Release builds on Ubuntu 26.04: rpm signing, GNU install for OpenWrt

ubuntu-latest is 26.04 now. Its rpm 6 runs %__gpg_sign_cmd without
taking the word after %{__gpg} for argv[0], as rpm 4 does, so the
command of our own broke there; rpm's own is given the passphrase file
and the digest through %_gpg_sign_cmd_extra_args and %_gpg_digest_algo
instead, which both read. Each rpm is then checked by the rpm of the EL
release it is for, against 3proxy-release-key.asc.

The OpenWrt SDK refuses an install which is not GNU's. 26.04 has the
Rust coreutils, and GNU's as gnuinstall and the like: gnuinstall is
linked as install ahead in PATH. ipk also reads DEVEL when there is no
RELEASE, so it can be run on the development branch.

workflow_dispatch takes a sign input, to sign the packages as a release
does without uploading anything.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/build-ipk.yml

@@ -4,6 +4,11 @@ on:
   release:
     types: [published]
   workflow_dispatch:
+    inputs:
+      sign:
+        description: "sign the packages, as for a release (nothing is uploaded)"
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -41,13 +46,26 @@ jobs:
     - uses: actions/checkout@v7
 
     - name: env
-      run: echo "RELEASE=$(tr -d ' \t\r\n' < RELEASE)" >> $GITHUB_ENV
+      run: |
+       # a release branch has RELEASE, the development one DEVEL
+       if [ -f RELEASE ]; then V=RELEASE; else V=DEVEL; fi
+       echo "RELEASE=$(tr -d ' \t\r\n' < $V)" >> $GITHUB_ENV
 
     - name: Install build dependencies
       run: |
        sudo apt-get update
        sudo apt-get install -y build-essential libncurses-dev zlib1g-dev gawk git \
          gettext libssl-dev xsltproc wget unzip python3 rsync file zstd
+       # The SDK wants GNU install. Ubuntu 26.04 has the Rust coreutils and
+       # GNU's under gnu names (switching back conflicts): link gnuinstall
+       if ! install --version 2>/dev/null | grep -q GNU; then
+         G=$(command -v gnuinstall || true)
+         if [ -z "$G" ]; then echo "no GNU install"; exit 1; fi
+         mkdir -p "$HOME/gnubin"
+         ln -sf "$G" "$HOME/gnubin/install"
+         echo "$HOME/gnubin" >> "$GITHUB_PATH"
+         "$HOME/gnubin/install" --version | head -1
+       fi
 
     - name: Fetch SDK
       run: |
@@ -95,7 +113,7 @@ jobs:
        path: "*.ipk"
 
     - name: Import signing key
-      if: github.event_name == 'release'
+      if: github.event_name == 'release' || inputs.sign
       env:
        GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
        GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
@@ -113,7 +131,7 @@ jobs:
        rm -f /tmp/prime.txt
 
     - name: Checksums and detached signatures
-      if: github.event_name == 'release'
+      if: github.event_name == 'release' || inputs.sign
       env:
        GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
       run: |

