Subject: How to sign repository with gpg key?

From: Kamil Cukrowski <[email-masked]>
Date: Wed, 22 Jul 2020 13:25:25 +0200

Hello!

I have a public key
https://kamcuk.gitlab.io/yio/alpine/x86_64/[email-masked]
that I (hopefully) used to sign my repository at
https://kamcuk.gitlab.io/yio/alpine/x86_64/ . However upon
installation using that repo and key I get `BAD signature` error from
alpine.

How do I add the public key to the list of trusted keys? Why the
signature is BAD?

I have my own rsa key, so I followed some online site on how to convert
it to RSA key.
I generate private rsa key from my gpg key with:

    gpg --export-secret-keys CC36098A43EBF7B5 | openpgp2ssh
CC36098A43EBF7B5 > /[email-masked]

This generates `-----BEGIN RSA PRIVATE KEY-----` file. I have then
signed the repo with like:

     abuild-sign -k /[email-masked]
/home/builder/packages/*/*/APKINDEX.tar.gz

And then generated public key with:

     openssl rsa -in /[email-masked] -pubout -out
/[email-masked]

I confirmed with `openssl rsa -pubin  -modulus -noout -in
/[email-masked]`
and `openssl rsa -noout -modulus -in /[email-masked]` that
modulus of keys matches.

Then these files are uploaded to gitlab pages and then I guess I should
be able to install it:

    # add public key, repo to apk and then apk add the package
    $ docker run --rm alpine sh -xc 'wget
    https://kamcuk.gitlab.io/yio/alpine/x86_64/[email-masked]
    -O /etc/apk/keys/[email-masked] ; echo
    'https://kamcuk.gitlab.io/yio/alpine/' >> /etc/apk/repositories ;
    apk add yio'
    + wget
    https://kamcuk.gitlab.io/yio/alpine/x86_64/[email-masked]
    -O /etc/apk/keys/[email-masked]
    Connecting to kamcuk.gitlab.io (35.185.44.232:443)
    saving to '/etc/apk/keys/[email-masked]'
    kamilcukrowski@gmail 100% |********************************|   800 
    0:00:00 ETA
    '/etc/apk/keys/[email-masked]' saved
    + echo https://kamcuk.gitlab.io/yio/alpine/
    + apk add yio
    fetch
    http://dl-cdn.alpinelinux.org/alpine/v3.12/main/x86_64/APKINDEX.tar.gz
    fetch
    http://dl-cdn.alpinelinux.org/alpine/v3.12/community/x86_64/APKINDEX.tar.gz
    fetch https://kamcuk.gitlab.io/yio/alpine/x86_64/APKINDEX.tar.gz
    ERROR: https://kamcuk.gitlab.io/yio/alpine/: BAD signature
    WARNING: Ignoring APKINDEX.f89d10e2.tar.gz: No such file or directory
    ERROR: unsatisfiable constraints:
      yio (missing):
        required by: world[yio]

But I get `BAD signature` and also `No such file or directory`. I tried
finding something in `apk` sources in
https://github.com/alpinelinux/apk-tools , but I do not know what is
wrong, the signing process in
https://github.com/alpinelinux/abuild/blob/master/abuild-sign.in is
pretty straightforward.
When I unpack the generated `APKINDEX.tar.gz` there is a
[email-masked]` file
inside it. Can I somehow "manually" confirm that the APKINDEX has been
correctly signed? Do I also need
to sign packages, or just APKINDEX?

Thank you.