Skip to content

chore: sign APT repository with both keys#13271

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
babakks merged 1 commit into from
Aug 18, 2026
+30 −23
Merged

chore: sign APT repository with both keys #13271

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion .github/workflows/deployment.yml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -375,12 +375,19 @@ jobs:
GPG_KEY: ${{ secrets.GPG_KEY }}
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
GPG_KEYGRIP: ${{ secrets.GPG_KEYGRIP }}
GPG_PUBKEY_2026: ${{ secrets.GPG_PUBKEY_2026 }}
GPG_KEY_2026: ${{ secrets.GPG_KEY_2026 }}
GPG_PASSPHRASE_2026: ${{ secrets.GPG_PASSPHRASE_2026 }}
GPG_KEYGRIP_2026: ${{ secrets.GPG_KEYGRIP_2026 }}
run: |
base64 -d <<<"$GPG_PUBKEY" | gpg --import --no-tty --batch --yes
base64 -d <<<"$GPG_KEY" | gpg --import --no-tty --batch --yes
base64 -d <<<"$GPG_PUBKEY_2026" | gpg --import --no-tty --batch --yes
base64 -d <<<"$GPG_KEY_2026" | gpg --import --no-tty --batch --yes
echo "allow-preset-passphrase" > ~/.gnupg/gpg-agent.conf
gpg-connect-agent RELOADAGENT /bye
base64 -d <<<"$GPG_PASSPHRASE" | /usr/lib/gnupg2/gpg-preset-passphrase --preset "$GPG_KEYGRIP"
base64 -d <<<"$GPG_PASSPHRASE_2026" | /usr/lib/gnupg2/gpg-preset-passphrase --preset "$GPG_KEYGRIP_2026"
- name: Sign RPMs
if: inputs.environment == 'production'
run: |
Expand All@@ -400,7 +407,7 @@ jobs:
./script/createrepo.sh
cp -r dist/repodata site/packages/rpm/
pushd site/packages/rpm
gpg --yes --detach-sign --armor repodata/repomd.xml
gpg --yes --detach-sign --armor --default-key 2C6106201985B60E6C7AC87323F3D4EA75716059 repodata/repomd.xml
popd
- name: Run reprepro
if: ${{ inputs.environment == 'production' }}
Expand Down
42 changes: 21 additions & 21 deletions script/distributions
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -4,79 +4,79 @@ Codename: stable
Architectures: i386 amd64 armhf arm64
Components: main
Description: The GitHub CLI - debian stable repo
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325

@babakksbabakksMay 13, 2026•
edited
Loading

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reprepro supports multiple keys in SignWith: value (See here):

2010-01-27

  • SignWith can take multiple arguments to denote multiple keys to sign a repository with.

It also supports script overrides, e.g. SignWith: ! path/to/script (See here).


Origin: gh
Label: gh
Codename: oldstable
Architectures: i386 amd64 armhf arm64
Components: main
Description: The GitHub CLI - debian oldstable repo
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325

Origin: gh
Label: gh
Codename: testing
Architectures: i386 amd64 armhf arm64
Components: main
Description: The GitHub CLI - debian testing repo
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325

Origin: gh
Label: gh
Codename: unstable
Architectures: i386 amd64 armhf arm64
Components: main
Description: The GitHub CLI - debian unstable repo
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325

Origin: gh
Label: gh
Codename: sid
Architectures: i386 amd64 armhf arm64
Components: main
Description: The GitHub CLI - debian unstable repo
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325

Origin: gh
Label: gh
Codename: buster
Architectures: i386 amd64 armhf arm64
Components: main
Description: The GitHub CLI - debian buster repo
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325

Origin: gh
Label: gh
Codename: bullseye
Architectures: i386 amd64 armhf arm64
Components: main
Description: The GitHub CLI - debian bullseye repo
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325

Origin: gh
Label: gh
Codename: stretch
Architectures: i386 amd64 armhf arm64
Components: main
Description: The GitHub CLI - debian stretch repo
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325

Origin: gh
Label: gh
Codename: jessie
Architectures: i386 amd64 armhf arm64
Components: main
Description: The GitHub CLI - debian jessie repo
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325

Origin: gh
Label: gh
Codename: focal
Architectures: i386 amd64 armhf arm64
Components: main
Description: The GitHub CLI - ubuntu focal repo
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
DebOverride: override.ubuntu

Origin: gh
Expand All@@ -85,7 +85,7 @@ Codename: precise
Architectures: i386 amd64 armhf arm64
Components: main
Description: The GitHub CLI - ubuntu precise repo
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
DebOverride: override.ubuntu

Origin: gh
Expand All@@ -94,7 +94,7 @@ Codename: bionic
Architectures: i386 amd64 armhf arm64
Components: main
Description: The GitHub CLI - ubuntu bionic repo
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
DebOverride: override.ubuntu

Origin: gh
Expand All@@ -103,7 +103,7 @@ Codename: trusty
Architectures: i386 amd64 armhf arm64
Components: main
Description: The GitHub CLI - ubuntu trusty repo
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
DebOverride: override.ubuntu

Origin: gh
Expand All@@ -112,7 +112,7 @@ Codename: xenial
Architectures: i386 amd64 armhf arm64
Components: main
Description: The GitHub CLI - ubuntu xenial repo
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
DebOverride: override.ubuntu

Origin: gh
Expand All@@ -121,7 +121,7 @@ Codename: groovy
Architectures: i386 amd64 armhf arm64
Components: main
Description: The GitHub CLI - ubuntu groovy repo
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
DebOverride: override.ubuntu

Origin: gh
Expand All@@ -130,7 +130,7 @@ Codename: eoan
Architectures: i386 amd64 armhf arm64
Components: main
Description: The GitHub CLI - ubuntu eoan repo
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
DebOverride: override.ubuntu

Origin: gh
Expand All@@ -139,7 +139,7 @@ Codename: disco
Architectures: i386 amd64 armhf arm64
Components: main
Description: The GitHub CLI - ubuntu disco repo
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
DebOverride: override.ubuntu

Origin: gh
Expand All@@ -148,7 +148,7 @@ Codename: cosmic
Architectures: i386 amd64 armhf arm64
Components: main
Description: The GitHub CLI - ubuntu cosmic repo
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
DebOverride: override.ubuntu

Origin: gh
Expand All@@ -157,7 +157,7 @@ Codename: hirsute
Architectures: i386 amd64 armhf arm64
Components: main
Description: The GitHub CLI - ubuntu hirsute repo
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
DebOverride: override.ubuntu

Origin: gh
Expand All@@ -166,13 +166,13 @@ Codename: kali-rolling
Architectures: i386 amd64 armhf arm64
Components: main
Description: The GitHub CLI - kali repo
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325

Origin: gh
Label: gh
Codename: impish
Architectures: i386 amd64 armhf arm64
Components: main
Description: The GitHub CLI - ubuntu impish repo
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
DebOverride: override.ubuntu
2 changes: 1 addition & 1 deletion script/rpmmacros
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
%_gpg_name GitHub CLI <opensource+cli@github.com>
%_gpg_name 2C6106201985B60E6C7AC87323F3D4EA75716059

@babakksbabakksApr 23, 2026

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is changed from identity to the key fingerprint as both our keys share the same identity (name and email), and we want to keep signing our RPM repos with the current key.