Sign the RPM packages in the Linux packaging jobs (#138)

* Sign RPM packages in the Linux packaging jobs

* Sign RPM packages in the Linux packaging jobs

.github/workflows/release.yml

@@ -571,6 +571,17 @@ jobs:
           CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
           CRAFT_FONTS_REQUIRED: "1"
         run: packaging/linux/package.sh
+      - name: Import the Linux signing key
+        if: github.ref == 'refs/heads/release'
+        id: linux_signing
+        uses: storytold/craft-common-actions/actions/import-signing-key@main
+        with:
+          key: ${{ secrets.LINUX_SIGNING_KEY }}
+      - name: Sign the RPM packages
+        if: steps.linux_signing.outputs.enabled == 'true'
+        uses: storytold/craft-common-actions/actions/sign-rpms@main
+        with:
+          path: dist/release
       - name: Check the packages
         run: |
           dpkg-deb --info dist/release/*.deb || true
@@ -1240,6 +1251,17 @@ jobs:
           EMULATOR: qemu-riscv64
           QEMU_LD_PREFIX: /usr/riscv64-linux-gnu
         run: packaging/linux/package.sh --formats "deb rpm tar"
+      - name: Import the Linux signing key
+        if: github.ref == 'refs/heads/release'
+        id: linux_signing
+        uses: storytold/craft-common-actions/actions/import-signing-key@main
+        with:
+          key: ${{ secrets.LINUX_SIGNING_KEY }}
+      - name: Sign the RPM packages
+        if: steps.linux_signing.outputs.enabled == 'true'
+        uses: storytold/craft-common-actions/actions/sign-rpms@main
+        with:
+          path: dist/release
       - name: Check the packages
         run: |
           dpkg-deb --info dist/release/*-linux-riscv64.deb 2>/dev/null || true

actions/sign-rpms/action.yml

@@ -0,0 +1,60 @@
+name: "Sign RPM packages"
+description: "Signs every .rpm in a directory with the key imported by import-signing-key and verifies each signature; needs GNUPGHOME, SIGNING_FPR and SIGNING_PUBKEY in the environment"
+
+inputs:
+  path:
+    description: "Directory holding the .rpm files"
+    required: false
+    default: "dist/release"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Install rpm
+      shell: bash
+      run: |
+        set -euo pipefail
+        if ! command -v rpm >/dev/null 2>&1; then
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends rpm
+        fi
+
+    - name: Sign and verify
+      shell: bash
+      env:
+        RPM_DIR: ${{ inputs.path }}
+      run: |
+        set -euo pipefail
+        if [ -z "${GNUPGHOME:-}" ] || [ -z "${SIGNING_FPR:-}" ]; then
+          echo "::error::GNUPGHOME/SIGNING_FPR are empty; run import-signing-key first."
+          exit 1
+        fi
+
+        shopt -s nullglob
+        rpms=("$RPM_DIR"/*.rpm)
+        if [ "${#rpms[@]}" -eq 0 ]; then
+          echo "::error::No .rpm files in $RPM_DIR to sign."
+          exit 1
+        fi
+
+        # Ubuntu's rpm shells out to /usr/bin/gpg2, a path only Fedora's gnupg2 provides.
+        gpg_bin="$(command -v gpg)"
+        # rpm only calls a signature good once the key is in its own database, and it wants an
+        # armored key, not the binary export import-signing-key also produces.
+        pubkey="${RUNNER_TEMP:-/tmp}/rpm-signing-key.asc"
+        gpg --batch --armor --export "$SIGNING_FPR" >"$pubkey"
+        rpm --import "$pubkey"
+
+        for pkg in "${rpms[@]}"; do
+          rpm --addsign \
+            --define "__gpg $gpg_bin" \
+            --define "_gpg_name $SIGNING_FPR" \
+            --define "_gpg_digest_algo sha256" \
+            "$pkg" >/dev/null
+          if ! rpmkeys --checksig "$pkg" 2>&1 | grep -q "signatures OK"; then
+            echo "::error::${pkg##*/} is not signed by $SIGNING_FPR"
+            rpmkeys --checksig "$pkg" 2>&1 || true
+            exit 1
+          fi
+          echo "signed ${pkg##*/}"
+        done