From 28e2681b65fde3a7e63a7fe5acc685ab0192f603 Mon Sep 17 00:00:00 2001 From: Mike Chang Date: Tue, 23 Nov 2021 13:41:55 -0800 Subject: [PATCH] Add signer script and new gpg signing cert (#5847) * Add signer script and new gpg signing cert Signed-off-by: Mike Chang --- .../signer/Platform/Linux/o3de-releases.gpg | Bin 3228 -> 3980 bytes scripts/signer/Platform/Linux/signer.sh | 27 ++++++++++++++++++ 2 files changed, 27 insertions(+) create mode 100644 scripts/signer/Platform/Linux/signer.sh diff --git a/scripts/signer/Platform/Linux/o3de-releases.gpg b/scripts/signer/Platform/Linux/o3de-releases.gpg index 602d822673321c002c4abf2cce48431685dc2733..b5fbb00392ce60d63a1d519022901cc16390e745 100644 GIT binary patch literal 3980 zcmaLZWmFRk-^cMWMoJDOq((QQG)!PLZYUy%fOK~Zq`Mgn5=u@Qh0)~*k(?qW4Hu21 zgdiY{$Lo5|b?)apFYdR$^FRNWpYzQHQi3eAvN#E706W`l#jtk2+4R)q1>Su7`rCL^ z^w5gqMbA6C+ZUeo*!N{hmAAPQp=0JS80StY>ZK;uRUc~Zyu9iWLP8s& zYS9^YssDP%UWz$^^*&|hTyFx!y|QlMm{#}jPEcQ9yxaV;4~iCc{>(w>=Lh|>ch}Nl zFi2v3`6x@QHaNJ>_d1i@dvakoT1VcfYcoz4qoNWrhMwUIe%(P%k>CFhMT8slYqLUs(IBFYM&X6+5#9q-UZ~umStvC7Q`Q*MYH!-fAX3kX6_#8=U&}aoK#3US=R<6a$Y{5g zYwlr1!Ue^ncw|~0j38ZkkEyxUWl)LnLi(d$c2~@USmMKSCihnkCSG`q+c>3wsmomr zF?)w=-*uF~1}Qgj@&>ly!F);~-+sBaRP!PHM3O0jsx!2LK8k5?XMhX^lPD&&XJ>A` zlaOX|Q*}*tmV3J0p|J-Ih!GF4Dv=3{nq>QddlHK_za-WEf_Yf zh#`6f4(})IcUf(Q&WzqKPY292=8cB~XbAuWjVA6AHnvudZkAq-wn#B|FMEi0YMBvLINN=0gy3_ffHml3w%|b-7;ge{CiAmW`t(dsG@`j zXqm(E8$eD*^Y0REL48FklEXaScUjboZ-iFReuRH3C>VRn5RT)^rrqU=+YaMey%)_H z=J#8+?lYE4+QuX@cNZc796g$_^RrM((|B!{F}{h#oh(fbOYqtY%VtonD&`zBg`QB) zrH(3|1~GNX8B}V(w=onDS0ZVhK6p+og39 zW$q`O*-tE`kJ()yh$jK0f#nlbbJI_BKw6d-3gPZJQiuv1$-sn{f!DV!3$q@8&t ztK@GLE@%bh61PcuVa%T7dd;*o2ZV+8b4WTlb+42D6LmwgXyaqKtWBD>$ctnPv*yRm(K)BuMO=vtz3PmQJPrwj$y9x&k1xg9hxe-kCn-r z$0npS^OZxC;QrNXI}YE{W7pP}4I1{iN*88=Cr~|UO$U?2jG)mJ8P`zUG5M_d|P@9}Q9^z%+s-}XlHXI_?<~T2h#QJDD7;)ayGXJo z6&@yb=Z9|7-z%JXB`>01+V>T%2AFRJ$x?d%SVJ&{c!z7GFn)f(2h4wnTn6ik`9E zZXCOEiFI1>l6DjQ88cd5c>vRWPh5WSTid{ zl}OLtBQKWloHPpoGV-D&69D-oqjC9N_2Vj zyDGForR$QA&%Tpi-+^*O;b36~>eQJ^Ps&;#q^|X|QDS3fP_XsehUA3Z9BP?n(X{KY zTJn1|m=woPttX6`F~vp{>Q{qGH6k<~JcxI&>2)`ht;0)sr2~4{(u1F&KB`}U1s7!f zr*Xb3M}rx@!pFL1V%MT%L<|*W8Um$IL;u+6yIbOVGcyq<)D^efTmn4Ci(7`mBUe@r z>9~|uCU}ml_x7zUnX%%HSe|nrsO6_faN#@o@Ao;yfY~30TR&s3@Kj2)Tapvz)(=yA zXbn;YeF`MNno#BSp>bO^oaaECfrECrth$Rav%f;mjRh5jk?Qn{9y~P>!lQc;SOyGc z(R#L>T!woIDzO-K@VV~3j*Wa(kWj5@lIaScvUXZi)b~ek+4|ehu~&+^ymE^CRxW*i z18~ZdG31phUl9N1)Fo!