.github/workflows/build-rpm-arm64.yml

@@ -4,6 +4,11 @@ on:
   release:
     types: [published]
   workflow_dispatch:
+    inputs:
+      sign:
+        description: "sign the packages, as for a release (nothing is uploaded)"
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -124,7 +129,7 @@ jobs:
        name: "3proxy-${{ env.RELEASE }}-arm64.deb"
        path: "*.deb"
     - name: Import signing key
-      if: github.event_name == 'release'
+      if: github.event_name == 'release' || inputs.sign
       env:
        GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
        GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
@@ -141,7 +146,7 @@ jobs:
            -u "$KEYID" --detach-sign -o /dev/null /tmp/prime.txt
        rm -f /tmp/prime.txt
     - name: Sign rpm
-      if: github.event_name == 'release'
+      if: github.event_name == 'release' || inputs.sign
       env:
        GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
       run: |
@@ -153,9 +158,13 @@ jobs:
        gpg --batch --yes --pinentry-mode loopback --passphrase-file /tmp/gpgpass \
            -u "$GPG_KEYID" --detach-sign -o /tmp/signtest.sig /tmp/signtest
        echo "key can sign"
+       # rpm's own signing command, given what it needs: rpm 4 takes the
+       # word after %{__gpg} in it for argv[0], rpm 6 does not, so one of our
+       # own breaks on one of them
        { echo "%_gpg_name $GPG_KEYID"
          echo "%__gpg $GPGBIN"
-         echo '%__gpg_sign_cmd %{__gpg} gpg --batch --no-armor --pinentry-mode loopback --passphrase-file /tmp/gpgpass --no-secmem-warning --digest-algo sha256 -u "%{_gpg_name}" -sbo %{__signature_filename} %{__plaintext_filename}'
+         echo "%_gpg_digest_algo sha256"
+         echo "%_gpg_sign_cmd_extra_args --batch --pinentry-mode loopback --passphrase-file /tmp/gpgpass"
        } > ~/.rpmmacros
        rpm --addsign *.rpm
        rm -f /tmp/gpgpass /tmp/signtest /tmp/signtest.sig
@@ -173,8 +182,23 @@ jobs:
          esac
          echo "$f: $sig"
        done
+    - name: Verify rpm signatures
+      if: github.event_name == 'release' || inputs.sign
+      run: |
+       # checked by the rpm of the system each package is for, with the
+       # published release key
+       for EL in $ELS; do
+         for f in *.el$EL.*.rpm; do
+           docker run --rm -v "$PWD:/w:ro" "almalinux:$EL" bash -c '
+             set -e
+             rpm --import /w/3proxy-release-key.asc
+             out=$(rpm -K "/w/$1")
+             echo "$out"
+             case "$out" in *"signatures OK"*) ;; *) exit 1 ;; esac' sh "$f"
+         done
+       done
     - name: Checksums and detached signatures
-      if: github.event_name == 'release'
+      if: github.event_name == 'release' || inputs.sign
       env:
        GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
       run: |

.github/workflows/build-rpm-x86-64.yml

@@ -4,6 +4,11 @@ on:
   release:
     types: [published]
   workflow_dispatch:
+    inputs:
+      sign:
+        description: "sign the packages, as for a release (nothing is uploaded)"
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -125,7 +130,7 @@ jobs:
        path: "*.deb"
 
     - name: Import signing key
-      if: github.event_name == 'release'
+      if: github.event_name == 'release' || inputs.sign
       env:
        GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
        GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
@@ -142,7 +147,7 @@ jobs:
            -u "$KEYID" --detach-sign -o /dev/null /tmp/prime.txt
        rm -f /tmp/prime.txt
     - name: Sign rpm
-      if: github.event_name == 'release'
+      if: github.event_name == 'release' || inputs.sign
       env:
        GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
       run: |
@@ -154,9 +159,13 @@ jobs:
        gpg --batch --yes --pinentry-mode loopback --passphrase-file /tmp/gpgpass \
            -u "$GPG_KEYID" --detach-sign -o /tmp/signtest.sig /tmp/signtest
        echo "key can sign"
+       # rpm's own signing command, given what it needs: rpm 4 takes the
+       # word after %{__gpg} in it for argv[0], rpm 6 does not, so one of our
+       # own breaks on one of them
        { echo "%_gpg_name $GPG_KEYID"
          echo "%__gpg $GPGBIN"
-         echo '%__gpg_sign_cmd %{__gpg} gpg --batch --no-armor --pinentry-mode loopback --passphrase-file /tmp/gpgpass --no-secmem-warning --digest-algo sha256 -u "%{_gpg_name}" -sbo %{__signature_filename} %{__plaintext_filename}'
+         echo "%_gpg_digest_algo sha256"
+         echo "%_gpg_sign_cmd_extra_args --batch --pinentry-mode loopback --passphrase-file /tmp/gpgpass"
        } > ~/.rpmmacros
        rpm --addsign *.rpm
        rm -f /tmp/gpgpass /tmp/signtest /tmp/signtest.sig
@@ -174,8 +183,23 @@ jobs:
          esac
          echo "$f: $sig"
        done
+    - name: Verify rpm signatures
+      if: github.event_name == 'release' || inputs.sign
+      run: |
+       # checked by the rpm of the system each package is for, with the
+       # published release key
+       for EL in $ELS; do
+         for f in *.el$EL.*.rpm; do
+           docker run --rm -v "$PWD:/w:ro" "almalinux:$EL" bash -c '
+             set -e
+             rpm --import /w/3proxy-release-key.asc
+             out=$(rpm -K "/w/$1")
+             echo "$out"
+             case "$out" in *"signatures OK"*) ;; *) exit 1 ;; esac' sh "$f"
+         done
+       done
     - name: Checksums and detached signatures
-      if: github.event_name == 'release'
+      if: github.event_name == 'release' || inputs.sign
       env:
        GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
       run: |