123set -euo pipefail4umask 07756usage() {7 cat <<'EOF'8Usage: scripts/sign-bazzite-release.sh \9 --tag vVERSION \10 --archive /absolute/path/sigil-vVERSION-linux-glibc2.17-x86_64.tar.gz \11 --minisign-key /absolute/offline/path/to/release.key \12 --public-key-file /absolute/path/to/sigil-minisign.pub \13 [--source-commit HEX]1415Verify and sign one clean Sigil release candidate on the offline publisher16machine. The secret key and passphrase are consumed only by Minisign and are17never copied into the package or printed by this script.18EOF19}2021die() {22 printf 'offline signing failed: %s\n' "$*" >&223 exit 124}2526script_dir="$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"27release_tag=""28archive_path=""29secret_key=""30public_key_file=""31source_commit=""3233while [[ $# -gt 0 ]]; do34 case "$1" in35 --tag)36 [[ $# -ge 2 ]] || die "--tag requires a value"37 release_tag="$2"38 shift 239 ;;40 --archive)41 [[ $# -ge 2 ]] || die "--archive requires a path"42 archive_path="$2"43 shift 244 ;;45 --minisign-key)46 [[ $# -ge 2 ]] || die "--minisign-key requires a path"47 secret_key="$2"48 shift 249 ;;50 --public-key-file)51 [[ $# -ge 2 ]] || die "--public-key-file requires a path"52 public_key_file="$2"53 shift 254 ;;55 --source-commit)56 [[ $# -ge 2 ]] || die "--source-commit requires a value"57 source_commit="$2"58 shift 259 ;;60 --help|-h)61 usage62 exit 063 ;;64 *) die "unknown argument: $1" ;;65 esac66done6768[[ -n "$release_tag" && -n "$archive_path" && -n "$secret_key" \69 && -n "$public_key_file" ]] || die "tag, archive, secret key, and public key are required"70[[ "$secret_key" == /* && -f "$secret_key" && ! -L "$secret_key" ]] \71 || die "Minisign secret key must be an absolute regular file"72[[ "$(stat -c '%a' "$secret_key" 2>/dev/null || stat -f '%Lp' "$secret_key")" =~ ^(400|600)$ ]] \73 || die "Minisign secret key permissions must be 0400 or 0600"74command -v minisign >/dev/null 2>&1 || die "minisign is required on the offline signer"7576verify_args=(--tag "$release_tag" --archive "$archive_path" --candidate)77if [[ -n "$source_commit" ]]; then78 verify_args+=(--source-commit "$source_commit")79fi80"$script_dir/verify-sigil-release.sh" "${verify_args[@]}"8182signature_path="$archive_path.minisig"83[[ ! -e "$signature_path" ]] || die "detached signature already exists: $signature_path"84signature_created=false85cleanup_signature() {86 local status=$?87 trap - EXIT INT TERM HUP88 if [[ "$status" -ne 0 && "$signature_created" == true \89 && -f "$signature_path" && ! -L "$signature_path" ]]; then90 rm -f -- "$signature_path"91 fi92 exit "$status"93}94trap cleanup_signature EXIT INT TERM HUP95minisign -S -s "$secret_key" -m "$archive_path" -x "$signature_path" \96 -t "Sigil host $release_tag" -c "offline release signature"97signature_created=true9899verify_args=(--tag "$release_tag" --archive "$archive_path" \100 --public-key-file "$public_key_file")101if [[ -n "$source_commit" ]]; then102 verify_args+=(--source-commit "$source_commit")103fi104"$script_dir/verify-sigil-release.sh" "${verify_args[@]}"105trap - EXIT INT TERM HUP106printf 'detached_signature=%s\n' "$signature_path"107printf 'offline_signing=ok\n'