000

#!/bin/bash
# release.sh — build and sign release artifacts for imh-snap-stat.
#
# Run from the repository root with the release signing PRIVATE key in
# the local GPG keyring. Set RELEASE_KEY_ID to the full 40-char
# fingerprint of that key (the same value embedded in install.sh).
#
# Produces:
#   MANIFEST.txt          sha256 of every release artifact
#   MANIFEST.txt.asc      detached GPG signature of MANIFEST.txt
#   install.sh.asc        detached GPG signature of install.sh
#   release-pubkey.asc    armored release public key (trust anchor)
#
# Upload all five files plus every artifact listed in MANIFEST.txt to:
#   https://gitlab.panelplugins.com/plugins/imh-snap-stat/-/raw/master/

set -euo pipefail

readonly KEY_ID="${RELEASE_KEY_ID:-}"
readonly ARTIFACTS=(
	install.sh
	index.php
	imh-snap-stat.php
	imh-snap-stat.conf
	imh-snap-stat.js
	imh-snap-stat.png
	imh-plugins.php
	sys-snap.pl
)

if [[ -z "$KEY_ID" ]]; then
	echo "ERROR: RELEASE_KEY_ID is not set." >&2
	echo "Set it to the full fingerprint of the release signing key, e.g.:" >&2
	echo "  RELEASE_KEY_ID=AAAA1111BBBB2222CCCC3333DDDD4444EEEE5555 ./release.sh" >&2
	exit 1
fi

if ! command -v gpg >/dev/null 2>&1; then
	echo "ERROR: gpg is required." >&2
	exit 1
fi

# Verify all artifacts exist before doing any signing.
for f in "${ARTIFACTS[@]}"; do
	if [[ ! -f "$f" ]]; then
		echo "ERROR: missing artifact: $f" >&2
		exit 1
	fi
done

# Verify install.sh embeds the same key fingerprint as the one we're signing with.
if ! grep -q "RELEASE_KEY_FINGERPRINT='${KEY_ID}'" install.sh; then
	echo "ERROR: install.sh does not embed RELEASE_KEY_FINGERPRINT='${KEY_ID}'." >&2
	echo "Update install.sh (RELEASE_KEY_FINGERPRINT and the release_pubkey() block)" >&2
	echo "to match the key you are signing with, then rerun this script." >&2
	exit 1
fi

# Verify the release public key is in the keyring.
if ! gpg --list-secret-keys --with-colons "$KEY_ID" 2>/dev/null | grep -q '^sec'; then
	echo "ERROR: no secret key in keyring for $KEY_ID" >&2
	exit 1
fi

echo ">>> Exporting release public key to release-pubkey.asc"
gpg --batch --yes --armor --export "$KEY_ID" > release-pubkey.asc
if ! [[ -s release-pubkey.asc ]]; then
	echo "ERROR: failed to export public key for $KEY_ID" >&2
	exit 1
fi

echo ">>> Building MANIFEST.txt"
sha256sum "${ARTIFACTS[@]}" > MANIFEST.txt
echo "    $(wc -l < MANIFEST.txt) entries"

echo ">>> Signing MANIFEST.txt with $KEY_ID"
rm -f MANIFEST.txt.asc
gpg --batch --yes --armor --detach-sign --local-user "$KEY_ID" MANIFEST.txt
gpg --batch --quiet --verify MANIFEST.txt.asc MANIFEST.txt

echo ">>> Signing install.sh with $KEY_ID"
rm -f install.sh.asc
gpg --batch --yes --armor --detach-sign --local-user "$KEY_ID" install.sh
gpg --batch --quiet --verify install.sh.asc install.sh

cat <<EOF

==> Release artifacts ready. Upload to BASE_URL:

install.sh
  install.sh.asc
  release-pubkey.asc
  MANIFEST.txt
  MANIFEST.txt.asc
EOF
for f in "${ARTIFACTS[@]:1}"; do
	echo "  $f"
done
echo
echo "If you rotated the release key, also re-export the public key block"
echo "and update release_pubkey() and RELEASE_KEY_FINGERPRINT in install.sh,"
echo "then rerun this script."