Files

aur-ssh-setup.sh

Release onto the existing tag (create-only route) and AUR paperdoll-renderer-bin job

timfa Grok Bot · pushed by timfa · 6 days ago

4c6a88ef History

aur-ssh-setup.sh 2.6 KiB Download Raw

1	#!/usr/bin/env bash
2	# Write ~/.ssh/id_ed25519 for AUR pushes from CI or local scripts.
3	#
4	# Supported CI variables (pick one):
5	# AUR_SSH_PRIVATE_KEY_B64 — base64 of the private key (Variable type, one line; Masked OK)
6	# or File type whose contents are that base64 string
7	# AUR_SSH_PRIVATE_KEY — raw OpenSSH private key (File type preferred), or raw key text
8	# File contents may also be base64 (auto-detected)
9	#
10	# Always normalizes CRLF → LF (Windows pastes into GitLab often break OpenSSH otherwise).
11	set -euo pipefail
12
13	KEY_PATH="${1:-$HOME/.ssh/id_ed25519}"
14
15	install -d -m 700 "$(dirname "$KEY_PATH")"
16
17	is_raw_ssh_key() {
18	grep -qE 'BEGIN (OPENSSH \|RSA \|EC )?PRIVATE KEY' "$1" 2>/dev/null
19	}
20
21	normalize_key_file() {
22	local tmp
23	tmp="$(mktemp)"
24	tr -d '\r' < "$KEY_PATH" > "$tmp"
25	if [[ -s "$tmp" ]] && [[ "$(tail -c1 "$tmp" \| wc -l)" -eq 0 ]]; then
26	printf '\n' >> "$tmp"
27	fi
28	mv "$tmp" "$KEY_PATH"
29	chmod 600 "$KEY_PATH"
30	}
31
32	decode_b64_to_key() {
33	local src="$1"
34	if [[ -f "$src" ]]; then
35	tr -d '\r\n[:space:]' < "$src" \| base64 -d > "$KEY_PATH"
36	else
37	printf '%s' "$src" \| tr -d '\r\n[:space:]' \| base64 -d > "$KEY_PATH"
38	fi
39	}
40
41	if [[ -n "${AUR_SSH_PRIVATE_KEY_B64:-}" ]]; then
42	decode_b64_to_key "$AUR_SSH_PRIVATE_KEY_B64"
43	elif [[ -n "${AUR_SSH_PRIVATE_KEY:-}" && -f "${AUR_SSH_PRIVATE_KEY}" ]]; then
44	if is_raw_ssh_key "$AUR_SSH_PRIVATE_KEY"; then
45	cp "$AUR_SSH_PRIVATE_KEY" "$KEY_PATH"
46	else
47	decode_b64_to_key "$AUR_SSH_PRIVATE_KEY"
48	fi
49	elif [[ -n "${AUR_SSH_PRIVATE_KEY:-}" ]]; then
50	if printf '%s' "$AUR_SSH_PRIVATE_KEY" \| grep -qE 'BEGIN (OPENSSH \|RSA \|EC )?PRIVATE KEY'; then
51	printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > "$KEY_PATH"
52	else
53	decode_b64_to_key "$AUR_SSH_PRIVATE_KEY"
54	fi
55	elif [[ -f "$HOME/.ssh/id_ed25519" ]]; then
56	cp "$HOME/.ssh/id_ed25519" "$KEY_PATH"
57	else
58	echo "No AUR SSH key found. Set AUR_SSH_PRIVATE_KEY_B64 or AUR_SSH_PRIVATE_KEY." >&2
59	exit 1
60	fi
61
62	normalize_key_file
63
64	if ! is_raw_ssh_key "$KEY_PATH"; then
65	echo "AUR SSH key is not a valid OpenSSH private key after setup." >&2
66	echo "Use either:" >&2
67	echo " - AUR_SSH_PRIVATE_KEY as File with raw key (BEGIN ... PRIVATE KEY)" >&2
68	echo " - AUR_SSH_PRIVATE_KEY_B64 as Variable with one-line base64 of that key" >&2
69	echo "Tip: generate base64 from a LF-normalized key (see docs/CI.md)." >&2
70	exit 1
71	fi
72
73	if ! ssh-keygen -y -f "$KEY_PATH" >/dev/null 2>&1; then
74	echo "AUR SSH key failed ssh-keygen validation (often CRLF or truncated paste)." >&2
75	exit 1
76	fi
77
78	ssh-keyscan aur.archlinux.org >> "$HOME/.ssh/known_hosts" 2>/dev/null \|\| true