introduce package signature validation

We verify the signature of the GPG signature before installing the
package.

2 files changed, 16 insertions, 14 deletions

diff --git a/.SRCINFO b/.SRCINFO
index 6c0df051e257..99997d04b58f 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -8,8 +8,9 @@ pkgbase = exoscale-cli
 	makedepends = git
 	makedepends = go
 	makedepends = make
-	source = exoscale-cli::git+https://github.com/exoscale/cli.git#tag=v1.73.0
-	source = git+https://github.com/exoscale/go.mk.git
+	source = https://github.com/exoscale/cli/releases/download/v1.73.0/exoscale-cli_1.73.0.tar.gz
+	source = https://github.com/exoscale/cli/releases/download/v1.73.0/exoscale-cli_1.73.0.tar.gz.sig
+	validpgpkeys = 7100E8BFD6199CE0374CB7F003686F8CDE378D41
 	sha256sums = SKIP
 	sha256sums = SKIP
 
diff --git a/PKGBUILD b/PKGBUILD
index 4686491ed6cc..bb18be9f869c 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -10,21 +10,22 @@ url="https://github.com/exoscale/cli"
 license=('Apache')
 
 makedepends=(git go make)
-source=("${pkgname}::git+https://github.com/exoscale/cli.git#tag=v${pkgver}"
-        "git+https://github.com/exoscale/go.mk.git")
+validpgpkeys=('7100E8BFD6199CE0374CB7F003686F8CDE378D41')
+source=("https://github.com/exoscale/cli/releases/download/v${pkgver}/${pkgname}_${pkgver}.tar.gz"
+        "https://github.com/exoscale/cli/releases/download/v${pkgver}/${pkgname}_${pkgver}.tar.gz.sig")
 sha256sums=('SKIP'
             'SKIP')
 
-prepare() {
-  cd "${srcdir}/${pkgname}"
-
-  git submodule init
-  git config submodule.libs/libdep.url "$srcdir/lib-dependency"
-  git -c protocol.file.allow=always submodule update
-}
-
 build() {
-  cd "${srcdir}/${pkgname}"
+  cd "${srcdir}/${pkgname}_${pkgver}"
+
+  # This package builds exo cli from a source tarball.
+  # But `make build` will bake the latest git tag into the binary.
+  # To provide this information to the build process we set it here.
+  git init
+  git add Makefile
+  git commit -m "dummy commit"
+  git tag v${pkgver}
 
   make build
   make completions
@@ -32,7 +33,7 @@ build() {
 }
 
 package() {
-  cd "${srcdir}/${pkgname}"
+  cd "${srcdir}/${pkgname}_${pkgver}"
 
   install -Dm 755 ./bin/exo "${pkgdir}/usr/bin/exo"
   install -Dm 644 ./contrib/completion/bash/exo -t "${pkgdir}/usr/share/bash-completion/completions/"