check-signatures

#!/bin/bash
# check-signatures - checks cryptographic signatures of all downloaded files
# by Sahal Ansari github@sahal.info
# use: ./check-signatures [force]

# Import GnuPG/PGP keys before running this script
# torproject package signer key fingerprints: https://www.torproject.org/docs/signing-keys.html.en
# please don't use 32bit keyIDs: https://evil32.com/
#wget --quiet -O - https://www.torproject.org/docs/signing-keys.html.en | grep "Key\ fingerprint" | sed 's/.*\=\ //' | tr -d "\ "
#gpg --keyserver hkp://keys.gnupg.net/ --fingerprint --recv-keys <list of key fingerprints here seperated by spaces>

# import some variables
source defaults.cfg

function do_gpgidchk {
gpg --list-keys --fingerprint | grep "Key\ fingerprint"| sed 's/.*\=\ //' | tr -d "\ " | sed 's/.\{32\}//' | sort | uniq -c | sed 's/\ \{6\}//' | grep -v ^1
if [ "$?" -eq "0" ]; then
    echo "WARNING: At least two keys in your keyring share 32bit KeyIDs."
    echo "         Double check output of \`gpg --list-keys --fingerprint\` More Info: https://evil32.com/" 
    echo "         If nothing looks suspicious re-run this script: ./check-signatures force"
    exit 1
fi
}

if [ "$1" == "force" ]; then
    echo "WARNING: This script will not test whether or not 32bit KeyIDS for any of the keys in your GPG keyring match."
    echo "         This could be dangerous depending on how you imported your GPG keys. More Info: https://evil32.com/"
else
    do_gpgidchk
fi

cd "$dldir"

if [ -f "$result" ]; then
    rm -f "$result"
fi

# put list of files in dldir into array a
a=( $(find . -name "*.asc" -type f) )

# check signatures in array
for var in "${a[@]}"
do
	  # i am getting tired of writing all this out
	  filename="$dldir${var##\.}"

          # just print the damn names!
          echo -ne "$filename"\\n >> "$result" 2>&1

	  # check the signature and write the result to a file silently
	  gpg --verify "$filename" >> "$result" 2>&1

	  # print whether it passed or not
	  # don't care if the signature is good -- only if its bad!
	  if [ "$?" != "0" ]; then
	  	echo "WARNING: $filename signature is bad!" #>> "$result" 2>&1
	  fi
done

# clean up and format the $result file
if [ -f "$result" ]; then
    sed -i -e 's/^gpg/\ \ \ \ \ gpg/' -e 's/^Primary/\ \ \ \ \ Primary/' -e 's@^/@\n/@' "$result"
fi