From 913ee5a7449c8feaa1959e72f7ffc0e7be47bcb2 Mon Sep 17 00:00:00 2001 From: daredoole Date: Wed, 29 Jul 2026 13:07:33 -0400 Subject: [PATCH] Verify RPM signatures with release key --- .github/workflows/release.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d3702b6..63ca64b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -43,8 +43,9 @@ jobs: gpg --batch --import "$RUNNER_TEMP/rpm-signing.key" printf '%%_signature gpg\n%%_gpg_name %s\n' "$RPM_SIGNING_KEY_ID" > "$HOME/.rpmmacros" find dist/rpm dist/srpm -name '*.rpm' -print0 | xargs -0 rpmsign --addsign - find dist/rpm dist/srpm -name '*.rpm' -print0 | xargs -0 -n1 rpm --checksig gpg --batch --armor --export "$RPM_SIGNING_KEY_ID" > dist/fedora-glow-kit-release-key.asc + rpmkeys --import dist/fedora-glow-kit-release-key.asc + find dist/rpm dist/srpm -name '*.rpm' -print0 | xargs -0 -n1 rpm --checksig rm -f "$RUNNER_TEMP/rpm-signing.key" - name: Refresh signed checksums