From 01ba8d557a1a66d58ceec4f4b8f6ea30581a4dce Mon Sep 17 00:00:00 2001
From: Marek Counts <mcounts@aerospike.com>
Date: Wed, 2 Oct 2024 08:54:52 -0400
Subject: [PATCH] DEVOPS-271: Feat/gpg tests and examples (#6)

* add gpg, rpm and deb examples

* added test files
---
 .github/workflows/sign-deb-example.yaml  |  20 ++++++++++++++++++++
 .github/workflows/sign-file-example.yaml |  23 +++++++++++++++++++++++
 .github/workflows/sign-rpm-example.yaml  |  22 ++++++++++++++++++++++
 tests/test-1.0-2.noarch.rpm              | Bin 0 -> 6409 bytes
 tests/test.deb                           | Bin 0 -> 630 bytes
 5 files changed, 65 insertions(+)
 create mode 100644 .github/workflows/sign-deb-example.yaml
 create mode 100644 .github/workflows/sign-file-example.yaml
 create mode 100644 .github/workflows/sign-rpm-example.yaml
 create mode 100644 tests/test-1.0-2.noarch.rpm
 create mode 100644 tests/test.deb

diff --git a/.github/workflows/sign-deb-example.yaml b/.github/workflows/sign-deb-example.yaml
new file mode 100644
index 0000000..83f3f36
--- /dev/null
+++ b/.github/workflows/sign-deb-example.yaml
@@ -0,0 +1,20 @@
+name: GPG sign DEB
+on: workflow_dispatch
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@master
+      
+      - name: setup GPG
+        uses: ./shared-workflows/devops/setup-gpg
+        with:
+          gpg-private-key: ${{ secrets.GPG_SECRET_KEY }}
+          gpg-public-key: ${{ secrets.GPG_PUBLIC_KEY }}
+          gpg-key-pass: ${{ secrets.GPG_PASS }}
+          gpg-key-name: "aerospike-inc"
+   
+      - name: GPG sign deb # gpg sign and verify deb packages
+        run: |
+          dpkg-sig --sign builder tests/*.deb
+          dpkg-sig --verify tests/*.deb
diff --git a/.github/workflows/sign-file-example.yaml b/.github/workflows/sign-file-example.yaml
new file mode 100644
index 0000000..eac031f
--- /dev/null
+++ b/.github/workflows/sign-file-example.yaml
@@ -0,0 +1,23 @@
+name: GPG sign file
+on: workflow_dispatch
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@master
+      
+      - name: setup GPG
+        uses: ./shared-workflows/devops/setup-gpg
+        with:
+          gpg-private-key: ${{ secrets.GPG_SECRET_KEY }}
+          gpg-public-key: ${{ secrets.GPG_PUBLIC_KEY }}
+          gpg-key-pass: ${{ secrets.GPG_PASS }}
+          gpg-key-name: "aerospike-inc"
+   
+      - name: GPG sign artifacts  # Signing other artifacts
+        env:
+          GPG_TTY: no-tty
+          GPG_PASSPHRASE: ${{ secrets.GPG_PASS }}
+        run: |
+          gpg --detach-sign --no-tty --batch --yes --output README.md.asc --passphrase "$GPG_PASSPHRASE" README.md
+          gpg --verify README.md.asc README.md
diff --git a/.github/workflows/sign-rpm-example.yaml b/.github/workflows/sign-rpm-example.yaml
new file mode 100644
index 0000000..c3f7c16
--- /dev/null
+++ b/.github/workflows/sign-rpm-example.yaml
@@ -0,0 +1,22 @@
+name: GPG sign RPM
+on: workflow_dispatch
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@master
+      
+      - name: setup GPG
+        uses: ./shared-workflows/devops/setup-gpg
+        with:
+          gpg-private-key: ${{ secrets.GPG_SECRET_KEY }}
+          gpg-public-key: ${{ secrets.GPG_PUBLIC_KEY }}
+          gpg-key-pass: ${{ secrets.GPG_PASS }}
+          gpg-key-name: "aerospike-inc"
+   
+      - name: Sign and check rpm # gpg sign and verify rpm packages 
+        # your rpm here
+        run: |
+          rpm --addsign tests/*.rpm
+          rpm --checksig tests/*.rpm
+
diff --git a/tests/test-1.0-2.noarch.rpm b/tests/test-1.0-2.noarch.rpm
new file mode 100644
index 0000000000000000000000000000000000000000..4897ce5bd95a44897530f0beca8343065cb0da12
GIT binary patch
literal 6409
zcmeI0Ux-vy9LLY>O#WGu6qVK_x<SgWIy2|~zc(rW>{2R}k_)9+bpGAhOS5xl@10q9
zg<#Dk2qB~%vYreQj4)p|SOO_3q(FLz9)f!C!BQhFMZ(P5e!rPxijTc^4}0c&Kj-&5
zzjN;IoSB8+r4KHDUnJ1xS}JRm%?d4Bi2tb-$US$@d;P?Pf*zYs$dVa&ejGYJzX!U6
zkiufndC;+eZ(%7Y@<5l17eGtU>zaQ7h54ij9p)E*1x5Q5beLcK4HWIuU^ZOtafb>|
zNoHDR6a=n_l;z8SQW{BLxwcY@Q=7;r3QXY%=`ul0E96!{d8jyN!ig9QY-zH9I{~*G
z8Zu?O9uHh9L_{Os4uymTVcD^p8)&#<eqo>e$FMc?<@OD*rP+=t|Hw0tXCTi&o`F0A
zc?R+f<Qd2_kY^yzK%Rj-19=Ai?-}USMCRt^4nrcKra{OZbrT0_8ZX1pM(9x2D2{@n
z50)GjK*xr453G}5-K0nJMa@_XLHo~|7iq>i%0lQ^e?j{t&Hb7$gO;E-HDjFx<F_<l
z0Y&?i=BuD+pVs`l=0lpVgW`H8H2(#P{--qmt@-mVmoPT=Gtl9kO6ZHFs&6%8EadMr
z_kyDT51R2kF+b-t-`nLvq#55E{0k$R@6&dCUtAA!4D$>7H7^H+Jrt%vAz!5xpg8}C
zw%-qm{zpO4-Uo{I<Djt5(n?UY&uD(2%RTrGXzvGw_&w-{^PdET`8@_G?q{oJ^h4eT
z3h{cV=I6BC0mb>dwLQ?hSKBv%;{4}9aX!XHenImd%^Vc>gZaXEQuC;0r8(7%e(1kX
zb6xYK<`yWv&tXtpudVr3{>FiEKS#UvWp8Rbo+qro>@+CGKdbp1DEj}T`A1NQU+mX>
zv1>1`M;;_t-y~4qBo-MSi8BNKn1O=^Yc}h#V68Z5kSIxwCKE5QTHL7h_V)G<CXI2G
zwv;rYG#P~{QgQ8}3_fYFdaN1-xMVQh2r8jlaVrBP`m^+GGijEStWswU*a0Dr4JjVO
zbEcG0ZD(mU8)2!c%0yIg8&#1sC)2n#(jxz^S#7uCdPeGTqdh?y2}{LDCls+kdJoJT
zz`F!%6<0!EXEJ4l)OJnJR4fQB5qVsg+@;DgZK^0|O4*hZ__p+X%cnjKLQ}w?3N7gf
zK|+^WzQwuE+{m_VVF@lgCQLyUGpPt<AbiJ>)b_%_c9;pi5%*yw2ja*OFT|~uCP|Cj
z^>MqxT**>VNt<w!;5V<+I;R7Z;h=kOb#SQ198O@gnW`*P@`<>vo@S#e8z9<-BSUcw
z(sz4oC!4G%tmB+*W#ejRs-k#efY=pUamprfDjrn1QM;d}50|35G%nxia6db3!CeLM
z0`9YtjdX5PMI?=gRC(N}lB#NnDk<-<jB<^LW}J}P{<uj(eQIU6HE{Oj?n&z4cSvDN
z(oP$yyt&5WhLMe^dfmuG8aG?(jm^6Tw{3%)I?*!Jgc9u*<8?)Dk7Aew?N(F{h|l3%
zLdT+x=h%*E*_4YA9^k}<^!?DYeUpcd@_bVTG-4(fuJ6IwD<PRJ@s|T)*_LNpe&oW1
zF?|}El$!w)R$xhKaxP6_x)w7fl~!oGp@@VZ23!S_GAHnCJHjBHe^zsIH$R2vB@Z2f
z?<usNq79eMr_L0iqwI*}QxEpN^Y*dTEBjXM*)n_j^t>+)4EGK0*f?PC_~em~W`|A&
z2RH9tdgiI^>%Ttx%`S3i&H3}k#*VG2om<yGDc2sq9^UwP?ZfK?-86o3>DXm=`zu$M
zy_S9WZsD_2@2~#qM)NI`(y6_2RnPLXd{cYTl~>=G_hQ3eurR%LZEW!~!^5RV4;ILD
KS{j;#WB&*F0i*K(

