--- repo-add.org	2008-08-27 03:16:41.000000000 +0200
+++ repo-add	2008-11-26 19:42:33.296007506 +0100
@@ -28,6 +28,7 @@
 confdir='/etc'
 
 QUIET=0
+SIGN=0
 REPO_DB_FILE=""
 
 # ensure we have a sane umask set
@@ -58,7 +59,7 @@
 # print usage instructions
 usage() {
 	printf "repo-add, repo-remove (pacman) %s\n\n" "$myver"
-	printf "$(gettext "Usage: repo-add [-q] <path-to-db> <package> ...\n")"
+	printf "$(gettext "Usage: repo-add [-q] [-s] <path-to-db> <package> ...\n")"
 	printf "$(gettext "Usage: repo-remove [-q] <path-to-db> <packagename> ...\n\n")"
 	printf "$(gettext "\
 repo-add will update a package database by reading a package file.\n\
@@ -70,6 +71,9 @@
 	printf "$(gettext "\
 The -q/--quiet flag to either program will force silent running except\n\
 in the case of warnings or errors.\n\n")"
+	printf "$(gettext "\
+The -s/--sign option will sign the package database with the default key.\n\
+This save a additional repo database sig file for checks with gpg.\n\n")"
 	echo "$(gettext "Example:  repo-add /path/to/repo.db.tar.gz pacman-3.0.0.pkg.tar.gz")"
 	echo "$(gettext "Example:  repo-remove /path/to/repo.db.tar.gz kernel26")"
 }
@@ -337,6 +341,8 @@
 		msg2 "$(gettext "use options=(force) in the PKGBUILD instead")"
 	elif [ "$arg" == "--quiet" -o "$arg" == "-q" ]; then
 		QUIET=1
+	elif [ "$arg" == "--sign" -o "$arg" == "-s" ]; then
+		SIGN=1
 	elif [ -z "$REPO_DB_FILE" ]; then
 		# store absolute path to repo DB
 		REPO_DB_FILE=$($realpath "$arg")
@@ -385,7 +391,9 @@
 
 	if [ -n "$(ls)" ]; then
 		[ -f "${REPO_DB_FILE}.old" ] && rm "${REPO_DB_FILE}.old"
+		[ -f "${REPO_DB_FILE}.sig.old" ] && rm "${REPO_DB_FILE}.sig.old"
 		[ -f "$REPO_DB_FILE" ] && mv "$REPO_DB_FILE" "${REPO_DB_FILE}.old"
+		[ -f "${REPO_DB_FILE}.sig" ] && mv "${REPO_DB_FILE}.sig" "${REPO_DB_FILE}.sig.old"
 
 		case "$DB_COMPRESSION" in
 			gz)  TAR_OPT="z" ;;
@@ -394,6 +402,33 @@
 		esac
 
 		bsdtar -c${TAR_OPT}f "$REPO_DB_FILE" *
+		
+		# Sign the database with our secret key
+		# produces a $reponame.db.tar.gz.sig file
+		if [ $SIGN -eq 1 ]; then
+		    msg "$(gettext "Signing package database.")"
+		    /usr/bin/gpg -q --detach-sign "$REPO_DB_FILE"
+		    case "$?" in
+			0) msg2 "$(gettext "OK, signed")" 
+			    ;;
+			1) error "$(gettext "Error, bad signature")" 
+			    ;;
+			*) error "$(gettext "Error, other gpg error")" 
+		    esac
+		    msg "$(gettext "Verifiying signature...")"
+		    /usr/bin/gpg --no-verbose --quiet --verify "$REPO_DB_FILE".sig
+		    case "$?" in
+			0) msg2 "$(gettext "OK, verified")" 
+			    ;;
+			1) error "$(gettext "Error, bad signature")" 
+			    ;;
+			*) error "$(gettext "Error, other gpg error")" 
+		    esac
+		    # Todo: better error checking, better logging, reduce gpg output?
+		    # gpg: --logger-file file ???
+		fi
+		
+		
 	else
 		# we should only end up with an empty db after a remove of the last package in the database
 		error "$(gettext "All packages have been removed from the database. Deleting '%s'.")" "$REPO_DB_FILE"
