#11364 Create detached signatures for the butane 0.18.0 release
Closed: Fixed a year ago by spresti. Opened a year ago by spresti.

Please create detached signatures for the binaries we will upload to GitHub for the butane 0.18.0 release. This is a manual process for now, pending the automation discussed in https://pagure.io/robosignatory/issue/53 and https://github.com/coreos/fedora-coreos-tracker/issues/335.

The binaries themselves have been built in koji. Here is a small script to grab all of the rpms and the files out of the rpms and name them appropriately:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
#!/bin/bash
set -eux -o pipefail

# Use the Fedora 37 key for the detached signatures
KEYTOSIGNWITH='fedora-37'

VR='0.18.0-1.fc37'
RPMKEY='5323552a' # Fedora 37 key

do_sign() {
    # Sign with sigul unless FAKESIGN=1
    if [ ${FAKESIGN:-0} != 1 ]; then
        sigul sign-data -a $KEYTOSIGNWITH "$1" -o "$1.asc"
    else
        echo INVALID > "$1.asc"
    fi
}

# Grab the binaries out of the redistributable rpm
rpm="butane-redistributable-${VR}.noarch.rpm"
koji download-build --key $RPMKEY --rpm $rpm
rpm -qip $rpm | grep -P "^Signature.*${RPMKEY}$" # Verify the output has the key in it
rpm2cpio $rpm | cpio -idv './usr/share/butane/butane-*'

# Rename the binaries
mv usr/share/butane/butane-aarch64-apple-darwin \
    butane-aarch64-apple-darwin
mv usr/share/butane/butane-aarch64-unknown-linux-gnu-static \
    butane-aarch64-unknown-linux-gnu
mv usr/share/butane/butane-ppc64le-unknown-linux-gnu-static \
    butane-ppc64le-unknown-linux-gnu
mv usr/share/butane/butane-s390x-unknown-linux-gnu-static \
    butane-s390x-unknown-linux-gnu
mv usr/share/butane/butane-x86_64-apple-darwin \
    butane-x86_64-apple-darwin
mv usr/share/butane/butane-x86_64-pc-windows-gnu.exe \
    butane-x86_64-pc-windows-gnu.exe
mv usr/share/butane/butane-x86_64-unknown-linux-gnu-static \
    butane-x86_64-unknown-linux-gnu

# Sign them
do_sign butane-aarch64-apple-darwin
do_sign butane-aarch64-unknown-linux-gnu
do_sign butane-ppc64le-unknown-linux-gnu
do_sign butane-s390x-unknown-linux-gnu
do_sign butane-x86_64-apple-darwin
do_sign butane-x86_64-pc-windows-gnu.exe
do_sign butane-x86_64-unknown-linux-gnu

# Fix permissions and clean up
chmod go+r *.asc
rm $rpm; rmdir ./usr/share/butane; rmdir ./usr/share; rmdir ./usr

After running this you should end up with a directory with files in it like:

$ ls -1
butane-aarch64-apple-darwin
butane-aarch64-apple-darwin.asc
butane-aarch64-unknown-linux-gnu
butane-aarch64-unknown-linux-gnu.asc
butane-ppc64le-unknown-linux-gnu
butane-ppc64le-unknown-linux-gnu.asc
butane-s390x-unknown-linux-gnu
butane-s390x-unknown-linux-gnu.asc
butane-x86_64-apple-darwin
butane-x86_64-apple-darwin.asc
butane-x86_64-pc-windows-gnu.exe
butane-x86_64-pc-windows-gnu.exe.asc
butane-x86_64-unknown-linux-gnu
butane-x86_64-unknown-linux-gnu.asc

Metadata Update from @phsmoura:
- Issue tagged with: low-trouble, medium-gain, ops

a year ago

Metadata Update from @humaton:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

a year ago

Hey so sorry, in double checking the signatures I found that the butane-x86_64-pc-windows-gnu.exe returned a bad signature

gpg --verify butane-x86_64-pc-windows-gnu.exe.asc butane-x86_64-pc-windows-gnu.exe
gpg: Signature made Fri 31 Mar 2023 06:18:08 AM EDT
gpg:                using RSA key ACB5EE4E831C74BB7C168D27F55AD3FB5323552A
gpg: BAD signature from "Fedora (37) <fedora-37-primary@fedoraproject.org>" [unknown]

All the others are good, but this one seems to be having issues. I did download again to make sure no packets were dropped and got the same result.

Metadata Update from @spresti:
- Issue status updated to: Open (was: Closed)

a year ago

@spresti sorry about that, same link new content in place.

no problem! That worked great thank you!

Metadata Update from @spresti:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

a year ago

Login to comment on this ticket.

Metadata
Boards 1
Ops Status: Backlog