Skip to content

chore: add linux package and checksum signing #236

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jingxiang-z wants to merge 8 commits into
base: main
Choose a base branch
from
Open

chore: add linux package and checksum signing #236

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
ca2c200
feat(release): sign Linux packages with 3S
jingxiang-z Jul 24, 2026
1364b13
feat(release): sign checksum manifest
jingxiang-z Jul 24, 2026
f04db09
docs: remove maintainer signing details
jingxiang-z Jul 24, 2026
352e130
docs: make package verification optional
jingxiang-z Jul 24, 2026
4ae9d4d
fix(release): address signature review findings
jingxiang-z Jul 24, 2026
167521b
fix(ci): install portable Python for nvsec
jingxiang-z Jul 24, 2026
efb83ee
fix(ci): install nvsec with pip resolver
jingxiang-z Jul 24, 2026
d81c05f
fix(ci): locate draft releases reliably
jingxiang-z Jul 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
131 changes: 128 additions & 3 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,105 @@ jobs:
env:
GORELEASER_CURRENT_TAG: ${{ github.ref_name }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


- name: Set up uv for nvsec
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
version: "0.11.31"

- name: Install nvsec
run: |
uv python install 3.13
uv venv --python 3.13 --seed "$RUNNER_TEMP/nvsec-venv"
"$RUNNER_TEMP/nvsec-venv/bin/pip" install "nvsec==2.9.2" \
--index-url "https://gitlab-master.nvidia.com/api/v4/projects/25923/packages/pypi/simple" \
--extra-index-url "https://urm.nvidia.com/artifactory/api/pypi/sw-cftt-pypi-local/simple"
echo "$RUNNER_TEMP/nvsec-venv/bin" >> "$GITHUB_PATH"

- name: Sign and verify DEB and RPM packages
run: |
scripts/sign-linux-packages.sh \
dist \
deployments/packages/keys/fleet-intelligence.pub.asc
env:
NVSEC_SSA_CLIENT_ID: ${{ secrets.NVSEC_SSA_CLIENT_ID }}
NVSEC_SSA_CLIENT_SECRET: ${{ secrets.NVSEC_SSA_CLIENT_SECRET }}
NVSEC_LINUX_PACKAGE_SSA_SCOPE: ${{ vars.NVSEC_LINUX_PACKAGE_SSA_SCOPE || 'SIGNING_LINUX_PACKAGE_FLEET_INTELLIGENCE' }}
NVSEC_LINUX_PACKAGE_JOB_TYPE: ${{ vars.NVSEC_LINUX_PACKAGE_JOB_TYPE || 'LINUX_PACKAGE_FLEET_INTELLIGENCE' }}
NSPECT_ID: ${{ vars.NSPECT_ID }}

- name: Refresh checksums for signed release artifacts
run: |
scripts/refresh-checksums.sh \
dist/checksums.txt \
deployments/packages/keys/fleet-intelligence.pub.asc \
scripts/verify-linux-package-signature.sh

- name: Sign and verify checksum manifest
run: |
scripts/sign-checksum-manifest.sh \
dist/checksums.txt \
deployments/packages/keys/fleet-intelligence.pub.asc
env:
NVSEC_SSA_CLIENT_ID: ${{ secrets.NVSEC_SSA_CLIENT_ID }}
NVSEC_SSA_CLIENT_SECRET: ${{ secrets.NVSEC_SSA_CLIENT_SECRET }}
NVSEC_CHECKSUM_SSA_SCOPE: ${{ vars.NVSEC_CHECKSUM_SSA_SCOPE || 'SIGNING_FLEET_INTELLIGENCE' }}
NVSEC_CHECKSUM_JOB_TYPE: ${{ vars.NVSEC_CHECKSUM_JOB_TYPE || 'FLEET_INTELLIGENCE' }}
NSPECT_ID: ${{ vars.NSPECT_ID }}

