matthew.binning/dood
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

fix: Import the public signing key

Browse source
This commit is contained in:
Matthew Binning 2026-01-16 16:51:35 -08:00
parent 737b76e362
commit f9a3cf5b71
No known key found for this signature in database
1 changed files with 8 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

30
.gitlab-ci.yml
View file

@ -134,7 +134,6 @@ package-docker-image:
- test-ci-cd - test-ci-cd
only: only:
- branches - branches
when: manual
artifacts: artifacts:
expire_in: 1 week expire_in: 1 week
name: wf-image-dood-$BUILD_VARIANT-$CI_COMMIT_BRANCH-$CI_COMMIT_SHORT_SHA name: wf-image-dood-$BUILD_VARIANT-$CI_COMMIT_BRANCH-$CI_COMMIT_SHORT_SHA
@ -148,39 +147,26 @@ encrypt:
- job: package-docker-image - job: package-docker-image
artifacts: true artifacts: true
before_script: before_script:
# Install GnuPG
- apk add --no-cache gnupg - apk add --no-cache gnupg
script: script:
# Import GPG keys (assuming they're configured as CI/CD variables)
# You may need to set GPG_PRIVATE_KEY as a CI/CD variable containing your private key
- | - |
if [ -n "$GPG_PRIVATE_KEY" ]; then if [ -n "$GPG_PRIVATE_KEY" ]; then
gpg --batch --import "$GPG_PRIVATE_KEY" gpg --batch --import "$GPG_PRIVATE_KEY"
else else
echo "Warning: GPG_PRIVATE_KEY not set. Using existing keyring." echo "Warning: GPG_PRIVATE_KEY not set. Using existing keyring."
fi fi
- echo "$GPG_PUBLIC_KEY" | gpg --import
# Encrypt and sign using the passphrase from pipeline input or CI/CD variable # WIP
# The passphrase can come from either the pipeline input or a CI/CD variable - echo 'DD0007338E2C43BD553D569377D9D93F96483723:6:' | gpg --import-ownertrust
#- |
# PASSPHRASE="${INPUT_GPG_PASSPHRASE:-$GPG_PASSPHRASE}"
#
# if [ -z "$PASSPHRASE" ]; then
# echo "Error: No passphrase provided. Set gpg_passphrase input or GPG_PASSPHRASE variable."
# exit 1
# fi
- echo "Encrypting hello-world.tar.gz..." - echo "Encrypting hello-world.tar.gz..."
- | - |
echo "$[[ inputs.gpg_passphrase ]]" | gpg --batch --yes \ gpg --batch --yes \
--pinentry-mode loopback \ --pinentry-mode loopback \
--passphrase-fd 0 \ --passphrase-fd 3 \
--encrypt \ --sign --default-key B35BF119FC3AE04C \
--sign \ --encrypt -r 6C4C078A1C72925E \
-r matthew.binning@whitefoxdefense.com \
-o hello-world.tar.gz.gpg \ -o hello-world.tar.gz.gpg \
hello-world.tar.gz hello-world.tar.gz 3<<<"$[[ inputs.gpg_passphrase ]]"
# Verify the encrypted file was created
- | - |
if [ -f "hello-world.tar.gz.gpg" ]; then if [ -f "hello-world.tar.gz.gpg" ]; then
echo "Encryption successful!" echo "Encryption successful!"