actions/cargo-binstall
1
0
Fork 0
mirror of https://github.com/cargo-bins/cargo-binstall.git synced 2025-04-24 14:28:42 +00:00
Code Issues Projects Releases Packages Wiki Activity

Fix release build again (#1400)

Browse source 
* Fix build again

* Recommend (r)age over minisign password

* Dry-run the entire release process

* Reorg a bit so dry-run works

* Fix secret name

* Add check on age key

* Pass secrets down

* Use a cross-platform "date"

* Delete signing key artifact to be extra safe

* Last little bits
This commit is contained in:
Félix Saparelli 2023-09-27 00:17:17 +13:00 • committed by GitHub
parent 3f29e13e42
commit 5d4333d5c8
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
8 changed files with 189 additions and 140 deletions
Download patch file Download diff file Expand all files Collapse all files

12
.github/scripts/ephemeral-crate.sh vendored Executable file
View file

@ -0,0 +1,12 @@
#!/usr/bin/env bash
set -euxo pipefail
cat >> crates/bin/Cargo.toml <<EOF
[package.metadata.binstall.signing]
algorithm = "minisign"
pubkey = "$(tail -n1 minisign.pub)"
EOF
cp minisign.pub crates/bin/minisign.pub

13
.github/scripts/ephemeral-gen.sh vendored
View file

@ -2,21 +2,12 @@
set -euxo pipefail
cargo binstall -y rsign2
cargo binstall -y rsign2 rage
rsign generate -f -W -p minisign.pub -s minisign.key
cat >> crates/bin/Cargo.toml <<EOF
[package.metadata.binstall.signing]
algorithm = "minisign"
pubkey = "$(tail -n1 minisign.pub)"
EOF
echo "public=$(tail -n1 minisign.pub)" >> "$GITHUB_OUTPUT"
cp minisign.pub crates/bin/minisign.pub
set +x
echo "::add-mask::$(tail -n1 minisign.key)"
echo "private=$(tail -n1 minisign.key)" >> "$GITHUB_OUTPUT"
set -x
rage --encrypt --recipient "$AGE_KEY_PUBLIC" --output minisign.key.age minisign.key
rm minisign.key

10
.github/scripts/ephemeral-sign.sh vendored
View file

@ -2,14 +2,15 @@
set -euo pipefail
echo "untrusted comment: rsign encrypted secret key" > minisign.key
cat >> minisign.key <<< "$SIGNING_KEY"
[[ -z "$AGE_KEY_SECRET" ]] && { echo "!!! Empty age key secret !!!"; exit 1; }
cat >> age.key <<< "$AGE_KEY_SECRET"
set -x
cargo binstall -y rsign2
cargo binstall -y rsign2 rage
rage --decrypt --identity age.key --output minisign.key minisign.key.age
ts=$(date --utc --iso-8601=seconds)
ts=$(node -e 'console.log((new Date).toISOString())')
git=$(git rev-parse HEAD)
comment="gh=$GITHUB_REPOSITORY git=$git ts=$ts run=$GITHUB_RUN_ID"
@ -17,3 +18,4 @@ for file in "$@"; do
rsign sign -W -s minisign.key -x "$file.sig" -t "$comment" "$file"
done
rm age.key minisign.key