Feature/dry quadlet rpms

[seantronsen]

Pull Request Template

Thank you for your contribution! Please ensure the following before submitting:

Checklist

• My code follows the style guidelines of this project
• I have added/updated comments where needed
• I have added tests that prove my fix is effective or my feature works
• I have run make test (or equivalent) locally and all tests pass
• I have updated the relevant documentation (CLI examples, man pages, README, other docs, etc.)
• DCO Sign-off: All commits are signed off (git commit -s) with my real name and email
• REUSE Compliance:
  • Each new/modified source file has SPDX copyright and license headers
  • Any non-commentable files include a <filename>.license sidecar
  • All referenced licenses are present in the LICENSES/ directory

Description

I'll update this description as time goes on and this is less of a "draft"... anyways:

This PR is motivated primarily by OpenCHAMI/release#64 which requires decomposing the current release repository RPM. More specifically, we'll be moving towards one podman quadlet RPM build per service repository.

Most of the repositories therefore need a similar setup for CI/CD and it seemed best to abstract out the routines instead of pasting the requisite workflows into N different repositories.

...and that's how we got here...

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Dependency update

---

For more info, see Contributing Guidelines.

--

Additional requirements/fixes/todos before merging:

Merge blockers

• 1. gpg-verify-trust-chain — replace runtime curl with vendored path.
  curl -fsSL --retry 3 -o "$script" "https://raw.githubusercontent.com/OpenCHAMI/gpg-signing-manager/main/scripts/verify-chain.sh" → script="$(cd "$GITHUB_ACTION_PATH/../.." && pwd)/scripts/verify-chain.sh". Fetches from mutable main, defeats action SHA-pinning, runs in the job holding the repo cert secret key. Also delete the two comment lines claiming it's already pinned/vendored — they're false.

• 2. gpg-configure-release-keys — delete repo cert secret key after use.
  After the sign-ephemeral step, add a step running gpg --batch --yes --delete-secret-keys "$REPO_CERT_FPR". Certifying key is only needed for --quick-sign-key, but currently survives into every downstream step and the exported GNUPGHOME.

• 3. gpg-configure-release-keys — shred GNUPGHOME as a final action step (not an EXIT trap).
  Add trailing step: find "$GNUPGHOME" -type f -exec shred -u {} + 2>/dev/null; rm -rf "$GNUPGHOME". setup's mktemp -d GNUPGHOME has no cleanup and persists on the runner. Do NOT use trap … EXIT in setup — separate shell, would shred before sign-rpm runs.

• 4. gpg-sign-rpm — move inline ${{ inputs.* }} into env:.
  _gpg_name ${{ inputs['gpg-fingerprint'] }}, the IFS=',' read … "${{ inputs['rpm-paths'] }}" reads, and [ "${{ inputs.resign }}" = "true" ]. Map each to an env: var, reference as $VAR. Reusable action interpolates caller inputs directly into run: — latent script injection in a secret-bearing job.

Should-fix (same PR)

• 5. gpg-configure-release-keys — read master key from env:.
  echo "${{ inputs.master-public-key-asc }}" > "master.pub.asc" → printf '%s\n' "$MASTER_PUBLIC_ASC" > master.pub.asc with env: MASTER_PUBLIC_ASC: ${{ inputs.master-public-key-asc }}. Multi-line secret-typed content spliced into shell.

• 6. WF2 (Release signed artifacts) — pin the user-facing verifier.
  In body:, the curl -LO …/main/…/verify-chain.sh instruction → pin to the release tag or ship the script as a release asset. Hands unpinned curl … | bash-style instructions to consumers.

Docs / cleanup

• 7. Document the key lifecycle: which key lives where, for how long, and that the handed-off GNUPGHOME intentionally contains only the ephemeral key post-teardown.
• 8. Document that MASTER_PUBLIC_ASC / MASTER_FPR are public; note they can be repo variables, not secrets (masking public keys is noisy) — or leave as secrets but say why.
• 9. Add a one-line note next to %no-protection in generate explaining the tradeoff (ephemeral, 1-day, isolated keyring).
• 10. After changes, re-grep the repo for curl piped-or-written-then-executed and for --export-secret to confirm nothing else exfiltrates or fetches unpinned.