literal 0
HcmV?d00001

diff --git a/tests/test.deb b/tests/test.deb
new file mode 100644
index 0000000000000000000000000000000000000000..a0d5255e4a16680e9442d2c1da0b9a477b4651d8
GIT binary patch
literal 630
zcmY$iNi0gvu;WTeP0CEn(@o0EODw8XP*5;5H!?RjGBdU?RZuVh@?oT*fq|KciGl(U
zK|unSk)8opa(-S(QGSkINn(*+RdESH{YJ(>gTWwyOJl44Uxo}(c7{(r8gd1mw;#;)
zRLOM{@;BS+_pfLP7uT5+9J4R@^IuqOrCA}wv-?ZjiN!s$i)YR1mlTq*uFfuCo0fJ|
z>rLEmt%KFeGPiLo*|g4EZQuC~a&xYkO#b?8W@F{S%vV;E+tTyPj#T#UuiVC=&bUA+
z^^l2ueCy|Y`^mm54v91hO%<FlX(P|lu<ZI}Hy0jwUv{SC?{x*a&XW!Tno}=Coe1I-
zlw)uD5Wpg#@Svkf%aYBjxp?oS8S4|+^wn7OQ`u{oy=41BTROxUSG#Sh?taXuUfK7q
zU_-+H?Va5RKMQy;1T#DnE@0+LNi0c(2NKZ#gu>a#zz8jzc-a_~PDn`?WR|w{SiOJ7
zm%gK(<Kl#%O-nhpGtIxcxorZI;I1PHmLDr4r|V^1T=;o$fr0|dPKmx6uj00*O5Og2
z4l0Z+Ci_Evt_<DI<lmyFwyfmqY=O-xFKqT*x7qBd6!S;>{Ey6)SM#oAt&i_{d6832
z;e(fwml403)e75)YkjL8X7VO4n51xCW&+Fa^#%)APpw-e$?OrL`uNq-v~35@3TPy3
mSmh}9rcr&e+E)d(1+Ox>9y46{r+>WTZ8e8VLuSLzFLwZ)u<kVg

literal 0
HcmV?d00001