Skip to content

Add gpg-sign step to drone #4188

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Jun 24, 2018
Merged

Add gpg-sign step to drone #4188

Changes from 3 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
dce2438
Add gpg-sign step to drone
sapk Jun 8, 2018
4c0a3c5
add compressed releases to gpg-sign targets
sapk Jun 8, 2018
ba04d35
Merge branch 'master' into drone-gpg-sig
lunny Jun 21, 2018
0c72983
Use exclude to simplify file list
sapk Jun 22, 2018
f43a711
Merge branch 'master' into drone-gpg-sig
techknowlogick Jun 22, 2018
bc76a71
Merge branch 'master' into drone-gpg-sig
lunny Jun 24, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions .drone.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -255,6 +255,28 @@ pipeline:
when:
event: [ push, tag ]

gpg-sign:
image: plugins/gpgsign:1
pull: true
secrets: [ gpgsign_key, gpgsign_passphrase ]
detach_sign: true
files:
- dist/release/*-amd64
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we sign the compressed files too?

Copy link
Member Author

@sapk sapk Jun 8, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since they should be extract to be usefull ? It is possible but it is un-needed I think but if someone want it we can.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it might be a good idea because if perhaps someone replaces the compressed file with perhaps a zip bomb. Signing the compressed file means they can check it before they extract.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Only the xz files are getting uploaded, right? Than only sign *.xz

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's only a cosmetical improvement and can be added anytime. I don't see a need to delay this milestone any further.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can merge the gpgsign plugin, but to tag a release I have to be home

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As long as we can merge and release RC today I'm fine

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Merged gpgsign PR and triggered a release => https://beta.drone.io/drone-plugins/drone-gpgsign/11

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@lunny @tboerger done.

- dist/release/*-386
- dist/release/*-arm64
- dist/release/*-arm-5
- dist/release/*-arm-6
- dist/release/*-arm-7
- dist/release/*-mips
- dist/release/*-mips64
- dist/release/*-mipsle
- dist/release/*-mips64le
- dist/release/*-amd64.exe
- dist/release/*-386.exe
- dist/release/*.xz
when:
event: [ push, tag ]
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we really need the push event here?
Since release only happens on tagging, it should be sufficient here as well?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://dl.gitea.io/gitea/master


release:
image: plugins/s3:1
pull: true
Expand Down