#!/usr/bin/env bash

LATEST_DUMP=$(aws s3 ls s3://digitalmarketplace-database-backups | sort | tail -n 1 | awk '{print $4}')
aws s3 cp s3://digitalmarketplace-database-backups/${LATEST_DUMP} ./latest-dump.sql.gz.gpg
gpg2 --batch --import <($DM_CREDENTIALS_REPO/sops-wrapper -d $DM_CREDENTIALS_REPO/gpg/database-backups/secret.key.enc)
echo -n $($DM_CREDENTIALS_REPO/sops-wrapper -d $DM_CREDENTIALS_REPO/gpg/database-backups/secret-key-passphrase.txt.enc) | gpg2 --batch --passphrase-fd 0 --list-packets ./latest-dump.sql.gz.gpg
EXIT_CODE=$?

if [ ${EXIT_CODE} -gt 0 ]; then
  echo 'Decrpytion failed'
else
  echo 'Decryption succeeded'
fi

gpg2 --list-secret-keys --with-colons --fingerprint | grep fpr | cut -c 13-52 | xargs -n1 gpg2 --batch --delete-secret-key
rm ./latest-dump.sql.gz.gpg

exit ${EXIT_CODE}

Add script to check the db dump is decryptable
Add script to check the db dump is decryptable

There's a risk that if the secret key we use to decrypt the dumps gets
rotated, and the public key were encrpyting with doesn't, then we'll be
creating dumps we can never use.

This script will use the secret key in the creds repo to check that the
dumps can be decrypted. Using the `--list-packets` command with GPG
allows us to check that we can decrypt without actually having to
decrypt the file.
