mirror of
https://github.com/storytold/craft-common-actions.git
synced 2026-11-06 02:22:15 +00:00
Dylan M. Taylor
96b8516a40
A new optional LINUX_SIGNING_KEY secret (an unprotected OpenPGP signing subkey, from the release environment) signs each Linux format the way its tools check it: - rpm: embedded signature (rpmsign), for `rpm -K` and dnf/zypper gpgcheck - deb: embedded _gpgorigin member (debsigs) and a detached .asc - Arch: <file>.sig, which pacman looks for - AppImage, tar.gz, zsync: detached .asc - Flatpak bundle: signed commit and embedded public key (flatpak-bundle.sh, via the scaffold's new step 4), so `flatpak install` verifies it, plus a detached .asc - Flatpak OCI image: a containers/image signature for ghcr.io/<repo>@<digest>, which Flatpak checks from its signature lookaside; the flatpak job records the pushed manifest for it - SHA256SUMS.txt.asc over every release asset, and release-signing-key.asc The draft-release action signs before computing checksums (embedded signatures change the rpm and deb files) and verifies every signature against the exported public key. The new import-signing-key action is shared by the flatpak and release jobs and refuses a key that needs a passphrase. Without the secret, releases are published unsigned with a warning.