raveos-keyring aláírás bekötve

9 files changed, 91 insertions, 2 deletions

diff --git a/.forgejo/workflows/build-kernel.yml b/.forgejo/workflows/build-kernel.yml
index c1d7d62..7dab4bf 100644
--- a/.forgejo/workflows/build-kernel.yml
+++ b/.forgejo/workflows/build-kernel.yml
@@ -37,6 +37,14 @@ jobs:
           git clone --depth 1 git@git.rp1.hu:RaveOS/raveos-core-repo.git /tmp/raveos-core-repo
           mkdir -p /tmp/builtpkgs
 
+      - name: Import GPG signing key
+        run: |
+          set -euo pipefail
+          export GNUPGHOME=/tmp/raveos-gnupg
+          rm -rf "$GNUPGHOME"
+          mkdir -m 700 "$GNUPGHOME"
+          echo "${{ secrets.GPG_PRIVATE_KEY }}" | base64 -d | gpg --batch --import
+
       - name: Check if already built
         id: check
         run: |
@@ -64,6 +72,19 @@ jobs:
           makepkg -s --noconfirm
           cp -v linux-cachyos-*.pkg.tar.zst /tmp/builtpkgs/
 
+      - name: Sign built packages
+        if: steps.check.outputs.SKIP == 'no'
+        run: |
+          set -euo pipefail
+          export GNUPGHOME=/tmp/raveos-gnupg
+          for pkg in /tmp/builtpkgs/*.pkg.tar.zst; do
+            gpg --batch --yes --pinentry-mode loopback \
+                --passphrase "${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}" \
+                --local-user 25C7668F1235F5664F037671BDB2A9CE6EBFF113 \
+                --detach-sign "$pkg"
+            echo "Alairva: $(basename "$pkg")"
+          done
+
       - name: Publish to core repo
         if: steps.check.outputs.SKIP == 'no'
         run: |
@@ -86,10 +107,14 @@ jobs:
             PKGNAME=$(echo "$PKGFILE" | sed 's/-[0-9][^-]*-[^-]*-[^-]*\.pkg\.tar\.zst$//')
             rm -f "$CORE/${PKGNAME}-"*.pkg.tar.zst* 2>/dev/null || true
             cp -v "$pkg" "$CORE/"
+            [ -f "$pkg.sig" ] && cp -v "$pkg.sig" "$CORE/"
           done
 
-          repo-add "$CORE/raveos-core-repo.db.tar.gz" "$CORE"/linux-cachyos-[^h]*.pkg.tar.zst
-          repo-add "$CORE/raveos-core-repo.db.tar.gz" "$CORE"/linux-cachyos-headers-*.pkg.tar.zst
+          export GNUPGHOME=/tmp/raveos-gnupg
+          repo-add -s -k 25C7668F1235F5664F037671BDB2A9CE6EBFF113 \
+              "$CORE/raveos-core-repo.db.tar.gz" "$CORE"/linux-cachyos-[^h]*.pkg.tar.zst
+          repo-add -s -k 25C7668F1235F5664F037671BDB2A9CE6EBFF113 \
+              "$CORE/raveos-core-repo.db.tar.gz" "$CORE"/linux-cachyos-headers-*.pkg.tar.zst
 
           git add -A
           git commit -m "kernel: linux-cachyos ${{ steps.check.outputs.PKGVER }}-${{ steps.check.outputs.PKGREL }}"
@@ -104,6 +129,8 @@ jobs:
       - name: Cleanup
         if: always()
         run: |
+          gpgconf --homedir /tmp/raveos-gnupg --kill gpg-agent || true
+          sudo rm -rf /tmp/raveos-gnupg || true
           sudo rm -rf /tmp/builtpkgs || true
           sudo rm -rf /tmp/raveos-core-repo || true
           sudo rm -rf linux-raveos/src linux-raveos/pkg || true
diff --git a/.forgejo/workflows/build-theme-send-core-repo.yml b/.forgejo/workflows/build-theme-send-core-repo.yml
index 9168a59..201a1ab 100644
--- a/.forgejo/workflows/build-theme-send-core-repo.yml
+++ b/.forgejo/workflows/build-theme-send-core-repo.yml
@@ -32,6 +32,14 @@ jobs:
           git clone --depth 1 git@git.rp1.hu:RaveOS/raveos-core-repo.git /tmp/raveos-core-repo
           mkdir -p /tmp/builtpkgs
 
+      - name: Import GPG signing key
+        run: |
+          set -euo pipefail
+          export GNUPGHOME=/tmp/raveos-gnupg
+          rm -rf "$GNUPGHOME"
+          mkdir -m 700 "$GNUPGHOME"
+          echo "${{ secrets.GPG_PRIVATE_KEY }}" | base64 -d | gpg --batch --import
+
       - name: Build raveos-calamares-theme
         run: |
           set -euo pipefail
@@ -203,6 +211,23 @@ jobs:
           makepkg -s --noconfirm -f
           cp -v build/raveos-welcome-*.pkg.tar.zst /tmp/builtpkgs/
 
