Repository: cargo-prebuilt/cargo-prebuilt (language: rust)

Issue:
Signed releases using minisign instead of doing hashes



Discussion / hints:

Fix patch:
diff --git a/.gitattributes b/.gitattributes
index d8ef330..c7617e2 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,5 +1,7 @@
 * text=auto
 
+# Because of caching in GitHub Actions
+Cargo.lock text eol=lf
+
 # Because of it being signed.
 test/pubdata.test text eol=lf
-test/pubdata.test.sig binary
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7322402..05dc4c8 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -181,7 +181,7 @@ jobs:
       - name: Artifact
         uses: actions/upload-artifact@v3
         with:
-          name: ${{ matrix.target }}
+          name: target-${{ matrix.target }}
           path: |
             target/${{ matrix.target }}/debug/${{ env.bin-name }}${{ matrix.ending }}
 
@@ -236,7 +236,7 @@ jobs:
       - name: Artifact
         uses: actions/upload-artifact@v3
         with:
-          name: ${{ matrix.target }}
+          name: target-${{ matrix.target }}
           path: |
             target/${{ matrix.target }}/debug/${{ env.bin-name }}
 
@@ -253,13 +253,6 @@ jobs:
     needs: [ setup ]
     steps:
       - uses: actions/checkout@v3
-      - name: Change file endings in Cargo.lock
-        shell: bash
-        run: |
-          ex Cargo.lock <<EOF
-          :set fileformat=unix
-          :wq
-          EOF
       - name: Get deps from cache
         uses: actions/cache@v3
         with:
@@ -297,6 +290,6 @@ jobs:
       - name: Artifact
         uses: actions/upload-artifact@v3
         with:
-          name: ${{ matrix.target }}
+          name: target-${{ matrix.target }}
           path: |
             target/${{ matrix.target }}/debug/${{ env.bin-name }}.exe
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a136e1d..d0e0b53 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -62,6 +62,24 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - uses: actions/download-artifact@v3
+      - name: Sign archives
+        shell: bash
+        run: |
+          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+          brew install minisign
+          echo -n "$SIGNING_KEY" | base64 --decode > ~/.minisign_secret.key
+          for D in target-*; do
+            if [ -d "${D}" ]; then
+                echo "${D}"
+                pushd "${D}"
+                minisign -S -s ~/.minisign_secret.key -m *.*
+                minisign -V -p ../keys/cargo-prebuilt.pub -m *.*
+                popd
+            fi
+          done
+          rm -f ~/.minisign_secret.key
+        env:
+          SIGNING_KEY: ${{ secrets.MINISIGN_SIGNING_KEY }}
       - name: Create and push artifacts to release
         uses: ncipollo/release-action@v1
         with:
@@ -69,7 +87,7 @@ jobs:
           name: ${{ needs.release.outputs.name }}
           allowUpdates: true
           prerelease: ${{ needs.release.outputs.prerelease }}
-          artifacts: "target-*/*.tar.gz,target-*/*.zip,target-*/*.sha256"
+          artifacts: "target-*/*.minisig,target-*/*.tar.gz,target-*/*.zip"
           body: ""
 
   check-fmt:
@@ -411,7 +429,7 @@ jobs:
         run: rustc --version
       - uses: cargo-prebuilt/cargo-prebuilt-action@v1
         with:
-          tools: cross,coreutils
+          tools: cross
       - name: Run tests
         if: ${{ matrix.can-test }}
         run: cross test --verbose --workspace --release --locked --target ${{ matrix.target }} ${{ env.feature-set }}
@@ -424,15 +442,12 @@ jobs:
           just --version
       - name: Tar
         run: tar czvf ${{ matrix.target }}.tar.gz -C ./target/${{ matrix.target }}/release ${{ env.bin-name }}${{ matrix.ending }}
-      - name: Hash
-        run: echo "$(coreutils sha256sum ${{ matrix.target }}.tar.gz)" > ${{ matrix.target }}.sha256
       - name: Artifact
         uses: actions/upload-artifact@v3
         with:
           name: target-${{ matrix.target }}
           path: |
             ${{ matrix.target }}.tar.gz
-            ${{ matrix.target }}.sha256
 
   apple-darwin:
     strategy:
@@ -465,7 +480,7 @@ jobs:
         run: rustup target add ${{ matrix.target }}
       - uses: cargo-prebuilt/cargo-prebuilt-action@v1
         with:
-          tools: cargo-auditable,coreutils
+          tools: cargo-auditable
       - name: Run tests
         if: ${{ matrix.can-test }}
         run: cargo test --verbose --workspace --release --locked --target ${{ matrix.target }} ${{ env.feature-set }}
@@ -478,15 +493,12 @@ jobs:
           just --version
       - name: Tar
         run: tar czvf ${{ matrix.target }}.tar.gz -C ./target/${{ matrix.target }}/release ${{ env.bin-name }}
-      - name: Hash
-        run: echo "$(coreutils sha256sum ${{ matrix.target }}.tar.gz)" > ${{ matrix.target }}.sha256
       - name: Artifact
         uses: actions/upload-artifact@v3
         with:
           name: target-${{ matrix.target }}
           path: |
             ${{ matrix.target }}.tar.gz
-            ${{ matrix.target }}.sha256
 
   pc-windows-msvc:
     strategy:
@@ -501,13 +513,6 @@ jobs:
     needs: [ setup, check-fmt, clippy, cargo-hack, cargo-msrv ]
     steps:
       - uses: actions/checkout@v3
-      - name: Change file endings in Cargo.lock
-        shell: bash
-        run: |
-          ex Cargo.lock <<EOF
-          :set fileformat=unix
-          :wq
-          EOF
       - name: Get deps from cache
         uses: actions/cache@v3
         with:
@@ -526,7 +531,7 @@ jobs:
         run: rustup target add ${{ matrix.target }}
       - uses: cargo-prebuilt/cargo-prebuilt-action@v1
         with:
-          tools: cargo-auditable,coreutils
+          tools: cargo-auditable
       - name: Run tests
         if: ${{ matrix.can-test }}
         run: cargo test --verbose --workspace --release --locked --target ${{ matrix.target }} ${{ env.feature-set }}
@@ -542,12 +547,9 @@ jobs:
         with:
           files: ./target/${{ matrix.target }}/release/${{ env.bin-name }}.exe
           dest: ${{ matrix.target }}.zip
-      - name: Hash
-        run: echo "$(coreutils sha256sum ${{ matrix.target }}.zip)" > ${{ matrix.target }}.sha256
       - name: Artifact
         uses: actions/upload-artifact@v3
         with:
           name: target-${{ matrix.target }}
           path: |
             ${{ matrix.target }}.zip
-            ${{ matrix.target }}.sha256
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6699e26..969d3fe 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,7 +25,8 @@
 - Reports can no longer be printed to stdout.
 - Extracted binaries are now checked with a hash.
 - Permissions are now explicitly set to 755 on unix platforms.
-- To opt in or out of colors use the env vars FORCE_COLOR/NO_COLOR;
+- To opt in or out of colors use the env vars FORCE_COLOR/NO_COLOR.
+- Releases are signed using minisign.
 
 ## [0.5.3](https://github.com/cargo-prebuilt/cargo-prebuilt/releases/tag/v0.5.3)
 
diff --git a/keys/cargo-prebuilt.pub b/keys/cargo-prebuilt.pub
new file mode 100644
index 0000000..d32a7e4
--- /dev/null
+++ b/keys/cargo-prebuilt.pub
@@ -0,0 +1,2 @@
+untrusted comment: minisign public key EAEEB71D7504A8D2
+RWTSqAR1Hbfu6mBFiaz4hb9I9gikhMmvKkVbyz4SJF/oxJcbbScmCqqO
\ No newline at end of file
diff --git a/keys/cargo-prebuilt.pub.base64 b/keys/cargo-prebuilt.pub.base64
new file mode 100644
index 0000000..65697d4
--- /dev/null
+++ b/keys/cargo-prebuilt.pub.base64
@@ -0,0 +1,1 @@
+dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXkgRUFFRUI3MUQ3NTA0QThEMgpSV1RTcUFSMUhiZnU2bUJGaWF6NGhiOUk5Z2lraE1tdktrVmJ5ejRTSkYvb3hKY2JiU2NtQ3FxTwo=
\ No newline at end of file


Test patch: