From 7e7b8487eab27e81c6cf10bde627537ac30dcf28 Mon Sep 17 00:00:00 2001
From: EnumDev <enumdev@enumerated.dev>
Date: Tue, 24 Feb 2026 18:52:08 +0200
Subject: [PATCH] bpm-package: add package signing

---
 src/bpm-package/main.go | 52 ++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 51 insertions(+), 1 deletion(-)

diff --git a/src/bpm-package/main.go b/src/bpm-package/main.go
index 3f7fa4e..4b0480b 100644
--- a/src/bpm-package/main.go
+++ b/src/bpm-package/main.go
@@ -21,13 +21,14 @@ import (
 
 var compile = flag.BoolP("compile", "c", false, "Compile BPM source package")
 var verbose = flag.BoolP("verbose", "v", false, "Show additional information about the compilation process")
-var skipCheck = flag.BoolP("skip-checks", "s", false, "Skip 'check' function while compiling")
+var skipCheck = flag.Bool("skip-checks", false, "Skip 'check' function while compiling")
 var keepCompilationFiles = flag.BoolP("keep", "k", false, "Keep compilation files after successful package compilation")
 var installDepends = flag.BoolP("depends", "d", false, "Install package dependencies for compilation")
 var installPackage = flag.BoolP("install", "i", false, "Install compiled BPM package after compilation finishes")
 var compilationJobs = flag.IntP("jobs", "j", 0, "Set the amount of concurrent processes to use for source package compilation")
 var moveToBinaryDir = flag.BoolP("move", "m", false, "Move output packages to the current repository's binary directory")
 var updateInfo = flag.BoolP("update-info", "u", false, "Update the pkg.info file")
+var signPackage = flag.BoolP("sign", "s", false, "Sign package using GPG")
 var yesAll = flag.BoolP("yes", "y", false, "Accept all confirmation prompts")
 
 func main() {
@@ -149,6 +150,18 @@ func createArchive() string {
 		}
 	}
 
+	// Remove old BPM archive signatures in current directory
+	oldSignatures, err := filepath.Glob("*.sig")
+	if err != nil {
+		log.Printf("Warning: could not search for old BPM archive signatures: %s", err)
+	}
+	for _, signature := range oldSignatures {
+		err = os.Remove(signature)
+		if err != nil {
+			log.Printf("Warning: could not remove old BPM archive signature (%s): %s", signature, err)
+		}
+	}
+
 	// Create filename
 	filename := fmt.Sprintf("%s-%s-%d-%s-src.bpm", pkgInfo.Name, pkgInfo.Version, pkgInfo.Revision, pkgInfo.Arch)
 
@@ -164,6 +177,19 @@ func createArchive() string {
 		log.Fatalf("Error: failed to create BPM source archive: %s", err)
 	}
 
+	// Sign package
+	if *signPackage {
+		cmd := exec.Command("gpg", "--detach-sign", filename)
+		cmd.Stdout = os.Stdout
+		cmd.Stderr = os.Stderr
+		cmd.Stdin = os.Stdin
+
+		err := cmd.Run()
+		if err != nil {
+			log.Fatalf("Error: could not sign package: %s", err)
+		}
+	}
+
 	// Get absolute path to filename
 	absFilepath, err := filepath.Abs(filename)
 	if err != nil {
@@ -246,6 +272,14 @@ func compilePackage(archive string) {
 					if err != nil {
 						log.Printf("Warning: could not remove old binary package (%s): %s", pkgFilepath, err)
 					}
+
+					// Remove package signature
+					if _, err := os.Stat(pkgFilepath + ".sig"); err == nil {
+						err := os.Remove(pkgFilepath + ".sig")
+						if err != nil {
+							log.Printf("Warning: could not remove old binary package signature (%s): %s", pkgFilepath+".str", err)
+						}
+					}
 				}
 			}
 
@@ -266,6 +300,22 @@ func compilePackage(archive string) {
 		bpmutilsshared.UpdateDatabases(repo)
 	}
 
+	// Sign package
+	if *signPackage {
+		for k, v := range outputPkgs {
+			cmd := exec.Command("gpg", "--detach-sign", v)
+			cmd.Dir = path.Dir(v)
+			cmd.Stdout = os.Stdout
+			cmd.Stderr = os.Stderr
+			cmd.Stdin = os.Stdin
+
+			err := cmd.Run()
+			if err != nil {
+				log.Fatalf("Error: could not sign package (%s) at: %s", k, v)
+			}
+		}
+	}
+
 	// Print out generated packages
 	for k, v := range outputPkgs {
 		fmt.Printf("Package (%s) was successfully compiled! Binary package generated at: %s\n", k, v)