Skip to content

Commit 0b76c99

Browse files
committed
fix: sign top-level Release files instead of non-existent component files
The signing function was looking for component-level Release files (dists/{release}/{component}/Release) which aptly doesn't create. Aptly only creates: - Top-level: dists/{release}/Release - Binary subdir: dists/{release}/{component}/binary-{arch}/Release Changed the signing function to: - Use find -maxdepth 2 to limit search depth - Sign files with slash_count=1 (top-level Release files) - This creates InRelease and Release.gpg for each distribution Verified: - All 4 distributions (bookworm, jammy, noble, trixie) now have signed Release files - gpg --verify confirms signatures are valid - Both InRelease (clearsigned) and Release.gpg (detached) created Signed-off-by: Igor Pecovnik <igor@armbian.com>
1 parent d339800 commit 0b76c99

File tree

1 file changed

+8
-14
lines changed

1 file changed

+8
-14
lines changed

tools/repository/repo.sh

Lines changed: 8 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -666,23 +666,17 @@ signing() {
666666
echo "Using GPG key: $actual_key (requested: $key)" >&2
667667
done
668668

669-
# Only sign Release files at component level, NOT binary subdirs
670-
# Sign: dists/{release}/{component}/Release
671-
# Skip: dists/{release}/Release (top-level, not needed)
672-
# Skip: dists/{release}/*/binary-*/Release (subdirs, not needed)
673-
find "$output_folder/public/dists" -type f -name Release | while read -r release_file; do
674-
# Skip if file is in a binary-* subdirectory
675-
if [[ "$release_file" =~ /binary-[^/]+/Release$ ]]; then
676-
continue
677-
fi
678-
679-
# Skip top-level Release files (dists/{release}/Release)
680-
# Only sign component-level Release files (dists/{release}/{component}/Release)
669+
# Sign top-level Release files for each distribution
670+
# Sign: dists/{release}/Release
671+
# Skip: dists/{release}/{component}/binary-*/Release (subdirs, not needed)
672+
find "$output_folder/public/dists" -maxdepth 2 -type f -name Release | while read -r release_file; do
673+
# Skip if file is in a subdirectory (component or binary subdir)
674+
# Only sign top-level dists/{release}/Release files
681675
local rel_path="${release_file#$output_folder/public/dists/}"
682-
# Count slashes - should have exactly 2 for component level: {release}/{component}/Release
676+
# Count slashes - should have exactly 1 for top-level: {release}/Release
683677
local slash_count=$(echo "$rel_path" | tr -cd '/' | wc -c)
684678

685-
if [[ $slash_count -eq 2 ]]; then
679+
if [[ $slash_count -eq 1 ]]; then
686680
local distro_path
687681
distro_path="$(dirname "$release_file")"
688682
echo "Signing release at: $distro_path" | logger -t repo-management

0 commit comments

Comments
 (0)