Skip to content

Improve package signing verification in CI workflows #304

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yarikoptic merged 3 commits into from
Oct 30, 2026
+72 −4
Merged

Improve package signing verification in CI workflows #304

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
786ee1f
CI: build Dependabot PRs unsigned on Ubuntu instead of failing
claude Oct 29, 2026
59e1413
CI: require and verify signing of Ubuntu packages outside PRs
claude Oct 29, 2026
128d11d
Merge remote-tracking branch 'origin/master' into claude/vibrant-curi…
claude Oct 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 36 additions & 2 deletions .github/workflows/build-ubuntu.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,11 +103,34 @@ jobs:
- name: Adjust changelog generation script to use original branch
run: sed -i -e "s,HEAD,$BUILD_COMMIT,g" debian/create-standalone-changelog

# Fork and Dependabot PRs get no secrets: build them unsigned, without ~/.gnupg
# (dpkg-buildpackage signs if it exists). Builds outside PRs in a non-fork must sign.
- name: Decide whether to sign
id: signing
run: |
if [ "$HAVE_KEY" = true ]; then
sign=true
elif [ "$GITHUB_EVENT_NAME" = pull_request ]; then
sign=false
else
fork="$(gh api "repos/$GITHUB_REPOSITORY" --jq .fork)"
if [ "$fork" != true ]; then
echo "::error::No signing key (secrets.datalad_builder_gpgkey), but $GITHUB_EVENT_NAME builds of $GITHUB_REPOSITORY must be signed"
exit 1
fi
sign=false
fi
echo "sign=$sign" >> "$GITHUB_OUTPUT"
env:
HAVE_KEY: ${{ secrets.datalad_builder_gpgkey != '' }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Import GPG keys
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false
if: steps.signing.outputs.sign == 'true'
run: |
# private key for signing - comes from secrets
echo '${{ secrets.datalad_builder_gpgkey }}' | gpg --import
gpg --list-secret-keys "$DEB_SIGN_KEYID"
# public key for verification
gpg --import .github/workflows/tools/datalad-builder-key.asc

Expand All @@ -122,7 +145,7 @@ jobs:

- name: Build binary package from the source package
run: |
sign="${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false }}"
sign="${{ steps.signing.outputs.sign }}"
if [ "x$sign" = xtrue ]
then opts=
else opts='-uc -us'
Expand All @@ -141,6 +164,17 @@ jobs:
run: grep -E '^All [[:digit:]]{3} tests passed' "${bbuild_log}"
if: "!contains(env.DEB_BUILD_OPTIONS, 'nocheck')"

- name: Check that the packages are signed
if: steps.signing.outputs.sign == 'true'
run: |
arch="$(dpkg --print-architecture)"
for f in git-annex_*.dsc git-annex_*_{source,"$arch"}.{buildinfo,changes}; do
if ! gpg --status-fd 1 --verify "$f" | grep "^\[GNUPG:\] VALIDSIG .* $DEB_SIGN_KEYID\$"; then
echo "::error::$f is not signed by $DEB_SIGN_KEYID"
exit 1
fi
done

- name: Upload packages
uses: actions/upload-artifact@v7
with:
Expand Down
38 changes: 36 additions & 2 deletions .github/workflows/template/build-{{ostype}}.yaml.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,11 +147,34 @@ jobs:
- name: Adjust changelog generation script to use original branch
run: sed -i -e "s,HEAD,$BUILD_COMMIT,g" debian/create-standalone-changelog

# Fork and Dependabot PRs get no secrets: build them unsigned, without ~/.gnupg
# (dpkg-buildpackage signs if it exists). Builds outside PRs in a non-fork must sign.
- name: Decide whether to sign
id: signing
run: |
if [ "$HAVE_KEY" = true ]; then
sign=true
elif [ "$GITHUB_EVENT_NAME" = pull_request ]; then
sign=false
else
fork="$(gh api "repos/$GITHUB_REPOSITORY" --jq .fork)"
if [ "$fork" != true ]; then
echo "::error::No signing key (secrets.datalad_builder_gpgkey), but $GITHUB_EVENT_NAME builds of $GITHUB_REPOSITORY must be signed"
exit 1
fi
sign=false
fi
echo "sign=$sign" >> "$GITHUB_OUTPUT"
env:
HAVE_KEY: ${{ secrets.datalad_builder_gpgkey != '' }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Import GPG keys
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false
if: steps.signing.outputs.sign == 'true'
run: |
# private key for signing - comes from secrets
echo '${{ secrets.datalad_builder_gpgkey }}' | gpg --import
gpg --list-secret-keys "$DEB_SIGN_KEYID"
# public key for verification
gpg --import .github/workflows/tools/datalad-builder-key.asc

Expand All @@ -166,7 +189,7 @@ jobs:

- name: Build binary package from the source package
run: |
sign="${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false }}"
sign="${{ steps.signing.outputs.sign }}"
if [ "x$sign" = xtrue ]
then opts=
else opts='-uc -us'
Expand All @@ -185,6 +208,17 @@ jobs:
run: grep -E '^All [[:digit:]]{3} tests passed' "${bbuild_log}"
if: "!contains(env.DEB_BUILD_OPTIONS, 'nocheck')"

- name: Check that the packages are signed
if: steps.signing.outputs.sign == 'true'
run: |
arch="$(dpkg --print-architecture)"
for f in git-annex_*.dsc git-annex_*_{source,"$arch"}.{buildinfo,changes}; do
if ! gpg --status-fd 1 --verify "$f" | grep "^\[GNUPG:\] VALIDSIG .* $DEB_SIGN_KEYID\$"; then
echo "::error::$f is not signed by $DEB_SIGN_KEYID"
exit 1
fi
done

{% elif ostype.startswith("macos") %}
- name: Configure build
run: |
Expand Down
Loading