.RPM Files should be GPG signed

[openhab]

.RPM Files should be GPG signed

[BClark09]

@theoweiss, Sorry to bother you while you are busy. Could you upload the signingKeyRingFile to cloudbees as a secret file?

[theoweiss]

Hi @BClark09,

I've installed the gpg key file on bintray.
You should be able to use it like this:

def ARTIFACTORY_GPG_KEY     = project.hasProperty('artifactoryGpgKey') ? project.property('artifactoryGpgKey') : System.env.ARTIFACTORY_API_GPG_KEY
def ARTIFACTORY_GPG_KEY_ID     = project.hasProperty('artifactoryGpgKeyId') ? project.property('artifactoryGpgKeyId') : System.env.ARTIFACTORY_API_GPG_KEY_ID
ARTIFACTORY_GPG_KEY_ID    = ARTIFACTORY_GPG_KEY_ID ?: "A224060A"

signingKeyId = ${ARTIFACTORY_GPG_KEY_ID}
signingKeyPassphrase = ${ARTIFACTORY_GPG}
signingKeyRingFile = new File(${ARTIFACTORY_GPG_KEY})

Regards,
Theo

[BClark09]

Thanks @theoweiss! Tested on my local machine with a test key and all works well. Hoping the same for cloudbees!

[BClark09]

Hi @theoweiss, unfortunately, whilst we have the right files. It seems that the underlining tool for building RPM files in ospackage fails at signing with long RSA headers.

https://openhab.ci.cloudbees.com/job/openhab-linuxpkg/85/console
craigwblake/redline#62

It'd be wise to GPG sign keys, but where should we go from here? Find another way? Or add another key?

Kind Regards,
Ben

[theoweiss]

Get redline fixed ;-)
craigwblake/redline#62 (comment)

[BClark09]

No reply at all from that branch, I've decided to try and push a workaround myself:

https://github.com/craigwblake/redline/compare/master...BClark09:signature-size?expand=1
https://github.com/nebula-plugins/gradle-ospackage-plugin/compare/master...BClark09:add-signature-size?expand=1

If testing this works, I can send the PRs in order and then adjust our gradle script accordingly, for a RSA Key of 4096 we just need to set:

signatureSize = 543

[BClark09]

That went better than I thought it would. Sent a pull request to redline.

[BClark09]

I've managed to locally compile both plugins and have a working 4096-bit RSA key signature on linuxpkg-testing.

I'll add these binaries to use in our project if I don't get any response in the above PRs