fix(apt): rewrite GPG setup script with native batch key generation - #5
Merged
Conversation
- Replace fragile expect-based addkey/passwd automation with a single non-interactive gpg --batch --gen-key call that generates both the primary key and sign-only subkey in one shot. - Generate a random passphrase (openssl rand -base64 32) and set it on the key pair via the batch Passphrase: directive. - Export secret subkey using the generated passphrase with --pinentry-mode loopback. - Write the passphrase to /tmp/zurvan-gpg-passphrase.txt for the maintainer to copy into the APT_SIGNING_PASSPHRASE GitHub secret. - Update public.key with the freshly generated key.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Rewrites
scripts/setup-gpg-keys.shto use GPG's native batch key generation instead of fragileexpect-based automation.Why
The previous script used
expectto drivegpg --edit-keyinteractively (foraddkeyandpasswd). This was unreliable on macOS — it hung at interactive prompts, timed out, and never reliably set a passphrase on the subkey.Changes
gpg --batch --gen-keywith a parameter file that generates both the primary RSA-4096 key and a sign-only subkey in one shot (Subkey-Type,Subkey-Usage: sign). Noexpect, no--edit-key, no hanging.openssl rand -base64 32) and sets it on the key pair via the batchPassphrase:directive./tmp/zurvan-gpg-passphrase.txtso the maintainer can copy it into theAPT_SIGNING_PASSPHRASEGitHub Actions secret.--pinentry-mode loopback --passphraseto exportsecret-subkey.ascnon-interactively.public.keywith the freshly generated key.Tested
Ran end-to-end on macOS (GnuPG 2.4.8): primary key + subkey generated, both files exported, passphrase written. No interactive prompts, no timeouts.