From ccd971097969a609a7da17bf68bb41e23d9c19ee Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Tue, 20 Jun 2023 19:02:35 -0400 Subject: [PATCH 1/4] Validate all debian artifact signatures --- .github/workflows/ci-suite.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci-suite.yml b/.github/workflows/ci-suite.yml index 08aa454616..f66fe5109b 100644 --- a/.github/workflows/ci-suite.yml +++ b/.github/workflows/ci-suite.yml @@ -903,8 +903,11 @@ jobs: run: | echo "TGS_VERSION=$(xmlstarlet sel -N X="http://schemas.microsoft.com/developer/msbuild/2003" --template --value-of /X:Project/X:PropertyGroup/X:TgsCoreVersion build/Version.props)" >> $GITHUB_ENV - - name: Validate .dsc Signature - run: gpg --verify tgstation-server_${{ env.TGS_VERSION }}-1.dsc + - name: Validate Signatures + run: | + gpg --verify tgstation-server_${{ env.TGS_VERSION }}-1.dsc + gpg --verify tgstation-server_${{ env.TGS_VERSION }}-1_amd64.changes + gpg --verify tgstation-server_${{ env.TGS_VERSION }}-1_amd64.buildinfo - name: Upload .deb Artifact uses: actions/upload-artifact@v3 From c768ac9d78ce7e97b35a891c6e4be06001263052 Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Tue, 20 Jun 2023 19:14:38 -0400 Subject: [PATCH 2/4] Packaging bundle to be processed by tgstation-ppa --- .github/workflows/ci-suite.yml | 43 ++++++++++------------------------ 1 file changed, 12 insertions(+), 31 deletions(-) diff --git a/.github/workflows/ci-suite.yml b/.github/workflows/ci-suite.yml index f66fe5109b..48e22b835f 100644 --- a/.github/workflows/ci-suite.yml +++ b/.github/workflows/ci-suite.yml @@ -909,17 +909,14 @@ jobs: gpg --verify tgstation-server_${{ env.TGS_VERSION }}-1_amd64.changes gpg --verify tgstation-server_${{ env.TGS_VERSION }}-1_amd64.buildinfo - - name: Upload .deb Artifact - uses: actions/upload-artifact@v3 - with: - name: package-deb-${{ matrix.arch }} - path: tgstation-server_${{ env.TGS_VERSION }}-1_${{ matrix.arch }}.deb + - name: Create Packaging Archive + run: tar cfJ tgstation-server-v${{ env.TGS_VERSION }}.debian.packaging.tar.xz tgstation-server_* - - name: Upload .dsc Artifact + - name: Upload Packaging Archive uses: actions/upload-artifact@v3 with: - name: package-dsc - path: tgstation-server_${{ env.TGS_VERSION }}-1.dsc + name: packaging-debian + path: tgstation-server-v${{ env.TGS_VERSION }}.debian.packaging.tar.xz deployment-gate: name: Deployment Gate @@ -1115,17 +1112,11 @@ jobs: name: openapi-spec path: swagger - - name: Retrieve amd64 .deb + - name: Retrieve Debian Packaging Archive uses: actions/download-artifact@v3 with: - name: package-deb-amd64 - path: package-deb-amd64 - - - name: Retrieve .dsc - uses: actions/download-artifact@v3 - with: - name: package-dsc - path: package-dsc + name: packaging-debian + path: packaging-debian - name: Zip Artifacts shell: powershell @@ -1200,25 +1191,15 @@ jobs: asset_name: ServerUpdatePackage.zip asset_content_type: application/zip - - name: Upload amd64 .deb Artifact + - name: Upload Debian Pacakaging Artifact uses: actions/upload-release-asset@v1 env: GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }} with: upload_url: ${{ steps.create_release.outputs.upload_url }} - asset_path: ./package-deb-amd64/tgstation-server_${{ env.TGS_VERSION }}-1_amd64.deb - asset_name: tgstation-server_${{ env.TGS_VERSION }}-1_amd64.deb - asset_content_type: application/vnd.debian.binary-package - - - name: Upload .dsc Artifact - uses: actions/upload-release-asset@v1 - env: - GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }} - with: - upload_url: ${{ steps.create_release.outputs.upload_url }} - asset_path: ./package-dsc/tgstation-server_${{ env.TGS_VERSION }}-1.dsc - asset_name: tgstation-server_${{ env.TGS_VERSION }}-1.dsc - asset_content_type: application/octet-stream + asset_path: ./packaging-debian/tgstation-server-v${{ env.TGS_VERSION }}.debian.packaging.tar.xz + asset_name: tgstation-server-v${{ env.TGS_VERSION }}.debian.packaging.tar.xz + asset_content_type: application/x-tar deploy-docker: name: Deploy TGS (Docker) From 0d56465b4ee4258aca37b66d69f54d8758456022 Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Tue, 20 Jun 2023 19:17:54 -0400 Subject: [PATCH 3/4] Username as var instead of secret --- .github/workflows/ci-suite.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-suite.yml b/.github/workflows/ci-suite.yml index 48e22b835f..951f2ede91 100644 --- a/.github/workflows/ci-suite.yml +++ b/.github/workflows/ci-suite.yml @@ -1242,4 +1242,4 @@ jobs: - name: Trigger tgstation-ppa workflow run: | - curl -XPOST -u "${{ secrets.DEV_PUSH_USERNAME }}:${{ secrets.DEV_PUSH_TOKEN }}" -H "Accept: application/vnd.github.everest-preview+json" -H "Content-Type: application/json" https://api.github.com/repos/tgstation/tgstation-ppa/actions/workflows/add_tgs_version.yml/dispatches --data '{"ref":"main","inputs":{"tgs_semver": "${{ env.TGS_VERSION }}"}}' + curl -XPOST -u "${{ vars.DEV_PUSH_USERNAME }}:${{ secrets.DEV_PUSH_TOKEN }}" -H "Accept: application/vnd.github.everest-preview+json" -H "Content-Type: application/json" https://api.github.com/repos/tgstation/tgstation-ppa/actions/workflows/add_tgs_version.yml/dispatches --data '{"ref":"main","inputs":{"tgs_semver": "${{ env.TGS_VERSION }}"}}' From ee91d8cb3c46951a51ac0a8aa7c7c3fb00b4d595 Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Tue, 20 Jun 2023 19:40:02 -0400 Subject: [PATCH 4/4] Remove hardcoded keygrip in favour of repo var --- .github/workflows/ci-suite.yml | 1 + build/package/deb/build_package.sh | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci-suite.yml b/.github/workflows/ci-suite.yml index 951f2ede91..fbebbce6ae 100644 --- a/.github/workflows/ci-suite.yml +++ b/.github/workflows/ci-suite.yml @@ -896,6 +896,7 @@ jobs: - name: Execute Build Script env: + PACKAGING_KEYGRIP: ${{ vars.PACKAGING_KEYGRIP }} PACKAGING_PRIVATE_KEY_PASSPHRASE: ${{ secrets.PACKAGING_PRIVATE_KEY_PASSPHRASE }} run: sudo -E build/package/deb/build_package.sh diff --git a/build/package/deb/build_package.sh b/build/package/deb/build_package.sh index 442fe506db..54063487dc 100755 --- a/build/package/deb/build_package.sh +++ b/build/package/deb/build_package.sh @@ -42,10 +42,10 @@ rm -f /tmp/tgs_wrap_gpg_output.log set +e -if [[ -z "$PACKAGING_PRIVATE_KEY_PASSPHRASE" ]]; then +if [[ -z "$PACKAGING_KEYGRIP" ]]; then dpkg-buildpackage --no-sign else - dpkg-buildpackage --sign-key=ad03052d1740533e --sign-command="$SIGN_COMMAND" + dpkg-buildpackage --sign-key=$PACKAGING_KEYGRIP --sign-command="$SIGN_COMMAND" fi EXIT_CODE=$?