ci: GPG-sign the Flatpak repository and bundle

Adds a dedicated repo-signing public key and signs the exported repo, static deltas, and single-file bundle. The public key is embedded in the generated .flatpakrepo so installs no longer need --no-gpg-verify.
2026-06-30 19:44:34 -05:00
parent f34c33bd60
commit 064e3a7400
3 changed files with 34 additions and 7 deletions
@@ -42,24 +42,40 @@ jobs:
          print(s)
          PY

-      - name: Build repo and bundle
+      - name: Import GPG signing key
+        env:
+          FLATPAK_GPG_PRIVATE_KEY: ${{ secrets.FLATPAK_GPG_PRIVATE_KEY }}
+        run: |
+          export GNUPGHOME="$GITHUB_WORKSPACE/.gnupg"
+          mkdir -p "$GNUPGHOME"; chmod 700 "$GNUPGHOME"
+          printf '%s\n' "$FLATPAK_GPG_PRIVATE_KEY" | gpg --batch --import
+          FPR=$(gpg --list-secret-keys --with-colons | awk -F: '/^fpr:/{print $10; exit}')
+          echo "GNUPGHOME=$GNUPGHOME" >> "$GITHUB_ENV"
+          echo "GPG_FPR=$FPR" >> "$GITHUB_ENV"
+
+      - name: Build repo and bundle (signed)
        run: |
          flatpak-builder --user --disable-rofiles-fuse --force-clean \
            --default-branch=stable --repo=repo \
+            --gpg-sign="$GPG_FPR" --gpg-homedir="$GNUPGHOME" \
            builddir io.github.toservetheking.FlatKontrol.yml
-          flatpak build-update-repo repo --generate-static-deltas
+          flatpak build-update-repo repo --generate-static-deltas \
+            --gpg-sign="$GPG_FPR" --gpg-homedir="$GNUPGHOME"
          flatpak build-bundle repo \
            io.github.toservetheking.FlatKontrol.flatpak \
-            io.github.toservetheking.FlatKontrol stable
+            io.github.toservetheking.FlatKontrol stable \
+            --gpg-sign="$GPG_FPR" --gpg-homedir="$GNUPGHOME"

      - name: Add repo landing page and .flatpakrepo
        run: |
-          cat > repo/flatkontrol.flatpakrepo <<'EOF'
+          GPGKEY=$(gpg --homedir "$GNUPGHOME" --export "$GPG_FPR" | base64 -w0)
+          cat > repo/flatkontrol.flatpakrepo <<EOF
          [Flatpak Repo]
          Title=FlatKontrol
          Url=https://toservetheking.github.io/FlatKontrol/
          Homepage=https://github.com/toservetheking/FlatKontrol
          Description=Manage Flatpak permissions
+          GPGKey=$GPGKEY
          EOF
          cat > repo/index.html <<'EOF'
          <!doctype html>
@@ -67,7 +83,7 @@ jobs:
          <title>FlatKontrol Flatpak repository</title>
          <h1>FlatKontrol</h1>
          <p>Add the repository and install:</p>
-          <pre>flatpak remote-add --if-not-exists --user --no-gpg-verify flatkontrol https://toservetheking.github.io/FlatKontrol/flatkontrol.flatpakrepo
+          <pre>flatpak remote-add --if-not-exists --user flatkontrol https://toservetheking.github.io/FlatKontrol/flatkontrol.flatpakrepo
          flatpak install --user flatkontrol io.github.toservetheking.FlatKontrol</pre>
          <p>Or download the single-file bundle from the
          <a href="https://github.com/toservetheking/FlatKontrol/releases">Releases page</a>.</p>
@@ -27,12 +27,13 @@ Tagged releases are built by CI into a single-file bundle (attached to each
 [GitHub Release]) and a hosted Flatpak repository on GitHub Pages:

 ```sh
-flatpak remote-add --if-not-exists --user --no-gpg-verify flatkontrol \
+flatpak remote-add --if-not-exists --user flatkontrol \
  https://toservetheking.github.io/FlatKontrol/flatkontrol.flatpakrepo
 flatpak install --user flatkontrol io.github.toservetheking.FlatKontrol
 ```

-(The repository is currently unsigned, hence `--no-gpg-verify`.)
+The repository and bundle are GPG-signed; the public key is embedded in the
+`.flatpakrepo` (and available at [`keys/flatkontrol.asc`](keys/flatkontrol.asc)).

 Or install the downloaded bundle directly:

@@ -0,0 +1,10 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMEakRigBYJKwYBBAHaRw8BAQdAk+aLLYVQweRC7AowqHmnK/YZ71kDgKpihdZe
+8WJEZWa0MEZsYXRLb250cm9sIFJlcG8gU2lnbmluZyA8YXVzdGluQHRoZWJlbm5l
+dHQubmV0PoiQBBMWCgA4FiEELVrvD1fr69qwOH+5Z/kf54kPfOAFAmpEYoACGwMF
+CwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQZ/kf54kPfOA5qwD+OGj4cjdo2w+F
+myc+FR0mrhhiKMRsn1jSTftbVqFgvTkBAKVLI8FkPdBmdR8+/oLm5kskbOlhbFot
+JwrjvJsyS38F
+=+Sft
+-----END PGP PUBLIC KEY BLOCK-----