Enforce SHA and GPG signature checks where possible

sebanc · Jun 22, 2024 · afb5016 · afb5016
1 parent 774ad7d
commit afb5016
Show file tree

Hide file tree

Showing 4 changed files with 985 additions and 820 deletions.
diff --git a/.github/workflows/live.yml b/.github/workflows/live.yml
@@ -30,7 +30,8 @@ jobs:
           echo "Found linuxloops release: ${RELEASE_FILE} with version ${RELEASE_VERSION} and date ${RELEASE_DATE}"
           echo "RELEASE_FILE=${RELEASE_FILE}" >> $GITHUB_ENV
           echo "RELEASE_TAG=linuxloops-${RELEASE_VERSION}-${RELEASE_DATE}" >> $GITHUB_ENV
-          echo "RELEASE_NAME=Linuxloops ${RELEASE_VERSION} ${RELEASE_DATE}" >> $GITHUB_ENV          
+          echo "RELEASE_NAME=Linuxloops ${RELEASE_VERSION} ${RELEASE_DATE}" >> $GITHUB_ENV
+          echo "RELEASE_SHA256=$(sha256sum -b $RELEASE_FILE)" >> $GITHUB_ENV
       - name: Create a release and upload artifacts as assets
         uses: ncipollo/release-action@v1
         with:
@@ -40,4 +41,4 @@ jobs:
           tag: "${{ env.RELEASE_TAG }}"
           name: "${{ env.RELEASE_NAME }}"
           commit: "${{ github.ref_name }}"
-          body: "${{ github.event.head_commit.message }}"
+          body: "${{ github.event.head_commit.message }}\n\nrelease_sha256sum=${{ env.RELEASE_SHA256 }}"
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
@@ -26,7 +26,7 @@ jobs:
             arg4=''
             arg5=''
             distro="$i"
-            env=$(sudo bash linuxloops --list | grep -A4 "\"$i\"" | grep 'Available desktops:' | sed 's@"\|Available desktops: @@g' | sed 's@None @@g' | sed 's@ @\n@g' | sed -e 's@\t@@g' | sort -R | head -1)
+            env=$(sudo bash linuxloops --list | grep -A4 "\"$i\"" | grep 'Available desktops:' | sed 's@"\|Available desktops: @@g' | sed 's@ @\n@g' | sed -e 's@\t@@g' | sort -R | head -1)
             if sudo bash linuxloops --list | grep -A4 "\"$i\"" | grep -q 'Install on btrfs filesystem possible: Yes' && [ $(($RANDOM % 2)) -eq 1 ]; then arg1='-b'; fi
             if sudo bash linuxloops --list | grep -A4 "\"$i\"" | grep -q 'Nvidia proprietary driver installation possible: Yes' && [ $(($RANDOM % 2)) -eq 1 ]; then arg2='-n'; fi
             if sudo bash linuxloops --list | grep -A4 "\"$i\"" | grep -q 'Surface patches installation possible: Yes' && [ "${arg2}" == "" ] && [ $(($RANDOM % 2)) -eq 1 ]; then arg3='-S'; fi

diff --git a/Readme.md b/Readme.md
@@ -43,7 +43,7 @@ For security purpose, Linuxloops will not install packages/binaries that are not
 |Arch            |Current         |✓ (shim-signed AUR)    |✓                                    |✓                                |[notes][Arch-notes]|
 |Artix           |Current         |✓ (shim-signed AUR)    |✓                                    |                                 |[notes][Artix-notes]|
 |BlendOS         |v4              |✓ (shim-signed AUR)    |✓                                    |                                 |[notes][BlendOS-notes]|
-|BlissOS         |14 / 15 / 16    |                       |                                     |                                 |              |
+|BlissOS         |15 / 16         |                       |                                     |                                 |              |
 |Brunch          |Latest          |✓                      |                                     |✓ (partially included)           |[notes][Brunch-notes]|
 |ChromeOS-Flex   |Latest          |✓                      |                                     |                                 |[notes][ChromeOS-Flex-notes]|
 |Debian          |Bookworm        |✓                      |✓                                    |✓                                |              |