feat: sign repo DB with dedicated ed25519 signing key

Replace the maintainer key in antergos-next-keyring with the new
Antergos NeXT Package Signing key (AA644A09..., sign subkey
3F1B219A..., expires 2028-08-16). CI now signs the repo database
with it (--detach-sign, loopback pinentry from SIGNING_KEY /
SIGNING_PASSPHRASE secrets). Client SigLevel switches from
'Optional TrustAll' to 'DatabaseRequired PackageOptional' — the
signed DB authenticates every package via its checksums.

.github/workflows/build.yml

@@ -46,6 +46,24 @@ jobs:
         cd repo/antergos-pkgs/os/x86_64
         repo-add antergos-pkgs.db.tar.gz *.pkg.tar.zst
 
+    - name: Sign repo database
+      env:
+        SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
+        SIGNING_PASSPHRASE: ${{ secrets.SIGNING_PASSPHRASE }}
+      run: |
+        if [[ -n "$SIGNING_KEY" && -n "$SIGNING_PASSPHRASE" ]]; then
+          export GNUPGHOME=/tmp/gpg-sign
+          mkdir -p "$GNUPGHOME" && chmod 700 "$GNUPGHOME"
+          echo "$SIGNING_KEY" | base64 -d > /tmp/signing-key.gpg
+          gpg --batch --import /tmp/signing-key.gpg
+          cd repo/antergos-pkgs/os/x86_64
+          gpg --batch --yes --pinentry-mode loopback --passphrase "$SIGNING_PASSPHRASE" \
+            --detach-sign --output antergos-pkgs.db.tar.gz.sig antergos-pkgs.db.tar.gz
+          rm -rf "$GNUPGHOME" /tmp/signing-key.gpg
+        else
+          echo "Signing secrets not set — skipping signature"
+        fi
+
     - name: Copy to root for flat-URL compat
       run: |
         cp repo/antergos-pkgs/os/x86_64/*.pkg.tar.zst repo/

packages/antergos-next-keyring/PKGBUILD

@@ -2,7 +2,7 @@
 
 pkgname=antergos-next-keyring
 pkgver=1
-pkgrel=2
+pkgrel=3
 pkgdesc="Antergos NeXT GPG keyring"
 arch=('any')
 url="https://github.com/Antergos-NeXT/antergos-packages"

packages/antergos-next-keyring/antergos-next-trusted

@@ -1 +1 @@
-F1D8F02C5E929F3FE0424EE897F813D238CF0DBB:4:
+AA644A095D2AF5F950FADB57C51BFE8D3A985236:4:

setup-repo.sh

@@ -14,7 +14,7 @@ if ! grep -q "\[antergos-pkgs\]" /etc/pacman.conf; then
     cat >> /etc/pacman.conf << 'CONF'
 
 [antergos-pkgs]
-SigLevel = Optional TrustAll
+SigLevel = DatabaseRequired PackageOptional
 Server = https://antergos-next.github.io/antergos-packages/
 CONF
     echo "Added antergos-pkgs to pacman.conf"
@@ -22,6 +22,9 @@ else
     echo "antergos-pkgs already in pacman.conf"
 fi
 
+pacman-key --init 2>/dev/null || true
+pacman-key --populate antergos-next 2>/dev/null || true
+
 pacman -Sy
 
 echo "Antergos NeXT PKGS ready!"