feat: sign released binaries

.env.dist

@@ -1,2 +1,3 @@
 GPG_SIGNING_KEY=
-ARCH_TARGETS='amd64 arm arm64 386'
+GPG_SIGNING_PASSPHRASE=
+ARCH_TARGETS='amd64 arm arm64'

crypto/pem.go

@@ -9,7 +9,6 @@ import (
 
 	jwt "github.com/dgrijalva/jwt-go"
 	"github.com/pkg/errors"
-	"golang.org/x/crypto/ssh"
 )
 
 func EncodePublicKeyToPEM(key crypto.PublicKey) ([]byte, error) {
@@ -29,23 +28,25 @@ func DecodePEMToPublicKey(pem []byte) (crypto.PublicKey, error) {
 }
 
 func DecodePEMEncryptedPrivateKey(key []byte, passphrase []byte) (*rsa.PrivateKey, error) {
-	var (
-		rawKey interface{}
-		err    error
-	)
-
-	if len(passphrase) == 0 {
-		rawKey, err = ssh.ParseRawPrivateKey(key)
-	} else {
-		rawKey, err = ssh.ParseRawPrivateKeyWithPassphrase(key, passphrase)
+	// Parse PEM block
+	var block *pem.Block
+	if block, _ = pem.Decode(key); block == nil {
+		return nil, errors.New("invalid PEM block")
 	}
+
+	decryptedBlock, err := x509.DecryptPEMBlock(block, passphrase)
 	if err != nil {
 		return nil, errors.WithStack(err)
 	}
 
+	var parsedKey interface{}
+	if parsedKey, err = x509.ParsePKCS1PrivateKey(decryptedBlock); err != nil {
+		return nil, errors.WithStack(err)
+	}
+
 	var privateKey *rsa.PrivateKey
 	var ok bool
-	if privateKey, ok = rawKey.(*rsa.PrivateKey); !ok {
+	if privateKey, ok = parsedKey.(*rsa.PrivateKey); !ok {
 		return nil, errors.New("invalid RSA private key")
 	}
 

script/release

@@ -39,7 +39,7 @@ function build {
 
   if [ ! -z "${GPG_SIGNING_KEY}" ]; then
     echo "signing '$destdir/$name' with gpg key '$GPG_SIGNING_KEY'..."
-    gpg --sign --default-key "${GPG_SIGNING_KEY}" --armor --detach-sign --output "$destdir/$name.sig" "$destdir/$name"
+    echo $GPG_SIGNING_PASSPHRASE | gpg --pinentry-mode loopback --passphrase-fd 0 --sign --default-key "${GPG_SIGNING_KEY}" --output "$destdir/$name.sig" "$destdir/$name"
   fi
 }