From ba245056c43427c4cdacb8ce57aa25826d592867 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82?= <ash8820@proton.me>
Date: Mon, 17 Aug 2026 18:55:32 +0200
Subject: [PATCH] feat: sign repo DB with dedicated ed25519 signing key
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace the maintainer key in antergos-next-keyring with the new
Antergos NeXT Package Signing key (AA644A09..., sign subkey
3F1B219A..., expires 2028-08-16). CI now signs the repo database
with it (--detach-sign, loopback pinentry from SIGNING_KEY /
SIGNING_PASSPHRASE secrets). Client SigLevel switches from
'Optional TrustAll' to 'DatabaseRequired PackageOptional' — the
signed DB authenticates every package via its checksums.
---
 .github/workflows/build.yml                   |  18 ++++++++++++++++++
 packages/antergos-next-keyring/PKGBUILD       |   2 +-
 .../antergos-next-trusted                     |   2 +-
 .../antergos-next-keyring/antergos-next.gpg   | Bin 2276 -> 590 bytes
 setup-repo.sh                                 |   5 ++++-
 5 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6e66ed2..cc3c704 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -46,6 +46,24 @@ jobs:
         cd repo/antergos-pkgs/os/x86_64
         repo-add antergos-pkgs.db.tar.gz *.pkg.tar.zst
 
+    - name: Sign repo database
+      env:
+        SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
+        SIGNING_PASSPHRASE: ${{ secrets.SIGNING_PASSPHRASE }}
+      run: |
+        if [[ -n "$SIGNING_KEY" && -n "$SIGNING_PASSPHRASE" ]]; then
+          export GNUPGHOME=/tmp/gpg-sign
+          mkdir -p "$GNUPGHOME" && chmod 700 "$GNUPGHOME"
+          echo "$SIGNING_KEY" | base64 -d > /tmp/signing-key.gpg
+          gpg --batch --import /tmp/signing-key.gpg
+          cd repo/antergos-pkgs/os/x86_64
+          gpg --batch --yes --pinentry-mode loopback --passphrase "$SIGNING_PASSPHRASE" \
+            --detach-sign --output antergos-pkgs.db.tar.gz.sig antergos-pkgs.db.tar.gz
+          rm -rf "$GNUPGHOME" /tmp/signing-key.gpg
+        else
+          echo "Signing secrets not set — skipping signature"
+        fi
+
     - name: Copy to root for flat-URL compat
       run: |
         cp repo/antergos-pkgs/os/x86_64/*.pkg.tar.zst repo/
diff --git a/packages/antergos-next-keyring/PKGBUILD b/packages/antergos-next-keyring/PKGBUILD
index 3aa81f2..6e8e430 100644
--- a/packages/antergos-next-keyring/PKGBUILD
+++ b/packages/antergos-next-keyring/PKGBUILD
@@ -2,7 +2,7 @@
 
 pkgname=antergos-next-keyring
 pkgver=1
-pkgrel=2
+pkgrel=3
 pkgdesc="Antergos NeXT GPG keyring"
 arch=('any')
 url="https://github.com/Antergos-NeXT/antergos-packages"
diff --git a/packages/antergos-next-keyring/antergos-next-trusted b/packages/antergos-next-keyring/antergos-next-trusted
index fc4a315..5a81062 100644
--- a/packages/antergos-next-keyring/antergos-next-trusted
+++ b/packages/antergos-next-keyring/antergos-next-trusted
@@ -1 +1 @@
-F1D8F02C5E929F3FE0424EE897F813D238CF0DBB:4:
+AA644A095D2AF5F950FADB57C51BFE8D3A985236:4:
diff --git a/packages/antergos-next-keyring/antergos-next.gpg b/packages/antergos-next-keyring/antergos-next.gpg
index edbe66be38fe91a9fa81db4111bd43ac8c7c0528..8e5583ed07883b26d5d319e4362d8cf888fb6115 100644
GIT binary patch
literal 590
zcmbPX%#zh?B_hVD&Bn;Wc*~uik&)ejcYRCSwTUGnoJ#M{{Mef6Hh*J|s3@zd%GBzu
zGxPYHHMYn)=9Q!trRNtb_@zdKC<G)XXD6noDg<Yy=Vj)lcdTa-7UN<F7gJ<emEy%2
ztM&C~z^~ikN2UMuTFnSDV`T!_C@s>!00b-ye7T8vrA9hNdZyZjdWJxTjuDeIBP%y2
z2Rjp!5)+#!7bgcd6N?xVGb586JCk?=0~e<N%q*L04F3~y^o~Ay*O|C{vqkB|ofjMq
z?)IF0z)f(H$kp84F1wZ-WMtUT^=S_O&0temmgkqYtM6Su?bbzR28m^B%F|bC&1v4o
zy8|2uiKu~4e7t#4yFQQMD)qPo4bB_dRa>SP+<W1EW!BWWP6leeUpg5DStNkobi(J&
zMEu@lV&!B$l+M7=i11OF0*fTjR9T>@_R@;843hmmzbvt0W;k}$e*Og=5pduof`R}h
z^2U?lf9m(oV)6c#%3GXde)088-gaB5Qm8MY!Hcad|LNRCWs?~hCja>mu#M;9gI^UV
zLk^pz+z4pd-&MvxqdES`q0dM6-Q*}a!0<o!?gvj}HnR(>n&uyjFO@3$qR-~1Fm3;2
w@$h@<^<fjm85utQ*xl3btJl}C-f_#-A7vGh9+Te&IbYM6x9RJj>82mK0s7e2!~g&Q

