Skip to content

Commit e145561

Browse files
Dax89Dax89
committed
feat: version naming scheme, unit test releases, signatures
1 parent eba35fc commit e145561

3 files changed

Lines changed: 80 additions & 20 deletions

File tree

‎.github/workflows/nightly.yml‎

Lines changed: 25 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -50,19 +50,34 @@ jobs:
5050
name: REDasm-windows-x86_64
5151
path: redasm-windows-x86_64/
5252

53+
- name: Rename AppImage
54+
run: mv REDasm-linux-x86_64.AppImage REDasm-nightly-linux-x86_64.AppImage
55+
5356
- name: Package Windows
54-
run: zip -r REDasm-windows-x86_64.zip redasm-windows-x86_64/
57+
run: zip -r REDasm-nightly-windows-x86_64.zip redasm-windows-x86_64/
5558

56-
- name: Sign artifacts
59+
- name: Checksum artifacts
60+
run: |
61+
sha256sum REDasm-nightly-linux-x86_64.AppImage > REDasm-nightly-linux-x86_64.AppImage.sha256
62+
sha256sum REDasm-nightly-windows-x86_64.zip > REDasm-nightly-windows-x86_64.zip.sha256
63+
64+
- name: Sign checksums
5765
env:
5866
GPG_PRIVATE_KEY: ${{ secrets.RD_NIGHTLY_GPG_PRIVATE_KEY }}
5967
GPG_PASSPHRASE: ${{ secrets.RD_NIGHTLY_GPG_PASSPHRASE }}
6068
run: |
6169
echo "$GPG_PRIVATE_KEY" | gpg --batch --import
6270
echo "$GPG_PASSPHRASE" | gpg --batch --pinentry-mode loopback \
63-
--passphrase-fd 0 --detach-sign --armor REDasm-linux-x86_64.AppImage
71+
--passphrase-fd 0 --detach-sign --armor REDasm-nightly-linux-x86_64.AppImage.sha256
6472
echo "$GPG_PASSPHRASE" | gpg --batch --pinentry-mode loopback \
65-
--passphrase-fd 0 --detach-sign --armor REDasm-windows-x86_64.zip
73+
--passphrase-fd 0 --detach-sign --armor REDasm-nightly-windows-x86_64.zip.sha256
74+
75+
- name: Verify signatures and checksums
76+
run: |
77+
gpg --verify REDasm-nightly-linux-x86_64.AppImage.sha256.asc REDasm-nightly-linux-x86_64.AppImage.sha256
78+
gpg --verify REDasm-nightly-windows-x86_64.zip.sha256.asc REDasm-nightly-windows-x86_64.zip.sha256
79+
sha256sum -c REDasm-nightly-linux-x86_64.AppImage.sha256
80+
sha256sum -c REDasm-nightly-windows-x86_64.zip.sha256
6681
6782
- name: Get current date
6883
id: date
@@ -78,7 +93,9 @@ jobs:
7893
prerelease: true
7994
body: ${{ needs.check.outputs.changelog }}
8095
files: |
81-
REDasm-linux-x86_64.AppImage
82-
REDasm-linux-x86_64.AppImage.asc
83-
REDasm-windows-x86_64.zip
84-
REDasm-windows-x86_64.zip.asc
96+
REDasm-nightly-linux-x86_64.AppImage
97+
REDasm-nightly-linux-x86_64.AppImage.sha256
98+
REDasm-nightly-linux-x86_64.AppImage.sha256.asc
99+
REDasm-nightly-windows-x86_64.zip
100+
REDasm-nightly-windows-x86_64.zip.sha256
101+
REDasm-nightly-windows-x86_64.zip.sha256.asc

‎.github/workflows/release.yml‎

Lines changed: 44 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -13,15 +13,19 @@ jobs:
1313
uses: ./.github/workflows/build-linux.yml
1414
with:
1515
version: ${{ github.event.client_payload.tag }}
16+
run_tests: true
1617

1718
build-windows:
1819
uses: ./.github/workflows/build-windows.yml
1920
with:
2021
version: ${{ github.event.client_payload.tag }}
22+
run_tests: true
2123

2224
publish:
2325
needs: [ build-linux, build-windows ]
2426
runs-on: ubuntu-latest
27+
env:
28+
TAG: ${{ github.event.client_payload.tag }}
2529

2630
steps:
2731
- name: Download Linux artifact
@@ -35,19 +39,48 @@ jobs:
3539
name: REDasm-windows-x86_64
3640
path: redasm-windows-x86_64/
3741

