scripts: add pgp keys expire check

Author: GustavoStingelin

scripts/check-pgp-expiry.sh

@@ -0,0 +1,85 @@
+#!/bin/bash
+
+# Check if any PGP key in scripts/keys expires within the next two weeks.
+# Exit with a non-zero status if any key is near expiration.
+
+set -euo pipefail
+
+KEY_DIR="./scripts/keys"
+
+if [[ ! -d "$KEY_DIR" ]]; then
+    echo "ERROR: Directory $KEY_DIR does not exist"
+    exit 1
+fi
+
+shopt -s nullglob
+key_files=("$KEY_DIR"/*.asc)
+if (( ${#key_files[@]} == 0 )); then
+    echo "ERROR: No PGP keys found in $KEY_DIR"
+    exit 0
+fi
+
+EXPIRE_THRESHOLD=$(date -d "2 weeks" +%s)
+exit_code=0
+
+reset_key_vars() {
+    current_key_type=""
+    current_expiry=""
+}
+
+for key_file in "${key_files[@]}"; do
+    gpg_output=$(gpg --with-colons --import-options show-only --import "$key_file" 2>&1)
+
+    key_name=$(basename "$key_file")
+    key_expiry_found=false
+
+    # Parse GPG output line by line to find key type, expiry and fingerprint
+    while IFS=: read -r type _ _ _ _ _ expiry _ _ fingerprint _; do
+        if [[ "$type" == "pub" || "$type" == "sub" ]]; then
+            # Store the key type and expiry for the next fpr line
+            current_key_type="$type"
+            current_expiry="$expiry"
+            key_expiry_found=true
+            continue
+        fi
+
+        # Skip if not a fingerprint line or no current key type
+        if [[ "$type" != "fpr" || -z "$current_key_type" ]]; then
+            continue
+        fi
+
+        key_info="$key_name $current_key_type fpr:${fingerprint:-unknown}"
+
+        # If expiry is empty, the key does not expire
+        if [[ -z "$current_expiry" ]]; then
+            echo "INFO: $key_info does not expire"
+            reset_key_vars
+            continue
+        fi
+
+        # Convert expiry timestamp to human readable date for comparison
+        if ! expiry_date=$(date -d "@$current_expiry" "+%Y-%m-%d" 2>/dev/null); then
+            echo "ERROR: Invalid expiry timestamp for $key_info $current_expiry"
+            exit_code=1
+            reset_key_vars
+            continue
+        fi
+
+        # Check if key expires within settled threshold
+        if (( current_expiry < EXPIRE_THRESHOLD )); then
+            echo "ERROR: $key_info expires soon ($expiry_date)"
+            exit_code=1
+        else
+            echo "INFO: $key_info is valid until $expiry_date"
+        fi
+
+        reset_key_vars
+    done <<< "$gpg_output"
+
+    if [[ "$key_expiry_found" == false ]]; then
+        echo "ERROR: Could not find any pub or sub keys for $key_name"
+        exit_code=1
+    fi
+done
+
+exit $exit_code