Implement signature verification in update-profile script.

home/bin/update-profile

@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/sh -e
 
 if [ ! -d ~/.local/profile-git ]; then
 	mkdir -p ~/.local/profile-git
@@ -6,10 +6,41 @@ if [ ! -d ~/.local/profile-git ]; then
 fi
 
 (
-cd ~/.local/profile-git
-git pull
-cd packages
-./packages.sh
-cd ..
-./install.sh
+
+	cd ~/.local/profile-git
+	echo "Fetching updates for profile..."
+	git fetch
+
+	# Synchronizing valid GPG keys
+	export GNUPGHOME="$HOME/.local/profile-data/gnupg"
+	mkdir -p "${GNUPGHOME}"
+	gpg --fingerprint
+	gpg --recv-keys \
+		B5108C5A158A6608AD3361DA1573F6D8EFE4D0CF \
+		04ADEF85EA6AEC6F75941E84468BBEEBB9EC6AEA
+
+	echo "Validating updates..."
+	git rev-list --format=oneline origin..HEAD | while IFS= read -r line; do
+		sha="$(echo "$line" | awk '{print $1}')"
+		title="$(echo "$line" | cut -f 1 -d ' ' --complement)"
+		printf "  … $title\r  "
+		if ! git verify-commit "$sha" >/dev/null 2>&1; then
+			echo  "✘"
+			echo "Found incorrectly signed commit, NOT applying. Contact the maintainer on the issue tracker."
+			exit 1
+		fi
+		echo "✔"
+	done
+
+	echo "All commits passed, now applying updates..."
+	git rebase master
+
+	echo "Running package installation..."
+	cd packages
+	./packages.sh
+
+	echo "Running profile installation..."
+	cd ..
+	./install.sh
+
 )

home/dotfiles/bash_profile

@@ -1 +1,4 @@
+#!/bin/bash
+
+# shellcheck source=profile
 source ~/.profile

home/dotfiles/bashrc

@@ -1,6 +1,4 @@
-#
-# ~/.bashrc
-#
+#!/bin/bash
 
 # If not running interactively, don't do anything
 [[ $- != *i* ]] && return

home/dotfiles/profile

@@ -3,26 +3,6 @@
 # just for this profile code
 PROFILE_DEBUG="${PROFILE_DEBUG:-0}"
 
-# features
-PROFILE_ALIAS=${PROFILE_ALIAS:-1}
-PROFILE_BIN=${PROFILE_BIN:-1}
-PROFILE_DEFAULT_TERM=${PROFILE_DEFAULT_TERM:-1}
-PROFILE_GO=${PROFILE_GO:-1}
-PROFILE_GPG_PINENTRY_FIX=${PROFILE_GPG_PINENTRY_FIX:-1}
-PROFILE_IBUS=${PROFILE_IBUS:-1}
-PROFILE_KEYCHAIN=${PROFILE_KEYCHAIN:-0}
-PROFILE_NANO=${PROFILE_NANO:-1}
-PROFILE_NANO_EXPLICIT_WIDE=${PROFILE_NANO_EXPLICIT_WIDE:-0}
-PROFILE_NO_BEEPS=${PROFILE_NO_BEEPS:-1}
-PROFILE_NODE=${PROFILE_NODE:-1}
-PROFILE_PRINT_REBOOT_REQUIRED=${PROFILE_PRINT_REBOOT_REQUIRED:-0} # hacky, see below
-PROFILE_RUBY=${PROFILE_RUBY:-1}
-PROFILE_RUST=${PROFILE_RUST:-1}
-PROFILE_SSH_AGENT=${PROFILE_SSH_AGENT:-1}
-PROFILE_SYSTEMD=${PROFILE_SYSTEMD:-1}
-PROFILE_THEFUCK=${PROFILE_THEFUCK:-1}
-PROFILE_YARN=${PROFILE_YARN:-1}
-
 ##############################################################################
 # Profile helper code from here
 
@@ -32,6 +12,19 @@ PROFILE_DEBUG_SECTION_END_TEXT="/"
 
