actions/cargo-install
actions/cargo-install
3
0
Fork 0
mirror of https://github.com/dtolnay/install.git synced 2025-01-31 07:01:20 +01:00
Code Issues Projects Activity Pipelines

Delete gpg-based verification in favor of attestations

Browse source
This commit is contained in:
David Tolnay 2025-01-26 13:46:00 -08:00
parent 4988755830
commit 9159632372
No known key found for this signature in database
GPG key ID: F9BA143B95FF6D82
1 changed files with 0 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
action.yml
View file

@ -24,15 +24,6 @@ runs:
- name: Download ${{steps.inputs.outputs.bin}}
run: curl --output ${{steps.cargo.outputs.dir}}/${{steps.inputs.outputs.bin}} https://github.com/dtolnay/install/releases/download/${{steps.inputs.outputs.crate}}/${{steps.inputs.outputs.bin}} --location --silent --show-error --fail --retry 5
shell: bash
- name: Download ${{steps.inputs.outputs.bin}}.sig
run: curl --output ${{runner.temp}}/${{steps.inputs.outputs.bin}}.sig https://github.com/dtolnay/install/releases/download/${{steps.inputs.outputs.crate}}/${{steps.inputs.outputs.bin}}.sig --location --silent --show-error --fail --retry 5
shell: bash
- name: Retrieve public key of signing key
run: gpg --output ${{runner.temp}}/signing-key.gpg --yes --dearmor ${{github.action_path}}/signing-key.asc
shell: bash
- name: Verify gpg signature
run: gpg --no-default-keyring --keyring ${{runner.temp}}/signing-key.gpg --trusted-key 830334D6A6010C41 --verify ${{runner.temp}}/${{steps.inputs.outputs.bin}}.sig ${{steps.cargo.outputs.dir}}/${{steps.inputs.outputs.bin}}
shell: bash
- name: Verify artifact attestation
run: gh attestation verify --owner dtolnay ${{steps.cargo.outputs.dir}}/${{steps.inputs.outputs.bin}}
env: