[yarikoptic-gitmate]

Summary

This PR refactors the package signing logic in the Ubuntu build workflows to be more explicit and adds verification that built packages are properly signed.

Key Changes

• Extracted signing decision logic: Created a new "Decide whether to sign" step that centralizes the logic for determining whether packages should be signed. This replaces inline conditional expressions and makes the decision process more maintainable.

  • Signs packages when the GPG key secret is available
  • Skips signing for pull requests (which don't have access to secrets)
  • For non-PR builds in non-fork repositories without a signing key, fails with a clear error message
  • For non-PR builds in fork repositories without a signing key, skips signing

• Updated GPG key import step: Changed the conditional from a complex GitHub expression to use the new steps.signing.outputs.sign output, making it clearer when GPG keys are imported. Also added verification that the secret key was successfully imported.

• Updated package build step: Simplified the signing flag logic to use the centralized decision output instead of duplicating the conditional logic.

• Added package signature verification: Introduced a new step that verifies all built packages (.dsc, .buildinfo, and .changes files) are signed with the correct key when signing is enabled. This ensures the build process actually produced signed artifacts as expected.

Implementation Details

• The signing decision step uses GitHub CLI to check if the repository is a fork when needed
• Signature verification uses gpg --verify with status output parsing to confirm the correct key ID signed each package
• Changes are applied to both the main workflow file and the template file to keep them in sync

https://claude.ai/code/session_01PvaGRY7auLbAfwNGj21YXd

[yarikoptic-gitmate]

build-package (Build git-annex on Ubuntu) fails at "Build binary package from the source package". This is not caused by this PR: master's nightly fails the same way at the same step today (run 40844225757, with the same log tail ending in make[3]: *** [Makefile:62: git-annex] Error 1).

It started with upstream git-annex switching MagicMime from the Haskell magic package to libmagic (>= 1.3) on 2026-10-27 (c51f910bc4, 5556371681). Debian doesn't package that yet.

• The 2026-10-28 nightly (run 40659421290) failed one step earlier, on unmet build dependencies: libghc-libmagic-dev.
• Upstream then commented that build-dependency out (b043867592). The source package builds again since then, but the compile still fails.
• The GHC error itself isn't in the job log, because the step only prints the last 50 lines of the build log. So the link to libmagic is very likely but not confirmed.

There is no fix for this in the repo yet. It will need either Haskell libmagic >= 1.3 in the buildenv image or upstream changes for the case where it's missing, which is outside this PR's scope.

What this run does confirm for this PR: "Decide whether to sign" chose to sign, "Import GPG keys" imported the secret key and found 13A1093296154584245E0300C98FC49D36DAB17F, and the signed source package built. "Check that the packages are signed" was skipped only because the binary build failed before reaching it. Re-running the failed job once.

---

Generated by Claude Code

[yarikoptic-gitmate]

With the new buildenv image (#305), build-package now passes on 128d11dbb9, including the new "Check that the packages are signed" step. All five files (.dsc and the source and amd64 .buildinfo and .changes) report VALIDSIG 13A1093296154584245E0300C98FC49D36DAB17F.

test-annex (nfs-home, ubuntu-24.04) failed in a single test:

import: FAIL
  import --duplicate failed with unexpected exit code
  import5/f changed while it was being added

This isn't caused by this PR, which only changes signing steps in build-package. It's the NFS mtime race tracked in #294, which lists import among the affected tests: git-annex compares the file's InodeCache exactly before and after, and the NFS client reports a different mtime for a file nothing wrote to. The actimeo=0 mount from #302 is in effect on this branch, but the race still hit once here.

No fix exists in this repo beyond #302's mitigation; the real fix is upstream (relaxing the exact comparison, as #294 describes).

Update after the one re-run: it failed again, this time in different places, all from the same race: two testremote storeKey failures (content changed while it was being sent) and drop (with remote) (git status reporting M ./foo). It now looks as if actimeo=0 has no effect on the current runner image:

	master nightly, 2026-10-27 (passed)	this PR's re-run, 2026-10-29 (failed)
runner image	ubuntu-24.04 20261012.334.1	ubuntu-24.04 20261025.353.1
mount command	-o actimeo=0	-o actimeo=0
700 unit tests	all passed in 1286 s	4 failed, in 282 s

#294 measured actimeo=0 at about 4× slower. On the 20261025 image, the suite is 4.5× faster than on the 20261012 image and fails the way an attribute-caching mount does. Something in that image, perhaps its kernel, seems to make the option ineffective. I haven't confirmed this; checking would mean printing /proc/mounts and uname -r in that job. I'm not re-running this again.

---

Generated by Claude Code

[yarikoptic-gitmate]

test-datalad (master) failed with 3 failed, 1376 passed. This also isn't caused by this PR: master's last Ubuntu nightly that ran these tests, on 2026-10-27 (job 122083437969), failed the same 3 tests:

• test_sibling_enable_sameas, and the RIA post-clone-config test: git-annex now refuses an unverified special remote (This special remote cannot be used since it's not verified. Run this command to verify it: git-annex verifyremote r_rsync). That's upstream's new verifyremote requirement meeting DataLad's tests, so the fix belongs in DataLad or upstream.
• test_assure_unicode: Could not decode value as utf-8, or to guess its encoding. That's DataLad's encoding guessing and doesn't involve git-annex.

No fix for these exists in this repo.

Update: test-datalad (maint) and (release) both passed on this run. I've re-run the failed jobs once, nfs-home and test-datalad (master), now that the run has finished.

---

Generated by Claude Code