From 15691bc46f9430d82db460bfaeabb602a30db30c Mon Sep 17 00:00:00 2001
From: Sebastian Palencsar <hello@linuxcommand.dev>
Date: Mon, 22 Jun 2026 16:32:16 +0200
Subject: [PATCH] fix(flatpak): GPG-sign repo summaries during build and deploy

Unsigned summary updates left stale summary.sig files on the server,
causing BAD signature errors for clients. Sign exports and summaries
with the BearWave repo key and require .sig files before deploy.
---
 scripts/build-flatpak.sh  | 11 +++++++++--
 scripts/deploy-flatpak.sh |  5 +++++
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/scripts/build-flatpak.sh b/scripts/build-flatpak.sh
index 1cb6b12..dde16c0 100755
--- a/scripts/build-flatpak.sh
+++ b/scripts/build-flatpak.sh
@@ -4,8 +4,15 @@ set -euo pipefail
 root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$root"
 
-flatpak-builder --repo=flatpak_repo --force-clean flatpak_build de.nerdbear.bearwave.json
-flatpak build-update-repo flatpak_repo
+gpg_key_id="${BEARWAVE_FLATPAK_GPG_KEY:-AA1D2F0170800855}"
+
+flatpak-builder \
+  --repo=flatpak_repo \
+  --gpg-sign="${gpg_key_id}" \
+  --force-clean \
+  flatpak_build \
+  de.nerdbear.bearwave.json
+flatpak build-update-repo --gpg-sign="${gpg_key_id}" flatpak_repo
 
 echo "Flatpak repo updated in flatpak_repo/."
 echo "Deploy with: scripts/deploy-flatpak.sh"
diff --git a/scripts/deploy-flatpak.sh b/scripts/deploy-flatpak.sh
index 4c84024..1484866 100755
--- a/scripts/deploy-flatpak.sh
+++ b/scripts/deploy-flatpak.sh
@@ -11,6 +11,11 @@ if [[ ! -d flatpak_repo/objects ]]; then
   exit 1
 fi
 
+if [[ ! -f flatpak_repo/summary.sig || ! -f flatpak_repo/summary.idx.sig ]]; then
+  echo "Missing summary.sig files. Run scripts/build-flatpak.sh with GPG signing first." >&2
+  exit 1
+fi
+
 rsync -avz \
   -e 'ssh -o RemoteCommand=none -o RequestTTY=no' \
   --no-group --no-owner \