From ac38770cc2465afdc1bb47a4bf823db4bd6dcaba Mon Sep 17 00:00:00 2001
From: "David M. Klein" <4+leander19961@noreply.localhost>
Date: Mon, 24 Aug 2026 15:09:01 +0200
Subject: [PATCH] docker/sync/sync.sh aktualisiert

---
 docker/sync/sync.sh | 34 ++++++++++++++++++++++++++++++++--
 1 file changed, 32 insertions(+), 2 deletions(-)

diff --git a/docker/sync/sync.sh b/docker/sync/sync.sh
index cea4caa..123f7b1 100644
--- a/docker/sync/sync.sh
+++ b/docker/sync/sync.sh
@@ -112,6 +112,20 @@ pull_one_ref() {
         exit 1
     fi
     ostree --repo="$REPO_PATH" refs --create="$ref" "$checksum" --force
+
+    if [ -n "${GPG_KEY_ID:-}" ]; then
+        # ref hat die Form "app/ID/ARCH/BRANCH" oder "runtime/ID/ARCH/BRANCH"
+        local ref_id ref_arch ref_branch
+        ref_id="$(echo "$ref" | cut -d/ -f2)"
+        ref_arch="$(echo "$ref" | cut -d/ -f3)"
+        ref_branch="$(echo "$ref" | cut -d/ -f4)"
+
+        log "Signiere ${ref_id}/${ref_arch}/${ref_branch} mit eigenem Key"
+        flatpak build-sign "$REPO_PATH" "$ref_id" "$ref_branch" \
+            --arch="$ref_arch" \
+            --gpg-sign="$GPG_KEY_ID" \
+            --gpg-homedir="${GNUPGHOME:-/etc/flatpak-sign/gnupg}"
+    fi
 }
 
 # Nimmt die explizit freigegebenen App-Refs, pullt sie, liest jeweils die
@@ -175,14 +189,30 @@ sync_refs() {
 # --- 7. Summary aktualisieren -----------------------------------------------
 update_summary() {
     log "Aktualisiere Repo-Summary und Static Deltas"
-    flatpak build-update-repo --generate-static-deltas "$REPO_PATH"
+    if [ -n "${GPG_KEY_ID:-}" ]; then
+        if ! flatpak build-update-repo \
+            --generate-static-deltas \
+            --gpg-sign="$GPG_KEY_ID" \
+            --gpg-homedir="${GNUPGHOME:-/etc/flatpak-sign/gnupg}" \
+            "$REPO_PATH"; then
+            log "FEHLER: Signierte Summary konnte nicht erstellt werden"
+            return 1
+        fi
+    else
+        if ! flatpak build-update-repo --generate-static-deltas "$REPO_PATH"; then
+            log "FEHLER: Summary konnte nicht erstellt werden"
+            return 1
+        fi
+    fi
 }
 
 run_once() {
     get_config
     init_repo
     sync_refs
-    update_summary
+    if ! update_summary; then
+        return 1
+    fi
     log "Sync abgeschlossen."
 }