How to use signing with nFPM?

[SSSOCPaulCote]

I'm very new when it comes to software releases and I found nFPM which has made things very easy. The next step in the learning process for me is signing binaries and release packages. I followed this tutorial on how to run my own APT repo and generate my own signing keys.

TL;DR of the tutorial: using gpg, I generated a master key and a subkey for signing from it. Exported the master key to a file and backed that up on a separate machine. Deleted the file and the master key from the keyring, which then deleted all other keys. Imported the signing key.

Now when I write my configuration files for nFPM, I try to export the signing key into a file format as follows:

$ gpg --export --armor XXXXXXXX > key.gpg

This prompts me for my passphrase. In the config under deb, rpm and apk I put this block:

signature:
    key_file: key.gpg
    key_id: XXXXXXXX

When I go to create my .deb, .rpm and .apk packages, I get this:

using deb packager...
signing error: armored detach sign: no signing key in keyring
using rpm packager...
failed to create signatures: call to signer failed: signing error: no signing key in keyring
using apk packager...
signing error: no PEM block found

I've tried exporting the passphrase manually as the NFPM_PASSPHRASE variable and using env NFPM_PASSPHRASE= as a prefix to the nfpm command, no luck. Can someone guide me here?

[caarlos0]

as stated in the docs, the env variable has a different name: https://goreleaser.com/customization/nfpm/

in your case, probably NFPM_DEFAULT_PASSPHRASE, unless you set a different nfpms.id

---

please reply in thread instead of a new one, thank

[SSSOCPaulCote]

When I click Issues, then New Issue on the nfpm github, I am greeted with this menu

And I clicked Ask a question, which brought me to the goreleaser discussion. I assumed nfpm was fair game, my bad.
Thank you for transferring it.

The nfpm docs mention that the ENV variable is either NFPM_RPM_PASSPHRASE with a fallback of NFPM_PASSPHRASE, both of which I have tried. I have not tried the deb and apk equivalents though. I'll give that a shot.

[caarlos0]

oh, my bad then, just fixed that link in fc0fe55

[SSSOCPaulCote]

I tried using NFPM_DEB_PASSPHRASE, NFPM_RPM_PASSPHRASE, NFPM_APK_PASSPHRASE and just NFPM_PASSPHRASE as per docs and I keep getting the same errors.

using deb packager...
signing error: armored detach sign: no signing key in keyring
using rpm packager...
failed to create signatures: call to signer failed: signing error: no signing key in keyring
using apk packager...
signing error: no PEM block found

when I do gpg --list-keys I see the key I'm referencing. I exported the key in this way gpg --export --armor XXXXXXXX > key.gpg

[caarlos0]

it looks there are no keys in the key.gpg file, or the key can't be used for signing... or its just the public key.

nfpm/internal/sign/pgp.go

Line 230 in fc0fe55

return nil, errNoKeys

errNoKeys is the error you are getting... so the password in the env is not the issue it seems.

[SSSOCPaulCote]

Hey I figured it out, you're right I was writing the public key to the file instead of the private key. gpg --export-secret-key --armor XXXXXXXX > key.gpg. Thanks!