- name: Replace signed assets in draft release
uses: actions/github-script@373c709c69115d41ff229c7e5df9f8788daa9553 # v9.0.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const fs = require("fs");
const path = require("path");
const tag = context.ref.replace("refs/tags/", "");
const releases = await github.paginate(github.rest.repos.listReleases, {
owner: context.repo.owner,
repo: context.repo.repo,
per_page: 100,
});
const release = releases.find((candidate) => candidate.tag_name === tag);
if (!release) {
throw new Error(`Draft release not found for tag ${tag}`);
}
if (!release.draft) {
throw new Error("Refusing to replace assets in a published release");
}

const files = fs.readdirSync("dist")
.filter((name) =>
name.endsWith(".deb") ||
name.endsWith(".rpm") ||
name === "checksums.txt.asc" ||
name === "checksums.txt"
)
.map((name) => path.join("dist", name));
files.push(
"deployments/packages/keys/fleet-intelligence.pub.asc",
"scripts/verify-linux-package-signature.sh",
);

const existing = new Map(release.assets.map((asset) => [asset.name, asset.id]));
for (const file of files) {
const name = path.basename(file);
const existingID = existing.get(name);
if (existingID) {
await github.rest.repos.deleteReleaseAsset({
owner: context.repo.owner,
repo: context.repo.repo,
asset_id: existingID,
});
}
await github.rest.repos.uploadReleaseAsset({
owner: context.repo.owner,
repo: context.repo.repo,
release_id: release.id,
name,
data: fs.readFileSync(file),
});
}
- name: Get version and commit info
id: version
run: |
Expand Down Expand Up @@ -170,7 +268,7 @@ jobs:
"sw-dgxc-gpuhealth-generic-local/KITMAKER/release/fleetint/linux-x86_64/${{ steps.version.outputs.version }}/" \
--flat=true \
--target-props "component_name=fleetint;branch=${{ steps.version.outputs.branch }};os=linux;arch=x86_64;platform=linux-x86_64;version=${{ steps.version.outputs.version }};changelist=${{ steps.version.outputs.commit }};source=${{ steps.version.outputs.source }};category=toolkit"

- name: Upload sbsa tarball to Artifactory
if: steps.version.outputs.is_prerelease == 'false'
run: |
Expand All @@ -179,7 +277,32 @@ jobs:
"sw-dgxc-gpuhealth-generic-local/KITMAKER/release/fleetint/linux-sbsa/${{ steps.version.outputs.version }}/" \
--flat=true \
--target-props "component_name=fleetint;branch=${{ steps.version.outputs.branch }};os=linux;arch=sbsa;platform=linux-sbsa;version=${{ steps.version.outputs.version }};changelist=${{ steps.version.outputs.commit }};source=${{ steps.version.outputs.source }};category=toolkit"


- name: Publish verified GitHub release
uses: actions/github-script@373c709c69115d41ff229c7e5df9f8788daa9553 # v9.0.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const tag = context.ref.replace("refs/tags/", "");
const releases = await github.paginate(github.rest.repos.listReleases, {
owner: context.repo.owner,
repo: context.repo.repo,
per_page: 100,
});
const release = releases.find((candidate) => candidate.tag_name === tag);
if (!release) {
throw new Error(`Draft release not found for tag ${tag}`);
}
if (!release.draft) {
throw new Error("Release is already published");
}
await github.rest.repos.updateRelease({
owner: context.repo.owner,
repo: context.repo.repo,
release_id: release.id,
draft: false,
});

- name: Summary
run: |
echo "### Release Build Complete" >> $GITHUB_STEP_SUMMARY
Expand All @@ -195,6 +318,8 @@ jobs:
echo "repo: oci://ghcr.io/${{ steps.agent_image_ghcr.outputs.owner_lc }}/charts" >> $GITHUB_STEP_SUMMARY
echo "chart: fleet-intelligence-agent:${{ steps.version.outputs.version }}" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "**Linux packages and checksum manifest:** verified with Fleet Intelligence key \`087199B3\`" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY

if [[ "${{ steps.version.outputs.is_prerelease }}" == "true" ]]; then
echo "GitHub release created (pre-release)" >> $GITHUB_STEP_SUMMARY
Expand Down
14 changes: 13 additions & 1 deletion .goreleaser.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,6 +151,10 @@ release:
github:
owner: NVIDIA
name: fleet-intelligence-agent
# Keep unsigned GoReleaser output private until the release workflow replaces
# DEB/RPM assets with verified 3S-signed versions, refreshes checksums, and
# adds a verified detached signature for the final checksum manifest.
draft: true
header: |
## NVIDIA Fleet Intelligence Agent v{{.Version}}

Expand All @@ -173,11 +177,19 @@ release:
```bash
sha256sum -c checksums.txt
```

Confirm that `fleet-intelligence.pub.asc` has fingerprint
`FE0C 8B74 CA66 357C 13BE 197D CCE3 C963 0871 99B3`, then authenticate
the checksum manifest:
```bash
gpg --show-keys --fingerprint fleet-intelligence.pub.asc
gpg --import fleet-intelligence.pub.asc
gpg --verify checksums.txt.asc checksums.txt
```

