opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: sign coder binaries with the release key using GPG (#18774)

Browse Source 
### Description
This PR introduces GPG signing for all Coder *slim-binaries*.
Detached signatures will allow users to verify the integrity and
authenticity of the binaries they download.

### Changes
  * `scripts/sign_with_gpg.sh`: New script to sign a given binary
     using GPG. It imports the release key, signs the binary, and
     verifies the signature.
   * `scripts/build_go.sh`: Updated to call `sign_with_gpg.sh` when the
     `CODER_SIGN_GPG` environment variable is set to 1.
   * `.github/workflows/release.yaml`: The` CODER_SIGN_GPG` environment
     variable is now set to 1 during the release build, enabling GPG
     signing for all release binaries.
   * `.github/workflows/ci.yaml`: The `CODER_SIGN_GPG` environment
     variable is now set to 1 during the CI build, enabling GPG
     signing for all CI binaries.
* `Makefile`: Detached signatures are moved to the `/site/out/bin/
`directory
This commit is contained in:
Jakub Domeracki
2025-07-09 11:53:27 +02:00
committed by GitHub
parent 3c2f3d640b
commit dc0919da33
6 changed files with 82 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/release/publish.sh
+2 -19
View File
@@ -129,26 +129,9 @@ if [[ "$dry_run" == 0 ]] && [[ "${CODER_GPG_RELEASE_KEY_BASE64:-}" != "" ]]; the
log "--- Signing checksums file"
log
# Import the GPG key.
old_gnupg_home="${GNUPGHOME:-}"
gnupg_home_temp="$(mktemp -d)"
export GNUPGHOME="$gnupg_home_temp"
echo "$CODER_GPG_RELEASE_KEY_BASE64" | base64 -d | gpg --import 1>&2
# Sign the checksums file. This generates a file in the same directory and
# with the same name as the checksums file but ending in ".asc".
#
# We pipe `true` into `gpg` so that it never tries to be interactive (i.e.
# ask for a passphrase). The key we import above is not password protected.
true | gpg --detach-sign --armor "${temp_dir}/${checksum_file}" 1>&2
rm -rf "$gnupg_home_temp"
unset GNUPGHOME
if [[ "$old_gnupg_home" != "" ]]; then
export GNUPGHOME="$old_gnupg_home"
fi
execrelative ../sign_with_gpg.sh "${temp_dir}/${checksum_file}"
signed_checksum_path="${temp_dir}/${checksum_file}.asc"
if [[ ! -e "$signed_checksum_path" ]]; then
log "Signed checksum file not found: ${signed_checksum_path}"
log