build a secure debian apt repo

.github/workflows/python-publish.yml

@@ -18,6 +18,7 @@ jobs:
     steps:
     - uses: actions/checkout@v2.3.4
 
+    # Environment Setup
     - name: Set up Python
       uses: actions/setup-python@v2.2.2
       with:
@@ -41,12 +42,24 @@ jobs:
         cd ..
         dpkg -i dh-virtualenv_*.deb
 
+    - name: Install GPG secret key
+      run: |
+        echo -e "${{ secrets.QMK_GPG_SECRET_KEY }}" | gpg --batch --import
+        gpg --list-secret-keys --keyid-format LONG
+
     - name: Install python dependencies
       run: |
         python -m pip install --upgrade pip
         pip install setuptools wheel 
         pip install -r requirements-dev.txt
 
+    - name: Log in to Docker Hub
+      uses: docker/login-action@v1.10.0
+      with:
+        username: ${{ secrets.DOCKER_HUB_USERNAME }}
+        password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
+
+    # Build and upload new Python package
     - name: Bump version
       run: |
         git config --local user.email "hello@qmk.fm"
@@ -68,15 +81,30 @@ jobs:
         python setup.py sdist bdist_wheel
         twine upload dist/*
 
-    - name: Log in to Docker Hub
-      uses: docker/login-action@v1.10.0
-      with:
-        username: ${{ secrets.DOCKER_HUB_USERNAME }}
-        password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
-
+    # Build and upload new Docker container
     - name: Build and Push to Docker Hub
       uses: docker/build-push-action@v2.6.1
       with:
         context: .
         push: true
         tags: qmkfm/qmk_cli:latest
+
+    # Build Debian package
+    - name: Build debian package
+      run: |
+        python3 setup.py bdist_deb
+
+    # Create Debian repo
+    - name: Build debian package repository
+      run: |
+        mkdir -p deb_repo/dists/stable deb_repo/deb deb_repo/dsc
+        cp gpg_pubkey.txt deb_repo
+        cp deb_dist/*.deb deb_repo/deb
+        cp deb_dist/*.dsc deb_dist/*.orig.tar.gz deb_dist/*.debian.tar.xz deb_repo/dsc
+        cd deb_repo
+        apt-ftparchive packages deb > Packages
+        apt-ftparchive sources dsc > Sources
+        gzip -k {Packages,Sources}
+        apt-ftparchive release . > Release
+        gpg --default-key F464DFD46C4DA3FD4D06234691B06358D2CAE8AE -abs -o Release.gpg Release
+        gpg --default-key F464DFD46C4DA3FD4D06234691B06358D2CAE8AE --clearsign -o InRelease Release