literal 2276
zcmV<A2pjjA0u2OeMP+aS5CFexpqggo$o6VrsY#la{L&p05K|QTc&fpu{yfBe0!$M`
zx`Cy*bH#al8+-;C*Uy0E6fUT3^Dx!n{s&eo2<KT!M|4g|uTxCU`Nyuw{RqMT_45Lh
zH(?GX7G}vbg8g^$Kb(!E&RID11LtZKpi1SHR<iA1^kKilbK~RyVt}1?4hfQDc?}^D
z2qZZQ{umnIXOr#j`m0Je%C66MR08RYHXWr@DIsTss@I%MV#j}u2;sN+lMeaHKFbN?
zbYxshY}?qdOaU{$A2^Z!Rhr)U*%G2gmQ^&*g+ErfcIi&{&vD0?SJ!R1W6zVy_H(8g
z;BE0f_7t`t3ddl4U0RBzdxr9<%8;paLcnO{@OemwCd$w`8PmO_b0ZfLQv^L;9`c{6
z@d8qBd2Y9yBo&-DOI&GvN^({IIDC5wGnKxj2LcgX$L<kXKiAS$y<EGwQy`Xr3H(Vg
zTv`rrQY2Np_1pg;CTzW`OxZ>k5MdlA3N7oDyt~@?Xvn4V5S>TraV&p4gCI$b<)EtV
zId-}Iz@-i~<(LSOKew~P>sXtKV@sa{T1dZJc!2RZi5x*?CDtSET!*YOubR#=^UVk#
z2qhDI&gNA$RX0|AU73g2t1HE-1$*soX%Q7iB*hIX>E-x|-Tgs?iyO0Nt&Jj~rup$Y
zPbmsDPW_q(pNjwy0RRECI8A9|Xko>IASgj@bY*g9Z*$^+kxpe;R3J@ZX>N33X>Mh5
zDIh#yb7(j?GB7}Ja&L5RZZ2(QK8XTO1QP)Y05}#Q1o7DLEMAhIKj1=6=$H5t(m2lz
zy9EMjMP+aT8v_Lk2?z%Q1{Dek2nzxP76JnS0v-VZ7k~f?2@sd~6Vf=(4ZA8M5CDt#
z7UOqa;pr)mH>!yTJm_XPE4SqhrH|t-guY|!n25+GP~DnpeoaaI_19so(9N2fp%(%}
z=v|ny3OvXH$OodTUBe;V_F`<{fG|4&YR>t+Yv6rc=cl>3X--b6P6b$ppN@AUQt8#K
zaUHrcrkgabpxu796zwwNTj+TREcum#u?OVNT{lghr-Mfx7KhP1)`9$-wJV$8tFyOZ
z7;L)`vifM}z<BciGN0n3tJy3}1zgV+8b-32Zy^L`Q|gdon2HO!C;D-y{<`{@?f8)z
z_FBciGhEWsOw-^!FQIw$u{|_6K+$MoU6vUPhFJfTOSUb>tJRey2>o>}ROxw!kp471
zgW<Z4EckF_y}r(n^c~Wn?eUIdlAT7S1VbmGoC#l7N&6Qbb!~aiDx(LWh@1rdOPiL4
zQ^HgMwR++Bd2jZ##S9dQs8=jcHW4j6^z%cJEs?5o0>qS|Eo_<vi>8%d%9~{2!4Kp<
zase{>7qg)Us^RykJC1QgssgA4&br)?V9pL2KC^6zYs-CEE-h0<#j?4v54Bb71SIyV
zw(Dx}=y-FSI>T=W3O^bfe{GM<HZ|7=g5;Bqe}gBqeSnK2>QW{JaYXZ#ed=8`PeYTp
zHEn7_y_bP8T?M+E5w`n7(V6kJR7~9Cc(r{emu`Z{GC{7cj@$E@H3_)_4FqaMWpDuy
z0HE-Bq-lGoZS$@VnX*8cuHt9`-PNmuD=95{-ROKG8H#cdI>)5o>H(x`ndgLJ!FDoY
zY{v9f+IeRt5zXx^0BMZd9LEke)p<`i8r+s+3+Jvf_i3&OGu!>0NgX(P1@NzJG;Q5<
zPb2(!wVcW(2N(9C%fNxg18`k2X99;y{0_HEEST_;hpj2vVKkWOcgeM0p1#1uLE*`;
z%{P*{$3)Zvhr{3rzYgfFw#``clX<AMs=MaS-tB^t!Wce$1na%`^VPBtn*Y3;mwuN3
