From da7a4a2f12fbf09c30e92806637d41561789fea3 Mon Sep 17 00:00:00 2001
From: Ruben Beltran del Rio <git@r.bdr.sh>
Date: Sat, 8 Feb 2025 22:44:32 +0100
Subject: Replace sha256 hash with minisign

---
 .build.yml      |  3 +++
 .gitignore      |  1 +
 Makefile        | 20 +++++++++++---------
 scripts/sign.sh | 18 ++++++++++++++++++
 4 files changed, 33 insertions(+), 9 deletions(-)
 create mode 100755 scripts/sign.sh

diff --git a/.build.yml b/.build.yml
index 5505e86..b597084 100644
--- a/.build.yml
+++ b/.build.yml
@@ -1,6 +1,7 @@
 image: archlinux
 packages:
   - make
+  - minisigm
   - rsync
   - coreutils
   - clang
@@ -16,6 +17,8 @@ environment:
 secrets:
   - a1e0e3da-c1ad-473a-ad69-8878f267a628
   - 0b0d3e5e-fbdc-41d0-97ed-ee654fe797ff
+  - f80356df-eb81-487f-8739-fbf08bf204dc
+  - 05763ec6-2f17-46b5-90f6-963482975b8b
 tasks:
   - set_rust: |
       cd blog
diff --git a/.gitignore b/.gitignore
index 57f64a4..9755d02 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,3 +6,4 @@ target
 
 *.tar.gz
 *.tar.gz.sha256
+*.minisig
diff --git a/Makefile b/Makefile
index 9f8306c..01e240b 100644
--- a/Makefile
+++ b/Makefile
@@ -2,6 +2,14 @@ profile := dev
 target = $(shell rustc -vV | grep host | awk '{print $$2}')
 architectures := x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu
 app_name := blog
+deploy_host := deploy@conchos.unlimited.pizza
+deploy_path := /srv/http/build.r.bdr.sh/$(app_name)
+
+define sign_and_deploy
+		@./scripts/sign.sh "$(1)" "$(channel)" "$(architecture)"
+    rsync -avz $(1) $(deploy_host):$(deploy_path)
+    rsync -avz $(1).minisig $(deploy_host):$(deploy_path)
+endef
 
 default: build
 
@@ -41,9 +49,7 @@ ifeq ($(findstring linux,$(target)),linux)
 	@$(eval filename := $(app_name)-$(target)-$(channel))
 	cargo deb --profile $(profile) --target $(target)
 	mv target/$(target)/debian/*.deb $(filename).deb
-	sha256sum $(filename).deb > $(filename).deb.sha256
-	rsync -avz $(filename).deb deploy@conchos.unlimited.pizza:/srv/http/build.r.bdr.sh/$(app_name)
-	rsync -avz $(filename).deb.sha256 deploy@conchos.unlimited.pizza:/srv/http/build.r.bdr.sh/$(app_name)
+	@$(call sign_and_deploy,$(filename).deb)
 endif
 
 rpm: build
@@ -51,17 +57,13 @@ ifeq ($(findstring linux,$(target)),linux)
 	@$(eval filename := $(app_name)-$(target)-$(channel))
 	cargo generate-rpm --profile $(profile) --target $(target)
 	mv target/$(target)/generate-rpm/*.rpm $(filename).rpm
-	sha256sum $(filename).rpm > $(filename).rpm.sha256
-	rsync -avz $(filename).rpm deploy@conchos.unlimited.pizza:/srv/http/build.r.bdr.sh/$(app_name)
-	rsync -avz $(filename).rpm.sha256 deploy@conchos.unlimited.pizza:/srv/http/build.r.bdr.sh/$(app_name)
+	@$(call sign_and_deploy,$(filename).rpm)
 endif
 
 tar: build
 	@$(eval filename := $(app_name)-$(target)-$(channel))
 	tar -czvf $(filename).tar.gz -C target/$(target)/$(profile)/ $(app_name)
-	sha256sum $(filename).tar.gz > $(filename).tar.gz.sha256
-	rsync -avz $(filename).tar.gz deploy@conchos.unlimited.pizza:/srv/http/build.r.bdr.sh/$(app_name)
-	rsync -avz $(filename).tar.gz.sha256 deploy@conchos.unlimited.pizza:/srv/http/build.r.bdr.sh/$(app_name)
+	@$(call sign_and_deploy,$(filename).tar.gz)
 
 package: $(architectures)
 
diff --git a/scripts/sign.sh b/scripts/sign.sh
new file mode 100755
index 0000000..b3bfe47
--- /dev/null
+++ b/scripts/sign.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+set +x
+if [ $# -ne 3 ]; then
+    echo "Usage: $0 <file> <channel> <architecture>"
+    exit 1
+fi
+
+FILE="$1"
+VERSION="$2"
+PLATFORM="$3"
+COMMENT="Version: ${VERSION}, File: $(basename ${FILE}) Built on: $(date +'%Y-%m-%d %H:%M'), Platform: ${PLATFORM}"
+
+if [ -f ~/.minisign/minisign.pass ]; then
+    cat ~/.minisign/minisign.pass | minisign -Sm "${FILE}" -t "${COMMENT}"
+else
+    minisign -Sm "${FILE}" -t "${COMMENT}"
+fi
-- 
cgit