Sign DEB packages in the GHA runners that build them. (#17949)
* Sign DEB packages in the GHA runners that build them. This provides a stronger signature guarantee than we currently provide, and simplifies handling of multiple repository servers. * Skip package signing on PRs. It’s unlikely to work correctly, and has little to no value.
Austin S. Hemmelgarn committed
Jun 25, 2024 at 11:33 UTC
22112ed18c07380ce175edfc1e53b1c15efc5c72
3 files changed
+38
.github/scripts/deb-sign.sh
new
+16
@@ -0,0 +1,16 @@
1
+#!/bin/bash
2
+
3
+set -e
4
+
5
+pkgdir="${1}"
6
+keyid="${2}"
7
+
8
+echo "::group::Installing Dependencies"
9
+apt update
10
+apt upgrade -y
11
+apt install -y debsigs
12
+echo "::endgroup::"
13
+
14
+echo "::group::Signing packages"
15
+debsigs --sign=origin --default-keyid="${keyid}" "${pkgdir}"/*.{,d}deb
16
+echo "::endgroup::"
.github/workflows/packaging.yml
+11
@@ -310,6 +310,17 @@ jobs:
310
${{ matrix.arch }} \
311
${{ matrix.format }} \
312
${{ needs.version-check.outputs.repo }}
313
+ - name: Import GPG Keys
314
+ id: import-keys
315
+ if: needs.file-check.outputs.run == 'true' && matrix.format == 'deb' && github.event_name != 'pull_request'
316
+ uses: crazy-max/ghaction-import-gpg@v6
317
+ with:
318
+ gpg_private_key: ${{ secrets.NETDATABOT_PACKAGE_SIGNING_KEY }}
319
+ - name: Sign DEB Packages
320
+ id: sign-deb
321
+ if: needs.file-check.outputs.run == 'true' && matrix.format == 'deb' && github.event_name != 'pull_request'
322
+ shell: bash
323
+ run: /netdata/.github/scripts/deb-sign.sh artifacts Netdatabot
324
- name: Upload to packages2.netdata.cloud
325
id: package2-upload
326
if: github.event_name == 'workflow_dispatch' && github.repository == 'netdata/netdata' && needs.file-check.outputs.run == 'true'
.github/workflows/repoconfig-packages.yml
+11
@@ -132,6 +132,17 @@ jobs:
132
netdata/netdata-repoconfig \
133
packaging/repoconfig/artifacts
134
done
135
+ - name: Import GPG Keys
136
+ id: import-keys
137
+ if: matrix.format == 'deb' && github.event_name != 'pull_request'
138
+ uses: crazy-max/ghaction-import-gpg@v6
139
+ with:
140
+ gpg_private_key: ${{ secrets.NETDATABOT_PACKAGE_SIGNING_KEY }}
141
+ - name: Sign DEB Packages
142
+ id: sign-deb
143
+ if: matrix.format == 'deb' && github.event_name != 'pull_request'
144
+ shell: bash
145
+ run: /netdata/.github/scripts/deb-sign.sh packaging/repoconfig/artifacts Netdatabot
146
- name: Upload to packages2.netdata.cloud
147
id: package2-upload
148
if: github.event_name != 'pull_request' && github.repository == 'netdata/netdata'