Create PGP signed releases about archinstall

[grazzolini]

archisntall is now on the official repos: https://archlinux.org/packages/?q=archinstall

[Torxed]

@kpcyrd @grazzolini Thank you both, this is honestly my first time signing things from the command-line, I've usually done everything (what's possible) via the GitHub GUI over the years. It's been a long time coming and I was bound to do some mistakes, so thank you for the help.

Key has been uploaded to https://keys.openpgp.org/search?q=256F73CEEFC6705C6BBAB20E5FBBB32941E3740A as well as a signature of the tarball is now attached to the release on the release page. I hope I didn't get that wrong or missed anything.

[grazzolini]

So far it's looking ok to me. I'll try creating packges today, let's see.

[kpcyrd]

Please sign the tarball generated with:

git archive --prefix="archinstall-2.1.0/" -o ./archinstall-2.1.0.tar.gz "v2.1.0"

instead of just the commit and attach the signature to the release. :)

Also please consider uploading your key to keys.openpgp.org.

[Torxed]

Good idea, I'll get right on it.
I've been a tad bit lazy on the signing process, but made sure to sign the hashes of the PKGBUILD at the very least to make the final check verifiable.

I'll try to get this done within a day or two!

[grazzolini]

No problem. I plan on being more active on archinstall this month, and I'll try to make a few PR's to get things moving and get it into archiso next month. At least, that's my goal. It'll start with packaging archinstall. I'm thinking about making it a split package, but let's see. Also, I've discussed this with @dvzrv and we have to focus on the profiles and logging to get archinstall into archiso. Our plan is to have a separate package with a few sanctioned/vetted profiles that would also get into archiso, alongside archinstall. This would live on a separate git repository, most likely on gitlab.archlinux.org. So, this would simplify getting them into archiso, because it would mean just installing a few packages on releng profile.

[Torxed]

Just a quick update on this one, the delay is partially because I want to get my HSM to work with this in a automated and meaningful way so I can integrate it more permanently (to avoid lazy shortcuts in the future). It proved to be a bit more difficult because my very outdated hardware on the HSM hehe. So I'm waiting for an order to come through within a day or two with new hardware that supports PGP signing and stuff : ) But it's on the way!

[grazzolini]

Oh, that wasn't needed, but it's good to have! I'm going through the code now.

[Torxed]

After a bit of tinkering. Got the HSM to work flawlessly.
Commits, tags (and releases) as well as PKGBUILDS are now signed by my PGP key.

I'll add the public key used for signing in the release as an artifact :)
If there's something missing just poke a message here and I'll re-open the ticket. (I'll have to come back to the chain of trust at some point when I'm more familiar with how that would work and the whole concept).

[grazzolini]

Thanks! Also thanks @kpcyrd, I was going to mention the lack of signatures on the artifacts as well.

[Torxed]

@grazzolini Awesome, looking forward to it :) Let me know if you find anything, I've been installing some 20 machines today just to verify as much as possible, and it's looking good. I'll avoid major changes for a bit and work only on the logging feature #56.

[grazzolini]

Yes, #56 should probably be done before putting this into archiso.

[Torxed]

This terrifies me, but at the same time I'm super excited hehe :)