18 lines
935 B
Bash
18 lines
935 B
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
# Allow CI to fall back to a deterministic test key when MIRROR_SIGN_KEY_B64 is unset.
|
|
DEFAULT_TEST_KEY_B64="LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1DNENBUUF3QlFZREsyVndCQ0lFSUhLbjhWMjJ5ZEpwbkZTY3k5VlNsdTczNXZBQ1NFdFFIWlBRR3pSNzcyUGcKLS0tLS1FTkQgUFJJVkFURSBLRVktLS0tLQo="
|
|
if [[ -z "${MIRROR_SIGN_KEY_B64:-}" ]]; then
|
|
echo "[warn] MIRROR_SIGN_KEY_B64 not set; using embedded test key (non-production) for CI signing" >&2
|
|
MIRROR_SIGN_KEY_B64="$DEFAULT_TEST_KEY_B64"
|
|
fi
|
|
ROOT=$(cd "$(dirname "$0")/../.." && pwd)
|
|
KEYDIR="$ROOT/out/mirror/thin/tuf/keys"
|
|
mkdir -p "$KEYDIR"
|
|
KEYFILE="$KEYDIR/ci-ed25519.pem"
|
|
printf "%s" "$MIRROR_SIGN_KEY_B64" | base64 -d > "$KEYFILE"
|
|
chmod 600 "$KEYFILE"
|
|
STAGE=${STAGE:-$ROOT/out/mirror/thin/stage-v1}
|
|
CREATED=${CREATED:-$(date -u +%Y-%m-%dT%H:%M:%SZ)}
|
|
SIGN_KEY="$KEYFILE" STAGE="$STAGE" CREATED="$CREATED" "$ROOT/src/Mirror/StellaOps.Mirror.Creator/make-thin-v1.sh"
|