 DEBUG_INDENT=0
 
+when_binary_available() {
+	if has_binary "$@"; then
+		printf '1'
+		return
+	fi
+	printf '0'
+	return
+}
+
+has_binary() {
+	command -v "$@" >/dev/null 2>&1
+}
+
 section() {
 	if [ $PROFILE_DEBUG -gt 0 ]; then
 		echo "${PROFILE_DEBUG_SECTION_START_PREFIX}$(tput smso)$*$(tput rmso)"
@@ -60,6 +53,28 @@ log() {
 	fi
 }
 
+##############################################################################
+# Profile tweaks and features
+
+PROFILE_ALIAS=${PROFILE_ALIAS:-1}
+PROFILE_BIN=${PROFILE_BIN:-1}
+PROFILE_DEFAULT_TERM=${PROFILE_DEFAULT_TERM:-1}
+PROFILE_GO=${PROFILE_GO:-$(when_binary_available go)}
+PROFILE_GPG_PINENTRY_FIX=${PROFILE_GPG_PINENTRY_FIX:-1}
+PROFILE_IBUS=${PROFILE_IBUS:-$(when_binary_available ibus)}
+PROFILE_KEYCHAIN=${PROFILE_KEYCHAIN:-$(when_binary_available keychain)}
+PROFILE_NANO=${PROFILE_NANO:-$(when_binary_available nano)}
+PROFILE_NANO_EXPLICIT_WIDE=${PROFILE_NANO_EXPLICIT_WIDE:-0}
+PROFILE_NO_BEEPS=${PROFILE_NO_BEEPS:-$(when_binary_available xset)}
+PROFILE_NODE=${PROFILE_NODE:-$(when_binary_available node)}
+PROFILE_PRINT_REBOOT_REQUIRED=${PROFILE_PRINT_REBOOT_REQUIRED:-0} # hacky, see below
+PROFILE_RUBY=${PROFILE_RUBY:-$(when_binary_available ruby)}
+PROFILE_RUST=${PROFILE_RUST:-$(when_binary_available rust)}
+PROFILE_SSH_AGENT=${PROFILE_SSH_AGENT:-$(when_binary_available ssh-agent)}
+PROFILE_SYSTEMD=${PROFILE_SYSTEMD:-$(when_binary_available systemctl)}
+PROFILE_THEFUCK=${PROFILE_THEFUCK:-$(when_binary_available thefuck)}
+PROFILE_YARN=${PROFILE_YARN:-$(when_binary_available yarn)}
+
 ##############################################################################
 # Actual profile code from here
 

home/dotfiles/zprofile

@@ -1 +1,3 @@
+#!/bin/zsh
+
 source ~/.profile

install.sh

@@ -2,9 +2,9 @@
 
 
 install_files() {
-	local target_dir="$1"
-	local source_dir="$(readlink -f "${2:-.}")"
-	local target_filename_prefix="${3}"
+	target_dir="$1"
+	source_dir="$(readlink -f "${2:-.}")"
+	target_filename_prefix="${3}"
 
 	mkdir -vp "${target_dir}"
 	target_dir="$(readlink -f "${target_dir}")"

packages/os.sh

@@ -15,7 +15,7 @@ add_tag() {
 has_tags() {
 	for req in "$@"; do
 		printf "Checking for tag: $req... "
-		local detected=0
+		detected=0
 		while IFS= read -r line; do
 			if [ "$line" = "$req" ]; then
 				echo "yes"
@@ -96,6 +96,6 @@ done
 # graphics UI detection
 # basically just checks if an X server is running on the machine and if yes, we just assume it's a desktop, not a server
 # grep will be always returned as a process with Xorg in the command line, so assume there must be a second process for this to succeed
-if [ $(ps aux | grep Xorg | wc -l) -gt 1 ]; then
+if [ "$(ps aux | grep Xorg | wc -l)" -gt 1 ]; then
 	add_tag "xorg_running" "desktop"
 fi