Skip to content

Commit dda8173

Browse files
logikallogikal
authored
Foundation laying (#15)
* refactor!: move and more explicitly name the existing workflow and action * docs: update README.md * chore: repo management, linting, editor integrations * chore: update linteres, update from trunk fmt: tabs are better than spaces * chore: update trunk actions * docs: add trunk commands to README * docs: update versioning guidelines * build: add commitlint, move prettierrc so editors read it * build: improve test workflows to test explicit ubuntu versions * build!: remove dpkg-[sig,dev]. not available in ubuntu-24 * fix: s/deb-sigs/debsigs * test: add non-expiring testing key * ci: fails with local keys, test with real ones * test: remove 24.04 from all workflows * test: remove debug 'exit 1'. oops. still hangs with local key * test: explicitly pass the gpg no-tty arg to dpkg-sig * test: add an actrc for local testing * fix: action and workflow fixes to make deb signing work again, keep rpm & file working * ci: act and gha runners differe on access to /root: don't use /root * ci: more safely reload the gpg agent
1 parent af875da commit dda8173

23 files changed

+541
-187
lines changed

‎.actrc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
--container-architecture=linux/amd64
2+
--action-offline-mode

‎.editorconfig‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# EditorConfig is awesome: https://EditorConfig.org
2+
3+
# top-most EditorConfig file
4+
root = true
5+
6+
[*]
7+
indent_style = space
8+
end_of_line = lf
9+
charset = utf-8
10+
trim_trailing_whitespace = false
11+
insert_final_newline = true

‎devops/setup-gpg/README.md‎ renamed to ‎.github/actions/setup-gpg/README.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
This composite action will setup your github action to use a supplied gpg key.
44

55
## Supported Platforms
6+
67
- GPG
78
- rpmsign/rpm
89
- debsign
@@ -28,7 +29,8 @@ jobs:
2829
gpg-key-name: "Aerospike"
2930
```
3031
31-
### Example RPM and GPG useage
32+
### Example RPM and GPG usage
33+
3234
```yaml
3335
name: GPG sign rpm
3436
on: workflow_dispatch