+      - name: Sign built packages
+        run: |
+          set -euo pipefail
+          export GNUPGHOME=/tmp/raveos-gnupg
+          BUILT=$(ls /tmp/builtpkgs/*.pkg.tar.zst 2>/dev/null || true)
+          if [ -z "$BUILT" ]; then
+            echo "Nincs csomag alairashoz -> kihagyva"
+            exit 0
+          fi
+          for pkg in $BUILT; do
+            gpg --batch --yes --pinentry-mode loopback \
+                --passphrase "${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}" \
+                --local-user 25C7668F1235F5664F037671BDB2A9CE6EBFF113 \
+                --detach-sign "$pkg"
+            echo "Alairva: $(basename "$pkg")"
+          done
+
       - name: Publish packages to raveos-core-repo (only if changed)
         run: |
           set -euo pipefail
@@ -229,6 +254,7 @@ jobs:
             fi
             rm -f "$CORE/${PKGNAME}-"*.pkg.tar.zst* 2>/dev/null || true
             cp -v "$pkg" "$CORE/"
+            [ -f "$pkg.sig" ] && cp -v "$pkg.sig" "$CORE/"
           done
 
           git add -A
@@ -244,6 +270,8 @@ jobs:
       - name: Cleanup (SAFE)
         if: always()
         run: |
+          gpgconf --homedir /tmp/raveos-gnupg --kill gpg-agent || true
+          sudo rm -rf /tmp/raveos-gnupg || true
           sudo rm -rf /tmp/builtpkgs || true
           sudo rm -rf /tmp/raveos-core-repo || true
           sudo rm -rf /var/cache/pacman/pkg/* || true
diff --git a/raveos-calamares-module/desktopselect/desktopselect.conf b/raveos-calamares-module/desktopselect/desktopselect.conf
index 2762b7a..2ded0cb 100644
--- a/raveos-calamares-module/desktopselect/desktopselect.conf
+++ b/raveos-calamares-module/desktopselect/desktopselect.conf
@@ -1,6 +1,7 @@
 ---
 mandatory_packages:
   - wget
+  - raveos-keyring
   - raveos-welcome
   - raveos-app-installer
   - noto-fonts
diff --git a/raveos-keyring/PKGBUILD b/raveos-keyring/PKGBUILD
new file mode 100644
index 0000000..a73ff71
--- /dev/null
+++ b/raveos-keyring/PKGBUILD
@@ -0,0 +1,25 @@
+pkgname=raveos-keyring
+pkgver=1.0.0
+pkgrel=1
+pkgdesc="RaveOS package signing keyring"
+arch=('any')
+url="https://raveos.local"
+license=('custom')
+install=raveos-keyring.install
+source=()
+sha256sums=()
+
+BUILDDIR="${startdir}/build"
+PKGDEST="${startdir}/build"
+SRCDEST="${startdir}/build"
+SRCPKGDEST="${startdir}/build"
+LOGDEST="${startdir}/build"
+
+package() {
+    install -Dm644 "${startdir}/raveos.gpg" \
+        "${pkgdir}/usr/share/pacman/keyrings/raveos.gpg"
+    install -Dm644 "${startdir}/raveos-trusted" \
+        "${pkgdir}/usr/share/pacman/keyrings/raveos-trusted"
+    install -Dm644 "${startdir}/raveos-revoked" \
+        "${pkgdir}/usr/share/pacman/keyrings/raveos-revoked"
+}
diff --git a/raveos-keyring/raveos-keyring.install b/raveos-keyring/raveos-keyring.install
new file mode 100644
index 0000000..7a8f592
--- /dev/null
+++ b/raveos-keyring/raveos-keyring.install
@@ -0,0 +1,7 @@
+post_install() {
+    pacman-key --populate raveos
+}
+
+post_upgrade() {
+    pacman-key --populate raveos
+}
diff --git a/raveos-keyring/raveos-revoked b/raveos-keyring/raveos-revoked
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/raveos-keyring/raveos-revoked
diff --git a/raveos-keyring/raveos-trusted b/raveos-keyring/raveos-trusted
new file mode 100644
index 0000000..8e909a5
--- /dev/null
+++ b/raveos-keyring/raveos-trusted
@@ -0,0 +1 @@
+25C7668F1235F5664F037671BDB2A9CE6EBFF113:4:
diff --git a/raveos-keyring/raveos.gpg b/raveos-keyring/raveos.gpg
new file mode 100644
index 0000000..47d5895
--- /dev/null
+++ b/raveos-keyring/raveos.gpg
diff --git a/raveos-keyring/raveos.gpg~ b/raveos-keyring/raveos.gpg~
new file mode 100644
index 0000000..7df87cc
--- /dev/null
+++ b/raveos-keyring/raveos.gpg~