Send patches - preferably formatted by git format-patch - to patches at archlinux32 dot org.
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authornl6720 <nl6720@gmail.com>2021-08-07 12:48:23 +0300
committernl6720 <nl6720@gmail.com>2021-08-25 00:26:07 +0300
commitea9572b98e7648bc090e240798244656662e2a09 (patch)
tree02f0973e616453c750a3bcc13a27b80aaa28a7bc
parentd3caf6f3a1d7055d788d8abda3f162c83f67ca48 (diff)
mkarchiso: add some sane gpg options to override those set in user's gpg.conf
* Add --batch, since gpg is run in a script. * Add --no-armor (this is the default). Armored output provides no benifit here. * Add --no-include-key-block (this is the default). There is no need to have the gpg key in the signature. The mkinitcpio hook will verify the signature against the included keyring. Remove the output files before running gpg. Otherwise gpg --batch will fail if they exist.
-rwxr-xr-xarchiso/mkarchiso15
1 files changed, 9 insertions, 6 deletions
diff --git a/archiso/mkarchiso b/archiso/mkarchiso
index 267804a..0a46fd6 100755
--- a/archiso/mkarchiso
+++ b/archiso/mkarchiso
@@ -238,15 +238,17 @@ _mkchecksum() {
# GPG sign the root file system image.
_mksignature() {
+ local airootfs_image_filename
_msg_info "Signing rootfs image..."
- cd -- "${isofs_dir}/${install_dir}/${arch}"
- # always use the .sig file extension, as that is what mkinitcpio-archiso's hooks expect
if [[ -e "${isofs_dir}/${install_dir}/${arch}/airootfs.sfs" ]]; then
- gpg --output airootfs.sfs.sig --detach-sign --default-key "${gpg_key}" airootfs.sfs
+ airootfs_image_filename="${isofs_dir}/${install_dir}/${arch}/airootfs.sfs"
elif [[ -e "${isofs_dir}/${install_dir}/${arch}/airootfs.erofs" ]]; then
- gpg --output airootfs.erofs.sig --detach-sign --default-key "${gpg_key}" airootfs.erofs
+ airootfs_image_filename="${isofs_dir}/${install_dir}/${arch}/airootfs.erofs"
fi
- cd -- "${OLDPWD}"
+ rm -f -- "${airootfs_image_filename}.sig"
+ # always use the .sig file extension, as that is what mkinitcpio-archiso's hooks expect
+ gpg --batch --no-armor --no-include-key-block --output "${airootfs_image_filename}.sig" --detach-sign \
+ --default-key "${gpg_key}" "${airootfs_image_filename}"
_msg_info "Done!"
}
@@ -1126,7 +1128,8 @@ _set_overrides() {
}
_export_gpg_publickey() {
- gpg --batch --output "${work_dir}/pubkey.gpg" --export "${gpg_key}"
+ rm -f -- "${work_dir}/pubkey.gpg"
+ gpg --batch --no-armor --output "${work_dir}/pubkey.gpg" --export "${gpg_key}"
}
_make_version() {