unos-repository

template (1884B)

---

 # Template file for 'unos-keys'
 pkgname=unos-keys
 version=0.1.0
 revision=2
 short_desc="UNOS trust anchors - apk and installer verification keys"
 maintainer="finwo <finwo@pm.me>"
 license="GPL-2.0-only"
 homepage="https://unos.finwo.dev"
 # Key ceremony: private halves live in ~/.unos-keys/ (developer) or on the CI
 # workers under the unos-sign-key feature, and never enter git. Public halves
 # are committed here (public by design):
 # files/apk/* -> /etc/apk/keys/, files/unos/* -> /etc/unos/keys/.
 # Rotation = add the new .pub files and bump revision.
 #
 # EVERY CI worker's public key must be here. Each of the four workers holds a
 # distinct keypair, and mk/build.sh names the signature record after whichever
 # key signed it (.SIGN.RSA.<keyname>.rsa.pub), so the signer is decided by
 # wherever the conductor happened to schedule the build. Ship fewer than all of
 # them and verification fails for an arbitrary, run-to-run-varying subset of
 # packages -- the failure looks like corruption, not like a missing key.
 #
 # Consequences worth knowing before adding a fifth worker:
 #   - publish this package BEFORE that worker builds anything, or existing
 #     installs cannot verify its output;
 #   - any one worker can sign packages every client trusts, so these four are
 #     jointly as trusted as the repo itself. The intended end state is a
 #     release step that re-signs with a single key and merely *accepts* these
 #     as inputs; that does not exist yet.
 #
 # unos-dev@finwo.dev-096b7b41 is the developer key, kept so locally built
 # packages still install. It should be dropped once CI is publishing.
 do_install() {
   for k in "${FILESDIR}"/apk/*; do
     [ -e "${k}" ] || break
     vinstall "${k}" 644 etc/apk/keys "$(basename "${k}")"
   done
   for k in "${FILESDIR}"/unos/*; do
     [ -e "${k}" ] || break
     vinstall "${k}" 644 etc/unos/keys "$(basename "${k}")"
   done
 }