gitian: more specific build, (detached) sign and PR instructions

[Sjors]

The following commands copy assert files to the host machine (which has your PGP key)

git clone git@github.com:bitcoin-core/gitian.sigs.git
git remote add you git@github.com:you/gitian.sigs.git

export NAME=you
export VERSION=0.21.1rc1
mkdir -p  $VERSION-osx-unsigned/$NAME  $VERSION-win-unsigned/$NAME $VERSION-linux/$NAME
scp -r gitian:gitian.sigs/$VERSION-osx-unsigned/$NAME $VERSION-osx-unsigned
scp -r gitian:gitian.sigs/$VERSION-win-unsigned/$NAME $VERSION-win-unsigned
scp -r gitian:gitian.sigs/$VERSION-linux/$NAME $VERSION-linux

(would be nice to have a single command for this, maybe with some grep magic to find the relevant ../...$NAME...$VERSION paths)

3. sign from the host machine

gpg --output $VERSION-linux/$NAME/bitcoin-core-linux-0.21-build.assert.sig --detach-sign $VERSION-linux/sjors/bitcoin-core-linux-0.21-build.assert 
gpg --output $VERSION-osx-unsigned/$NAME/bitcoin-core-osx-0.21-build.assert.sig --detach-sign $VERSION-osx-unsigned/$NAME/bitcoin-core-osx-0.21-build.assert 
gpg --output $VERSION-win-unsigned/$NAME/bitcoin-core-win-0.21-build.assert.sig --detach-sign $VERSION-win-unsigned/$NAME/bitcoin-core-win-0.21-build.assert 

4. if code-signed binaries are not yet available: make a PR without code-signed binaries (optional)

git checkout -b $VERSION
git add $VERSION-*/$NAME
git commit -S -a -m "Add $NAME $VERSION non-code signed signatures"
git push --set-upstream $NAME $VERSION

5. once code-signed binaries are available: [...]

./gitian-build.sh --detach-sign -s sjors $VERSION`

mkdir -p $VERSION-osx-signed/$NAME $VERSION-win-signed/$NAME
scp -r gitian:gitian.sigs/$VERSION-osx-signed/$NAME $VERSION-osx-signed
scp -r gitian:gitian.sigs/$VERSION-win-signed/$NAME $VERSION-win-signed

gpg --output $VERSION-osx-signed/$NAME/bitcoin-dmg-signer-build.assert.sig --detach-sign $VERSION-osx-signed/$NAME/bitcoin-dmg-signer-build.assert 
gpg --output $VERSION-win-signed/$NAME/bitcoin-win-signer-build.assert.sig --detach-sign $VERSION-win-signed/$NAME/bitcoin-win-signer-build.assert 

git checkout -b $VERSION-signed
git add $VERSION-*-signed/$NAME
git commit -S -a -m "Add $NAME $VERSION code signed signatures"
git push --set-upstream $NAME $VERSION-signed

[fivepiece]

copy+paste from #9

Re. gitconfig in the host VM, what I did want to set up but did not have a chance yet is :

Fork the gitian.sigs on github
On the gitian host VM, clone the forked repo from github
On the "metal" host, clone the forked repo from github and set a second remote to the cloned repo in the gitian host VM or clone the repo from the gitian host VM and set a second remote to github
Run the gitian build process without signing, commit the unsigned asserts
On the metal host, pull the unsigned asserts from the VM remote
Sign and commit the signatures for the assert files
Push to the github remote
Create PR against Core's gitian.sigs
I think it should be possible to script this if using ssh keys

[Sjors]

Fixed via #25.

[Sjors]

I keep using the above instructions, so maybe we should incorporate them.

[maflcko]

Gitian has been archived and is no longer actively maintained for bitcoin-core, see #76