chore: executables signing update

Author: denis256

.github/assets/release-assets-config.json

@@ -69,6 +69,10 @@
     {
       "name": "SHA256SUMS.pem",
       "description": "Cosign certificate"
+    },
+    {
+      "name": "terragrunt-signing-key.asc",
+      "description": "GPG public key for signature verification"
     }
   ]
 }

.github/scripts/release/sign-checksums.sh

@@ -6,7 +6,8 @@ set -e
 # Usage: sign-checksums.sh <bin-directory>
 #
 # Environment variables:
-#   GPG_FINGERPRINT - GPG key fingerprint for signing (required)
+#   GPG_FINGERPRINT        - GPG key fingerprint for signing (required)
+#   SIGNING_GPG_PASSPHRASE - GPG key passphrase (required)
 #
 # Outputs:
 #   SHA256SUMS.gpgsig - GPG detached signature
@@ -26,6 +27,11 @@ function main {
     exit 1
   fi
 
+  if [[ -z "${SIGNING_GPG_PASSPHRASE}" ]]; then
+    echo "ERROR: SIGNING_GPG_PASSPHRASE environment variable is not set"
+    exit 1
+  fi
+
   # Use pushd/popd to avoid side effects on caller's working directory
   pushd "$bin_dir" || exit 1
 
@@ -38,6 +44,8 @@ function main {
   # GPG signing
   echo "Signing SHA256SUMS with GPG..."
   gpg --batch --yes -u "${GPG_FINGERPRINT}" \
+      --pinentry-mode loopback \
+      --passphrase "${SIGNING_GPG_PASSPHRASE}" \
       --output SHA256SUMS.gpgsig \
       --detach-sign SHA256SUMS
 

.github/workflows/release.yml

@@ -72,16 +72,21 @@ jobs:
       - name: Generate SHA256SUMS
         run: .github/scripts/release/generate-checksums.sh bin
 
-      - name: Import GPG key
+      - name: Import GPG key and export public key
+        env:
+          SIGNING_GPG_PRIVATE_KEY: ${{ secrets.SIGNING_GPG_PRIVATE_KEY }}
         run: |
-          echo "${{ secrets.GPG_PRIVATE_KEY }}" | base64 --decode | gpg --import
+          echo "${SIGNING_GPG_PRIVATE_KEY}" | base64 --decode | gpg --batch --import
           GPG_FINGERPRINT=$(gpg --list-secret-keys --keyid-format LONG | awk '/^sec/{sub(/.*\//, "", $2); print $2; exit}')
           echo "GPG_FINGERPRINT=${GPG_FINGERPRINT}" >> "${GITHUB_ENV}"
+          gpg --armor --export "${GPG_FINGERPRINT}" > bin/terragrunt-signing-key.asc
 
       - name: Install Cosign
         uses: sigstore/cosign-installer@v3
 
       - name: Sign SHA256SUMS
+        env:
+          SIGNING_GPG_PASSPHRASE: ${{ secrets.SIGNING_GPG_PASSPHRASE }}
         run: .github/scripts/release/sign-checksums.sh bin
 
       - name: Verify signatures before upload