fix: debsign argument parsing, PPA_SERIES precedence, passphrase cleanup#119
Merged
fix: debsign argument parsing, PPA_SERIES precedence, passphrase cleanup#119
Conversation
- Makefile: validate GPG_KEY_ID and GPG_PASSPHRASE are set before signing; space-separate -k from its value so empty key ID doesn't eat the filename - setup_ppa.sh: PPA_SERIES env var takes precedence when set, ensuring all CI containers use the same series regardless of OS - build_debian.yml: cleanup step also removes GPG passphrase temp file Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up fixes for the debsign signing failure after merging #117:
GPG_KEY_IDandGPG_PASSPHRASEare set before signing; space-separate-kfrom its value so an empty key ID doesn't consume the.changesfilename as the key argumentPPA_SERIESenv var takes precedence when set, ensuring all CI containers (including Ubuntu ones) use the same PPA seriesFull build+sign flow verified end-to-end in an ubuntu:latest container (changelog patching → install-upload-deps → install-kolibri → dist → debsign with passphrase-protected key).
References
Reviewer guidance
-k "value"(space-separated) won't collapse when the value is empty, unlike-k"value"which becomes just-ksetup_ppa.shchange:PPA_SERIESnow takes precedence over auto-detection, so CI containers consistently use the build runner's seriesAI usage
This PR was developed using Claude Code. Claude identified the root cause of the debsign failure (empty
-k""consuming the next positional argument), proposed and tested fixes, and ran a full end-to-end simulation of the build_debian.yml workflow in an ubuntu:latest container to verify the signing flow works with a passphrase-protected GPG key.