Fix signing for real

.github/workflows/ci-suite.yml

@@ -883,9 +883,6 @@ jobs:
       matrix:
         arch: [ 'amd64' ] # Can't do i386 due to https://github.com/dotnet/core/issues/4595
     steps:
-    - name: Checkout
-      uses: actions/checkout@v3
-
     - name: Import GPG Key
       run: |
         sudo apt-get update
@@ -894,13 +891,21 @@ jobs:
         echo ${{ secrets.PACKAGING_PRIVATE_KEY_PASSPHRASE }} | gpg --batch --yes --passphrase-fd 0 --import private.pgp
         rm private.pgp
 
+    - name: Checkout
+      uses: actions/checkout@v3
+
     - name: Execute Build Script
-      run: sudo build/package/deb/build_package.sh
+      env:
+         PACKAGING_PRIVATE_KEY_PASSPHRASE: ${{ secrets.PACKAGING_PRIVATE_KEY_PASSPHRASE }}
+      run: sudo -E build/package/deb/build_package.sh
 
     - name: Parse TGS version
       run: |
         echo "TGS_VERSION=$(xmlstarlet sel -N X="http://schemas.microsoft.com/developer/msbuild/2003" --template --value-of /X:Project/X:PropertyGroup/X:TgsCoreVersion build/Version.props)" >> $GITHUB_ENV
 
+    - name: Validate Package Signature
+      run: gpg --verify tgstation-server_${{ env.TGS_VERSION }}-1.dsc.asc
+
     - name: Upload .deb Artifact
       uses: actions/upload-artifact@v3
       with:

build/package/deb/build_package.sh

@@ -1,6 +1,8 @@
 #!/bin/bash
 # Run from git root
 
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
 set -e
 set -x
 
@@ -27,13 +29,25 @@ TGS_VERSION=$(xmlstarlet sel -N X="http://schemas.microsoft.com/developer/msbuil
 
 dh_make -p tgstation-server_$TGS_VERSION -y --createorig -s
 
-rm debian/README* debian/changelog debian/*.ex debian/upstream/*.ex
+rm -f debian/README* debian/changelog debian/*.ex debian/upstream/*.ex
 
 cp -r build/package/deb/debian/* debian/
 sed -i "s/~!VERSION!~/$TGS_VERSION/g" debian/changelog
 
 cp build/tgstation-server.service debian/
 
-dpkg-buildpackage
+SIGN_COMMAND="$SCRIPT_DIR/wrap_gpg.sh"
+
+rm -f /tmp/tgs_wrap_gpg_output.log
+
+set +e
+
+dpkg-buildpackage --sign-key=ad03052d1740533e --sign-command="$SIGN_COMMAND"
+
+EXIT_CODE=$?
+
+cat /tmp/tgs_wrap_gpg_output.log
 
 cd ..
+
+exit $EXIT_CODE

build/package/deb/wrap_gpg.sh

@@ -0,0 +1,65 @@
+#!/bin/bash
+
+echo "----------------------------------------------------------------------------------------------------" >> /tmp/tgs_wrap_gpg_output.log
+if [[ -z "$PACKAGING_PRIVATE_KEY_PASSPHRASE" ]]; then
+    echo "No passphrase provided. Exec'ing gpg with original args: \"$@\"" >> /tmp/tgs_wrap_gpg_output.log
+    exec gpg "$@"
+fi
+
+echo "Original gpg args: \"$@\"" >> /tmp/tgs_wrap_gpg_output.log
+
+# S/O copypasta
+# https://stackoverflow.com/questions/9970212/how-do-i-find-the-last-positional-parameter-in-linux
+# https://stackoverflow.com/questions/192249/how-do-i-parse-command-line-arguments-in-bash
+DSC_PATH=${!#}
+
+POSITIONAL_ARGS=()
+
+while [[ $# -gt 0 ]]; do
+  case $1 in
+    -o|--output)
+      GPG_OUTPUT="$2"
+      shift # past argument
+      shift # past value
+      ;;
+    --clear-sign|--clearsign)
+      $DSC_PATH="$2"
+      shift # past argument
+      shift # past value
+      ;;
+    *)
+      POSITIONAL_ARGS+=("$1") # save positional arg
+      shift # past argument
+      ;;
+  esac
+done
+
+set -- "${POSITIONAL_ARGS[@]}" # restore positional parameters
+
+echo "Running gpg with args '--batch --yes --pinentry-mode loopback --passphrase *** --weak-digest SHA1 --weak-digest RIPEMD160 --utf8-strings --armor --openpgp --personal-digest-preferences \"SHA512 SHA384 SHA256 SHA224\" --output $GPG_OUTPUT --clearsign $DSC_PATH'" >> /tmp/tgs_wrap_gpg_output.log
+
+if [[ -f "$GPG_OUTPUT" ]]; then
+    echo "$GPG_OUTPUT exists." >> /tmp/tgs_wrap_gpg_output.log
+else
+    echo "$GPG_OUTPUT DOESN'T EXIST! This is to be expected." >> /tmp/tgs_wrap_gpg_output.log
+fi
+
+if [[ -f "$DSC_PATH" ]]; then
+    echo "$DSC_PATH exists." >> /tmp/tgs_wrap_gpg_output.log
+else
+    echo "$DSC_PATH DOESN'T EXIST!" >> /tmp/tgs_wrap_gpg_output.log
+fi
+
+echo ">>>>" >> /tmp/tgs_wrap_gpg_output.log
+gpg --batch --yes --pinentry-mode loopback --passphrase "$PACKAGING_PRIVATE_KEY_PASSPHRASE" --weak-digest SHA1 --weak-digest RIPEMD160 --utf8-strings --armor --openpgp --personal-digest-preferences "SHA512 SHA384 SHA256 SHA224" --output "$GPG_OUTPUT" --clearsign "$DSC_PATH"  >> /tmp/tgs_wrap_gpg_output.log
+GPG_EXIT_CODE=$?
+
+echo ">>>>" >> /tmp/tgs_wrap_gpg_output.log
+
+if [[ -f "$GPG_OUTPUT" ]]; then
+    echo "$GPG_OUTPUT exists." >> /tmp/tgs_wrap_gpg_output.log
+else
+    echo "$GPG_OUTPUT DOESN'T EXIST AFTER IT WAS SUPPOSED TO BE CREATED WTF!" >> /tmp/tgs_wrap_gpg_output.log
+fi
+
+exit $GPG_EXIT_CODE

tgstation-server.sln

@@ -205,6 +205,7 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "deb", "deb", "{457A1F89-620
 	ProjectSection(SolutionItems) = preProject
 		build\package\deb\build_package.sh = build\package\deb\build_package.sh
 		build\package\deb\MakeInstall = build\package\deb\MakeInstall
+		build\package\deb\wrap_gpg.sh = build\package\deb\wrap_gpg.sh
 	EndProjectSection
 EndProject
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "debian", "debian", "{08E7C650-A447-4DE2-974E-ED123B50F8D6}"