### Support

For issues and questions, please visit: https://github.com/NVIDIA/fleet-intelligence-agent/issues
draft: false
prerelease: auto # Auto-detect pre-release based on version (e.g., v1.0.0-beta)
mode: replace # Replace existing release if it exists
replace_existing_artifacts: true # Handle reruns where GitHub assets with same name already exist
Expand Down
29 changes: 29 additions & 0 deletions deployments/packages/keys/fleet-intelligence.pub.asc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBGpjlKgBEADpuUQEvYXpO4hC8noK3fHFllG/6D8bzlgwGhApux+/oPJrc1wn
Whcikthv91gRGI9SORGzQiIzhH9IGZNYUHwD3vituPD+TeG6zli6HV3AlB1b7iRx
xtYwaZb7IIyiduzKStxX/vjdRuB3zMSVbIwIIsH8Vm1UEqyBemJ/CMSQZtKU5q33
mKlWCKs1q/N2ebY9aoHiFTGRXDBaSDm5prHBeydH1J9O2I+LR2Yt4gEv3mYGFSnL
uAQO71rDcyxf4AHNp/ajRjzaBqVnOfYnJrEMFmcgOfMbQ+0+mjH8ZuzZav2Au+p4
v8dbIycfsVrLmvoeeX5ognllc8yKZk0NbWdzf303DC1COPpDAJIMCPHPgjFMQI1w
2lInQgzCu+0NuvSsi6DZS58JfM06CTIBlkyAFYajBLERdsc5wsqwFFJA6sft+aiR
Ot3H5/5Ha9b1rds90mikLYoRkL7lh2Da0mP6dWsl2ojuWkol7MJ4SvE8ahLrxCxN
rNENYGnwusbNV5HSVVyBKjRDhW01rs/Dra6V7VnZjFtY/TW5XkRPCtAawGO5EgGE
O8xDHUXZ8zGUc9LkHtoPUKj0AXOvKwyUc40Hd09CRQUUZ6cL/H5m70VHiJ0zP0xg
vm2XTtAnib2zDxgp0SIBhUy/Li/tj07BNe4sNi03RF0PTCHC8r6wo7s4/wARAQAB
tDhOVklESUEgRmxlZXQgSW50ZWxsaWdlbmNlIDxmbGVldGludEBleGNoYW5nZS5u
dmlkaWEuY29tPokCRgQTAQgAMBYhBP4Mi3TKZjV8E74ZfczjyWMIcZmzBQJqY5So
AhsvAgsJAxUKCAIWAgIeBQIXgAAKCRDM48ljCHGZs1xtEADky/CSLyEmXwyf6RH8
FdeNdfV6fbgOx7xfbL8s7NpdT09O/aryWpZOczl9MWQfO33PE7qa5AEpOqg4Iph3
yfcJA2OVuQ+mEKtagn9s0B0CAKbj4rP3YQs5mQvy1vGMba3+5tzJfdVuMZaqK3QK
6AdHk5zUH+Ptly28gHXH+G+XYvP0e0xlDzImVgcTA5M9WQF8AMO6BME1WLDD9Ewt
hvNxWKLAnzpEg582KOegV4+Vg+h8hV192sEpY9Y7rsGlSAzr/hoxDQP7F45LZfba
xqZqOzGdS5xr8PvsfZEWW7ibT7VaGQizAEHgE1xYgEyPD9RaB6rOGz2ewltRRAwH
vcMXJgwABUudoCjmFkDoMMwkXcYGr31y0O1KHh8gbmc6FmGY/0Sb3Wh7c1T4JxZy
APZGjIsU33vhLx6BpJOaV7iFLIQ5xgB6lQCix5ps5QeO31QYn/eTlSkZW6j6uXPG
Jj6MUGjq0hnlWrDCA5J2XjZjQ38Pa+dI+Hjat0bWR+nTTnUUo3Ybrn43rpOAM5jN
lmJHZ8R0q5KV7tVh6zQBMSJ1cFBPDJoF9eUvEM8uiE1FlvtajkWrcnwuVpVSCHod
twcRgdpoq9Y/rdgaAuhd/cLCypBumZSoJtYhwX/GP0LeT6Wk4/6awACoMPLahrsa
8N/pBfOGFmtZpcUq0GLV0j+ipw==
=uZuZ
-----END PGP PUBLIC KEY BLOCK-----
32 changes: 30 additions & 2 deletions docs/install-deb.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,9 @@ After adding the CUDA repository, package dependencies (`datacenter-gpu-manager-

