signing: rpm payload signing, key publication, consumer repo setup for #51
Implement the signing and consumer-repo trust infrastructure: - Makefile: add generate-test-key, sign-rpm, checksums, clearsign targets; make release now automates the full build→sign→checksum→clearsign flow - Key ceremony: document the import→sign→delete lifecycle, key rotation outline, and private-key-in-password-manager policy - Public key: update placeholder with raw URL, algorithm, and ceremony ref - Consumer docs: README now covers apt signed-by keyring flow, dnf repo file setup, signature verification commands, and migration runbook link - Release spec: updated to reference ceremony doc and rpmsign workflow - Tests: 36 structural signing tests (nfpm config, Makefile targets, repo file, key publication, ceremony doc, consumer docs, spec refs) plus throwaway-key RPM signature and clearsign mechanics; no network or real key required Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
This commit is contained in:
xavierk
co-authored by
CommandCodeBot
CommandCodeBot
parent
c45b07003a
commit
d8fa6df072
@@ -17,7 +17,7 @@ MANIFEST := $(DATA_DIR)/manifest.txt
|
||||
# Legacy history path (IN-4)
|
||||
LEGACY_HISTORY := ./data/history.jsonl
|
||||
|
||||
.PHONY: help install upgrade uninstall purge update-deps test lint check-python check-smartctl import-legacy stage package-deb package-rpm package release clean
|
||||
.PHONY: help install upgrade uninstall purge update-deps test lint check-python check-smartctl import-legacy stage package-deb package-rpm package generate-test-key sign-rpm checksums clearsign release clean
|
||||
|
||||
help:
|
||||
@echo "Fenris NVMe endurance monitor"
|
||||
@@ -34,7 +34,11 @@ help:
|
||||
@echo " package - Build deb + rpm packages"
|
||||
@echo " package-deb - Build deb package only"
|
||||
@echo " package-rpm - Build rpm package only"
|
||||
@echo " release - Full release (build, sign, attach)"
|
||||
@echo " generate-test-key - Create throwaway GPG key for CI/testing"
|
||||
@echo " sign-rpm - Sign RPM payload with packaging key"
|
||||
@echo " checksums - Generate SHA256SUMS manifest"
|
||||
@echo " clearsign - Clearsign SHA256SUMS with packaging key"
|
||||
@echo " release - Full release (build, sign, checksum, print upload steps)"
|
||||
@echo " clean - Remove build artifacts"
|
||||
|
||||
# ─── Pre-install gates ──────────────────────────────────────────────────────
|
||||
@@ -223,11 +227,14 @@ lint:
|
||||
update-deps:
|
||||
$(PYTHON) -m pip compile pyproject.toml -o requirements.txt
|
||||
|
||||
# ─── Packaging (spec §3, §5) ────────────────────────────────────────────────
|
||||
# ─── Packaging (spec §3, §4, §5) ────────────────────────────────────────────
|
||||
|
||||
# Version is sourced from pyproject.toml for both formats
|
||||
FENRIS_VERSION := $(shell sed -n 's/^version = "\(.*\)"/\1/p' pyproject.toml)
|
||||
|
||||
# GPG signing — packaging key UID (spec §4)
|
||||
PACKAGING_KEY ?= packaging@bongbetic.com
|
||||
|
||||
stage: dist/fenris-*.whl
|
||||
@echo "=== Staging packaging tree (v$(FENRIS_VERSION)) ==="
|
||||
bash packaging/stage.sh "$(FENRIS_VERSION)"
|
||||
@@ -245,26 +252,71 @@ package-rpm: stage
|
||||
package: package-deb package-rpm
|
||||
@echo "=== Both packages built in dist/ ==="
|
||||
|
||||
release: package
|
||||
@echo "=== Release v$(FENRIS_VERSION) ==="
|
||||
@echo "Artifacts:"
|
||||
@ls -la dist/fenris_$(FENRIS_VERSION)_amd64.deb dist/fenris-$(FENRIS_VERSION)-1.x86_64.rpm 2>/dev/null
|
||||
# ─── GPG key management ─────────────────────────────────────────────────────
|
||||
|
||||
generate-test-key:
|
||||
@echo "=== Generating throwaway test GPG key ==="
|
||||
@echo "This key is for CI/testing only — never use for real releases."
