Add gpg-sign step to drone #4188

sapk · 2018-06-08T17:40:24Z

@go-gitea/owners need to add secrets (gpgsign_key, gpgsign_passphrase) to make this work and disclose the public part to be usefull ^^.
Friendly ping to @tboerger who develop the drone plugin.

Fix #4182
Related #4167

techknowlogick · 2018-06-08T17:43:29Z

.drone.yml

+    secrets: [ gpgsign_key, gpgsign_passphrase ]
+    detach_sign: true
+    files:
+      - dist/release/*-amd64


should we sign the compressed files too?

Since they should be extract to be usefull ? It is possible but it is un-needed I think but if someone want it we can.

I think it might be a good idea because if perhaps someone replaces the compressed file with perhaps a zip bomb. Signing the compressed file means they can check it before they extract.

Only the xz files are getting uploaded, right? Than only sign *.xz

That's only a cosmetical improvement and can be added anytime. I don't see a need to delay this milestone any further.

I can merge the gpgsign plugin, but to tag a release I have to be home

As long as we can merge and release RC today I'm fine

Merged gpgsign PR and triggered a release => https://beta.drone.io/drone-plugins/drone-gpgsign/11

@lunny @tboerger done.

codecov-io · 2018-06-08T17:47:46Z

Codecov Report

Merging #4188 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master    #4188   +/-   ##
=======================================
  Coverage   20.09%   20.09%           
=======================================
  Files         153      153           
  Lines       30696    30696           
=======================================
  Hits         6168     6168           
  Misses      23586    23586           
  Partials      942      942

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 212fef0...bc76a71. Read the comment docs.

sapk · 2018-06-08T17:57:38Z

Steps to generate the key and import it :

# Generate key
gpg --full-generate-key 
 > 1 RSA et RSA
 > 4096
 > 0 (we could setup a expiration date but not necessary)
 > y
 > Gitea Drone Build System
 > drone@gitea.io
 > y
 > (Provide a good random passphrase)

gpg --export-secret-keys -a LONG_KEY_ID_DISPLAY_AT_END_OF_GENERATION > path/to/private.key

# Import in drone
drone secret add --repository go-gitea/gitea --name gpgsign_key --value $(base64 -i path/to/private.key) --event push --event tag --image plugins/gpgsign
drone secret add --repository go-gitea/gitea --name gpgsign_passphrase --value password-for-key --event push --event tag --image plugins/gpgsign

# Disclose public key to every one
gpg --armor --export LONG_KEY_ID_DISPLAY_AT_END_OF_GENERATION > release_key.pub

tboerger · 2018-06-12T07:59:17Z

Please use sub keys, follow a guide like https://www.void.gr/kargig/blog/2013/12/02/creating-a-new-gpg-key-with-subkeys/ to generate GPG keys. Than you can also increase the trust of the endless valid key and use a sub signing key with a limited lifetime for signing the builds.

Beside that the public key should be uploaded to the keyservers and also been provided via the download server.

daviian · 2018-06-21T05:20:28Z

.drone.yml

+      - dist/release/*-386.exe
+      - dist/release/*.xz
+    when:
+      event: [ push, tag ]


Do we really need the push event here?
Since release only happens on tagging, it should be sufficient here as well?

https://dl.gitea.io/gitea/master

tboerger · 2018-06-21T14:25:02Z

Now there is also a PR to provide some documentation for the gpgsign plugin: drone/drone-plugin-index#129

tboerger · 2018-06-22T16:47:23Z

Now you can add the excludes attribute and simplify this step :D

drone-plugins/drone-gpgsign#2

lunny · 2018-06-24T04:17:42Z

Wait util I setup drone.

