From 0744f56ec09baa07013824935ca51ee249f8c851 Mon Sep 17 00:00:00 2001 From: slayerjain Date: Mon, 9 Nov 2026 19:47:05 +0530 Subject: [PATCH] ci: sign releases with the new release key, and check secrets first The release key 8541784E4EC36FB8 could not sign in GitHub Actions: its private half was only in the retired Woodpecker pipeline's secrets, so v2.1.2's "Build, sign and publish to Maven Central" failed with "No secret key" and never published. Releases are now signed with a new key, F844278E3B5F9051 (fingerprint 0167FEA3204A35D8C1E11EE9F844278E3B5F9051), held in MAVEN_GPG_PRIVATE_KEY and MAVEN_GPG_PASSPHRASE and published on keyserver.ubuntu.com, where Central checks signatures. release.yml now fails before anything is built or signed, naming each release secret that is missing, as keploy-junit5-release.yml already did. SECURITY.md lists the fingerprints of both keys and how to check a file. Signed-off-by: slayerjain --- .github/workflows/keploy-junit5-release.yml | 5 +++-- .github/workflows/release.yml | 24 ++++++++++++++++++++- SECURITY.md | 19 +++++++++++++++- 3 files changed, 44 insertions(+), 4 deletions(-) diff --git a/.github/workflows/keploy-junit5-release.yml b/.github/workflows/keploy-junit5-release.yml index 168fdf85..9feaa5ea 100644 --- a/.github/workflows/keploy-junit5-release.yml +++ b/.github/workflows/keploy-junit5-release.yml @@ -15,7 +15,8 @@ name: keploy-junit5 release # modules, and never this one. This workflow signs and deploys with the same # key and the same secret names as release.yml: CENTRAL_USERNAME and # CENTRAL_PASSWORD (a Central Portal user token for the io.keploy namespace), -# MAVEN_GPG_PRIVATE_KEY (the ASCII-armored release key, id 8541784E4EC36FB8) +# MAVEN_GPG_PRIVATE_KEY (the ASCII-armored release key, id F844278E3B5F9051, +# fingerprint 0167FEA3204A35D8C1E11EE9F844278E3B5F9051) # and MAVEN_GPG_PASSPHRASE. A step below fails, naming each one that is not # set, before anything is built or signed. # Every action this workflow runs, the rows' included, is pinned by commit: @@ -56,7 +57,7 @@ jobs: timeout-minutes: 150 env: # The public key id of keploy's release signing key, as release.yml. - GPG_KEY_ID: 8541784E4EC36FB8 + GPG_KEY_ID: F844278E3B5F9051 defaults: run: shell: bash # -eo pipefail: a failed command before a pipe fails the step diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 082930a6..6cfb1be8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -50,7 +50,7 @@ jobs: env: # Public key id of the Keploy release signing key. Selects the right # secret key when more than one is present in the keyring. - GPG_KEY_ID: 8541784E4EC36FB8 + GPG_KEY_ID: F844278E3B5F9051 steps: - name: Checkout uses: actions/checkout@v4 @@ -84,6 +84,28 @@ jobs: fi echo "version=${version}" >> "$GITHUB_OUTPUT" + - name: Check the release secrets are set + # Fail before anything is built or signed, naming each secret that is + # missing (as keploy-junit5-release.yml does). Without it a missing + # private key surfaced only as maven-gpg-plugin's "No secret key" + # (setup-java skips the import when the secret is empty), and a + # missing passphrase as gpg's "No passphrase given". + env: + CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }} + CENTRAL_PASSWORD: ${{ secrets.CENTRAL_PASSWORD }} + MAVEN_GPG_PRIVATE_KEY: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} + MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }} + shell: bash + run: | + missing=() + for s in CENTRAL_USERNAME CENTRAL_PASSWORD MAVEN_GPG_PRIVATE_KEY MAVEN_GPG_PASSPHRASE; do + [[ -n "${!s}" ]] || missing+=("$s") + done + if (( ${#missing[@]} )); then + echo "::error::the secret(s) ${missing[*]} are not set; refusing to publish" + exit 1 + fi + - name: Set up JDK 17 uses: actions/setup-java@v4 with: diff --git a/SECURITY.md b/SECURITY.md index 3eafe680..3af23ccd 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -6,4 +6,21 @@ We value security for the project very highly. We encourage all users to report If you find a security vulnerability in the Keploy project, please report it responsibly by sending an email to hello@keploy.io At this juncture, we don't have a bug bounty program. We are a small team trying to solve a big problem. We urge you to report any vulnerabilities responsibly -so that we can continue building a secure application for the entire community. \ No newline at end of file +so that we can continue building a secure application for the entire community. + +## Verifying releases + +Every artifact on Maven Central (`io.keploy`) and every `.asc` file on a +GitHub Release is signed by the Keploy release key: + +- Releases from v2.1.3 on: key id `F844278E3B5F9051`, fingerprint + `0167 FEA3 204A 35D8 C1E1 1EE9 F844 278E 3B5F 9051`. +- Releases up to v2.1.1: key id `8541784E4EC36FB8`, fingerprint + `D51E 37C1 E5D2 F092 72E3 8869 8541 784E 4EC3 6FB8`. + +Fetch the key from keyserver.ubuntu.com and check a file: + +```sh +gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 0167FEA3204A35D8C1E11EE9F844278E3B5F9051 +gpg --verify keploy-sdk-.jar.asc keploy-sdk-.jar +```