Vault signature watermark

#!/bin/bash
# Note requirement: ./last-hash is a symlink to the previous file or seed text.
# Usage: sign-image.sh [IMAGE FILE]

LAST=$(readlink -f last-hash)
cat last-hash | base64 -w 0 > last-base64

# Get signature from the last image/block
SIG=$(vault write image-verifiers/sign/chain-signer/sha2–256 input=@last-base64 -format=json)
SIG=$(echo “$SIG” | jq -r .data.signature)

# Generate small qrcode PNG from last image
qrencode -s 1 -o qr.png “$SIG”

# Now watermark last image signature onto our image
composite -watermark 50% -gravity southwest -geometry +4+4 qr.png “$1” “$1-sig.jpg”

# Now make our image the last image
ln -sf “$1-sig.jpg” last-hash
echo “Signed ‘$1’ from ‘$LAST’. ‘$1-sig.jpg’ is new last-hash.”