dotfiles/home/.chezmoiscripts/run_once_update_gpg.sh.tmpl at main · jeremy-code/dotfiles · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
#!/usr/bin/env zsh
#
# Updates the expiration date of the GPG key for the user with email address
# $EMAIL_ADDRESS to 1 year if the key will expire in less than 6 months.
#
# GPG key status:
{{/* https://github.com/gpg/gnupg/blob/master/doc/DETAILS */}}
{{- range output "gpg" "--list-keys" "--with-colons" | splitList "\n" -}}
{{-   if hasPrefix "tru:" .  -}}
{{-     $expirationTimestamp := (split ":" .)._4 -}}
{{-     $timeUntilExpiration := now | unixEpoch | sub $expirationTimestamp -}}
{{-     $SixMonthsInSeconds := mul 60 60 24 7 4 6 }}
{{-     $dateOfExpiration :=  now | dateModify (duration $timeUntilExpiration) | date "Mon Jan 2, 2006 MST" -}}
{{-     if gt $timeUntilExpiration $SixMonthsInSeconds  -}}
echo "Chezmoi: Your GPG key is valid and will expire in more than 6 months ({{ $dateOfExpiration }})"
{{-     else -}}
echo "Chezmoi: Your GPG key is valid and will expire on {{ $dateOfExpiration }}"
{{-     end -}}
{{-   end -}}
{{- end }}

readonly EMAIL_ADDRESS={{ .emailAddress }}
readonly -i SIX_MONTHS_IN_SECONDS="$((60 * 60 * 24 * 7 * 4 * 6))"

function error() {
  echo "[$(date "+%Y-%m-%dT%H:%M:%S%z")]: $*" >&2
}

function get_gpg_key_expiration_date() {
  local fingerprint="$1"

  if [[ -z "${fingerprint}" ]]; then
    error "Error: No fingerprint provided"
    return 1
  fi

  gpg --list-keys --with-colons "${fingerprint}" \
    | grep "^tru:" \
    | cut -f 5 -d ":"

  if (( PIPESTATUS[0] != 0 )); then
    error "Error: Could not find expiration date for key with fingerprint ${fingerprint}"
    return 1
  fi
}

function {
  echo "GPG script file hash has updated. Finding GPG key for user ${EMAIL_ADDRESS}..."

  # I am using `gpg --list-keys` with option `show-only-fpr-mbox` to get the
  # primary GPG key's fingerprint. This may be discouraged as parsing is only
  # recommended with `--with-colons`, but that would make it difficult to
  # distinguish between the fingerprints of keys owned by someone else or
  # subkeys.
  #
  # Note: SHA-1 fingerprint is 40 characters long in hexadecimal (160 bits = 20
  # bytes)
  fingerprint=$(
    gpg --list-keys --list-options show-only-fpr-mbox \
      | grep -E "^[[:xdigit:]]{40} ${EMAIL_ADDRESS}$" \
      | cut -f 1 -w
  )

  echo "Checking expiration date for user ${EMAIL_ADDRESS} key with fingerprint: ${fingerprint}"

  local -i current_expiration_timestamp
  current_expiration_timestamp="$(get_gpg_key_expiration_date ${fingerprint})"

  echo "${fingerprint} will expire on $(date -Idate -r ${current_expiration_timestamp}). Checking if extending expiration date is necessary..."

  now=$(date +%s)
  seconds_until_expiration=$((current_expiration_timestamp - now ))
  if (( seconds_until_expiration > SIX_MONTHS_IN_SECONDS )); then
    echo "Key ${fingerprint} will expire in more than 6 months. Confirm script hash is correct. No action required."
    return 0
  fi

  echo "Key ${fingerprint} will expire in less than 6 months. Setting its expiration date to 1 year from now..."

  gpg --quick-set-expire "${fingerprint}" "1y"

  echo "Updated expiration date for key ${fingerprint} and all its subkeys"

  # I am not sure why, but after updating the expiration date, when this command
  # is ran for the first time, the expiration date will always be "1"
  # (formatted to "1969-12-31") -- hence piping output to `/dev/null`.
  gpg --list-keys --with-colons "${fingerprint}" &> /dev/null

  new_expiration_timestamp="$(get_gpg_key_expiration_date ${fingerprint})"

  echo "New expiration date for key ${fingerprint} is $(date -Idate -r ${new_expiration_timestamp})"
}