separated steps for cent os 10 for different encryption

Author: ahegdeNR

.github/workflows/pull_request.yml

@@ -13,6 +13,7 @@ env:
   GPG_MAIL: ${{ secrets.LOGGING_GPG_MAIL }}
   GPG_PASSPHRASE: ${{ secrets.OHAI_GPG_PASSPHRASE }}
   GPG_PRIVATE_KEY_BASE64: ${{ secrets.OHAI_GPG_PRIVATE_KEY_BASE64 }} # base64 encoded
+  GPG_PRIVATE_KEY_SHA256_BASE64: ${{ secrets.OHAI_GPG_PRIVATE_KEY_SHA256_BASE64}}  # base64 encoded SHA256 encrypted
 
 jobs:
   # Empties the GH pre-release
@@ -108,12 +109,19 @@ jobs:
           fi
 
       - name: Download, rename and resign Linux package
-        if: ${{ steps.download_package_from_nr.outputs.result == 'failure' && matrix.osDistro != 'windows-server' }}
+        if: ${{ steps.download_package_from_nr.outputs.result == 'failure' && matrix.osDistro != 'windows-server' && !(matrix.osDistro == 'centos' && matrix.osVersion == '10') }}
         run: |
           curl ${{ matrix.packageUrl }} -o packages/${{ matrix.targetPackageName }}
           sudo apt-get install -y debsigs
           bash ./scripts/sign.sh
 
+      - name: Download, rename and resign Cent OS version 10 package # requires SHA 256 signing
+        if: ${{ steps.download_package_from_nr.outputs.result == 'failure' && matrix.osDistro == 'centos' && matrix.osVersion == '10' }}
+        run: |
+          curl ${{ matrix.packageUrl }} -o packages/${{ matrix.targetPackageName }}
+          sudo apt-get install -y debsigs
+          bash ./scripts/sign_centos_10.sh
+
       - name: Download and re-zip Windows package
         if: ${{ steps.download_package_from_nr.outputs.result == 'failure' && matrix.osDistro == 'windows-server' }}
         run: |

scripts/sign_centos_10.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env sh
+set -e
+#
+#
+#
+# Sign RPM's & DEB's in /packages to GH Release Assets
+#
+#
+#
+
+# Sign RPM's
+echo "===> Create .rpmmacros to sign rpm"
+echo "%_gpg_name ${GPG_MAIL}" >> ~/.rpmmacros
+echo "%_signature gpg" >> ~/.rpmmacros
+echo "%_gpg_path /home/runner/.gnupg" >> ~/.rpmmacros
+echo "%_gpgbin /usr/bin/gpg" >> ~/.rpmmacros
+echo "%__gpg_sign_cmd   %{__gpg} gpg --no-verbose --no-armor --batch --pinentry-mode loopback --passphrase ${GPG_PASSPHRASE} --no-secmem-warning -u "%{_gpg_name}" -sbo %{__signature_filename} %{__plaintext_filename}" >> ~/.rpmmacros
+
+echo "===> Importing GPG private key from GHA secrets..."
+printf %s ${GPG_PRIVATE_KEY_SHA256_BASE64} | base64 -d | gpg --batch --import -
+
+echo "===> Importing GPG signature, needed to verify signature"
+gpg --export -a ${GPG_MAIL} > /tmp/RPM-GPG-KEY-${GPG_MAIL}
+rpm --import /tmp/RPM-GPG-KEY-${GPG_MAIL}
+
+cd packages
+
+for rpm_file in $(find -regex ".*\.\(rpm\)");do
+  echo "===> Signing $rpm_file"
+  rpm --addsign $rpm_file
+  echo "===> Sign verification $rpm_file"
+  rpm -v --checksig $rpm_file
+done
+
+# Sign DEB's
+GNUPGHOME="/home/runner/.gnupg"
+echo "${GPG_PASSPHRASE}" > "${GNUPGHOME}/gpg-passphrase"
+echo "passphrase-file ${GNUPGHOME}/gpg-passphrase" >> "$GNUPGHOME/gpg.conf"
+echo 'allow-loopback-pinentry' >> "${GNUPGHOME}/gpg-agent.conf"
+echo 'pinentry-mode loopback' >> "${GNUPGHOME}/gpg.conf"
+echo 'use-agent' >> "${GNUPGHOME}/gpg.conf"
+echo RELOADAGENT | gpg-connect-agent
+
+for deb_file in $(find -regex ".*\.\(deb\)");do
+  echo "===> Signing $deb_file"
+  debsigs --sign=origin --verify --check -v -k ${GPG_MAIL} $deb_file
+done

versions/centos_10.yml

@@ -0,0 +1,7 @@
+osDistro: centos
+osVersion: 10
+packages:
+  - arch: x86_64
+    ami: ami-000a52d5ade2eab02
+  - arch: aarch64
+    ami: ami-005298a5e9fac3bb4