feat: sign coder binaries with the release key using GPG

jdomeracki-coder · jdomeracki-coder · commit 3c01e7d7f33e · 2025-07-07T17:50:05.000+02:00
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -1278,6 +1278,7 @@ jobs:
           # do (see above).
           CODER_SIGN_WINDOWS: "1"
           CODER_WINDOWS_RESOURCES: "1"
+          CODER_SIGN_GPG: "1"
           EV_KEY: ${{ secrets.EV_KEY }}
           EV_KEYSTORE: ${{ secrets.EV_KEYSTORE }}
           EV_TSA_URL: ${{ secrets.EV_TSA_URL }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -323,6 +323,7 @@ jobs:
         env:
           CODER_SIGN_WINDOWS: "1"
           CODER_SIGN_DARWIN: "1"
+          CODER_SIGN_GPG: "1"
           CODER_WINDOWS_RESOURCES: "1"
           AC_CERTIFICATE_FILE: /tmp/apple_cert.p12
           AC_CERTIFICATE_PASSWORD_FILE: /tmp/apple_cert_password.txt
diff --git a/Makefile b/Makefile
@@ -252,6 +252,10 @@ $(CODER_ALL_BINARIES): go.mod go.sum \
 		fi
 
 		cp "$@" "./site/out/bin/coder-$$os-$$arch$$dot_ext"
+
+		if [[ "$${CODER_SIGN_GPG:-0}" == "1" ]]; then
+			cp "$@.asc" "./site/out/bin/coder-$$os-$$arch$$dot_ext.asc"
+		fi
 	fi
 
 # This task builds Coder Desktop dylibs
diff --git a/scripts/build_go.sh b/scripts/build_go.sh
@@ -41,6 +41,7 @@ slim="${CODER_SLIM_BUILD:-0}"
 agpl="${CODER_BUILD_AGPL:-0}"
 sign_darwin="${CODER_SIGN_DARWIN:-0}"
 sign_windows="${CODER_SIGN_WINDOWS:-0}"
+sign_gpg="${CODER_SIGN_GPG:-0}"
 boringcrypto=${CODER_BUILD_BORINGCRYPTO:-0}
 dylib=0
 windows_resources="${CODER_WINDOWS_RESOURCES:-0}"
@@ -85,6 +86,10 @@ while true; do
 		sign_windows=1
 		shift
 		;;
+	--sign-gpg)
+		sign_gpg=1
+		shift
+		;;
 	--boringcrypto)
 		boringcrypto=1
 		shift
@@ -319,4 +324,9 @@ if [[ "$sign_windows" == 1 ]] && [[ "$os" == "windows" ]]; then
 	execrelative ./sign_windows.sh "$output_path" 1>&2
 fi
 
+# Platform agnostic signing
+if [[ "$sign_gpg" == 1 ]]; then
+	execrelative ./sign_with_gpg.sh "$output_path" 1>&2
+fi
+
 echo "$output_path"
diff --git a/scripts/sign_with_gpg.sh b/scripts/sign_with_gpg.sh
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+
+# This script signs a given binary using GPG.
+# It expects the binary to be signed as the first argument.
+#
+# Usage: ./sign_with_gpg.sh path/to/binary
+#
+# On success, the input file will be signed using the GPG key.
+#
+# Depends on the GPG utility. Requires the following environment variables to be set:
+#  - $CODER_GPG_RELEASE_KEY_BASE64: The base64 encoded private key to use.
+
+set -euo pipefail
+# shellcheck source=scripts/lib.sh
+source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+requiredenvs CODER_GPG_RELEASE_KEY_BASE64
+
+FILE_TO_SIGN="$1"
+
+if [[ -z "$FILE_TO_SIGN" ]]; then
+  echo "Usage: $0 <file_to_sign>"
+  exit 1
+fi
+
+if [[ ! -f "$FILE_TO_SIGN" ]]; then
+  echo "File not found: $FILE_TO_SIGN"
+  exit 1
+fi
+
+# Import the GPG key.
+old_gnupg_home="${GNUPGHOME:-}"
+gnupg_home_temp="$(mktemp -d)"
+export GNUPGHOME="$gnupg_home_temp"
+echo "$CODER_GPG_RELEASE_KEY_BASE64" | base64 -d | gpg --import 1>&2
+
+# Sign the binary. This generates a file in the same directory and
+# with the same name as the binary but ending in ".asc".
+#
+# We pipe `true` into `gpg` so that it never tries to be interactive (i.e.
+# ask for a passphrase). The key we import above is not password protected.
+true | gpg --detach-sign --armor "$FILE_TO_SIGN" 1>&2
+
+# Verify the signature and capture the exit status
+gpg --verify "${FILE_TO_SIGN}.asc" "$FILE_TO_SIGN" 1>&2
+verification_result=$?
+
+# Clean up the temporary GPG home
+rm -rf "$gnupg_home_temp"
+unset GNUPGHOME
+if [[ "$old_gnupg_home" != "" ]]; then
+	export GNUPGHOME="$old_gnupg_home"
+fi
+
+if [[ $verification_result -eq 0 ]]; then
+  echo "${FILE_TO_SIGN}.asc"
+else
+  echo "Signature verification failed!" >&2
+  exit 1
+fi
