#!/bin/sh
set -eu
version=$1
releases=$(pwd)/releases/$version
rpm=$releases/MeWeb-$version-linux-x64.rpm
fingerprint=F92C166E9B1C13EDD1629E76888DCF969D133FB2
test -f "$rpm"
keys=$(mktemp -d)
trap 'rm -rf "$keys"' EXIT
export GNUPGHOME="$keys"
printf '%s\n' "$PACKAGES_SIGNING_KEY" | gpg --batch --quiet --import
gpg --batch --with-colons --list-secret-keys | grep -q "^fpr:::::::::$fingerprint:$"
gpg --batch --armor --export "$fingerprint" > "$keys/public.asc"
rpmsign --define "__gpg /usr/bin/gpg" --define "_gpg_name $fingerprint" --define "_gpg_path $keys" --addsign "$rpm" > /dev/null
rpmkeys --dbpath "$keys/rpmdb" --import "$keys/public.asc"
rpmkeys --dbpath "$keys/rpmdb" -K "$rpm" | grep -q 'digests signatures OK'
(cd "$releases" && for file in $(ls | LC_ALL=C sort); do [ "$file" = SHA256SUMS.txt ] || sha256sum "$file"; done) > "$keys/sums"
mv "$keys/sums" "$releases/SHA256SUMS.txt"
echo "signed $(basename "$rpm") with $fingerprint"