util/release: Update build-release script to pause for the PGP key

When the script is run, it fetches a new copy of the repo, then creates
a tag, signed by GPG. When this signing step runs, a window pops up for
the user to enter their PGP key's passphrase. This window prevents the
user from doing anything else on their desktop, like looking up the
passphrase.  It also times out after a while, and causes the script to
fail at that point.

To prevent this annoyance, pause right before the step asking for the
passphrase until the user is ready.

Because the submodules aren't tagged, we can delay their update until
after the tag is created to lower the amount of time needed before the
tag & signing step.

Signed-off-by: Martin Roth <gaumless@gmail.com>
Change-Id: I414dfc0f8944b4408881392278a2bce2a364992b
Reviewed-on: https://review.coreboot.org/c/coreboot/+/77366
Reviewed-by: Paul Menzel <paulepanter@mailbox.org>
Reviewed-by: Felix Singer <service+coreboot-gerrit@felixsinger.de>
Reviewed-by: Felix Held <felix-coreboot@felixheld.de>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>

1 files changed, 13 insertions, 1 deletions

diff --git a/util/release/build-release b/util/release/build-release
index 5bbc1b5d7a..c8e939b4bb 100755
--- a/util/release/build-release
+++ b/util/release/build-release
@@ -38,6 +38,16 @@ if [ -z "${VERSION_NAME}" ] || [ "${VERSION_NAME}" = "--help" ] || [ -z "${COMMI
 	exit 1
 fi
 
+pause() {
+  local text=$1
+
+  echo
+  if [ -n "$text" ]; then
+    echo "$text"
+  fi
+  read -r -p "Press [Enter] key to continue..."
+}
+
 # Verify that tar supports --sort
 if ! tar --sort=name -cf /dev/null /dev/null 2>/dev/null ; then
 	echo "Error: The installed version of tar does not support --sort"
@@ -70,13 +80,15 @@ fi
 
 	util/crossgcc/buildgcc -W > .crossgcc-version
 
-	git submodule update --init --checkout
 	if [ -n "${GPG_KEY_ID}" ]; then
+		pause "The next step will need your PGP key's passphrase, so be ready."
 		git tag -a -s -u "$GPG_KEY_ID" --force "${VERSION_NAME}" -m "coreboot version ${VERSION_NAME}" --
 	else
 		git tag -a --force "${VERSION_NAME}" -m "coreboot version ${VERSION_NAME}" --
 	fi
 
+	git submodule update --init --checkout
+
 	printf "%s-%s\n" "$VERSION_NAME"  "$(git log --pretty=%h -1)" > .coreboot-version
 	printf "%s\n" "$(git log --pretty=format:%ci -1)" > "${TIME_FILE}"
 )