{X5J4F?Kid6SVG(`ThsGCnZ2hkpOij#FbSwCVEyjm^oYcm zz2&~=l!Vg+tBOd?X6lDQKJ5@)b0vO{V&iBo{S#>1Btb{^gS}q$_=PVC9gzLG)fwuP z#TZIl-B`@Wf--ichAS*s{jO(&z6dm{kCwJ@97s?zM6I$y?(VGS0+ z^Y!dzPm@lvvcLk3Al+51;9pYZ~(8d)7$75TfOUZ zsDg-ldBK$C91r!21}IhLl!0Fs(;DkHGzIxHSbi~GR5xivu1}fpK<6|fq*BoZA6o^r z4e4V2U9fYoCO5=IQ20{P*+LS#pJM=(Nc0&6*^Q1`ZqKo28^Wb*T@0kvYK*YI%I{{0 zoWADfuX#g=CLiRWu&k<&F@KgmK0XP@Q$2b!og|<1zzeItBKzk%70kJih2gHlKQzF6;I~XT={pvPs+N* zEv_}k+n(Dn>O0B3hy#DBI*ow?%N|EFczYp`(~B!r_=vMy}6M;CPNrNa*8Ldv})7Rd+SVYGAwBs+P}$s@8^+Sc=q)t~u?K4s%Z>Uk{wNk znBQqnorJf%ZiYBfhA}yL{*yuRAg_NQ;RCV&{~ILQL}Y}0l7c%Ggs~S+SVNb~GsLs0MW+_PKYepShEXr#zNU?c-cA5IIowK<4i5?j)BmZ|a(x=@=b|u?T zwei!b4ywJZ={l|G%p)tdRUKp&w|kH#&$+VZ{D?n5`pm1*`&i6NCTf*LUOIHFqS0|v zNp{cf+Fx7sAf{!KH`{)305EOlnB2Ne{65EwK_~p)H!o9ppQo|QN>UNMlBe`{ zVuHzT@gN2K^QUU;A#E>S%vjjR^Diyy(>+j4v^rpBPk}c5X??G&QSz}q5ng}P+>r#U z^$c+Yhi)7iQSrg?z1*FUlRHH*?!!=-{AnDEP%h1$hG3dWos41ohxw&+gI%n=x8W4Y z7CVHE0ZMEi@3lhuSNkyWb2Fj4uMa94S{@@;=u1uRA4q4e0} zUEu(snNaHQT=3KHTcYPVdw}PB3 zjW_aOV1Nm_u;X6j+V$D4x7b__$7MzYkIAHGkO%-G&urRwK<*3 z!`V(eclJ&@Ki>@_wU_z|Uflp>jH(WyZD>er{@q zNmg@bg{bhPOXl;s{CZMRvkSSLG&@}A;ASDYvOPqoG@!!??B1kdc4gih2@PKW0@{m> z>Anr3z+8(z(ekH>4x^7iKHneAj! zh;4q~9du{WJ$e1CjBm90FC1@oYlf1lmGIgNQgP=aaE(BwJ=EL5(y?p1a2qGw+cMD0 b>GPn-c46$Z!rlJ!x3Pn1@O(oLmD>LS-Kb&Fn`u|1$0f5m}El!r>p%poi6;?7I8#iBYG}T?)I)^DPZ>b`U z<~=o8HE|y~iNKe99~nA2WFG-4e$sHnaIUYcOY%iM3i(FDRb`;iz7^aOSi~CRZwWRj zQHoZ5%pDnNpEZ5Lv~A8C5Yiw!@!2%9oYnCR&v6;#%!q1ZD#w-B5JLrz#(HIpD`eJ( zv08#t)%#u;HgDkG2dZ4cpw!h1D|p{?WZAWQA!#nEGd0P3Zg_?cEf8&ej!oCcz6`Iv z?OnvmsoQh_mIox4&d?Jm_>P~^4Q&xwPL<(drb8eyZob^>bD(ZQ&QK~ZeIQ?ul6TTt##4>vS$wuDBe zrWoDh58uo7M-QON%&3Z&tV-OSqsx$B z-ed5b8Hnbh3fJ#)dbl$Eq;k||G10uoVR+xf@gCn`>uMpuaVE#tEGV_2`18fg<#9!^-~H;sb|K$yfq4O*Lt5z{J%Y}(ov@hC$S7NoN8Vw48k?9N48 z=c;&YL~gLCvg$pIneUw0W8k>Uq_VqyDvOlbs=1_;sZYer;p!YBq<$jLU=o5H=S{Xq z=bHqlDsqcJQC-m4gal{?-a}WgtJBQ7y*9>b^}!uysWVHx0$LlrL*}7+D}@Rh$m_-z z%2()8+;ke8Z&U{Sk93Ko_%QzMM{mqYmDXoUUfgD@S=lEdJkNo`V~Lx~ghsa36io%s zn^^KiDvb{YJU^ko`TBK5GUvZAZhp@W?HiIqJl6cyn^vaEmm427q$0EYp;zbP@k|68 z^7{V%G7uo4cqvfFGhcHQDFVN1H?{_rv2VmCk;fPcZ;~;S>fwJ(r9#w2#XB(T!