gpg_pubkey.txt

@@ -0,0 +1,52 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGEKF6YBEACzlxKIzWbfxKpOQ60tvYupcSh3Cn6u9z0CI5aNTiTHBeTKA7WQ
+NOzIBcH6EK+N1gmhkq4ykOCUZD8vFhYD+UMF4UyYsFcjhqSw6W4vPBBX4t9v8pqn
+PvMy0eXBnfi4IiMaKwPInIeNB6JQXp+hvP+yByi0mifBwDt2zgj1bh/iCL29AF3S
+sw+qlaURh7E3OYpR0t9EpJ6NYIAiebOwUegiG4HODSuSrueaAwE6tIXNvB8SapOP
+VUO0ysDWBzTWg81bmGl2LCfC56iChTKSrw+9iCBD5zBJMQmMmLBiVYq2lHWGelHS
+tv4bIyq77WNC24TQyH47L4Q+YcmcJwJYi4brQn0Nol0P+hQHmi/DjxXmGA0oDfnv
+EcxnUddobzqldq3UmyWewoqKX4GQ0bHgl3bkIgDKQ5mUPLezRRqr8GBhD8aRYDv0
+Tuxecpch8aEN8Alp/AWe3VSMxK/fN0xe8Q8gA8cSmGC+naQorafoD6WFe+1qUqHE
+DJlEgvp68KfrmBaQd8vrHabjc3wcCoqn/vnOsExX5KLVTZKvKDWqUkhXwGkt9Unf
+yCMJJr/LsHzVNAhFfXuxgRG/t6IF1HwGfJ8RvnTOjlOV69cWQwtpuf5dK9ZGhpBt
+r1hGDZ+SCF/c2vM5422cjv2fsOJ2hRSwCaM+NAYaSSoYwP0bWCAoOeYolwARAQAB
+tDpRTUsgRmlybXdhcmUgKE9mZmljaWFsIFFNSyBHUEcgU2lnbmluZyBLZXkpIDxo
+ZWxsb0BxbWsuZm0+iQJUBBMBCgA+FiEE9GTf1GxNo/1NBiNGkbBjWNLK6K4FAmEK
+F6YCGwMFCQPCZwAFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQkbBjWNLK6K7J
+iw/9H0LpNEShRhh29+XamPEiWUF3NF3OxCvbW56UNa0GQbTUnNK+mfyEs2vcIvQ0
+4m9XP9QdqnpgIYtE0bKp0iJ+2Egsh0qpdyRrM527HvLXHUlq9ZcwcAeYPIGqAUV8
+YBGIiBgPrQfLIjRw39cDBC/iP7CLn+c64ZzoaWdfNt7XWBpEZ07d7DFQ+858fcTJ
+cs7eeAjhrC0A+JMjiluIWpcVQvGolB/0RQAbLooLXa25iYKI99iwkT9iX8x+EyRC
+Pxd+za2fayojNqppQL9k+kgSeug0IB8bonJoyEvHy2x/x5IvJaPEiCVJj+DOydj3
+JKEp7Al9vNuwfSVdn4ArhmlnaZElvfBXdz2DdoET+8sm95fS2uHFzD2Dx1F8D6Eb
+yQNyvn13+whXK96DLXJqlHzAl6CFx9IefQDeuLoJYgWbK0cxSvD26d7V8BQxDU+d
+XZNrl1KBTF5oCVUHt6nZ5Uf7ai0JZf0ugc+qdIvdXXMFIaWDK64HsIhZ2heSZ/+U
+FEzw1+4IBXd1EvaC6smpUf3bZG0cLhZdG1js5JrXvWR6nZ9RYoSfPB+8YntRMklS
+dupWh3XszA4XabsTBJZ6VHcCmErRNd6Z+Rf3cy/1n9Eud1SKuzUOFEAmeXeAuLHp
+JqEWFB9jY8xcfTh7/mHISQv0MI/mNxt/cJZvZLOZAFB2bWe5Ag0EYQoXpgEQAK6T
+rV/zw9aVSVHPrWwB7a8yIKa5ERXBb4LYTVXMX1KoN1tlFKQ13R+1Ga+5clGtKF3z
+z1UZlVMxsWUF2stx8UIpVj2iTQriAVwBg440gfLV5Rddk4+mmOdo7r05q1MqpuG+
+94+QT5QTvT9FjFMAW+oRnujmx00YSgqJPfFJdPZS93g1UCspUmqLKBbuJ0NzjnBv
++ISDe9ne78fQv9wjxfkKAiq/wNu2xLBN40RRmPKM7gu2mEy9Xovr8eYR4HrjyQhk
+X+r54f5h8iKxbDl95716cgtYJpPbJVPTuERiqRjPziYA2OZSmH4kv9/wm6r1OwDH
+4y80S0yBPc/tm98nHGBFKokWnEjyjm2a8g3zBnFGw6p5riNBCrVO3G/YFis+lCXl
+Nj1Rz3tAAJqZz+ZMx6tDc9WnCzwYgKbpuYxVNRGLBNCqRA7TZiJgFJLemo9xsOuF
+ANYNxDDEsIrKjO/DmdNl5240bY0pdqAnhXibvCbA5zFQP3W/h5CEaDMUaMUPZhWM
+dSK7r4jzu2rJyQjVJ9aP8Cda+OP4GdzxY594Agra5oLxCsx5tM7BDvnq8PGAnSRn
+LCNOiW5d6AYbj/15iqfsHD700R5+WI9K+rqAIIFxWNka5ih5m97ZYrZntV7lShIc
+NenEUeOTByyve5viS6zNNSBtGH+K+z/3sefjWJcdABEBAAGJAjwEGAEKACYWIQT0
+ZN/UbE2j/U0GI0aRsGNY0srorgUCYQoXpgIbDAUJA8JnAAAKCRCRsGNY0sroruwY
+D/0VcLSwNtUPVO2p9TTbpPShzzMHyk9AlFG2WzIglfEKC3H54WJDkAxuBIswhLfa
+77apJpj3ukE0FqhnxbdofK9lQR0F50wdCrvrc3vs/biqjGHKIyUojveOyyum68uB
+kRQiihJ2RV8PsuOjNVpB0YwoVg8HYuJbGWsuTt7TVhaGLFTIZW08XOeWLQSiDEBy
+qoaYTidOegtaoaQm3OWakpKCtdZZZXPXpYahW8OlMMoKKsdwHP0aCeOnLuHpwlVX
+Pas+14J3mA+7CI8bL0SqXAev3UzXAQFeFhdd4B2+Rqgz18fEwAXu1HqHE1BQTFyG
+4EN8Q6qteFamnJCWTJ8dWX6jJz8aztGVcaQqvgccQzVK54vihfhKjP68MscMA5vl
+tCdCxlyV8zzghNVsHCx2P3XEbMLgoek8twNsdk+B344RcqgQV0ATs9OeV1ehtaQB
+VMVRNbYJVsIbmxYc8gLkuHHb2xjqni6YbaXL9CBLGnu+mL1KA2QF4CjWix0B+Aqb
+y/8Xu7l2guZGUO2lzlJWmEkL3dqw2UlrTnYdPTnl1kB4A4gDyhCaq9eRf3LoZAOP
+cfK21MYiwfGwqSTuuImN4yzmAkVMFKQg/fenyVgZpGvKaZJb07sJOuFaDdHkZTld
+i756iMGOCupSNiTeEEiZQn8VYR8SBm96/Sbrcb88+Il2Bw==
+=t1lg
+-----END PGP PUBLIC KEY BLOCK-----

setup.cfg

@@ -36,10 +36,11 @@ requires-python = >=3.7
 with-python2: False
 with-python3: True
 with-dh-virtualenv: True
+sign-results: True
 compat: 10
 suite3: stable
 package3: qmk
-maintainer: QMK Community <hello@qmk.fm>
+maintainer: QMK Firmware (Official QMK GPG Signing Key) <hello@qmk.fm>
 section: devel
 depends3: build-essential, clang-format, diffutils, gcc, git, unzip, wget, zip, python3-pip, binutils-avr, gcc-avr, avr-libc, binutils-arm-none-eabi, gcc-arm-none-eabi, libnewlib-arm-none-eabi, avrdude, dfu-programmer, dfu-util, teensy-loader-cli, libhidapi-hidraw0, libusb-dev
 depends: build-essential, clang-format, diffutils, gcc, git, unzip, wget, zip, python3-pip, binutils-avr, gcc-avr, avr-libc, binutils-arm-none-eabi, gcc-arm-none-eabi, libnewlib-arm-none-eabi, avrdude, dfu-programmer, dfu-util, teensy-loader-cli, libhidapi-hidraw0, libusb-dev