fix: add package signing - #28
Conversation
|
Warning Review limit reached
Next review available in: 52 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe release configuration now supports GPG-signed RPM artifacts. Snapshot and tagged workflows decode signing keys, pass signing credentials to GoReleaser, verify RPM signatures in Fedora 41, and clean up temporary key files. ChangesRPM signing and release validation
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant ReleaseWorkflow
participant GoReleaser
participant FedoraContainer
ReleaseWorkflow->>GoReleaser: provide GPG_RPM_KEY_FILE and NFPM_PASSPHRASE
GoReleaser->>ReleaseWorkflow: produce signed RPMs
ReleaseWorkflow->>FedoraContainer: run rpm -K on produced RPMs
FedoraContainer->>ReleaseWorkflow: return verification results
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.goreleaser.yml (1)
150-159: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winEnable GoReleaser Pro for SRPMs
srpm:is Pro-only, so the OSSdistribution: goreleaserrelease job won’t produce these packages until it runs with the Pro license/distribution.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.goreleaser.yml around lines 150 - 159, Update the GoReleaser configuration around the srpm section so SRPM packaging runs through a GoReleaser Pro-enabled distribution or release job. Ensure the job uses the Pro license/distribution while preserving the existing SRPM package name, spec_file, import_path, and signing configuration.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 393-423: Ensure RPM signature verification fails when no .rpm
files are present, rather than exiting successfully with status 0. Update both
duplicated “Verify RPM signatures” flows, preferably by extracting the logic
into a shared scripts/verify-rpm-signatures.sh invoked by each job; track
whether at least one RPM was checked and set a nonzero exit status when none are
found, while preserving existing invalid-signature failures.
---
Outside diff comments:
In @.goreleaser.yml:
- Around line 150-159: Update the GoReleaser configuration around the srpm
section so SRPM packaging runs through a GoReleaser Pro-enabled distribution or
release job. Ensure the job uses the Pro license/distribution while preserving
the existing SRPM package name, spec_file, import_path, and signing
configuration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 912270d4-76dd-4975-a278-8a98fb46345f
📒 Files selected for processing (2)
.github/workflows/release.yml.goreleaser.yml
The SRPM is only attached to the GitHub release and never published to the yum repository, so it does not need a signature for gpgcheck. Drop its signing config and skip src.rpm files in the verification step.
The inline verify loop exited 0 when dist/ contained no RPMs at all: an unmatched glob stays literal, fails the -f test, and the loop body never runs, so an empty dist "passed" while verifying nothing. Extract the duplicated snapshot/release step into scripts/verify-rpm-signatures.sh and fail unless at least one binary RPM was checked.
447ff15 to
ee7d8ed
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/verify-rpm-signatures.sh`:
- Line 17: Update scripts/verify-rpm-signatures.sh to validate the downloaded
RPM signing key against a pinned fingerprint or digest before invoking rpm
--import. Apply the check to the key source selected by RPM_PUBLIC_KEY_URL,
reject mismatches, and preserve the existing import flow only for the verified
key.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 919745f9-da3d-4730-9cee-5da7de06e448
📒 Files selected for processing (2)
.github/workflows/release.ymlscripts/verify-rpm-signatures.sh
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/release.yml
| repo_root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd) | ||
| dist_dir=${1:-$repo_root/dist} | ||
| fedora_image=${FEDORA_IMAGE:-fedora:41} | ||
| key_url=${RPM_PUBLIC_KEY_URL:-https://pkgs.netbird.io/yum/repodata/repomd.xml.key} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
git ls-files scripts/verify-rpm-signatures.sh
wc -l scripts/verify-rpm-signatures.sh
cat -n scripts/verify-rpm-signatures.sh | sed -n '1,120p'Repository: netbirdio/network-manager-vpn-plugin
Length of output: 2994
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n --hidden --no-heading -S 'RPM_PUBLIC_KEY_URL|repomd\.xml\.key|rpm --import|gpg|fingerprint|sha256|signing key|NetBird yum repository key' .Repository: netbirdio/network-manager-vpn-plugin
Length of output: 1727
Pin the RPM signing key identity before import. RPM_PUBLIC_KEY_URL is trusted as-is, so a bad redirect or compromised endpoint can make forged RPMs pass this gate. Validate a pinned fingerprint or digest before rpm --import.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/verify-rpm-signatures.sh` at line 17, Update
scripts/verify-rpm-signatures.sh to validate the downloaded RPM signing key
against a pinned fingerprint or digest before invoking rpm --import. Apply the
check to the key source selected by RPM_PUBLIC_KEY_URL, reject mismatches, and
preserve the existing import flow only for the verified key.
1 participant
Description
Added signing for packages on fedora and debian registries
Fixes #27
Need help on this PR? Tag
/codesmithwith what you need. Autofix is disabled.Summary by CodeRabbit
Summary by CodeRabbit
New Features
Bug Fixes