%Yq( zn(PM%3J_YRK;3XQG2z8cPzREWPA%j(+PycjZ9=;h-4nV;YFawaG*hn+ngs7(URZMk zkl5Rzccxf!4@+)_UT@^vEND~a1vx~E;e>FahknAz?HyA1po*&&noK?o#wEqI0Sv!# z{vza7=&0$ZiF%s6JW5ot7~?(=an~)}j^C_d$gY@`B8Feu6SH=pasH@NDpf7P*07kQS**IE%jyeK@O6xQnD`}%tv!8e#piNBHuO=`c1<)X zun}W~c4mKRz+tqZdVL^SuSlFyVriZb7y%0!zRN4XN2v%H8O03}_~~lX%4j>^(&PE% zr(P+@4g{hbM{zL6xe4rnWtXSPsW6o0Z+-Z7dw#CF(FvvLF#vq=sl0#ELN8#Hi#}(e z!lVj*$uGibZ1&7zV!p?-InFXhgsR$CoS`sLReh*gRvKqm{D=l3F?l5{jl)w_DHno7xRx2;qq$rpXuWu(i$5|vwl zlv{nuX;qZ~)vsaySd7+FP9N>% zVKz5=ZrrsnrbFJV`!?+@DhI4_uB5d9LmXUyys(`p>Zx`upG|tBGCOBI`SGzoYMC}Y z$JEez2S4Hgx@>xw&6 zozmA*mOGP~wPF5#daWXiZ3hs~D3rktoRvx~moz1g;_Q~xW44V0)=S@wsOhYScdKDc zA-KLH*frrU)KL+-A6^FZSrs590l%*xY+8G$ioTbSy_j`Jt z1AU6@qNWi+uRpt!Ym-E99cdwMPxE-enRl?yy991Tb#it4fTa-JUItmD>*r2?uz=g{ z?IH3kg4J2GFkAJW;6Of&arH>~)?>w5u$8K{$%&)goNHi#jCPSRhLf>SnGr}F@ApgnfIdlPieFE#1n7iYo>ulGi(K}j zOV*1+aZC}uaUTtm zUFv)>m{OY|y{ss_DMET#3G)@8pJyn_1P!yT>CLX|f-!&rO1b^vNHk*+hsqk7W`t;k zFlIF5)bawaAB&qEfI^9rRS1i&N34fbwEXca-M8}*Su7Y@ znc!O`+e`+KfN2O;YKRoWBuKWwz~pOauB#91&Y@>Wv0yy!V?!fVql3urs|C-0{{{X< QcjN&6ZWf{?{ExNcKd8DEw*UYD diff --git a/scripts/signer/Platform/Linux/signer.sh b/scripts/signer/Platform/Linux/signer.sh new file mode 100644 index 0000000000..b090012c5a --- /dev/null +++ b/scripts/signer/Platform/Linux/signer.sh @@ -0,0 +1,27 @@ +#!/bin/bash + +# +# Copyright (c) Contributors to the Open 3D Engine Project. +# For complete copyright and license terms please see the LICENSE at the root of this distribution. +# +# SPDX-License-Identifier: Apache-2.0 OR MIT +# +# + +set +x + +export GPG_TTY=$(tty) # Required to pass valid tty during ssh sessions +file=$1 + +# dpkg-sig depends on a valid and trusted GPG private key. This also assumes a private key password has already been cached via gpg-agent +# If you do need to pass a password, a gpg argument can be added to the command: +# dpkg-sig -k $fingerprint -g "--pinentry-mode loopback --passphrase $pass" --sign builder + +fingerprint=$(gpg --list-keys --with-colons | awk -F: '/fpr:/ {print $10}' | tail -n1) #Get the last certificate in the list, which is the signing cert +if [ -z $fingerprint ]; then + echo "No valid certs found. Exiting with 1" + exit 1 +fi +echo "Signing with $fingerprint" +dpkg-sig -k $fingerprint --sign builder $file +dpkg-sig --verify $file && echo "Signing $file complete!"