Add GPG signing to macOS binary zip builds

.github/workflows/build-macos-release.yml

@@ -38,6 +38,26 @@ jobs:
         working-directory: ./graft/subnet-evm
         run: ./scripts/run_task.sh build
 
+      - name: Install aws cli
+        run: |
+          curl "https://awscli.amazonaws.com/AWSCLIV2.pkg" -o "AWSCLIV2.pkg"
+          sudo installer -pkg AWSCLIV2.pkg -target /
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_DEPLOY_SA_ROLE_ARN }}
+          role-session-name: githubrolesession
+          aws-region: us-east-1
+
+      - name: Import GPG key
+        run: |
+          GPG_KEY_FILE="$(mktemp)"
+          chmod 600 "${GPG_KEY_FILE}"
+          printf '%s' "${{ secrets.RPM_GPG_PRIVATE_KEY }}" > "${GPG_KEY_FILE}"
+          printf 'GPG_KEY_FILE=%s\n' "${GPG_KEY_FILE}" >> "$GITHUB_ENV"
+        shell: bash
+
       - name: Try to get tag from git
         if: "${{ github.event.inputs.tag == '' }}"
         id: get_tag_from_git
@@ -52,50 +72,34 @@ jobs:
           echo "TAG=${{ github.event.inputs.tag }}" >> "$GITHUB_ENV"
         shell: bash
 
-      - name: Create avalanchego zip file
-        run: 7z a "avalanchego-macos-${TAG}.zip" build/avalanchego
-        env:
-          TAG: ${{ env.TAG }}
-
-      - name: Create subnet-evm zip file
-        run: 7z a "subnet-evm-macos-${TAG}.zip" build/subnet-evm
+      - name: Create zip packages and upload to S3
+        run: ./.github/workflows/build-zip-pkg.sh
         env:
           TAG: ${{ env.TAG }}
-
-      - name: Install aws cli
-        run: |
-          curl "https://awscli.amazonaws.com/AWSCLIV2.pkg" -o "AWSCLIV2.pkg"
-          sudo installer -pkg AWSCLIV2.pkg -target /
-
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: ${{ secrets.AWS_DEPLOY_SA_ROLE_ARN }}
-          role-session-name: githubrolesession
-          aws-region: us-east-1
-
-      - name: Upload avalanchego to S3
-        run: aws s3 cp avalanchego-macos-${{ env.TAG }}.zip "s3://${BUCKET}/macos/"
-        env:
-          BUCKET: ${{ secrets.BUCKET }}
-
-      - name: Upload subnet-evm to S3
-        run: aws s3 cp subnet-evm-macos-${{ env.TAG }}.zip "s3://${BUCKET}/macos/"
-        env:
           BUCKET: ${{ secrets.BUCKET }}
+          GPG_KEY_FILE: ${{ env.GPG_KEY_FILE }}
+          GPG_PASSPHRASE: ${{ secrets.RPM_GPG_PASSPHRASE }}
 
       - name: Save avalanchego as Github artifact
         uses: actions/upload-artifact@v4
         with:
           name: avalanchego-macos
-          path: avalanchego-macos-${{ env.TAG }}.zip
+          path: |
+            avalanchego-macos-${{ env.TAG }}.zip
+            avalanchego-macos-${{ env.TAG }}.zip.sig
 
       - name: Save subnet-evm as Github artifact
         uses: actions/upload-artifact@v4
         with:
           name: subnet-evm-macos
-          path: subnet-evm-macos-${{ env.TAG }}.zip
+          path: |
+            subnet-evm-macos-${{ env.TAG }}.zip
+            subnet-evm-macos-${{ env.TAG }}.zip.sig
 
       - name: Cleanup
+        if: always()
         run: |
+          if [[ -n "${GPG_KEY_FILE:-}" ]]; then
+            rm -f "${GPG_KEY_FILE}"
+          fi
           rm -rf ./build

.github/workflows/build-zip-pkg.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# ── GPG setup ────────────────────────────────────────────────────
+#
+# When GPG_KEY_FILE is set and non-empty, import the key and define
+# a sign_archive() helper. Otherwise, define a no-op stub.
+
+if [[ -n "${GPG_KEY_FILE:-}" && -s "${GPG_KEY_FILE}" ]]; then
+    GNUPGHOME=$(mktemp -d)
+    export GNUPGHOME
+    trap 'gpgconf --kill gpg-agent 2>/dev/null || true; rm -rf "${GNUPGHOME}"' EXIT
+
+    echo "Importing GPG key for archive signing..."
+    gpg --batch --import "${GPG_KEY_FILE}"
+
+    sign_archive() {
+        local archive="$1"
+        echo "Signing ${archive}..."
+        printf '%s' "${GPG_PASSPHRASE:-}" | gpg --batch --yes --detach-sign \
+            --pinentry-mode loopback \
+            --passphrase-fd 0 \
+            "${archive}"
+        echo "Verifying signature for ${archive}..."
+        gpg --batch --verify "${archive}.sig" "${archive}"
+    }
+
+    GPG_SIGNING_ENABLED=true
+else
+    echo "No GPG key provided, skipping archive signing."
+    sign_archive() { :; }
+    GPG_SIGNING_ENABLED=false
+fi
+
+# ── Build avalanchego zip ────────────────────────────────────────
+
+echo "Build avalanchego zip package..."
+echo "Tag: $TAG"
+7z a "avalanchego-macos-${TAG}.zip" build/avalanchego
+sign_archive "avalanchego-macos-${TAG}.zip"
+aws s3 cp "avalanchego-macos-${TAG}.zip" "s3://${BUCKET}/macos/"
+if [[ "$GPG_SIGNING_ENABLED" == "true" ]]; then
+    aws s3 cp "avalanchego-macos-${TAG}.zip.sig" "s3://${BUCKET}/macos/"
+fi
+
+# ── Build subnet-evm zip ────────────────────────────────────────
+
+echo "Build subnet-evm zip package..."
+7z a "subnet-evm-macos-${TAG}.zip" build/subnet-evm
+sign_archive "subnet-evm-macos-${TAG}.zip"
+aws s3 cp "subnet-evm-macos-${TAG}.zip" "s3://${BUCKET}/macos/"
+if [[ "$GPG_SIGNING_ENABLED" == "true" ]]; then
+    aws s3 cp "subnet-evm-macos-${TAG}.zip.sig" "s3://${BUCKET}/macos/"
+fi