A new optional LINUX_SIGNING_KEY secret (an unprotected OpenPGP signing subkey, from the
release environment) signs each Linux format the way its tools check it:
- rpm: embedded signature (rpmsign), for `rpm -K` and dnf/zypper gpgcheck
- deb: embedded _gpgorigin member (debsigs) and a detached .asc
- Arch: <file>.sig, which pacman looks for
- AppImage, tar.gz, zsync: detached .asc
- Flatpak bundle: signed commit and embedded public key (flatpak-bundle.sh, via the
scaffold's new step 4), so `flatpak install` verifies it, plus a detached .asc
- Flatpak OCI image: a containers/image signature for ghcr.io/<repo>@<digest>, which Flatpak
checks from its signature lookaside; the flatpak job records the pushed manifest for it
- SHA256SUMS.txt.asc over every release asset, and release-signing-key.asc
The draft-release action signs before computing checksums (embedded signatures change the rpm
and deb files) and verifies every signature against the exported public key. The new
import-signing-key action is shared by the flatpak and release jobs and refuses a key that
needs a passphrase. Without the secret, releases are published unsigned with a warning.
- A prerelease bundle (a version with `-`, as resolve-version marks it) gets no --repo-url: the
OCI index serves only the latest stable release, so Flatpak would replace the prerelease
with that older build. The generated script clears OCI_REPO for such a version and passes
${OCI_REPO:+--repo-url="$OCI_REPO"}.
- --verify passes only with the exact URL, the prerelease guard and the option on the active
build-bundle command; a commented-out command never matches, nor is it edited.
- A script that already sets OCI_REPO or its own --repo-url fails the scaffold instead of being
reported ready or overwritten.
- The OCI export assertion matches the whole line (CodeRabbit).
scaffold-flatpak-oci.sh now also adds --repo-url=oci+https://getartcraft.com to each app's
.flatpak build-bundle command, and --verify reports it. A bundle installed with that URL gets an
origin remote that updates from the OCI index, which points Flatpak at GHCR. Installing such a
bundle over an existing bundle install rewrites the existing origin's URL in place, so existing
users switch over on their next bundle update without a reinstall.
Dylan M. Taylor