enricobuehler
1fd4c97139
apple / swift (push) Successful in 53s
ci / rust (push) Successful in 1m11s
ci / web (push) Successful in 32s
android / android (push) Failing after 1m51s
ci / docs-site (push) Successful in 30s
ci / bench (push) Successful in 1m47s
decky / build-publish (push) Successful in 12s
docker / build-push (--build-arg FEDORA_VERSION=44, ci, ci/fedora-rpm.Dockerfile, punktfunk-fedora44-rpm) (push) Successful in 5s
docker / build-push (., web/Dockerfile, punktfunk-web) (push) Successful in 4s
docker / build-push (ci, ci/fedora-rpm.Dockerfile, punktfunk-fedora-rpm) (push) Successful in 3s
docker / build-push (ci, ci/rust-ci.Dockerfile, punktfunk-rust-ci) (push) Successful in 4s
docker / build-push (docs-site, docs-site/Dockerfile, punktfunk-docs) (push) Successful in 19s
flatpak / build-publish (push) Failing after 2s
deb / build-publish (push) Failing after 2m43s
rpm / build-publish (bazzite, punktfunk-fedora-rpm) (push) Successful in 5m19s
rpm / build-publish (fedora-44, punktfunk-fedora44-rpm) (push) Successful in 5m15s
docker / deploy-docs (push) Successful in 5s
The audit's signing recommendation, scoped to RPM (apt's signed Release metadata already covers .debs; bootc cosign deferred). packaging/rpm/sign-rpms.sh GPG-signs dist/*.rpm and self-verifies (rpmkeys --checksig), run from rpm.yml between build + publish. Safe to ship: the step is a NO-OP (exit 0, unsigned as today) until RPM_GPG_PRIVATE_KEY is set as a CI secret — so it can't break current CI, and when enabled a bad macro fails loudly via the in-step checksig rather than shipping bad signatures. rpm/README gains the one-time enablement runbook (generate a dedicated passphrase-less key, add the secret, publish the public key, flip gpgcheck=1 only after a signed build lands) and notes step-ca is for TLS, not OpenPGP (it can't sign RPMs). Also fixes the rpm/README version staleness the doc review caught: rolling is 0.2.0-0.ciN (outranks the stray 0.1.1, no pin needed), host releases use host-v* not the client's v*. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
46 lines
2.1 KiB
Bash
Executable File
46 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Detached-GPG-sign the built dist/*.rpm so the Gitea RPM registry can be served with gpgcheck=1.
|
|
#
|
|
# DORMANT by default: if RPM_GPG_PRIVATE_KEY is unset this exits 0 and leaves the RPMs unsigned —
|
|
# exactly today's behaviour — so it is SAFE to ship before a key exists. The signing only activates
|
|
# once you add the key as a CI secret (see packaging/rpm/README.md "Enabling per-package signing").
|
|
#
|
|
# Recommended: a DEDICATED, PASSPHRASE-LESS signing key (simplest in CI), distinct from the Gitea
|
|
# instance's repo-metadata key. If your key has a passphrase, set RPM_GPG_PASSPHRASE too.
|
|
#
|
|
# Usage (in rpm.yml, after build-rpm.sh): RPM_GPG_PRIVATE_KEY=... [RPM_GPG_PASSPHRASE=...] bash packaging/rpm/sign-rpms.sh
|
|
set -euo pipefail
|
|
|
|
if [ -z "${RPM_GPG_PRIVATE_KEY:-}" ]; then
|
|
echo "RPM_GPG_PRIVATE_KEY unset — leaving dist/*.rpm UNSIGNED (registry stays gpgcheck=0)."
|
|
exit 0
|
|
fi
|
|
|
|
command -v rpmsign >/dev/null 2>&1 || dnf -y install rpm-sign >/dev/null
|
|
|
|
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; chmod 700 "$GNUPGHOME"
|
|
trap 'rm -rf "$GNUPGHOME"' EXIT
|
|
echo "allow-loopback-pinentry" > "$GNUPGHOME/gpg-agent.conf"
|
|
|
|
printf '%s' "$RPM_GPG_PRIVATE_KEY" | gpg --batch --import
|
|
KEYID="$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/{print $5; exit}')"
|
|
[ -n "$KEYID" ] || { echo "no secret key imported from RPM_GPG_PRIVATE_KEY" >&2; exit 1; }
|
|
|
|
# rpm v4 detached-signing macro. Force loopback pinentry (no TTY in CI); feed the passphrase, if
|
|
# any, on stdin via --passphrase-fd 0.
|
|
SIGN_CMD="%{__gpg} gpg --batch --no-verbose --no-armor --pinentry-mode loopback"
|
|
[ -n "${RPM_GPG_PASSPHRASE:-}" ] && SIGN_CMD="$SIGN_CMD --passphrase-fd 0"
|
|
SIGN_CMD="$SIGN_CMD -u %{_gpg_name} --digest-algo sha256 -sbo %{__signature_filename} %{__plaintext_filename}"
|
|
|
|
for rpm in dist/*.rpm; do
|
|
printf '%s' "${RPM_GPG_PASSPHRASE:-}" | rpmsign \
|
|
--define "_gpg_name $KEYID" \
|
|
--define "__gpg_sign_cmd $SIGN_CMD" \
|
|
--addsign "$rpm"
|
|
done
|
|
|
|
# Verify locally so a bad signature fails the build before publishing.
|
|
rpm --import <(gpg --export --armor "$KEYID")
|
|
rpmkeys --checksig dist/*.rpm
|
|
echo "signed + verified $(find dist -name '*.rpm' | wc -l) RPM(s) with key $KEYID"
|