42+
- name: Rename AppImage
43+
env:
44+
VERSION: ${{ steps.version.outputs.version }}
45+
run: mv REDasm-linux-x86_64.AppImage "REDasm-${VERSION}-linux-x86_64.AppImage"
46+
3847
- name: Package Windows
39-
run: zip -r REDasm-windows-x86_64.zip redasm-windows-x86_64/
48+
env:
49+
VERSION: ${{ steps.version.outputs.version }}
50+
run: zip -r "REDasm-${VERSION}-windows-x86_64.zip" redasm-windows-x86_64/
51+
52+
- name: Checksum artifacts
53+
env:
54+
VERSION: ${{ steps.version.outputs.version }}
55+
run: |
56+
sha256sum "REDasm-${VERSION}-linux-x86_64.AppImage" > "REDasm-${VERSION}-linux-x86_64.AppImage.sha256"
57+
sha256sum "REDasm-${VERSION}-windows-x86_64.zip" > "REDasm-${VERSION}-windows-x86_64.zip.sha256"
4058
41-
- name: Sign artifacts
59+
- name: Sign checksums
4260
env:
61+
VERSION: ${{ steps.version.outputs.version }}
4362
GPG_PRIVATE_KEY: ${{ secrets.RD_GPG_PRIVATE_KEY }}
4463
GPG_PASSPHRASE: ${{ secrets.RD_GPG_PASSPHRASE }}
4564
run: |
4665
echo "$GPG_PRIVATE_KEY" | gpg --batch --import
4766
echo "$GPG_PASSPHRASE" | gpg --batch --pinentry-mode loopback \
48-
--passphrase-fd 0 --detach-sign --armor REDasm-linux-x86_64.AppImage
67+
--passphrase-fd 0 --detach-sign --armor "REDasm-${VERSION}-linux-x86_64.AppImage.sha256"
4968
echo "$GPG_PASSPHRASE" | gpg --batch --pinentry-mode loopback \
50-
--passphrase-fd 0 --detach-sign --armor REDasm-windows-x86_64.zip
69+
--passphrase-fd 0 --detach-sign --armor "REDasm-${VERSION}-windows-x86_64.zip.sha256"
70+
71+
- name: Verify signatures and checksums
72+
env:
73+
VERSION: ${{ steps.version.outputs.version }}
74+
run: |
75+
gpg --verify "REDasm-${VERSION}-linux-x86_64.AppImage.sha256.asc" "REDasm-${VERSION}-linux-x86_64.AppImage.sha256"
76+
gpg --verify "REDasm-${VERSION}-windows-x86_64.zip.sha256.asc" "REDasm-${VERSION}-windows-x86_64.zip.sha256"
77+
sha256sum -c "REDasm-${VERSION}-linux-x86_64.AppImage.sha256"
78+
sha256sum -c "REDasm-${VERSION}-windows-x86_64.zip.sha256"
79+
80+
- name: Verify signatures
81+
run: |
82+
gpg --verify "REDasm-linux-x86_64-${{ github.event.client_payload.tag }}.AppImage.asc" "REDasm-linux-x86_64-${{ github.event.client_payload.tag }}.AppImage"
83+
gpg --verify "REDasm-windows-x86_64-${{ github.event.client_payload.tag }}.zip.asc" "REDasm-windows-x86_64-${{ github.event.client_payload.tag }}.zip"
5184
5285
- name: Publish release
5386
uses: softprops/action-gh-release@v3
@@ -59,7 +92,10 @@ jobs:
5992
prerelease: false
6093
draft: true
6194
files: |
62-
REDasm-linux-x86_64.AppImage
63-
REDasm-linux-x86_64.AppImage.asc
64-
REDasm-windows-x86_64.zip
65-
REDasm-windows-x86_64.zip.asc
95+
REDasm-${{ steps.version.outputs.version }}-linux-x86_64.AppImage
96+
REDasm-${{ steps.version.outputs.version }}-linux-x86_64.AppImage.sha256
97+
REDasm-${{ steps.version.outputs.version }}-linux-x86_64.AppImage.sha256.asc
98+
REDasm-${{ steps.version.outputs.version }}-windows-x86_64.zip
99+
REDasm-${{ steps.version.outputs.version }}-windows-x86_64.zip.sha256
100+
REDasm-${{ steps.version.outputs.version }}-windows-x86_64.zip.sha256.asc
101+

‎README.md‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,7 @@ The resulting `REDasm-x86_64.AppImage` will be in the current directory.
152152

153153
## Verifying Release Signatures
154154

155-
All release artifacts are GPG signed. Import the appropriate public key to verify:
155+
All nightly and release's checksums are GPG signed, import the appropriate public key to verify:
156156

157157
```sh
158158
# Stable releases
@@ -162,12 +162,19 @@ gpg --keyserver keys.openpgp.org --recv-keys B0C728D7021EEEE9D9B859043AF46EB2201
162162
gpg --keyserver keys.openpgp.org --recv-keys A2391AFACAE2EE52B35541DD65F948A2F6BB294A
163163
```
164164

165-
Verify a downloaded artifact:
165+
Each artifact ships with a `.sha256` checksum file and a `.sha256.asc` signature of that checksum file.
166+
Verify in two steps: first the signature, then the checksum:
166167

167168
```sh
168-
gpg --verify REDasm-linux-x86_64.AppImage.asc REDasm-linux-x86_64.AppImage
169-
gpg --verify REDasm-windows-x86_64.zip.asc REDasm-windows-x86_64.zip
169+
# 1. Verify the checksum file itself is authentic
170+
gpg --verify REDasm-4.0.1-linux-x86_64.AppImage.sha256.asc REDasm-4.0.1-linux-x86_64.AppImage.sha256
171+
gpg --verify REDasm-4.0.1-windows-x86_64.zip.sha256.asc REDasm-4.0.1-windows-x86_64.zip.sha256
172+
173+
# 2. Verify the downloaded artifact matches that checksum
174+
sha256sum -c REDasm-4.0.1-linux-x86_64.AppImage.sha256
175+
sha256sum -c REDasm-4.0.1-windows-x86_64.zip.sha256
170176
```
177+
For nightly builds, filenames use `nightly` in place of the version.
171178

172179
Key fingerprints:
173180

0 commit comments

Comments
 (0)