‎.github/actions/setup-gpg/action.yaml‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
name: Setup GPG
2+
description: Configures this action to run gpg with a given key and pass
3+
inputs:
4+
gpg-private-key:
5+
description: GPG private key exported as an ASCII armored version or its base64 encoding
6+
required: true
7+
gpg-key-pass:
8+
description: GPG key pass
9+
required: true
10+
gpg-public-key:
11+
description: GPG public key exported as an ASCII armored version or its base64 encoding
12+
required: true
13+
runs:
14+
using: composite
15+
steps:
16+
- name: Check Ubuntu version
17+
shell: bash
18+
run: |
19+
if [[ "$(cat /etc/os-release | grep VERSION_ID)" != *"22.04"* ]]; then
20+
echo "This action only supports Ubuntu 22.04"
21+
exit 1
22+
fi
23+
24+
- name: check if private key is not empty
25+
shell: bash
26+
env:
27+
PRIVATE_KEY: ${{ inputs.gpg-private-key }}
28+
if: ${{ env.PRIVATE_KEY == '' }}
29+
run: |
30+
echo "the gpg-private-key was empty"
31+
exit 1
32+
33+
- name: check if key pass is not empty
34+
shell: bash
35+
env:
36+
KEY_PASS: ${{ inputs.gpg-key-pass }}
37+
if: ${{ env.KEY_PASS == '' }}
38+
run: |
39+
echo "the secret gpg-key-pass was empty"
40+
exit 1
41+
42+
- name: check if public key pass is empty
43+
shell: bash
44+
env:
45+
PUBLIC_KEY: ${{ inputs.gpg-public-key }}
46+
if: ${{ env.PUBLIC_KEY == '' }}
47+
run: |
48+
echo "the secret gpg-public-pass was empty"
49+
exit 1
50+
51+
- name: install tools
52+
shell: bash
53+
run: |
54+
sudo apt-get update && sudo apt-get install ca-certificates gnupg rpm pinentry-tty -y
55+
56+
- name: Set up GPG
57+
shell: bash
58+
env:
59+
GPG_PRIVATE_KEY: ${{ inputs.gpg-private-key }}
60+
GPG_KEY_PASS: ${{ inputs.gpg-key-pass }}
61+
GPG_PUBLIC_KEY: ${{ inputs.gpg-public-key }}
62+
HOME: /home/runner
63+
GNUPGHOME: /home/runner/.gnupg
64+
run: |
65+
# Ensure environment variables are exported
66+
export HOME="${HOME}"
67+
export GNUPGHOME="${GNUPGHOME}"
68+
69+
# Setup gpg with consistent path
70+
mkdir -p "$GNUPGHOME"
71+
chmod 700 "$GNUPGHOME"
72+
73+
# Import the private key
74+
gpg --import --batch --yes <<< "$GPG_PRIVATE_KEY"
75+
76+
# Get the key fingerprint and name from the imported key
77+
KEY_FP=$(gpg --list-secret-keys --with-colons | awk -F: '/^fpr:/ { print $10 }' | head -n1)
78+
KEY_NAME=$(gpg --list-secret-keys --with-colons | awk -F: '/^uid:/ { print $10 }' | head -n1)
79+
80+
# Set default key
81+
echo "default-key $KEY_FP" >> "$GNUPGHOME/gpg.conf"
82+
83+
# Configure passphrase handling
84+
echo "allow-preset-passphrase" >> "$GNUPGHOME/gpg-agent.conf"
85+
echo "allow-loopback-pinentry" >> "$GNUPGHOME/gpg-agent.conf"
86+
87+
# Configure GPG for non-interactive use
88+
echo "use-agent" >> "$GNUPGHOME/gpg.conf"
89+
echo "pinentry-mode loopback" >> "$GNUPGHOME/gpg.conf"
90+
echo "batch" >> "$GNUPGHOME/gpg.conf"
91+
echo "no-tty" >> "$GNUPGHOME/gpg.conf"
92+
echo "passphrase-file $GNUPGHOME/passphrase" >> "$GNUPGHOME/gpg.conf"
93+
94+
# Create passphrase file
95+
echo "$GPG_KEY_PASS" > "$GNUPGHOME/passphrase"
96+
chmod 600 "$GNUPGHOME/passphrase"
97+
98+
# Set permissions on specific files we know exist
99+
for file in "$GNUPGHOME/gpg.conf" "$GNUPGHOME/gpg-agent.conf" "$GNUPGHOME/passphrase"; do
100+
if [ -f "$file" ]; then
101+
chmod 600 "$file"
102+
fi
103+
done
104+
105+
# Create symlink for gpg2 (required for rpm signing)
106+
sudo ln -sf $(which gpg) /usr/bin/gpg2
107+
108+
# Configure rpm macros line by line
109+
{
110+
echo "%_signature gpg"
111+
echo "%_gpg_path $GNUPGHOME"
112+
echo "%_gpg_name $KEY_FP"
113+
echo "%_gpgbin /usr/bin/gpg2"
114+
echo "%__gpg /usr/bin/gpg2"
115+
echo "%__gpg_sign_cmd %{__gpg} --batch --pinentry-mode loopback --passphrase-file $GNUPGHOME/passphrase --no-armor --no-secmem-warning --no-tty -u \"%{_gpg_name}\" -sbo %{__signature_filename} %{__plaintext_filename}"
116+
} > "$HOME/.rpmmacros"
117+
chmod 600 "$HOME/.rpmmacros"
118+
119+
# Import public key for verification
120+
echo -e "$GPG_PUBLIC_KEY" > "$GNUPGHOME/public.key"
121+
chmod 600 "$GNUPGHOME/public.key"
122+
gpg --import "$GNUPGHOME/public.key"
123+
rpm --import "$GNUPGHOME/public.key"
124+
125+
# Reload gpg-agent configuration
126+
gpg-connect-agent reloadagent /bye

‎.github/dependabot.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: github-actions
4+
directories:
5+
- /
6+
schedule:
7+
interval: daily

‎.github/workflows/sign-deb-example.yaml‎

Lines changed: 0 additions & 40 deletions
This file was deleted.

