Sign OpenBSD packages with signify, drop -D unsigned

Packages are now signed via pkg_sign with the custom-pkg signify key
on the OpenBSD build host. The public key at /etc/signify/custom-pkg.pub
on each client allows pkg_add to verify without -D unsigned.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2 files changed, 16 insertions, 4 deletions

diff --git a/f3s/pkgrepo/test-artifacts/build-test-packages.sh b/f3s/pkgrepo/test-artifacts/build-test-packages.sh
index feb83ce..a6fee06 100755
--- a/f3s/pkgrepo/test-artifacts/build-test-packages.sh
+++ b/f3s/pkgrepo/test-artifacts/build-test-packages.sh
@@ -92,6 +92,18 @@ DESC
         -p / \
         "$OUTDIR/hello-test-1.0.tgz"
 
+    # Sign with signify if the key exists
+    if [ -f /etc/signify/custom-pkg.sec ]; then
+        mkdir -p "$OUTDIR/signed"
+        doas pkg_sign -s signify2 -s /etc/signify/custom-pkg.sec \
+            -o "$OUTDIR/signed" "$OUTDIR/hello-test-1.0.tgz"
+        mv "$OUTDIR/signed/hello-test-1.0.tgz" "$OUTDIR/hello-test-1.0.tgz"
+        rm -rf "$OUTDIR/signed"
+        echo "Package signed with signify"
+    else
+        echo "Warning: /etc/signify/custom-pkg.sec not found, package is unsigned"
+    fi
+
     rm -rf "$WORKDIR"
 
     echo ""
diff --git a/frontends/Rexfile b/frontends/Rexfile
index 0b508a9..add480e 100644
--- a/frontends/Rexfile
+++ b/frontends/Rexfile
@@ -506,8 +506,8 @@ task 'dtail',
 desc 'Installing Gogios binary';
 # Configure the custom package repository on OpenBSD frontends.
 # Adds PKG_PATH to root's .profile so custom packages are available
-# alongside the official OpenBSD repo. Official packages still install
-# normally; custom (unsigned) packages require -D unsigned.
+# alongside the official OpenBSD repo. Packages are signed with signify;
+# the public key must be at /etc/signify/custom-pkg.pub on each host.
 desc 'Setup custom package repo on OpenBSD frontends';
 task 'pkgrepo_setup',
   group => 'frontends',
@@ -534,8 +534,8 @@ task 'gogios_install',
         run 'rm -f /usr/local/bin/gogios';
       }
 
-      # Install or update from custom repo (unsigned for now)
-      say run 'PKG_PATH="https://pkgrepo.f3s.buetow.org/openbsd/7.8/packages/amd64/" pkg_add -D unsigned -u gogios || PKG_PATH="https://pkgrepo.f3s.buetow.org/openbsd/7.8/packages/amd64/" pkg_add -D unsigned gogios';
+      # Install or update from custom repo (packages signed with signify)
+      say run 'PKG_PATH="https://pkgrepo.f3s.buetow.org/openbsd/7.8/packages/amd64/" pkg_add -u gogios || PKG_PATH="https://pkgrepo.f3s.buetow.org/openbsd/7.8/packages/amd64/" pkg_add gogios';
     }
     elsif ( $os eq 'FreeBSD' ) {
       say run 'pkg update -r custom && pkg install -y gogios';