f.weber
103ad311b7
Provides a self-contained, containerized aptly (Debian repo manager) stack with independently releasable image and Helm chart versions. - images/: aptly-server (aptly built from source, cross-compiled) and aptly-deb-builder (nfpm + dpkg-buildpackage) container images - rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack scripts consumed identically by Compose and the Helm chart, driven by one declarative state.yaml contract - compose/: test (ephemeral, open) and production docker-compose stacks with an nginx read/auth sidecar - charts/aptly/: aptly-native Helm chart covering every security posture from fully open to authenticated read+write, Ingress and Gateway API support (usable in parallel for migration scenarios), metrics, and declarative repo/mirror/publish reconciliation via a Helm hook - .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test) plus separately tagged image (image/v*) and chart (chart/v*) releases, weekly rebuilds, and a preflight workflow validating the runner's Docker/Helm-OCI capabilities - pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's signKey annotation (Helm can't verify Ed25519 keys) - docs/, README.md, charts/aptly/README.md: usage, security, and versioning documentation
3.0 KiB
Public keys
Chart signing key (needed, not yet set up)
.gitea/workflows/release-chart.yaml runs helm package --sign to produce a
.tgz.prov file for every chart release, and charts/aptly/Chart.yaml is meant to
carry an artifacthub.io/signKey annotation pointing at the public half of that
key (both are currently commented out / referencing a placeholder — see below).
This key must NOT be Ed25519/EdDSA. Helm's chart signing is built on the
deprecated golang.org/x/crypto/openpgp library, which cannot read Ed25519 keys at
all — signing fails with Error: private key not found (or, depending on gpg
version, openpgp: unsupported feature: public key type: 22). This is a
long-standing, unresolved upstream limitation (helm/helm#11634, #31180, #31181), not
a configuration mistake — confirmed by reproducing it locally against a throwaway
Ed25519 test key before writing this note. Use RSA (4096-bit, no expiry is
fine for a CI signing key) or a classic ECC curve helm's openpgp fork supports;
RSA is the safest choice since it's unambiguously supported.
The org's existing "Morlana CI Signing Key" (used by e.g. bookstack-chart) is
Ed25519 and was tried here first — it does not work for this purpose. It may still
be perfectly valid for other things (signing an actual apt repository via
aptly.gpg.signingKey, which is a completely different code path that does support
Ed25519 — see docs/packaging.md — just not for
helm package --sign. This repo therefore needs its own, separate, RSA key
dedicated to chart-package signing.
Generating it
Run this yourself (locally, not in CI) so the private key material never has to pass through anything but your own machine and the Gitea secrets store:
gpg --full-generate-key
# RSA and RSA (default)
# 4096 bit
# key does not expire (or a long expiry — a CI signing key you'd have to rotate
# on a schedule is more operational overhead than it's worth here)
# Name: Aptly Chart Signing Key
# Email: something you control, e.g. contact+development@morlana.net
gpg --list-secret-keys --with-colons | awk -F: '$1=="sec"{print $5}' # -> the key ID
gpg --armor --export <key-id> > pubkeys/chart-signing.asc
gpg --armor --export-secret-keys <key-id> # -> paste as GPG_PRIVATE_KEY
Then, in the repo's Gitea settings:
- Secret
GPG_PRIVATE_KEY— the armored output of the last command above - Secret
GPG_PASSPHRASE— whatever passphrase you set (empty string if none) - Secret
GPG_KEY_ID— the key ID or fingerprint fromgpg --list-secret-keys
Commit pubkeys/chart-signing.asc, then uncomment the artifacthub.io/signKey
block in charts/aptly/Chart.yaml with the real fingerprint, and uncomment
pubkeys/chart-signing.asc in release-chart.yaml's release-assets step.
Verifying a downloaded chart (once the key exists)
gpg --import pubkeys/chart-signing.asc
gpg --export > /tmp/pubring.gpg # legacy binary format — helm can't read pubring.kbx
helm verify aptly-<version>.tgz --keyring /tmp/pubring.gpg