Only sign packages that are newer than signage

[git-tools-moved-to-github.git] / update-archive / update-yum-archive.sh

diff --git a/update-archive/update-yum-archive.sh b/update-archive/update-yum-archive.sh
index 72b1b81..482fc09 100755 (executable)
--- a/update-archive/update-yum-archive.sh
+++ b/update-archive/update-yum-archive.sh
@@ -19,9 +19,16 @@ if test ! -x /usr/bin/gpg; then
   exit 1
 fi
 
+if test ! -x /usr/bin/expect; then
+  echo "$0: /usr/bin/expect missing. Install expect"
+  exit 1
+fi
+
+now=`date +%s`
+# sign if newer than signage (86400=24 hrs)
+signage=8000
 #check if root has rpm macros
 confdir=`pwd`
-pkgs_to_sign=""
 architectures="i386 x86_64"
 dirs_to_upd=""
 for vdist in centos/5.5 rhel/5.5; do
@@ -58,7 +65,6 @@ for vdist in centos/5.5 rhel/5.5; do
       done
     done
     # Make symlinks from the regular FTP archive
-    has_packages=false
     for pdir in /home/ftp/pub/*; do
       use=false
       if test -f $pdir/.htaccess -a $section != "main"; then
@@ -72,7 +78,7 @@ for vdist in centos/5.5 rhel/5.5; do
         if test -d $distdir; then
           if test -d $distdir/SRPMS; then
             for f in $distdir/SRPMS/*.src.rpm; do
-              if test -f $f; then                                                              
+              if test -f $f; then
                 ln -sf $f $d/SRPMS/
               fi
             done
@@ -81,9 +87,22 @@ for vdist in centos/5.5 rhel/5.5; do
             mkdir -p $d/${arch}/Packages
             for f in $distdir/RPMS/${arch}/*.rpm $distdir/RPMS/noarch/*.rpm; do
               if test -f $f; then
-                pkgs_to_sign="${pkgs_to_sign} $f"
-                ln -sf $f $d/${arch}/Packages/
-                has_packages=true
+               age=`stat --printf='%Y' $f`
+               if expr $now - $age \< $signage >/dev/null; then
+                  ln -sf $f $d/${arch}/Packages/
+                 if rpm -K $f|grep -q ' gpg' >/dev/null; then
+                   echo "Already signed $f"
+                  else
+                   expect << __EOF
+                    spawn rpm --addsign $f
+expect -exact "Enter pass phrase: "
+send -- "\r"
+expect eof
+__EOF
+                    chgrp staff $f
+                    chmod g+w $f
+                  fi
+                fi
               fi
             done
           done
@@ -92,10 +111,6 @@ for vdist in centos/5.5 rhel/5.5; do
     done
   done
 done
-echo "Signing packages (default ID PPH is empty):"
-rpm --addsign ${pkgs_to_sign}
-chgrp staff ${pkgs_to_sign}
-chmod g+w ${pkgs_to_sign}
 echo "Updating repository meta:"
 for rdir in ${dirs_to_upd}; do
   echo "Section ${rdir}"