* SECURITY * Limit uploaded avatar image-size to 4096x3072 by default (go-gitea#4353) * Do not allow to reuse TOTP passcode (go-gitea#3878) * FEATURE * Add cli commands to regen hooks & keys (go-gitea#3979) * Add support for FIDO U2F (go-gitea#3971) * Added user language setting (go-gitea#3875) * LDAP Public SSH Keys synchronization (go-gitea#1844) * Add topic support (go-gitea#3711) * Multiple assignees (go-gitea#3705) * Add protected branch whitelists for merging (go-gitea#3689) * Global code search support (go-gitea#3664) * Add label descriptions (go-gitea#3662) * Add issue search via API (go-gitea#3612) * Add repository setting to enable/disable health checks (go-gitea#3607) * Emoji Autocomplete (go-gitea#3433) * Implements generator cli for secrets (go-gitea#3531) * ENHANCEMENT * Add more webhooks support and refactor webhook templates directory (go-gitea#3929) * Add new option to allow only OAuth2/OpenID user registration (go-gitea#3910) * Add option to use paged LDAP search when synchronizing users (go-gitea#3895) * Symlink icons (go-gitea#1416) * Improve release page UI (go-gitea#3693) * Add admin dashboard option to run health checks (go-gitea#3606) * Add branch link in branch list (go-gitea#3576) * Reduce sql query times in retrieveFeeds (go-gitea#3547) * Option to enable or disable swagger endpoints (go-gitea#3502) * Add missing licenses (go-gitea#3497) * Reduce repo indexer disk usage (go-gitea#3452) * Enable caching on assets and avatars (go-gitea#3376) * Add repository search ordered by stars/forks. Forks column in admin repo list (go-gitea#3969) * Add Environment Variables to Docker template (go-gitea#4012) * LFS: make HTTP auth period configurable (go-gitea#4035) * Add config path as an optionial flag when changing pass via CLI (go-gitea#4184) * Refactor User Settings sections (go-gitea#3900) * Allow square brackets in external issue patterns (go-gitea#3408) * Add Attachment API (go-gitea#3478) * Add EnableTimetracking option to app settings (go-gitea#3719) * Add config option to enable or disable log executed SQL (go-gitea#3726) * Shows total tracked time in issue and milestone list (go-gitea#3341) * TRANSLATION * Improve English grammar and consistency (go-gitea#3614) * DEPLOYMENT * Allow Gitea to run as different USER in Docker (go-gitea#3961) * Provide compressed release binaries (go-gitea#3991) * Sign release binaries (go-gitea#4188)

Add gpg-sign step to drone

dce2438

techknowlogick reviewed Jun 8, 2018

View reviewed changes

bkcsoft added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Jun 8, 2018

techknowlogick added topic/deployment topic/build PR changes how Gitea is built, i.e. regarding Docker or the Makefile labels Jun 8, 2018

add compressed releases to gpg-sign targets

4c0a3c5

techknowlogick approved these changes Jun 8, 2018

View reviewed changes

bkcsoft added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Jun 8, 2018

lunny added this to the 1.5.0 milestone Jun 21, 2018

daviian suggested changes Jun 21, 2018

View reviewed changes

daviian approved these changes Jun 21, 2018

View reviewed changes

bkcsoft added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Jun 21, 2018

Merge branch 'master' into drone-gpg-sig

ba04d35

Use exclude to simplify file list

0c72983

drone-plugins/drone-gpgsign#2

tboerger approved these changes Jun 22, 2018

View reviewed changes

Merge branch 'master' into drone-gpg-sig

f43a711

daviian approved these changes Jun 23, 2018

View reviewed changes

Merge branch 'master' into drone-gpg-sig

bc76a71

lunny merged commit a747a5d into go-gitea:master Jun 24, 2018

sapk mentioned this pull request Jul 3, 2018

Add changelog for 1.5.0-RC1 #4324

Merged

lafriks added the type/changelog Adds the changelog for a new Gitea version label Jul 3, 2018

go-gitea locked and limited conversation to collaborators Nov 24, 2020

delvh removed the type/changelog Adds the changelog for a new Gitea version label Oct 7, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add gpg-sign step to drone #4188

Add gpg-sign step to drone #4188

sapk commented Jun 8, 2018 •

edited

Loading

techknowlogick Jun 8, 2018

sapk Jun 8, 2018 •

edited

Loading

techknowlogick Jun 8, 2018

sapk Jun 8, 2018

tboerger Jun 9, 2018

daviian Jun 22, 2018

tboerger Jun 22, 2018

daviian Jun 22, 2018

tboerger Jun 22, 2018

sapk Jun 22, 2018

codecov-io commented Jun 8, 2018 •

edited

Loading

sapk commented Jun 8, 2018 •

edited

Loading

tboerger commented Jun 12, 2018

daviian Jun 21, 2018

lunny Jun 21, 2018

tboerger commented Jun 21, 2018

tboerger commented Jun 22, 2018

lunny commented Jun 24, 2018

Add gpg-sign step to drone #4188

Add gpg-sign step to drone #4188

Conversation

sapk commented Jun 8, 2018 • edited Loading

Choose a reason for hiding this comment

sapk Jun 8, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codecov-io commented Jun 8, 2018 • edited Loading

Codecov Report

sapk commented Jun 8, 2018 • edited Loading

tboerger commented Jun 12, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tboerger commented Jun 21, 2018

tboerger commented Jun 22, 2018

lunny commented Jun 24, 2018

sapk commented Jun 8, 2018 •

edited

Loading

sapk Jun 8, 2018 •

edited

Loading

codecov-io commented Jun 8, 2018 •

edited

Loading

sapk commented Jun 8, 2018 •

edited

Loading