Public Access
f.weber
103ad311b7
Provides a self-contained, containerized aptly (Debian repo manager) stack with independently releasable image and Helm chart versions. - images/: aptly-server (aptly built from source, cross-compiled) and aptly-deb-builder (nfpm + dpkg-buildpackage) container images - rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack scripts consumed identically by Compose and the Helm chart, driven by one declarative state.yaml contract - compose/: test (ephemeral, open) and production docker-compose stacks with an nginx read/auth sidecar - charts/aptly/: aptly-native Helm chart covering every security posture from fully open to authenticated read+write, Ingress and Gateway API support (usable in parallel for migration scenarios), metrics, and declarative repo/mirror/publish reconciliation via a Helm hook - .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test) plus separately tagged image (image/v*) and chart (chart/v*) releases, weekly rebuilds, and a preflight workflow validating the runner's Docker/Helm-OCI capabilities - pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's signKey annotation (Helm can't verify Ed25519 keys) - docs/, README.md, charts/aptly/README.md: usage, security, and versioning documentation
63 lines
3.0 KiB
Markdown
63 lines
3.0 KiB
Markdown
# Public keys
|
|
|
|
## Chart signing key (needed, not yet set up)
|
|
|
|
`.gitea/workflows/release-chart.yaml` runs `helm package --sign` to produce a
|
|
`.tgz.prov` file for every chart release, and `charts/aptly/Chart.yaml` is meant to
|
|
carry an `artifacthub.io/signKey` annotation pointing at the public half of that
|
|
key (both are currently commented out / referencing a placeholder — see below).
|
|
|
|
**This key must NOT be Ed25519/EdDSA.** Helm's chart signing is built on the
|
|
deprecated `golang.org/x/crypto/openpgp` library, which cannot read Ed25519 keys at
|
|
all — signing fails with `Error: private key not found` (or, depending on gpg
|
|
version, `openpgp: unsupported feature: public key type: 22`). This is a
|
|
long-standing, unresolved upstream limitation (helm/helm#11634, #31180, #31181), not
|
|
a configuration mistake — confirmed by reproducing it locally against a throwaway
|
|
Ed25519 test key before writing this note. Use **RSA** (4096-bit, no expiry is
|
|
fine for a CI signing key) or a classic ECC curve helm's openpgp fork supports;
|
|
RSA is the safest choice since it's unambiguously supported.
|
|
|
|
The org's existing "Morlana CI Signing Key" (used by e.g. `bookstack-chart`) is
|
|
Ed25519 and was tried here first — it does not work for this purpose. It may still
|
|
be perfectly valid for other things (signing an actual apt repository via
|
|
`aptly.gpg.signingKey`, which is a completely different code path that does support
|
|
Ed25519 — see [docs/packaging.md](../docs/packaging.md#gpg) — just not for
|
|
`helm package --sign`. This repo therefore needs its own, separate, RSA key
|
|
dedicated to chart-package signing.
|
|
|
|
### Generating it
|
|
|
|
Run this yourself (locally, not in CI) so the private key material never has to
|
|
pass through anything but your own machine and the Gitea secrets store:
|
|
|
|
```bash
|
|
gpg --full-generate-key
|
|
# RSA and RSA (default)
|
|
# 4096 bit
|
|
# key does not expire (or a long expiry — a CI signing key you'd have to rotate
|
|
# on a schedule is more operational overhead than it's worth here)
|
|
# Name: Aptly Chart Signing Key
|
|
# Email: something you control, e.g. contact+development@morlana.net
|
|
|
|
gpg --list-secret-keys --with-colons | awk -F: '$1=="sec"{print $5}' # -> the key ID
|
|
gpg --armor --export <key-id> > pubkeys/chart-signing.asc
|
|
gpg --armor --export-secret-keys <key-id> # -> paste as GPG_PRIVATE_KEY
|
|
```
|
|
|
|
Then, in the repo's Gitea settings:
|
|
- Secret **`GPG_PRIVATE_KEY`** — the armored output of the last command above
|
|
- Secret **`GPG_PASSPHRASE`** — whatever passphrase you set (empty string if none)
|
|
- Secret **`GPG_KEY_ID`** — the key ID or fingerprint from `gpg --list-secret-keys`
|
|
|
|
Commit `pubkeys/chart-signing.asc`, then uncomment the `artifacthub.io/signKey`
|
|
block in `charts/aptly/Chart.yaml` with the real fingerprint, and uncomment
|
|
`pubkeys/chart-signing.asc` in `release-chart.yaml`'s release-assets step.
|
|
|
|
### Verifying a downloaded chart (once the key exists)
|
|
|
|
```bash
|
|
gpg --import pubkeys/chart-signing.asc
|
|
gpg --export > /tmp/pubring.gpg # legacy binary format — helm can't read pubring.kbx
|
|
helm verify aptly-<version>.tgz --keyring /tmp/pubring.gpg
|
|
```
|