releng

#11704 Create detached signatures for the butane 0.19.0 release
Closed: It's all good by spresti. Opened by spresti.

Closed: It's all good
Reopen Issue

Please create detached signatures for the binaries we will upload to GitHub for the butane 0.19.0 release. This is a manual process for now, pending the automation discussed in https://pagure.io/robosignatory/issue/53 and https://github.com/coreos/fedora-coreos-tracker/issues/335.

The binaries themselves have been built in koji. Here is a small script to grab all of the rpms and the files out of the rpms and name them appropriately:

#!/bin/bash
set -eux -o pipefail
# Use the Fedora 38 key for the detached signatures
KEYTOSIGNWITH='fedora-38'
VR='0.19.0-1.fc38'
RPMKEY='eb10b464' # Fedora 38 key
do_sign() {
    # Sign with sigul unless FAKESIGN=1
    if [ ${FAKESIGN:-0} != 1 ]; then
        sigul sign-data -a $KEYTOSIGNWITH "$1" -o "$1.asc"
    else
        echo INVALID > "$1.asc"
    fi
}
# Grab the binaries out of the redistributable rpm
rpm="butane-redistributable-${VR}.noarch.rpm"
koji download-build --key $RPMKEY --rpm $rpm
rpm -qip $rpm | grep -P "^Signature.*${RPMKEY}$" # Verify the output has the key in it
rpm2cpio $rpm | cpio -idv './usr/share/butane/butane-*'
# Rename the binaries
mv usr/share/butane/butane-aarch64-apple-darwin \
    butane-aarch64-apple-darwin
mv usr/share/butane/butane-aarch64-unknown-linux-gnu-static \
    butane-aarch64-unknown-linux-gnu
mv usr/share/butane/butane-ppc64le-unknown-linux-gnu-static \
    butane-ppc64le-unknown-linux-gnu
mv usr/share/butane/butane-s390x-unknown-linux-gnu-static \
    butane-s390x-unknown-linux-gnu
mv usr/share/butane/butane-x86_64-apple-darwin \
    butane-x86_64-apple-darwin
mv usr/share/butane/butane-x86_64-pc-windows-gnu.exe \
    butane-x86_64-pc-windows-gnu.exe
mv usr/share/butane/butane-x86_64-unknown-linux-gnu-static \
    butane-x86_64-unknown-linux-gnu
# Sign them
do_sign butane-aarch64-apple-darwin
do_sign butane-aarch64-unknown-linux-gnu
do_sign butane-ppc64le-unknown-linux-gnu
do_sign butane-s390x-unknown-linux-gnu
do_sign butane-x86_64-apple-darwin
do_sign butane-x86_64-pc-windows-gnu.exe
do_sign butane-x86_64-unknown-linux-gnu
# Fix permissions and clean up
chmod go+r *.asc
rm $rpm; rmdir ./usr/share/butane; rmdir ./usr/share; rmdir ./usr

After running this you should end up with a directory with files in it like:

$ ls -1
butane-aarch64-apple-darwin
butane-aarch64-apple-darwin.asc
butane-aarch64-unknown-linux-gnu
butane-aarch64-unknown-linux-gnu.asc
butane-ppc64le-unknown-linux-gnu
butane-ppc64le-unknown-linux-gnu.asc
butane-s390x-unknown-linux-gnu
butane-s390x-unknown-linux-gnu.asc
butane-x86_64-apple-darwin
butane-x86_64-apple-darwin.asc
butane-x86_64-pc-windows-gnu.exe
butane-x86_64-pc-windows-gnu.exe.asc
butane-x86_64-unknown-linux-gnu
butane-x86_64-unknown-linux-gnu.asc

Metadata Update from @phsmoura:
- Issue tagged with: low-trouble, medium-gain, ops

Done, results can be found here: https://humaton.fedorapeople.org/butane/0.19.0/

Metadata Update from @humaton:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

@humaton, for some reason I cannot verify any of these keys?

As an example I run

gpg --verify butane-aarch64-apple-darwin.asc butane-aarch64-apple-darwin

It results with 

gpg: Signature made Thu 05 Oct 2023 04:20:40 AM EDT
gpg: using RSA key 6A51BBABBA3D5467B6171221809A8D7CEB10B464
gpg: Can't check signature: No public key

Reopening for now.

Metadata Update from @spresti:
- Issue status updated to: Open (was: Closed)

Oh, weird let me redo the signing again.

Actually, do you have the F38 key installed on the machine where verifying this?

Ah, your right thank you :). I was on f38 and assumed I had it. I just updated it via curl'ing https://fedoraproject.org/fedora.gpg | gpg --import

Metadata Update from @spresti:
- Issue close_status updated to: It's all good
- Issue status updated to: Closed (was: Open)
Metadata
None

low-trouble medium-gain ops

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.