## Install package

Download the package from [Latest stable release](https://github.com/NVIDIA/fleet-intelligence-agent/releases/latest), then install:
Download the package from the
[latest stable release](https://github.com/NVIDIA/fleet-intelligence-agent/releases/latest),
then install it:

```bash
# Ubuntu (x86_64)
Expand All @@ -63,6 +65,32 @@ sudo fleetint --version
systemctl status fleetintd
```

## Optional: Verify package authenticity

To verify a release before installation, download the package,
`fleet-intelligence.pub.asc`, `checksums.txt`, `checksums.txt.asc`, and
`verify-linux-package-signature.sh` from the same release.

Confirm that the public key fingerprint is:

```text
FE0C 8B74 CA66 357C 13BE 197D CCE3 C963 0871 99B3

@ambermingxin ambermingxin Jul 27, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is this key an existing, already-published NVIDIA release key authoritative outside this repo? If so, better to link it here in md.

@jingxiang-z jingxiang-z Jul 27, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The public key will be published in this repo and release artifact.

```

Then verify the checksum manifest, package digest, and embedded package
signature:

```bash
gpg --show-keys --fingerprint fleet-intelligence.pub.asc
gpg --import fleet-intelligence.pub.asc
gpg --verify checksums.txt.asc checksums.txt
sha256sum -c --ignore-missing checksums.txt
chmod 755 verify-linux-package-signature.sh
./verify-linux-package-signature.sh \
fleetint_VERSION_amd64.deb \
fleet-intelligence.pub.asc
```

## Update

Install the newer package version:
Expand All @@ -87,4 +115,4 @@ sudo apt purge fleetint # Also removes configuration files
References:
- DCGM: <https://docs.nvidia.com/datacenter/dcgm/latest/user-guide/getting-started.html#installation>
- Fabric Manager: <https://docs.nvidia.com/datacenter/tesla/fabric-manager-user-guide/index.html#installing-fabric-manager>
- NVAT (`nvattest`/`corelib`): <https://docs.nvidia.com/attestation/nv-attestation-sdk-cpp/latest/overview.html>
- NVAT (`nvattest`/`corelib`): <https://docs.nvidia.com/attestation/nv-attestation-sdk-cpp/latest/overview.html>
32 changes: 30 additions & 2 deletions docs/install-rpm.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,9 @@ After adding the CUDA repository, package dependencies (`datacenter-gpu-manager-

## Install package

Download the package from [Latest stable release](https://github.com/NVIDIA/fleet-intelligence-agent/releases/latest), then install:
Download the package from the
[latest stable release](https://github.com/NVIDIA/fleet-intelligence-agent/releases/latest),
then install it:

```bash
# RHEL/Rocky/AlmaLinux/Amazon Linux (x86_64)
Expand All @@ -88,6 +90,32 @@ sudo fleetint --version
systemctl status fleetintd
```

## Optional: Verify package authenticity

To verify a release before installation, download the package,
`fleet-intelligence.pub.asc`, `checksums.txt`, `checksums.txt.asc`, and
`verify-linux-package-signature.sh` from the same release.

Confirm that the public key fingerprint is:

```text
FE0C 8B74 CA66 357C 13BE 197D CCE3 C963 0871 99B3
```

Then verify the checksum manifest, package digest, and embedded package
signature:

```bash
gpg --show-keys --fingerprint fleet-intelligence.pub.asc
gpg --import fleet-intelligence.pub.asc
gpg --verify checksums.txt.asc checksums.txt
sha256sum -c --ignore-missing checksums.txt
chmod 755 verify-linux-package-signature.sh
./verify-linux-package-signature.sh \
fleetint-VERSION-1.x86_64.rpm \
fleet-intelligence.pub.asc
```

## Update

Install the newer package version:
Expand All @@ -111,4 +139,4 @@ sudo dnf remove fleetint
References:
- DCGM: <https://docs.nvidia.com/datacenter/dcgm/latest/user-guide/getting-started.html#installation>
- Fabric Manager: <https://docs.nvidia.com/datacenter/tesla/fabric-manager-user-guide/index.html#installing-fabric-manager>
- NVAT (`nvattest`/`corelib`): <https://docs.nvidia.com/attestation/nv-attestation-sdk-cpp/latest/overview.html>
- NVAT (`nvattest`/`corelib`): <https://docs.nvidia.com/attestation/nv-attestation-sdk-cpp/latest/overview.html>
Loading
Loading