mirror of
https://github.com/coder/coder.git
synced 2026-06-02 20:48:20 +00:00
Jakub Domeracki
6bc6e2baa6
GPG emits an "untrusted key" warning when signing with a key that hasn't been assigned a trust level, which can cause verification steps to fail or produce noisy output. Example: ```sh gpg: Signature made Tue Mar 24 20:56:59 2026 UTC gpg: using RSA key 21C96B1CB950718874F64DBD6A5A671B5E40A3B9 gpg: Good signature from "Coder Release Signing Key <security@coder.com>" [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 21C9 6B1C B950 7188 74F6 4DBD 6A5A 671B 5E40 A3B9 ``` After importing the release key, derive its fingerprint from the keyring and mark it as ultimately trusted via `--import-ownertrust`. The fingerprint is extracted dynamically rather than hard-coded, so this works for any key supplied via `CODER_GPG_RELEASE_KEY_BASE64`.
67 lines
2.3 KiB
Bash
Executable File
67 lines
2.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# This script signs a given binary using GPG.
|
|
# It expects the binary to be signed as the first argument.
|
|
#
|
|
# Usage: ./sign_with_gpg.sh path/to/binary
|
|
#
|
|
# On success, the input file will be signed using the GPG key and the signature output file will moved to /site/out/bin/ (happens in the Makefile)
|
|
#
|
|
# Depends on the GPG utility. Requires the following environment variables to be set:
|
|
# - $CODER_GPG_RELEASE_KEY_BASE64: The base64 encoded private key to use.
|
|
|
|
set -euo pipefail
|
|
# shellcheck source=scripts/lib.sh
|
|
source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
|
|
|
|
requiredenvs CODER_GPG_RELEASE_KEY_BASE64
|
|
|
|
FILE_TO_SIGN="$1"
|
|
|
|
if [[ -z "$FILE_TO_SIGN" ]]; then
|
|
error "Usage: $0 <file_to_sign>"
|
|
fi
|
|
|
|
if [[ ! -f "$FILE_TO_SIGN" ]]; then
|
|
error "File not found: $FILE_TO_SIGN"
|
|
fi
|
|
|
|
# Import the GPG key.
|
|
old_gnupg_home="${GNUPGHOME:-}"
|
|
gnupg_home_temp="$(mktemp -d)"
|
|
export GNUPGHOME="$gnupg_home_temp"
|
|
|
|
# Ensure GPG uses the temporary directory
|
|
echo "$CODER_GPG_RELEASE_KEY_BASE64" | base64 -d | gpg --homedir "$gnupg_home_temp" --import 1>&2
|
|
|
|
# Mark the imported key as ultimately trusted so GPG does not emit an
|
|
# "untrusted key" warning during signature verification. We derive the
|
|
# fingerprint from the keyring rather than hard-coding it so this works
|
|
# regardless of which key is supplied.
|
|
fingerprint="$(gpg --homedir "$gnupg_home_temp" --with-colons --fingerprint | awk -F: '/^fpr/ { print $10; exit }')"
|
|
echo "${fingerprint}:6:" | gpg --homedir "$gnupg_home_temp" --import-ownertrust 1>&2
|
|
|
|
# Sign the binary. This generates a file in the same directory and
|
|
# with the same name as the binary but ending in ".asc".
|
|
#
|
|
# We pipe `true` into `gpg` so that it never tries to be interactive (i.e.
|
|
# ask for a passphrase). The key we import above is not password protected.
|
|
true | gpg --homedir "$gnupg_home_temp" --detach-sign --armor "$FILE_TO_SIGN" 1>&2
|
|
|
|
# Verify the signature and capture the exit status
|
|
gpg --homedir "$gnupg_home_temp" --verify "${FILE_TO_SIGN}.asc" "$FILE_TO_SIGN" 1>&2
|
|
verification_result=$?
|
|
|
|
# Clean up the temporary GPG home
|
|
rm -rf "$gnupg_home_temp"
|
|
unset GNUPGHOME
|
|
if [[ "$old_gnupg_home" != "" ]]; then
|
|
export GNUPGHOME="$old_gnupg_home"
|
|
fi
|
|
|
|
if [[ $verification_result -eq 0 ]]; then
|
|
echo "${FILE_TO_SIGN}.asc"
|
|
else
|
|
error "Signature verification failed!"
|
|
fi
|