#!/bin/bash

## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## Variables for key handling and verification

## 'sq-git'
## https://sequoia-pgp.gitlab.io/sequoia-git/
## https://sequoia-pgp.gitlab.io/sequoia-git/user-manual/
## https://sequoia-pgp.gitlab.io/sequoia-git/man/sq-git.1.html
## https://fosdem.org/2026/schedule/event/KFSUCW-sequoia-git/

## 'sq-git log' root of trust ('--trust-root')
## Default to:
## - for user custom builds: HEAD
## - redistributable builds: See 'help-steps/variables'.
##   (when using setting variable 'dist_build_redistributable=true')
#sq_git_trust_root="HEAD"

## path to 'sq-git log' policy file ('--policy-file')
## https://sequoia-pgp.gitlab.io/sequoia-git/specification/#name-policy
##
## help-steps/variables walks ${dist_build_config_dirs_list} for
## openpgp-policy.toml; the highest-precedence (= last) entry that
## contains the file wins. Defaults map to:
##
##   Priority  | Location
## 1 (lowest)  | ${source_code_folder_dist}/buildconfig.d/openpgp-policy.toml
## 2 (higher)  | /etc/buildconfig-dist.d/openpgp-policy.toml
## 3 (highest) | ${HOMEVAR}/buildconfig.d/openpgp-policy.toml
##
## Override here only to point at a non-buildconfig.d location.
## CLI equivalent: --policy-file <path>
#sq_git_policy_file=/some/other/openpgp-policy.toml

## Local maintainer's exported public cert (sq cert export). Used
## by signing-key-create's 'sq-git policy authorize' step to add
## the local cert to the user-side policy file. Defaults to
## ${openpgp_policy_dir_user}/openpgp-cert.pgp; override here if
## the cert lives elsewhere.
## CLI equivalent: --cert-file <path>
## Why file extension '.pgp'? 'sq key generate' places private keys:
## ~/.local/share/sequoia/keystore/softkeys/*.pgp
#openpgp_cert_file_user=/some/other/openpgp-cert.pgp

#set -x
set -o errexit
set -o nounset
set -o pipefail
set -o errtrace
