Add gpg code signing to nightly workflow #20
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
lopopolo
added
A-build
Sign release tarballs and zipballs with the following GPG key: **User ID**: Code signing for Artichoke Ruby <codesign@artichokeruby.org> **Signing Key ID**: AF57A37CAC061452 **Signing Key Fingerprint**: 1C4A856ACF86EC1EE841180FAF57A37CAC061452 **Public Key**: <https://github.com/artichoke-ci.gpg>, #20 ``` -----BEGIN PGP PUBLIC KEY BLOCK----- mDMEX/IrgxYJKwYBBAHaRw8BAQdA6rMZoRTZv6ENkud+nxfk9HfNV1FvsOCYP+VR LWmUF1O0PENvZGUgc2lnbmluZyBmb3IgQXJ0aWNob2tlIFJ1YnkgPGNvZGVzaWdu QGFydGljaG9rZXJ1Ynkub3JnPoiQBBMWCAA4FiEEyYOPEEAh9Z7m9ry+sZnQNH/a FKQFAl/yK4MCGwMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQsZnQNH/aFKSg iQEAwRFgu0fB+RqsnlSnuhq/k0wkYzqKRk/Cn2tVAp/7Ig0BAN4RpIHLIBuzYKYR nY7MScuKvbzCnADJNxZShoUZteoPuDgEX/IrgxIKKwYBBAGXVQEFAQEHQJVJmYxU 3Sz8OzDK014vVssn+3C1dC9q7zVweb7IkcY8AwEIB4h4BBgWCAAgFiEEyYOPEEAh 9Z7m9ry+sZnQNH/aFKQFAl/yK4MCGwwACgkQsZnQNH/aFKRGZgD/Ug5tGItj3GYT ECTlwbAsyxrhdW045Ddl2uw5epnY6GAA/0equokFotiYTI7PHPmerP1fQQIl2cHC C3zT47MsvosBuDMEX/IsyhYJKwYBBAHaRw8BAQdA/+xQVpaZO5VJqBd8MpQDMvXU AQJ10WqCSF9tc/uLaaKI7wQYFggAIBYhBMmDjxBAIfWe5va8vrGZ0DR/2hSkBQJf 8izKAhsCAIEJELGZ0DR/2hSkdiAEGRYIAB0WIQQcSoVqz4bsHuhBGA+vV6N8rAYU UgUCX/IsygAKCRCvV6N8rAYUUlq5AQCKwtdEJboo10L8xgbBfjfXqTmXwVZEuZCn N4wIwNATbwEA2L2Q4MjSORTIBAWb25OcP+E2sry0tbcGAXosLVRaXgqlkQD/YQXi 2DDwJ3n0a+3GpOB8m4H1dBwKE3pRADAqCT2CR3UBAKUNsnlTssA8VxSJj50xyH1Z OA55wz5Bm3xklwDJ4mYM =RXFA -----END PGP PUBLIC KEY BLOCK----- ``` This GPG key is attached to the @artichoke-ci GitHub user. @artichoke-ci is a member of the @artichoke organization: https://github.com/orgs/artichoke/people This GPG key is attached to @artichoke-ci on GitHub and can be retrieved from: https://github.com/artichoke-ci.gpg
|
Uploading the artifacts it produced in this issue so they don't get purged by the The sigs verify correctly. $ ls -1 | xargs openssl sha256
SHA256(artichoke-nightly-aarch64-apple-darwin.tar.gz)= f21f936b43ce7ba69dd4d494b3a93db22dfbe63cdd40a65ce871c97216b6c52f
SHA256(artichoke-nightly-aarch64-apple-darwin.tar.gz.asc)= 1d52e53d7c3a0dc74b190c1106f698271a3afcdbdef060c2ac8e69373697a4f7
SHA256(artichoke-nightly-x86_64-apple-darwin.tar.gz)= 341a4bcf3e27bfb60c4107209758f44f430b41162db859fb8dbf2b0c0ae42aa9
SHA256(artichoke-nightly-x86_64-apple-darwin.tar.gz.asc)= 7196bd6db543ae8a19eb60f669a43a47472381e150d673de7d21feaa08fb7dd4
SHA256(artichoke-nightly-x86_64-pc-windows-msvc.zip)= b8b08b9cb87b5537139c46ca55db7089b3405766f9857fbd321e2482ce233bd3
SHA256(artichoke-nightly-x86_64-pc-windows-msvc.zip.asc)= 2086e0528af74d0b9bf31f80911efc3f4f5aa5cf5ab0991eac9338d3664eb16f
SHA256(artichoke-nightly-x86_64-unknown-linux-gnu.tar.gz)= cfc10c31ba9d264b57584863281bbe7757e4fad92ca4f448cb402ff6f4e296f3
SHA256(artichoke-nightly-x86_64-unknown-linux-gnu.tar.gz.asc)= 7f68e038883c49a1882e7ed9c179d58b4d3590fbc50230993b4f2a4cbc0c24d3
SHA256(artichoke-nightly-x86_64-unknown-linux-musl.tar.gz)= 68fcc57479ab58903d7f268a104ac4f42df36a2f6cb5f19d8b3af574e6b5fea6
