bin/interpret-mail: require a valid signature from an admin to do anything

1 files changed, 16 insertions, 1 deletions

diff --git a/bin/interpret-mail b/bin/interpret-mail
index ff40b22..12b0520 100755
--- a/bin/interpret-mail
+++ b/bin/interpret-mail
@@ -28,7 +28,22 @@ if ! sed -n '
       p
     }
   ' "${tmp_dir}/mail" | \
-    chronic gpg --batch -q -d -o "${tmp_dir}/plain-content"; then
+    chronic gpg --batch --status-file "${tmp_dir}/gpg-status" -q -d -o "${tmp_dir}/plain-content"; then
+  exit
+fi
+
+if [ -z "$(
+  (
+    grep '^\[GNUPG:] VALIDSIG ' "${tmp_dir}/gpg-status" | \
+      cut -d' ' -f3 | \
+      sort -u
+    printf '%s\n' "${admin_gpg_keys}" | \
+      sort -u
+  ) | \
+    sort | \
+    uniq -d
+  )" ]; then
+  >&2 echo 'No valid signature found.'
   exit
 fi