diff --git a/packages/gen-frameworks.sh b/packages/gen-frameworks.sh index 69e50130..ea5c6ba4 100755 --- a/packages/gen-frameworks.sh +++ b/packages/gen-frameworks.sh @@ -1,107 +1,109 @@ #!/bin/bash # Copyright (C) 2016 Intevation GmbH +# Copyright (C) 2021 g10 Code GmbH +# +# Software engineering by Ingo Klöcker # # This file is part of GPG4Win. # # GPG4Win is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # GPG4Win is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA +# along with this program; if not, see . +# +# SPDX-License-Identifier: GPL-2.0+ # Grab the version information for KDE Frameworks and generate a text block # that can be copy and pasted into packages.current. -# -# Ideally KDE will PGP Sign their releases soon. set -e if [ -z "$1" ]; then echo "Usage $0 > snippet" exit 1 fi FRAMEWORKS="extra-cmake-modules kconfig ki18n kwidgetsaddons kcompletion kwindowsystem kcoreaddons kcodecs kconfigwidgets kdbugaddons kxmlgui kguiaddons kitemviews kitemmodels kiconthemes breeze-icons karchive kcrash" fullversion=$1 case ${fullversion} in *.*.*) majorversion=${fullversion%.*} ;; *.*) majorversion=${fullversion} fullversion=${majorversion}.0 echo "Using full version ${fullversion}" ;; *) echo "Invalid version ${fullversion}" exit 1 ;; esac curdate=$(date +%Y-%m-%d) -KEYRING=$(dirname $0)/kde-release-key.gpg +KEYRING=$(dirname $0)/kde-release-keys.gpg server=https://download.kde.org/stable/frameworks echo "server ${server}" tmpdir=$(mktemp -d -t gen-frameworks.XXXXXXXXXX) for fw in $FRAMEWORKS; do # Download packages over https now and verify that the signature matches tarfile="$fw-${fullversion}.tar.xz" tarfileurl="${server}/$majorversion/${tarfile}" if ! curl -L --silent --show-error --fail "${tarfileurl}" > "$tmpdir/${tarfile}"; then echo "Downloading ${tarfileurl} failed" exit 1 fi sigfile="${tarfile}.sig" sigfileurl="${tarfileurl}.sig" if ! curl -L --silent --show-error --fail "${sigfileurl}" > "$tmpdir/${sigfile}"; then echo "Downloading ${sigfileurl} failed" exit 1 fi # Check the signature if ! gpgv --keyring "$KEYRING" "$tmpdir/${sigfile}" "$tmpdir/${tarfile}"; then echo "Signature for $tmpdir/${tarfile} is not valid!" exit 1 fi sha2=$(sha256sum $tmpdir/${tarfile} | cut -d ' ' -f 1) echo "# $fw" echo "# last changed: $curdate" echo "# by: ah" - echo "# verified: PGP Signed by ./kde-release-key.gpg (created by gen-frameworks.sh)" + echo "# verified: PGP Signed by ./kde-release-keys.gpg (created by gen-frameworks.sh)" echo "file $majorversion/${tarfile}" echo "chk $sha2" echo "" done rm -r $tmpdir diff --git a/packages/gen-frameworks.sh b/packages/gen-kde-gears.sh similarity index 65% copy from packages/gen-frameworks.sh copy to packages/gen-kde-gears.sh index 69e50130..ce1d3f68 100755 --- a/packages/gen-frameworks.sh +++ b/packages/gen-kde-gears.sh @@ -1,107 +1,93 @@ #!/bin/bash # Copyright (C) 2016 Intevation GmbH +# Copyright (C) 2021 g10 Code GmbH +# +# Software engineering by Ingo Klöcker # # This file is part of GPG4Win. # # GPG4Win is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # GPG4Win is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA - -# Grab the version information for KDE Frameworks and generate a text block -# that can be copy and pasted into packages.current. +# along with this program; if not, see . # -# Ideally KDE will PGP Sign their releases soon. +# SPDX-License-Identifier: GPL-2.0+ + +# Grab the version information for packages released with a KDE Gears release +# and generate a text block that can be copy and pasted into packages.current. set -e if [ -z "$1" ]; then echo "Usage $0 > snippet" exit 1 fi -FRAMEWORKS="extra-cmake-modules - kconfig - ki18n - kwidgetsaddons - kcompletion - kwindowsystem - kcoreaddons - kcodecs - kconfigwidgets - kdbugaddons - kxmlgui - kguiaddons - kitemviews - kitemmodels - kiconthemes - breeze-icons - karchive - kcrash" +GEARS="libkleo + kleopatra" fullversion=$1 case ${fullversion} in *.*.*) majorversion=${fullversion%.*} ;; *.*) majorversion=${fullversion} fullversion=${majorversion}.0 echo "Using full version ${fullversion}" ;; *) echo "Invalid version ${fullversion}" exit 1 ;; esac curdate=$(date +%Y-%m-%d) -KEYRING=$(dirname $0)/kde-release-key.gpg +KEYRING=$(dirname $0)/kde-release-keys.gpg -server=https://download.kde.org/stable/frameworks +server=https://download.kde.org/stable/release-service echo "server ${server}" -tmpdir=$(mktemp -d -t gen-frameworks.XXXXXXXXXX) +tmpdir=$(mktemp -d -t gen-kde-gears.XXXXXXXXXX) -for fw in $FRAMEWORKS; do +for package in $GEARS; do # Download packages over https now and verify that the signature matches - tarfile="$fw-${fullversion}.tar.xz" - tarfileurl="${server}/$majorversion/${tarfile}" + tarfile="${package}-${fullversion}.tar.xz" + tarfileurl="${server}/${fullversion}/src/${tarfile}" if ! curl -L --silent --show-error --fail "${tarfileurl}" > "$tmpdir/${tarfile}"; then echo "Downloading ${tarfileurl} failed" exit 1 fi sigfile="${tarfile}.sig" sigfileurl="${tarfileurl}.sig" if ! curl -L --silent --show-error --fail "${sigfileurl}" > "$tmpdir/${sigfile}"; then echo "Downloading ${sigfileurl} failed" exit 1 fi # Check the signature if ! gpgv --keyring "$KEYRING" "$tmpdir/${sigfile}" "$tmpdir/${tarfile}"; then echo "Signature for $tmpdir/${tarfile} is not valid!" exit 1 fi sha2=$(sha256sum $tmpdir/${tarfile} | cut -d ' ' -f 1) - echo "# $fw" + echo "# $package" echo "# last changed: $curdate" echo "# by: ah" - echo "# verified: PGP Signed by ./kde-release-key.gpg (created by gen-frameworks.sh)" - echo "file $majorversion/${tarfile}" + echo "# verified: PGP Signed by ./kde-release-keys.gpg (created by gen-kde-gears.sh)" + echo "file ${fullversion}/src/${tarfile}" echo "chk $sha2" echo "" done rm -r $tmpdir diff --git a/packages/kde-release-key.gpg b/packages/kde-release-key.gpg deleted file mode 100644 index 0c4caa2c..00000000 Binary files a/packages/kde-release-key.gpg and /dev/null differ diff --git a/packages/kde-release-keys.gpg b/packages/kde-release-keys.gpg new file mode 100644 index 00000000..89f27391 Binary files /dev/null and b/packages/kde-release-keys.gpg differ