Sign Debian packages

Author: qzed

.github/workflows/ci.yml

@@ -89,11 +89,23 @@ jobs:
       run: rustup update stable && rustup default stable
 
     - name: Install dependencies
-      run: sudo apt-get install debhelper fakeroot
+      run: sudo apt-get install debhelper fakeroot dpkg-sig
 
     - name: Build package
       run: ./pkg/deb/makedeb
 
+    - name: Sign package
+      env:
+        GPG_KEY_ID: 56C464BAAC421453
+        GPG_KEY: ${{ secrets.SURFACE_GPG_KEY }}
+      run: |
+        # import GPG key
+        echo "$GPG_KEY" | base64 -d | gpg --import --no-tty --batch --yes
+        export GPG_TTY=$(tty)
+
+        # sign package
+        cd pkg/deb && dpkg-sig -g "--batch --no-tty" --sign builder -k $GPG_KEY_ID ./*.deb
+
     - name: Prepare release
       run: mkdir release && mv pkg/deb/*.deb release