austin/FlatKontrol
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: GPG-sign the Flatpak repository and bundle

Browse Source 
Adds a dedicated repo-signing public key and signs the exported repo,
static deltas, and single-file bundle. The public key is embedded in the
generated .flatpakrepo so installs no longer need --no-gpg-verify.
This commit is contained in:
austin
2026-06-30 19:44:34 -05:00
parent f34c33bd60
commit 064e3a7400
3 changed files with 34 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build.yml
+21 -5
View File
@@ -42,24 +42,40 @@ jobs:
print(s) print(s)
PY PY
- name: Build repo and bundle - name: Import GPG signing key
env:
FLATPAK_GPG_PRIVATE_KEY: ${{ secrets.FLATPAK_GPG_PRIVATE_KEY }}
run: |
export GNUPGHOME="$GITHUB_WORKSPACE/.gnupg"
mkdir -p "$GNUPGHOME"; chmod 700 "$GNUPGHOME"
printf '%s\n' "$FLATPAK_GPG_PRIVATE_KEY" | gpg --batch --import
FPR=$(gpg --list-secret-keys --with-colons | awk -F: '/^fpr:/{print $10; exit}')
echo "GNUPGHOME=$GNUPGHOME" >> "$GITHUB_ENV"
echo "GPG_FPR=$FPR" >> "$GITHUB_ENV"
- name: Build repo and bundle (signed)
run: | run: |
flatpak-builder --user --disable-rofiles-fuse --force-clean \ flatpak-builder --user --disable-rofiles-fuse --force-clean \
--default-branch=stable --repo=repo \ --default-branch=stable --repo=repo \
--gpg-sign="$GPG_FPR" --gpg-homedir="$GNUPGHOME" \
builddir io.github.toservetheking.FlatKontrol.yml builddir io.github.toservetheking.FlatKontrol.yml
flatpak build-update-repo repo --generate-static-deltas flatpak build-update-repo repo --generate-static-deltas \
--gpg-sign="$GPG_FPR" --gpg-homedir="$GNUPGHOME"
flatpak build-bundle repo \ flatpak build-bundle repo \
io.github.toservetheking.FlatKontrol.flatpak \ io.github.toservetheking.FlatKontrol.flatpak \
io.github.toservetheking.FlatKontrol stable io.github.toservetheking.FlatKontrol stable \
--gpg-sign="$GPG_FPR" --gpg-homedir="$GNUPGHOME"
- name: Add repo landing page and .flatpakrepo - name: Add repo landing page and .flatpakrepo
run: | run: |
cat > repo/flatkontrol.flatpakrepo <<'EOF' GPGKEY=$(gpg --homedir "$GNUPGHOME" --export "$GPG_FPR" | base64 -w0)
cat > repo/flatkontrol.flatpakrepo <<EOF
[Flatpak Repo] [Flatpak Repo]
Title=FlatKontrol Title=FlatKontrol
Url=https://toservetheking.github.io/FlatKontrol/ Url=https://toservetheking.github.io/FlatKontrol/
Homepage=https://github.com/toservetheking/FlatKontrol Homepage=https://github.com/toservetheking/FlatKontrol
Description=Manage Flatpak permissions Description=Manage Flatpak permissions
GPGKey=$GPGKEY
EOF EOF
cat > repo/index.html <<'EOF' cat > repo/index.html <<'EOF'
<!doctype html> <!doctype html>
@@ -67,7 +83,7 @@ jobs:
<title>FlatKontrol Flatpak repository</title> <title>FlatKontrol Flatpak repository</title>
<h1>FlatKontrol</h1> <h1>FlatKontrol</h1>
<p>Add the repository and install:</p> <p>Add the repository and install:</p>
<pre>flatpak remote-add --if-not-exists --user --no-gpg-verify flatkontrol https://toservetheking.github.io/FlatKontrol/flatkontrol.flatpakrepo <pre>flatpak remote-add --if-not-exists --user flatkontrol https://toservetheking.github.io/FlatKontrol/flatkontrol.flatpakrepo
flatpak install --user flatkontrol io.github.toservetheking.FlatKontrol</pre> flatpak install --user flatkontrol io.github.toservetheking.FlatKontrol</pre>
<p>Or download the single-file bundle from the <p>Or download the single-file bundle from the
<a href="https://github.com/toservetheking/FlatKontrol/releases">Releases page</a>.</p> <a href="https://github.com/toservetheking/FlatKontrol/releases">Releases page</a>.</p>
README.md
+3 -2
View File
@@ -27,12 +27,13 @@ Tagged releases are built by CI into a single-file bundle (attached to each
[GitHub Release]) and a hosted Flatpak repository on GitHub Pages: [GitHub Release]) and a hosted Flatpak repository on GitHub Pages:
```sh ```sh
flatpak remote-add --if-not-exists --user --no-gpg-verify flatkontrol \ flatpak remote-add --if-not-exists --user flatkontrol \
https://toservetheking.github.io/FlatKontrol/flatkontrol.flatpakrepo https://toservetheking.github.io/FlatKontrol/flatkontrol.flatpakrepo
flatpak install --user flatkontrol io.github.toservetheking.FlatKontrol flatpak install --user flatkontrol io.github.toservetheking.FlatKontrol
``` ```
(The repository is currently unsigned, hence `--no-gpg-verify`.) The repository and bundle are GPG-signed; the public key is embedded in the
`.flatpakrepo` (and available at [`keys/flatkontrol.asc`](keys/flatkontrol.asc)).
Or install the downloaded bundle directly: Or install the downloaded bundle directly:
keys/flatkontrol.asc
+10
View File
@@ -0,0 +1,10 @@
-----BEGIN PGP PUBLIC KEY BLOCK-----
mDMEakRigBYJKwYBBAHaRw8BAQdAk+aLLYVQweRC7AowqHmnK/YZ71kDgKpihdZe
8WJEZWa0MEZsYXRLb250cm9sIFJlcG8gU2lnbmluZyA8YXVzdGluQHRoZWJlbm5l
dHQubmV0PoiQBBMWCgA4FiEELVrvD1fr69qwOH+5Z/kf54kPfOAFAmpEYoACGwMF
CwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQZ/kf54kPfOA5qwD+OGj4cjdo2w+F
myc+FR0mrhhiKMRsn1jSTftbVqFgvTkBAKVLI8FkPdBmdR8+/oLm5kskbOlhbFot
JwrjvJsyS38F
=+Sft
-----END PGP PUBLIC KEY BLOCK-----