chore: verify WAR signature when downloading it

[lemeurherve]

This change uses the GPG signature files now served from both pkg.jenkins.io and get.jenkins.io, and the new Jenkins PGP public key from 2026 (stored in this repository¹) to verify Jenkins WAR signature on build.

Ref:

• Verify WAR signature when downloading it #2203

Testing done

$ make test

Submitter checklist

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Link to relevant issues in GitHub or Jira
• Link to relevant pull requests, esp. upstream and downstream changes
• Ensure you have provided tests that demonstrate the feature works or the issue is fixed

Footnotes

1. As that GPG public key is valid for 3 years and as builds will fail if expired, manually updating it when it arrives could be enough. ↩

[dduportal]

(nit) As per https://docs.docker.com/reference/dockerfile/#adding-files-from-a-url

If the HTTP response contains a Last-Modified header, the timestamp from that header will be used to set the mtime on the destination file. However, like any other file processed during an ADD, mtime isn't included in the determination of whether or not the file has changed and the cache should be updated.

=> we can totally delegate the file download to the Docker Engine with something like

Suggested change

	# Not using ADD as it does not check Last-Modified header
	# see https://github.com/docker/docker/issues/8331
	RUN curl -fsSL "${WAR_URL}" -o /war/jenkins.war \
	&& curl -fsSL "${WAR_URL}.asc" -o /war/jenkins.war.asc \
	# Not using ADD as it does not check Last-Modified header
	# see https://github.com/docker/docker/issues/8331
	ADD "${WAR_URL}" /war/jenkins.war
	ADD "${WAR_URL}.asc" /war/jenkins.war.asc

[lemeurherve]

Nice!

I suggest doing this change for all downloads in all images in another pull request.

[dduportal]

Nice!

I suggest doing this change for all downloads in all images in another pull request.

Yup, totally agreed \o/

[dduportal]

🚀