Merge branch 'master' into fix-prune

bsdpot · Jul 28, 2024 · 6c69d9b · 6c69d9b
2 parents 42c5149 + 1a5db00
commit 6c69d9b
Show file tree

Hide file tree

Showing 5 changed files with 13 additions and 2 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,9 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
 ## Unreleased
+### Added
+- import/prepare: Support setting a default signature public key to verify pot signature (#296)
+
 ### Fixed
 - prune: Only attempt to stop pot if it is running (#295)
 

diff --git a/etc/pot/pot.conf.sample b/etc/pot/pot.conf.sample
@@ -54,6 +54,10 @@
 # IP of the DNS
 # POT_DNS_IP=10.192.0.2
 
+# Path to default public key to verify pot signatures using signify(1)
+# on import/prepare - can be overridden using `-C pubkey`.
+# POT_DEFAULT_SIGNATURE_PUBKEY=/usr/local/etc/pot/sign_key.pub
+
 # VPN support
 
 # name of the tunnel network interface

diff --git a/etc/pot/pot.default.conf b/etc/pot/pot.default.conf
@@ -63,6 +63,10 @@ POT_ISOLATE_VNET_POTS=false
 POT_EXPORT_PORTS_PF_RULES_HOOK=
 # VPN support
 
+# Path to default public key to verify pot signatures using signify(1)
+# on import/prepare - can be overridden using `-C pubkey`.
+POT_DEFAULT_SIGNATURE_PUBKEY=
+
 # name of the tunnel network interface
 POT_VPN_EXTIF=
 POT_VPN_NETWORKS=

diff --git a/share/pot/import.sh b/share/pot/import.sh
@@ -161,7 +161,7 @@ pot-import()
 	_rpname=
 	_tag=
 	_URL=
-	_sign_pubkey=
+	_sign_pubkey="$POT_DEFAULT_SIGNATURE_PUBKEY"
 	local _meta _dep_pname_tag _dep_snap _dep_pname _dep_tag _dep_origin
 	local _filename
 

diff --git a/share/pot/prepare.sh b/share/pot/prepare.sh
@@ -48,7 +48,7 @@ pot-prepare()
 	_bridge_name=
 	_cmd=
 	_dns=
-	_sign_pubkey=
+	_sign_pubkey="$POT_DEFAULT_SIGNATURE_PUBKEY"
 	OPTIND=1
 	while getopts "hvp:U:t:c:e:a:n:sN:i:B:S:d:C:" _o ; do
 		case "$_o" in