SHA256(artichoke-nightly-x86_64-unknown-linux-musl.tar.gz.asc)= 386ea937db601b44d4d7ea3f6f8da53f46230f230538bdc31b09110211f45f7a
$ (set -x; for sig in ./*.asc; do gpg --verify "$sig" "${sig%.asc}"; done)
+ for sig in ./*.asc
+ gpg --verify ./artichoke-nightly-aarch64-apple-darwin.tar.gz.asc ./artichoke-nightly-aarch64-apple-darwin.tar.gz
gpg: Signature made Sun Jan 3 16:57:00 2021 PST
gpg: using EDDSA key 1C4A856ACF86EC1EE841180FAF57A37CAC061452
gpg: Good signature from "Code signing for Artichoke Ruby <codesign@artichokeruby.org>" [ultimate]
+ for sig in ./*.asc
+ gpg --verify ./artichoke-nightly-x86_64-apple-darwin.tar.gz.asc ./artichoke-nightly-x86_64-apple-darwin.tar.gz
gpg: Signature made Sun Jan 3 16:27:06 2021 PST
gpg: using EDDSA key 1C4A856ACF86EC1EE841180FAF57A37CAC061452
gpg: Good signature from "Code signing for Artichoke Ruby <codesign@artichokeruby.org>" [ultimate]
+ for sig in ./*.asc
+ gpg --verify ./artichoke-nightly-x86_64-pc-windows-msvc.zip.asc ./artichoke-nightly-x86_64-pc-windows-msvc.zip
gpg: Signature made Sun Jan 3 16:27:46 2021 PST
gpg: using EDDSA key 1C4A856ACF86EC1EE841180FAF57A37CAC061452
gpg: Good signature from "Code signing for Artichoke Ruby <codesign@artichokeruby.org>" [ultimate]
+ for sig in ./*.asc
+ gpg --verify ./artichoke-nightly-x86_64-unknown-linux-gnu.tar.gz.asc ./artichoke-nightly-x86_64-unknown-linux-gnu.tar.gz
gpg: Signature made Sun Jan 3 16:25:30 2021 PST
gpg: using EDDSA key 1C4A856ACF86EC1EE841180FAF57A37CAC061452
gpg: Good signature from "Code signing for Artichoke Ruby <codesign@artichokeruby.org>" [ultimate]
+ for sig in ./*.asc
+ gpg --verify ./artichoke-nightly-x86_64-unknown-linux-musl.tar.gz.asc ./artichoke-nightly-x86_64-unknown-linux-musl.tar.gz
gpg: Signature made Sun Jan 3 16:25:53 2021 PST
gpg: using EDDSA key 1C4A856ACF86EC1EE841180FAF57A37CAC061452
gpg: Good signature from "Code signing for Artichoke Ruby <codesign@artichokeruby.org>" [ultimate]Artifactsartichoke-nightly-aarch64-apple-darwin.tar.gz artichoke-nightly-x86_64-apple-darwin.tar.gz artichoke-nightly-x86_64-pc-windows-msvc.zip artichoke-nightly-x86_64-unknown-linux-gnu.tar.gz artichoke-nightly-x86_64-unknown-linux-musl.tar.gz |
|
this message was tweeted from https://twitter.com/artichokeruby/status/1345911198340923393 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add GPG code signing to nightly workflow
Sign release tarballs and zipballs with the following GPG key:
User ID: Code signing for Artichoke Ruby <codesign@artichokeruby.org>
Signing Key ID: AF57A37CAC061452
Signing Key Fingerprint: 1C4A856ACF86EC1EE841180FAF57A37CAC061452
Public Key: https://github.com/artichoke-ci.gpg, #20
This GPG key is attached to the @artichoke-ci GitHub user. @artichoke-ci
is a member of the @artichoke organization:
https://github.com/orgs/artichoke/people
This GPG key is attached to @artichoke-ci on GitHub and can be retrieved
from:
https://github.com/artichoke-ci.gpg