From e48cc100a519fae72767eda3f4d68104b95a6ccf Mon Sep 17 00:00:00 2001
From: Sebastian Martinez <me@sebastinez.dev>
Date: Wed, 30 Jul 2025 17:56:27 +0200
Subject: [PATCH] Add container instructions to release pipeline for apt
 signing

---
 RELEASE.md | 81 +++++++++++++++++++++---------------------------------
 1 file changed, 31 insertions(+), 50 deletions(-)

diff --git a/RELEASE.md b/RELEASE.md
index e817a6ec6..aacd5eb22 100644
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -63,39 +63,6 @@
     radicle-desktop-amd64.AppImage
   ```
 
-- Sign the Debian package
-
-  TODO: automate the signing process with a docker image so it can be done from
-  the host machine.
-
-  Currently this happens via an Ubuntu vm manually:
-
-  ```bash
-  # Set the VERSION and SHORT_RELEASE_SHA variables to the same values here
-  # in the VM as on the host system.
-  RELEASE_SHA=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
-  SHORT_RELEASE_SHA=XXXXXXXX
-
-  cd radicle-apt-repo
-  rad sync && git fetch
-
-  curl -fLO \
-    "https://minio-api.radworks.garden/radworks-releases/radicle-desktop/pre-release/${VERSION}_${SHORT_RELEASE_SHA}/radicle-desktop_${VERSION}_amd64.deb"
-
-  RADICLE_APT_SIGNING_KEY=~/work/apt-signing/rudolfs ./import-deb ./radicle-desktop_${VERSION}_amd64.deb
-  rm -rf ./radicle-desktop_0.7.1_amd64.deb
-
-  git checkout -b release-v${VERSION}
-  git commit -a -m "Update radicle-desktop to ${VERSION}"
-
-  # Make sure ssh-agent is started and `rad auth` is working, then publish the patch.
-
-  git push rad HEAD:refs/patches
-
-  # The next step is to merge this patch into main, which effectively publishes
-  # the Deb packages. Continue this in the publish section below.
-  ```
-
 - Update Arch Linux package info
   - Update `pkgver` in `arch/radicle-desktop/PKGBUILD` to match the release version
   - Update `_commit` in `arch/radicle-desktop/PKGBUILD` to the release commit
@@ -119,27 +86,32 @@
 - Wait for CI of the Release Patch to pass
 - Wait for approval of the Release Patch and merge it into `main`
 
-- Publish release files
+- Sign the Debian package from `radicle-apt-repo`
 
   ```bash
-  scp -i "$(rad path)/keys/radicle" \
-    release-artifacts/* "release@files.radicle.xyz:/mnt/radicle/files/releases/radicle-desktop/latest/"
+  cd radicle-apt-repo
+  rad sync && git fetch
+
+  curl -fLO \
+    "https://minio-api.radworks.garden/radworks-releases/radicle-desktop/pre-release/${VERSION}_${SHORT_RELEASE_SHA}/radicle-desktop_${VERSION}_amd64.deb"
+
+  podman build -t apt-import scripts
+  podman run --rm -v ~/work/apt-signing/rudolfs:/src/keys/signing-key -v $(pwd):/src/apt -v ./radicle-desktop_${VERSION}_amd64.deb:/src/tmp.deb apt-import
+
+  rm -rf ./radicle-desktop_${VERSION}_amd64.deb
+
+  git checkout -b release-v${VERSION}
+  git add -A
+  git commit -m "Update radicle-desktop to ${VERSION}"
+  git push rad HEAD:refs/patches
+
+  # Once you get peer approval, merge the patch
+  git checkout main
+  git merge --ff-only release-v${VERSION}
+  git push
   ```
 
-- Publish the Debian package to the APT repository
-    - Switch to the `radicle-apt-repo` repository
-    ```bash
-    cd radicle-apt-repo
-    ```
-
-    - Merge the patch that was created on radicle-apt-repo in the VM into main from your host machine as a delegate
-    ```bash
-    rad sync && git fetch
-    rad patch checkout XXXXXXX
-    git checkout main
-    git merge --ff-only patch/XXXXXXX
-    git push
-    ```
+- Publish the Debian package to the APT repository from `radicle-apt-repo`
 
     - Upload the signed deb packages to files.radicle.xyz
     ```bash
@@ -151,6 +123,15 @@
 
     TODO: can we make scp skip the files that are already uploaded?
 
+- Publish release files from `radicle-desktop`
+
+  ```bash
+  cd radicle-desktop
+
+  scp -i "$(rad path)/keys/radicle" \
+    release-artifacts/* "release@files.radicle.xyz:/mnt/radicle/files/releases/radicle-desktop/latest/"
+  ```
+
 - Publish the Arch package by pushing changes to the [Arch User Repository][1]
   (You need to be a maintainer of the AUR package to push)