_OPENSSL_PUBKEY -signature \
read -p "Would you like this script to try and sign it again [Y/n]?" response
case $response in
[yY][eE][sS]|[yY]|"")
tools/offline-sigrequest.sh || true;;
SignLEAuto || true;;
*)
;;
esac