build: verify tag signatures

[theborakompanioni]

Verify release signatures.

After this change, you will only be able to build from signed tags for both JM and Jam (e.g. v0.1.5 for Jam, v0.9.10 for JM) when signature verification is enabled (defaults to true).

For testing purposes, if you want to build from non-tagged objects, e.g. the latest commit in master branch, you must disable signature verification with --build-arg VERIFY_RELEASE=false.

Test

Try to build the ui-only image..

..should succeed with enabled verification of a tagged object (tag v0.3.0):

docker build --label "local" --build-arg JAM_REPO_REF=v0.3.0 --tag "joinmarket-webui/jam-ui-only" ./ui-only --no-cache

..should fail with enabled verification of a non-tagged object (branch master):

docker build --label "local" --build-arg JAM_REPO_REF=master --tag "joinmarket-webui/jam-ui-only" ./ui-only --no-cache

Exits with an error like:

error: master: cannot verify a non-tag object of type commit.

..should succeed with disabled verification of a non-tagged object (branch master):

docker build --label "local" --build-arg JAM_REPO_REF=master --build-arg SKIP_RELEASE_VERIFICATION=true --tag "joinmarket-webui/jam-ui-only" ./ui-only --no-cache

..should fail with enabled verification of a tagged object (tag v0.3.0) if no pubkey can be found:

Delete the pubkey ./ui-only/pubkeys/tbk.asc locally and run:

docker build --label "local" --build-arg JAM_REPO_REF=v0.3.0 --tag "joinmarket-webui/jam-ui-only" ./ui-only --no-cache

Exits with an error like:

gpg: Can't check signature: No public key

[MarnixCroes]

cACK

I have limited docker knowledge, but the change looks good to me.
I've verified all the added pubkeys, except yours: Kristaps and Adam's match the ones listed in JM repo and dergigi's matches the one listed on his website (dergigi.com/pgp). I'm not sure where yours is listed tho?:)

doc change also LGTM

[theborakompanioni]

I've verified all the added pubkeys, except yours: Kristaps and Adam's match the ones listed in JM repo and dergigi's matches the one listed on his website (dergigi.com/pgp). I'm not sure where yours is listed tho?:)

Can be seen e.g. when you click the "verified" badge on the commits, should be E8070AF0053AAC0D.
Also: https://pgp.mit.edu/pks/lookup?op=vindex&search=0xE8070AF0053AAC0D

doc change also LGTM

👍 🙏

[theborakompanioni]

docker build --label "local" --build-arg JAM_REPO_REF=master --tag "joinmarket-webui/jam-ui-only" ./ui-only --no-cache

Exits with an error like:

error: master: cannot verify a non-tag object of type commit.

e.g. see a failed build GitHub actions run for this scenario, building a non-release version (from current "master") having SKIP_RELEASE_VERIFICATION := false.

[theborakompanioni]

..should succeed with enabled verification of a tagged object (tag v0.3.0):

docker build --label "local" --build-arg JAM_REPO_REF=v0.3.0 --tag "joinmarket-webui/jam-ui-only" ./ui-only --no-cache

e.g. see a success build GitHub actions run for this scenario, building a release version ("v0.3.0") having SKIP_RELEASE_VERIFICATION := false.

Good signature from "theborakompanioni (no comment) [email protected]" [unknown]