From aeee37998ec9a0198388dfd980a1d40b43bea336 Mon Sep 17 00:00:00 2001 From: Vladimir Dubrovin <3proxy@3proxy.ru> Date: Fri, 21 Aug 2026 13:13:24 +0300 Subject: [PATCH] rpm signing: pass the passphrase explicitly, add diagnostics on failure Do not rely on the gpg-agent passphrase cache surviving between steps: the signing command gets the passphrase from a file. A test signature is made first, so a wrong passphrase or a key which can not sign fails with a clear gpg error instead of an rpm which is silently left unsigned. On failure the rpm version, the sign command and the key capabilities are printed. --- .github/workflows/build-rpm-arm64.yml | 22 ++++++++++++++++++++-- .github/workflows/build-rpm-armhf.yml | 22 ++++++++++++++++++++-- .github/workflows/build-rpm-x86-64.yml | 22 ++++++++++++++++++++-- 3 files changed, 60 insertions(+), 6 deletions(-) diff --git a/.github/workflows/build-rpm-arm64.yml b/.github/workflows/build-rpm-arm64.yml index fc3fd72..ae364aa 100644 --- a/.github/workflows/build-rpm-arm64.yml +++ b/.github/workflows/build-rpm-arm64.yml @@ -92,14 +92,32 @@ jobs: rm -f /tmp/prime.txt - name: Sign rpm if: github.event_name == 'release' + env: + GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} run: | GPGBIN=$(command -v gpg) if [ -z "$GPGBIN" ]; then echo "gpg not found"; exit 1; fi - { echo "%_gpg_name $GPG_KEYID"; echo "%__gpg $GPGBIN"; } > ~/.rpmmacros + umask 077 + printf '%s' "$GPG_PASSPHRASE" > /tmp/gpgpass + echo test > /tmp/signtest + gpg --batch --yes --pinentry-mode loopback --passphrase-file /tmp/gpgpass \ + -u "$GPG_KEYID" --detach-sign -o /tmp/signtest.sig /tmp/signtest + echo "key can sign" + { echo "%_gpg_name $GPG_KEYID" + echo "%__gpg $GPGBIN" + echo '%__gpg_sign_cmd %{__gpg} gpg --batch --no-armor --pinentry-mode loopback --passphrase-file /tmp/gpgpass --no-secmem-warning --digest-algo sha256 -u "%{_gpg_name}" -sbo %{__signature_filename} %{__plaintext_filename}' + } > ~/.rpmmacros rpm --addsign *.rpm + rm -f /tmp/gpgpass /tmp/signtest /tmp/signtest.sig for f in *.rpm; do sig=$(rpm -qp --qf '%{RSAHEADER:pgpsig}' "$f" 2>/dev/null) - case "$sig" in ""|"(none)") echo "$f is not signed"; exit 1 ;; esac + case "$sig" in ""|"(none)") + echo "$f is not signed" + echo "--- rpm version ---"; rpm --version + echo "--- sign cmd ---"; rpm --eval '%{__gpg_sign_cmd}' + echo "--- secret keys ---"; gpg --list-secret-keys --with-colons | grep -E '^(sec|ssb):' || true + exit 1 ;; + esac echo "$f: $sig" done - name: Checksums and detached signatures diff --git a/.github/workflows/build-rpm-armhf.yml b/.github/workflows/build-rpm-armhf.yml index 0a3b4f6..6fd68de 100644 --- a/.github/workflows/build-rpm-armhf.yml +++ b/.github/workflows/build-rpm-armhf.yml @@ -125,14 +125,32 @@ jobs: rm -f /tmp/prime.txt - name: Sign rpm if: github.event_name == 'release' + env: + GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} run: | GPGBIN=$(command -v gpg) if [ -z "$GPGBIN" ]; then echo "gpg not found"; exit 1; fi - { echo "%_gpg_name $GPG_KEYID"; echo "%__gpg $GPGBIN"; } > ~/.rpmmacros + umask 077 + printf '%s' "$GPG_PASSPHRASE" > /tmp/gpgpass + echo test > /tmp/signtest + gpg --batch --yes --pinentry-mode loopback --passphrase-file /tmp/gpgpass \ + -u "$GPG_KEYID" --detach-sign -o /tmp/signtest.sig /tmp/signtest + echo "key can sign" + { echo "%_gpg_name $GPG_KEYID" + echo "%__gpg $GPGBIN" + echo '%__gpg_sign_cmd %{__gpg} gpg --batch --no-armor --pinentry-mode loopback --passphrase-file /tmp/gpgpass --no-secmem-warning --digest-algo sha256 -u "%{_gpg_name}" -sbo %{__signature_filename} %{__plaintext_filename}' + } > ~/.rpmmacros rpm --addsign *.rpm + rm -f /tmp/gpgpass /tmp/signtest /tmp/signtest.sig for f in *.rpm; do sig=$(rpm -qp --qf '%{RSAHEADER:pgpsig}' "$f" 2>/dev/null) - case "$sig" in ""|"(none)") echo "$f is not signed"; exit 1 ;; esac + case "$sig" in ""|"(none)") + echo "$f is not signed" + echo "--- rpm version ---"; rpm --version + echo "--- sign cmd ---"; rpm --eval '%{__gpg_sign_cmd}' + echo "--- secret keys ---"; gpg --list-secret-keys --with-colons | grep -E '^(sec|ssb):' || true + exit 1 ;; + esac echo "$f: $sig" done - name: Checksums and detached signatures diff --git a/.github/workflows/build-rpm-x86-64.yml b/.github/workflows/build-rpm-x86-64.yml index fbf0d85..2099387 100644 --- a/.github/workflows/build-rpm-x86-64.yml +++ b/.github/workflows/build-rpm-x86-64.yml @@ -93,14 +93,32 @@ jobs: rm -f /tmp/prime.txt - name: Sign rpm if: github.event_name == 'release' + env: + GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} run: | GPGBIN=$(command -v gpg) if [ -z "$GPGBIN" ]; then echo "gpg not found"; exit 1; fi - { echo "%_gpg_name $GPG_KEYID"; echo "%__gpg $GPGBIN"; } > ~/.rpmmacros + umask 077 + printf '%s' "$GPG_PASSPHRASE" > /tmp/gpgpass + echo test > /tmp/signtest + gpg --batch --yes --pinentry-mode loopback --passphrase-file /tmp/gpgpass \ + -u "$GPG_KEYID" --detach-sign -o /tmp/signtest.sig /tmp/signtest + echo "key can sign" + { echo "%_gpg_name $GPG_KEYID" + echo "%__gpg $GPGBIN" + echo '%__gpg_sign_cmd %{__gpg} gpg --batch --no-armor --pinentry-mode loopback --passphrase-file /tmp/gpgpass --no-secmem-warning --digest-algo sha256 -u "%{_gpg_name}" -sbo %{__signature_filename} %{__plaintext_filename}' + } > ~/.rpmmacros rpm --addsign *.rpm + rm -f /tmp/gpgpass /tmp/signtest /tmp/signtest.sig for f in *.rpm; do sig=$(rpm -qp --qf '%{RSAHEADER:pgpsig}' "$f" 2>/dev/null) - case "$sig" in ""|"(none)") echo "$f is not signed"; exit 1 ;; esac + case "$sig" in ""|"(none)") + echo "$f is not signed" + echo "--- rpm version ---"; rpm --version + echo "--- sign cmd ---"; rpm --eval '%{__gpg_sign_cmd}' + echo "--- secret keys ---"; gpg --list-secret-keys --with-colons | grep -E '^(sec|ssb):' || true + exit 1 ;; + esac echo "$f: $sig" done - name: Checksums and detached signatures