fix(ci): minisign install

Author: streamer45

.github/workflows/marketplace-build.yml

@@ -24,6 +24,7 @@ env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1
   SHERPA_ONNX_VERSION: "1.12.17"
+  MINISIGN_VERSION: "0.12"
   MARKETPLACE_VERSION: ${{ inputs.version }}
   RELEASE_TAG: ${{ inputs.release_tag }}
   REGISTRY_BASE_URL: ${{ inputs.registry_base_url || format('https://{0}.github.io/streamkit/registry', github.repository_owner) }}
@@ -40,7 +41,45 @@ jobs:
       - name: Install system dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y cmake pkg-config libclang-dev wget libopenblas-dev zstd minisign patchelf python3-yaml
+          sudo apt-get install -y cmake pkg-config libclang-dev wget libopenblas-dev zstd patchelf python3-yaml
+
+      - name: Install minisign
+        run: |
+          tar_path="/tmp/minisign-${MINISIGN_VERSION}-linux.tar.gz"
+          wget -O "${tar_path}" \
+            https://github.com/jedisct1/minisign/releases/download/${MINISIGN_VERSION}/minisign-${MINISIGN_VERSION}-linux.tar.gz
+          extract_dir="/tmp/minisign-${MINISIGN_VERSION}"
+          mkdir -p "${extract_dir}"
+          minisign_path="$(
+            TAR_PATH="${tar_path}" EXTRACT_DIR="${extract_dir}" python3 - <<'PY'
+            import os
+            import pathlib
+            import sys
+            import tarfile
+
+            extract_dir = pathlib.Path(os.environ["EXTRACT_DIR"])
+            tar_path = pathlib.Path(os.environ["TAR_PATH"])
+
+            with tarfile.open(tar_path, "r:gz") as tar:
+                tar.extractall(extract_dir)
+
+            preferred = extract_dir / "minisign-linux" / "x86_64" / "minisign"
+            if preferred.exists():
+                print(preferred)
+                sys.exit(0)
+
+            candidates = list(extract_dir.rglob("minisign"))
+            if not candidates:
+                sys.exit(1)
+            print(candidates[0])
+            PY
+          )"
+          if [ -z "${minisign_path}" ]; then
+            echo "minisign binary not found in ${extract_dir}"
+            exit 1
+          fi
+          sudo install -m 0755 "${minisign_path}" /usr/local/bin/minisign
+          minisign -h >/dev/null
 
       - name: Install sherpa-onnx
         run: |

.github/workflows/marketplace-release.yml

@@ -25,6 +25,9 @@ env:
 jobs:
   marketplace:
     uses: ./.github/workflows/marketplace-build.yml
+    permissions:
+      contents: write
+      pull-requests: write
     with:
       version: ${{ inputs.version }}
       release_tag: ${{ inputs.release_tag || format('marketplace-v{0}', inputs.version) }}

.github/workflows/release.yml

@@ -82,6 +82,9 @@ jobs:
 
   marketplace:
     uses: ./.github/workflows/marketplace-build.yml
+    permissions:
+      contents: write
+      pull-requests: write
     with:
       version: ${{ github.ref_name }}
       release_tag: ${{ github.ref_name }}