Add minisign signing instead of sha256 hash

3 files changed, 19 insertions, 9 deletions

diff --git a/.build.yml b/.build.yml
index 4b16a9e..bd9ec05 100644
--- a/.build.yml
+++ b/.build.yml
@@ -13,6 +13,8 @@ sources:
 secrets:
   - a1e0e3da-c1ad-473a-ad69-8878f267a628
   - 0b0d3e5e-fbdc-41d0-97ed-ee654fe797ff
+  - f80356df-eb81-487f-8739-fbf08bf204dc
+  - 05763ec6-2f17-46b5-90f6-963482975b8b
 tasks:
   - set_rust: |
       cd page
@@ -32,4 +34,5 @@ tasks:
       echo 'rustflags = ["-C", "link-arg=-fuse-ld=lld"]' >> .cargo/config.toml
   - package: |
       cd page
+      ./scripts/read_minisign_password.sh
       make ci
diff --git a/Makefile b/Makefile
index 33f107f..f4773d2 100644
--- a/Makefile
+++ b/Makefile
@@ -2,6 +2,15 @@ profile := dev
 target = $(shell rustc -vV | grep host | awk '{print $$2}')
 architectures := x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu
 app_name := page
+deploy_host := deploy@conchos.unlimited.pizza
+deploy_path := /srv/http/build.r.bdr.sh/$(app_name)
+
+define sign_and_deploy
+    sha256sum $(1) > $(1).sha256
+		echo "$MINISIGN_PASSWORD" | minisign -Sm $(1)
+    rsync -avz $(1) $(DEPLOY_HOST):$(DEPLOY_PATH)
+    rsync -avz $(1).minisig $(DEPLOY_HOST):$(DEPLOY_PATH)
+endef
 
 default: build
 
@@ -41,9 +50,7 @@ ifeq ($(findstring linux,$(target)),linux)
 	@$(eval filename := $(app_name)-$(target)-$(channel))
 	cargo deb --profile $(profile) --target $(target)
 	mv target/$(target)/debian/*.deb $(filename).deb
-	sha256sum $(filename).deb > $(filename).deb.sha256
-	rsync -avz $(filename).deb deploy@conchos.unlimited.pizza:/srv/http/build.r.bdr.sh/$(app_name)
-	rsync -avz $(filename).deb.sha256 deploy@conchos.unlimited.pizza:/srv/http/build.r.bdr.sh/$(app_name)
+	@$(call checksum_and_deploy,$(filename).deb)
 endif
 
 rpm: build
@@ -51,17 +58,13 @@ ifeq ($(findstring linux,$(target)),linux)
 	@$(eval filename := $(app_name)-$(target)-$(channel))
 	cargo generate-rpm --profile $(profile) --target $(target)
 	mv target/$(target)/generate-rpm/*.rpm $(filename).rpm
-	sha256sum $(filename).rpm > $(filename).rpm.sha256
-	rsync -avz $(filename).rpm deploy@conchos.unlimited.pizza:/srv/http/build.r.bdr.sh/$(app_name)
-	rsync -avz $(filename).rpm.sha256 deploy@conchos.unlimited.pizza:/srv/http/build.r.bdr.sh/$(app_name)
+	@$(call checksum_and_deploy,$(filename).rpm)
 endif
 
 tar: build
 	@$(eval filename := $(app_name)-$(target)-$(channel))
 	tar -czvf $(filename).tar.gz -C target/$(target)/$(profile)/ $(app_name)
-	sha256sum $(filename).tar.gz > $(filename).tar.gz.sha256
-	rsync -avz $(filename).tar.gz deploy@conchos.unlimited.pizza:/srv/http/build.r.bdr.sh/$(app_name)
-	rsync -avz $(filename).tar.gz.sha256 deploy@conchos.unlimited.pizza:/srv/http/build.r.bdr.sh/$(app_name)
+	@$(call checksum_and_deploy,$(filename).tar.gz)
 
 package: $(architectures)
 
diff --git a/scripts/read_minisign_password.sh b/scripts/read_minisign_password.sh
new file mode 100755
index 0000000..c4bfd66
--- /dev/null
+++ b/scripts/read_minisign_password.sh
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+
+set +x
+export MINISIGN_PASSWORD=$(cat ~/.minisign/minisign.pass)