root/trunk/hotstuff/scripts/ghnssignature

#!/usr/bin/env perl
#
# GHNS Signature - manage digital signatures on files in SVN-backed repository
# Copyright (C) 2007 Josef Spillner <josef@kstuff.org>
# Published under 'GNU AGPLv3 or later' conditions

use strict;
use XML::DOM;

if(($ARGV[0] eq "-h") || ($ARGV[0] eq "--help") || (!$ARGV[0])){
        print "Synopsis: ghnssignature --sign|--verify|--auto [<payloadfile>]\n";
        print "\n";
        print "If no payloadfile is given, it will scan all *.meta files to find\n";
        print "them on its own.\n";
        print "The --auto option will sign if needed, and add signature to SVN.\n";
        exit;
}

my $mode = $ARGV[0];
if(($mode eq "--sign") || ($mode eq "--verify") || ($mode eq "--auto")){
}else{
        print "Error: action must be --sign or --verify or --auto.\n";
        exit 1;
}

my @files;
if($ARGV[1]){
        my $file = $ARGV[1];
        push @files, $file;
}else{
        my @metafiles = glob("*.meta");
        my $parser = new XML::DOM::Parser;
        foreach my $metafile(@metafiles){
                #print "??? $metafile\n";
                my $doc = $parser->parsefile($metafile);
                my $root = $doc->getDocumentElement();
                my @payloads = $root->getElementsByTagName("payload");
                foreach my $payload(@payloads){
                        my $file = $payload->getFirstChild->getData;
                        #print "!!! $file\n";
                        push @files, $file;
                }
        }
}

my $identityfile = "identity.txt";
if(!(-f $identityfile)){
        print "Error: no file '$identityfile' found.\n";
        exit 1;
}

open(F, $identityfile);
my $id = <F>;
close(F);

chomp $id;
if(!$id){
        print "Error: couldn't read identity from '$identityfile'.\n";
        exit 1;
}

sub verify{
        my $file = shift(@_);
        my $x = system("gpg --verify $file.asc");
        return $x;
}

sub sign{
        my $file = shift(@_);
        my $id = shift(@_);
        my $x = system("gpg --local-user $id --armor --detach-sign $file");
        return $x;
}

if($mode eq "--verify"){
        foreach my $file(@files){
                my $x = verify($file);
                if($x != 0){
                        print "Error: cannot verify $file.asc.\n";
                        exit $x;
                }
        }
}

if($mode eq "--sign"){
        foreach my $file(@files){
                my $x = sign($file, $id);
                if($x != 0){
                        print "Error: signature could not be created.\n";
                        exit $x;
                }
        }
}

if($mode eq "--auto"){
        foreach my $file(@files){
                my $newsignature = 0;
                my $x = -1;
                if(!(-f "$file.asc")){
                        $newsignature = 1;
                }else{
                        $x = verify($file);
                }
                if($x != 0){
                        print "File $file needs to be signed...\n";
                        my $x = sign($file, $id);
                        if($x != 0){
                                print "Error: signature could not be created.\n";
                                exit $x;
                        }
                        if($newsignature){
                                system("svn add $file.asc");
                        }
                }
        }
}