‎.github/workflows/sign-deb-test.yaml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
name: GPG sign DEB
2+
on:
3+
workflow_dispatch:
4+
pull_request:
5+
branches:
6+
- main
7+
permissions: read-all
8+
jobs:
9+
sign-deb:
10+
runs-on: ${{ matrix.os }}
11+
strategy:
12+
matrix:
13+
os:
14+
- ubuntu-22.04
15+
#- ubuntu-24.04
16+
steps:
17+
- uses: actions/checkout@v4
18+
- name: Check Ubuntu version
19+
# This action only supports Ubuntu 22.04. 24.04 has removed dpkg-sig
20+
run: |
21+
if [[ "$(cat /etc/lsb-release | grep DISTRIB_RELEASE)" != *"22.04"* ]]; then
22+
echo "This action only supports Ubuntu 22.04 due to the removal of dpkg-sig in 24.04"
23+
exit 1
24+
fi
25+
shell: bash
26+
- name: install dpkg-sig
27+
run: |
28+
sudo apt-get update && sudo apt-get install dpkg-sig dpkg-dev -y
29+
- name: setup GPG
30+
uses: ./.github/actions/setup-gpg/
31+
with:
32+
gpg-private-key: ${{ secrets.GPG_SECRET_KEY }}
33+
gpg-public-key: ${{ secrets.GPG_PUBLIC_KEY }}
34+
gpg-key-pass: ${{ secrets.GPG_PASS }}
35+
36+
- name: GPG sign deb # gpg sign and verify deb packages
37+
env:
38+
GPG_TTY: /dev/null
39+
HOME: /home/runner
40+
GNUPGHOME: /home/runner/.gnupg
41+
run: |
42+
# Ensure environment variables are exported
43+
export HOME="${HOME}"
44+
export GNUPGHOME="${GNUPGHOME}"
45+
46+
# Sign the package
47+
dpkg-sig --sign builder --gpg-options "--batch --pinentry-mode loopback --passphrase-file $GNUPGHOME/passphrase" tests/*.deb
48+
# Verify the signature
49+
dpkg-sig --verify tests/*.deb

‎.github/workflows/sign-file-example.yaml‎

Lines changed: 0 additions & 27 deletions
This file was deleted.

‎.github/workflows/sign-file-test.yaml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: GPG sign file
2+
on:
3+
workflow_dispatch:
4+
pull_request:
5+
branches:
6+
- main
7+
permissions: read-all
8+
jobs:
9+
sign-file:
10+
runs-on: ${{ matrix.os }}
11+
strategy:
12+
matrix:
13+
os:
14+
- ubuntu-22.04
15+
# - ubuntu-24.04
16+
steps:
17+
- uses: actions/checkout@v4
18+
19+
- name: setup GPG
20+
uses: ./.github/actions/setup-gpg/
21+
with:
22+
gpg-private-key: ${{ secrets.GPG_SECRET_KEY }}
23+
gpg-public-key: ${{ secrets.GPG_PUBLIC_KEY }}
24+
gpg-key-pass: ${{ secrets.GPG_PASS }}
25+
26+
- name: GPG sign artifacts # Signing other artifacts
27+
env:
28+
GPG_TTY: /dev/null
29+
HOME: /home/runner
30+
GNUPGHOME: /home/runner/.gnupg
31+
run: |
32+
# Ensure environment variables are exported
33+
export HOME="${HOME}"
34+
export GNUPGHOME="${GNUPGHOME}"
35+
36+
# Sign the file
37+
gpg --detach-sign --no-tty --batch --yes --output README.md.asc --passphrase-file "$GNUPGHOME/passphrase" README.md
38+
# Verify the signature
39+
gpg --verify README.md.asc README.md

‎.github/workflows/sign-rpm-example.yaml‎

Lines changed: 0 additions & 28 deletions
This file was deleted.

0 commit comments

Comments
 (0)