|
||||
printf '%%no-protection\nKey-Type: RSA\nKey-Length: 3072\nName-Real: Fenris Packaging (TESTING ONLY)\nName-Email: packaging-test@bongbetic.com\nExpire-Date: 0\n%%commit\n' | \
|
||||
gpg --batch --gen-key
|
||||
@echo "=== Test key created. Fingerprint: ==="
|
||||
@gpg --fingerprint packaging-test@bongbetic.com
|
||||
|
||||
# ─── Signing ────────────────────────────────────────────────────────────────
|
||||
|
||||
sign-rpm: package-rpm
|
||||
@echo "=== Signing RPM payload ==="
|
||||
@rpm --import packaging/keys/fenris-packaging.asc 2>/dev/null || true
|
||||
rpmsign --addsign --define "_gpg_name $(PACKAGING_KEY)" \
|
||||
dist/fenris-$(FENRIS_VERSION)-1.x86_64.rpm
|
||||
@echo "=== RPM signed ==="
|
||||
@rpm -Kv dist/fenris-$(FENRIS_VERSION)-1.x86_64.rpm
|
||||
|
||||
checksums: package
|
||||
@echo "=== Generating SHA256SUMS ==="
|
||||
cd dist && sha256sum fenris_$(FENRIS_VERSION)_amd64.deb \
|
||||
fenris-$(FENRIS_VERSION)-1.x86_64.rpm > SHA256SUMS
|
||||
@echo "=== SHA256SUMS written ==="
|
||||
@cat dist/SHA256SUMS
|
||||
|
||||
clearsign: checksums
|
||||
@echo "=== Clearsigning SHA256SUMS ==="
|
||||
gpg --batch --yes --clearsign --local-user $(PACKAGING_KEY) \
|
||||
dist/SHA256SUMS
|
||||
@echo "=== SHA256SUMS.asc written ==="
|
||||
|
||||
# ─── Release (spec §5) ──────────────────────────────────────────────────────
|
||||
|
||||
release: package sign-rpm clearsign
|
||||
@echo ""
|
||||
@echo "Manual steps (spec §5):"
|
||||
@echo " 1. Import packaging key: gpg --import <keyfile>"
|
||||
@echo " 2. Sign RPM payload: rpmsign --addsign dist/fenris-$(FENRIS_VERSION)-1.x86_64.rpm"
|
||||
@echo " 3. Generate checksums: cd dist && sha256sum fenris_$(FENRIS_VERSION)_amd64.deb fenris-$(FENRIS_VERSION)-1.x86_64.rpm > SHA256SUMS"
|
||||
@echo " 4. Clearsign manifest: gpg --clearsign dist/SHA256SUMS"
|
||||
@echo " 5. Upload to registry:"
|
||||
@echo " curl -X PUT -u user:token -T dist/fenris_$(FENRIS_VERSION)_amd64.deb \\"
|
||||
@echo " 'https://git.bongbetic.com/api/packages/xavierk/debian/pool/bookworm/main/upload'"
|
||||
@echo " curl -X PUT -u user:token -T dist/fenris_$(FENRIS_VERSION)_amd64.deb \\"
|
||||
@echo " 'https://git.bongbetic.com/api/packages/xavierk/debian/pool/jammy/main/upload'"
|
||||
@echo " curl -X PUT -u user:token -T dist/fenris_$(FENRIS_VERSION)_amd64.deb \\"
|
||||
@echo " 'https://git.bongbetic.com/api/packages/xavierk/debian/pool/noble/main/upload'"
|
||||
@echo " curl -X PUT -u user:token -T dist/fenris-$(FENRIS_VERSION)-1.x86_64.rpm \\"
|
||||
@echo " 'https://git.bongbetic.com/api/packages/xavierk/rpm/fenris/upload'"
|
||||
@echo " 6. Create Gitea release with notes and attach .deb, .rpm, SHA256SUMS.asc"
|
||||
@echo "=== Release v$(FENRIS_VERSION) ==="
|
||||
@echo ""
|
||||
@echo "Artifacts:"
|
||||
@ls -la dist/fenris_$(FENRIS_VERSION)_amd64.deb \
|
||||
dist/fenris-$(FENRIS_VERSION)-1.x86_64.rpm \
|
||||
dist/SHA256SUMS.asc 2>/dev/null
|
||||
@echo ""
|
||||
@echo "Verify signing (manual):"
|
||||
@echo " rpm -Kv dist/fenris-$(FENRIS_VERSION)-1.x86_64.rpm"
|
||||
@echo " gpg --verify dist/SHA256SUMS.asc dist/SHA256SUMS"
|
||||
@echo ""
|
||||
@echo "Upload to registry:"
|
||||
@echo " curl -X PUT -u user:token -T dist/fenris_$(FENRIS_VERSION)_amd64.deb \\"
|
||||
@echo " 'https://git.bongbetic.com/api/packages/xavierk/debian/pool/bookworm/main/upload'"
|
||||
@echo " curl -X PUT -u user:token -T dist/fenris_$(FENRIS_VERSION)_amd64.deb \\"
|
||||
@echo " 'https://git.bongbetic.com/api/packages/xavierk/debian/pool/jammy/main/upload'"
|
||||
@echo " curl -X PUT -u user:token -T dist/fenris_$(FENRIS_VERSION)_amd64.deb \\"
|
||||
@echo " 'https://git.bongbetic.com/api/packages/xavierk/debian/pool/noble/main/upload'"
|
||||
@echo " curl -X PUT -u user:token -T dist/fenris-$(FENRIS_VERSION)-1.x86_64.rpm \\"
|
||||
@echo " 'https://git.bongbetic.com/api/packages/xavierk/rpm/fenris/upload'"
|
||||
@echo ""
|
||||
@echo "Create Gitea release with notes and attach:"
|
||||
@echo " dist/fenris_$(FENRIS_VERSION)_amd64.deb"
|
||||
@echo " dist/fenris-$(FENRIS_VERSION)-1.x86_64.rpm"
|
||||
@echo " dist/SHA256SUMS.asc"
|
||||
@echo ""
|
||||
@echo "Key ceremony: delete the private key after upload."
|
||||
@echo " See docs/install/signing-key-ceremony.md"
|
||||
|
||||
clean:
|
||||
@echo "=== Cleaning build artifacts ==="
|
||||
|
||||
Reference in New Issue
Block a user