Add GPG key handling to build workflow and script for improved security

.github/workflows/build.yml

@@ -64,6 +64,7 @@ jobs:
           DEBFULLNAME: Tran Ngoc Duc
           NAME: Tran Ngoc Duc
           DEBIAN_FRONTEND: noninteractive
+          GPG_KEY: ${{ secrets.GPG_KEY }}
           DEB_SIGN_KEYID: ${{ secrets.GPG_KEY_ID }}
           GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}
 

src/build.sh

@@ -58,8 +58,8 @@ env GIT_COMMITTER_MESSAGE $GIT_COMMITTER_MESSAGE
 
 # gpg key
 env GPG_KEY_ID $GPG_KEY_ID
-env DEB_SIGN_KEYID $(gpg --list-keys --with-colons --fingerprint | awk -F: '/fpr:/ {print $10; exit}')
-# env DEB_SIGN_KEYID $DEB_SIGN_KEYID
+env GPG_KEY $GPG_KEY
+env DEB_SIGN_KEYID $DEB_SIGN_KEYID
 
 # debian
 env changelog $(realpath $debian_dir/changelog)
@@ -150,6 +150,17 @@ $SUDO apt install $INPUT_APT_OPTS -- dpkg-dev libdpkg-perl dput tree devscripts
 $SUDO apt install $INPUT_APT_OPTS -- libdistro-info-perl $INPUT_EXTRA_BUILD_DEPS
 end_group
 
+start_group "GPG/SSH Configuration"
+if ! gpg --list-keys --with-colons | grep -q "fpr"; then
+    echo "$GPG_KEY====" | tr -d '\n' | fold -w 4 | sed '$ d' | tr -d '\n' | fold -w 76 | base64 -di | gpg --batch --import || true
+fi
+
+if gpg --list-secret-keys --keyid-format=long | grep -q "sec"; then
+    export DEB_SIGN_KEYID=$(gpg --list-keys --with-colons --fingerprint | awk -F: '/fpr:/ {print $10; exit}')
+fi
+gpg --list-secret-keys --keyid-format=long
+end_group
+
 start_group View Source Code
 echo $source_dir
 ls -la $source_dir