Repository: opencontainers/runc
File: script/keyring_validate.sh (Shell)

Code before:
# See the License for the specific language governing permissions and
# limitations under the License.

set -Eeuo pipefail

project="runc"
root="$(readlink -f "$(dirname "${BASH_SOURCE[0]}")/..")"

function log() {
	echo "[*]" "$@" >&2
}

function bail() {
	log "$@"
	exit 1
}

# Temporary GPG keyring for messing around with.
tmp_gpgdir="$(mktemp -d --tmpdir "$project-validate-tmpkeyring.XXXXXX")"
trap 'rm -r "$tmp_gpgdir"' EXIT
function gpg_user() {
	gpg --homedir="$tmp_gpgdir" --no-default-keyring --keyring="$username.keyring" "$@"
}

# Get the set of MAINTAINERS.
readarray -t maintainers < <(sed -E 's|.* <.*> \(@?(.*)\)$|\1|' <"$root/MAINTAINERS")
echo "------------------------------------------------------------"
echo "$project maintainers:"
printf " * %s\n" "${maintainers[@]}"
echo "------------------------------------------------------------"

# Create a dummy gpg keyring from the set of MAINTAINERS.
while IFS="" read -r username || [ -n "$username" ]; do
	curl -sSL "https://github.com/$username.gpg" | gpg_user --import
done < <(printf '%s\n' "${maintainers[@]}")

# Make sure all of the keys in the keyring have a github=... comment.
awk <"$root/$project.keyring" '
	/^-----BEGIN PGP PUBLIC KEY BLOCK-----$/ { key_idx++; in_pgp=1; has_comment=0; }

	# PGP comments are never broken up over several lines, and we only have one
	# comment entry in our keyring file anyway.
	in_pgp && /^Comment:.* github=\w+.*/ { has_comment=1 }

	/^-----END PGP PUBLIC KEY BLOCK-----$/ {
		if (!has_comment) {
			print "[!] Key", key_idx, "in '$project'.keyring is missing a github= comment."
			exit 1
		}
	}
'

Review comment (suggestion):
I don't really like having a loop variable be used like this -- maybe make it the first argument to `gpg_user`?

```suggestion
function gpg_user() {
	local username="$1"
	shift
	gpg --homedir="$tmp_gpgdir" --no-default-keyring --keyring="$username.keyring" "$@"
}
```

Code after:
# See the License for the specific language governing permissions and
# limitations under the License.

set -Eeuo pipefail

project="runc"
root="$(readlink -f "$(dirname "${BASH_SOURCE[0]}")/..")"

function log() {
	echo "[*]" "$@" >&2
}

function bail() {
	log "$@"
	exit 1
}

# Temporary GPG keyring for messing around with.
tmp_gpgdir="$(mktemp -d --tmpdir "$project-validate-tmpkeyring.XXXXXX")"
trap 'rm -r "$tmp_gpgdir"' EXIT

function gpg_user() {
	local user=$1
	shift
	gpg --homedir="$tmp_gpgdir" --no-default-keyring --keyring="$user.keyring" "$@"
}

# Get the set of MAINTAINERS.
readarray -t maintainers < <(sed -E 's|.* <.*> \(@?(.*)\)$|\1|' <"$root/MAINTAINERS")
echo "------------------------------------------------------------"
echo "$project maintainers:"
printf " * %s\n" "${maintainers[@]}"
echo "------------------------------------------------------------"

# Create a dummy gpg keyring from the set of MAINTAINERS.
while IFS="" read -r username || [ -n "$username" ]; do
	curl -sSL "https://github.com/$username.gpg" | gpg_user "$username" --import
done < <(printf '%s\n' "${maintainers[@]}")

# Make sure all of the keys in the keyring have a github=... comment.
awk <"$root/$project.keyring" '
	/^-----BEGIN PGP PUBLIC KEY BLOCK-----$/ { key_idx++; in_pgp=1; has_comment=0; }

	# PGP comments are never broken up over several lines, and we only have one
	# comment entry in our keyring file anyway.
	in_pgp && /^Comment:.* github=\w+.*/ { has_comment=1 }

	/^-----END PGP PUBLIC KEY BLOCK-----$/ {
		if (!has_comment) {
			print "[!] Key", key_idx, "in '$project'.keyring is missing a github= comment."
			exit 1