zx<m7N6@>nx9(g4yi4?vh&RlDR&b>nxOL#eSJ|6?>=!rRJs`l3_i@8-!08Anee2Gew
zKX}!3%RCC`rF5p%A<r2g1Z!RfbyE>Vyg@BVvOR(`U5rqL3B{?F|CYfHwM|A?UAF22
zF%9&Ehm&htS>Z#yqNd+CD<}5G76Uj0%IU^VmH6#T0uaV548=ty?D~44I^^M)EN=09
zw{S^#Zj2q@&4i(uF4r(*q2Rn<5CA(%xZ}fAMMqaR3t-KiJz4r+EhIgIJDI^aq2+zq
zXFCs?*&A7LfwNd9j*Mywa41Bm#YFg7;n}pyajiaWIePXSw9Ng<1|`RJiX<l$o5e_(
z-9M-s`1G_y8?3msA~n5{bup$%^l>6GnwpN>tNJO(evygtWAc0KO?hA)cK{Iq00D^t
zHUt;}3IHG$Aq4T*@GM@EpFiM2PUx5T6Vf=(4Z8&bYDHym0vikf3JDOG_!H7N&kegB
zUJw9)1sjn9c$<3Geehoza@p5UtQs>qgCpFWEC>+LKtp3qazj0J_NUGUd`I&!%`W)|
zp-hmMMGb4#{**VLQ=ttQ;m6g;EO!>}D}-BQua*;mT@%FwepGAZ_PoVDZHXW@S{<V0
zUNraUv#O*w(Z8jyJ~g8l>jAFDGP6$Z!z-W|GCB>TujJtWp*Rrhd^L{!22yJ$jd{nG
zd_>vy!PmWUt2zoQMV^iPJ^AhPfS%pxrGZvn32iyrE&1R{@RSjjM#4gwwkHOgE^tmK
z3}9c-tH}tg0De-%OuvJ>Do$%r&(iK<Lt4@=c}vH+yxdXFr@d=$c9fzB%Sz~IMNWlP
zGE<^?iY^N?uGg^@mP=4`SV_~}rjcK}ys{6ZIc}5(=G=u{@6i|GeO8UB;`>C4h>?yK
z4d3=iQELZc1(GiDfq{<gOqYKSNvB+%5{NNux-ygIm`ns2M(60I*{oK9z@?lsAzBDR
z8@t8bMVc_>)=+!I7qLDN3##x7mE_lxR34LVx}BQ0ru`e$5_!WuEuU?IU2&jV)#9h6
zx&!bVt0!H_*e8-Z`W`iuNR5t?=Ezt61q!pw0@GqchaDKv4U|~Hk7)4PPpAFCpN89D
yn*gKzwXNdMTZ_1We&SILka6i-JkN%lKSc?9;hK(NR8MNGJZV%eN4g6A6DeP<s65pG

diff --git a/setup-repo.sh b/setup-repo.sh
index 4aff294..9fbe0b5 100644
--- a/setup-repo.sh
+++ b/setup-repo.sh
@@ -14,7 +14,7 @@ if ! grep -q "\[antergos-pkgs\]" /etc/pacman.conf; then
     cat >> /etc/pacman.conf << 'CONF'
 
 [antergos-pkgs]
-SigLevel = Optional TrustAll
+SigLevel = DatabaseRequired PackageOptional
 Server = https://antergos-next.github.io/antergos-packages/
 CONF
     echo "Added antergos-pkgs to pacman.conf"
@@ -22,6 +22,9 @@ else
     echo "antergos-pkgs already in pacman.conf"
 fi
 
+pacman-key --init 2>/dev/null || true
+pacman-key --populate antergos-next 2>/dev/null || true
+
 pacman -Sy
 
 echo "Antergos NeXT PKGS ready!"