From d3572b5127f7fc44d5557649d617e9b04cad5271 Mon Sep 17 00:00:00 2001
From: Oliver Hamlet <git@ortham.net>
Date: Mon, 5 Jun 2023 17:59:58 +0100
Subject: [PATCH] Sign snapshot build artifacts using GPG

In preparation for not having an "official" hosting location for the
artifacts once my JFrog account is closed, so that the authenticity of
files hosted elsewhere can be verified.

The public key is hosted on the loot.github.io website.
---
 .github/workflows/ci.yml | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9c73fab1..61e7ac0c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -140,11 +140,19 @@ jobs:
           VERSION="${{ steps.get-libloot-version.outputs.version }}"
           echo "filename=libloot-${VERSION}-Linux.tar.xz" >> $GITHUB_OUTPUT
 
+      - name: Import GPG key
+        run: echo -n "${{ secrets.GPG_SIGNING_KEY }}" | gpg --import
+
+      - name: Sign archive
+        run: gpg --output "build/package/${{ steps.build-archive.outputs.filename }}.sig" --detach-sig "build/package/${{ steps.build-archive.outputs.filename }}"
+
       - name: Upload archive
         uses: actions/upload-artifact@v3
         with:
           name: ${{ steps.build-archive.outputs.filename }}
-          path: build/package/${{ steps.build-archive.outputs.filename }}
+          path: |
+            build/package/${{ steps.build-archive.outputs.filename }}
+            build/package/${{ steps.build-archive.outputs.filename }}.sig
         if: github.event_name == 'push'
 
   windows:
@@ -227,9 +235,17 @@ jobs:
 
           echo "filename=libloot-${VERSION}-${PLATFORM}.7z" >> $GITHUB_OUTPUT
 
+      - name: Import GPG key
+        run: echo -n "${{ secrets.GPG_SIGNING_KEY }}" | gpg --import
+
+      - name: Sign archive
+        run: gpg --output "build/package/${{ steps.build-archive.outputs.filename }}.sig" --detach-sig "build/package/${{ steps.build-archive.outputs.filename }}"
+
       - name: Upload archive
         uses: actions/upload-artifact@v3
         with:
           name: ${{ steps.build-archive.outputs.filename }}
-          path: build/package/${{ steps.build-archive.outputs.filename }}
+          path: |
+            build/package/${{ steps.build-archive.outputs.filename }}
+            build/package/${{ steps.build-archive.outputs.filename }}.sig
         if: github.event_name == 'push'