Verify Heptapod Rails tarball with GPG
Currently, we're using the url
variant of the source DSL directive of Omnibus, with SHA-256 verification.
Since cheksum verification is mandatory in Omnibus, that forces us to check in the checksum value each time there's a new version, which is cumbersome and somewhat redundant as long as the download site (where that SHA-256 is also available) is under our direct control.
We could pass the SHA256 file in a CI artifact from its generation when we have a full multi-project pipeline, but that wouldn't work for manual builds, which are still very desirable.
To prepare for a future where Heptapod release managers would not have direct control of the download site (say we have plenty of mirrors in round-robin), it would be better to use GPG signatures.
Since Omnibus doesn't seem to support GPG signature verification instead of checksums, what we could do would be
- sign the SHA256 file as part of the
tarball
job of the Heptapod Rails CI. - fetch the SHA256 file from the download site and verify its signature before the call of the
#source
method. - call
#source
with the validated value.
Of course it will be necessary to have a GPG signing key for our CI.