import type { MurasakiConfig } from '../config.js';
/**
 * Linux code-signing: detached, armored GPG signatures for the `.AppImage`
 * (bundle.ts's `bundleLinux`) and the `.deb` (installer.ts's
 * `installerLinux`), plus a `SHA256SUMS`/`SHA256SUMS.sig` covering both.
 * Murasaki ships no key — signing only runs once the app developer supplies
 * their own (config.sign.linux.gpgKey / $MURASAKI_GPG_KEY, resolved into an
 * imported GPG secret key on the build host or CI runner).
 *
 * A detached `<artifact>.sig` (`gpg --detach-sign --armor`) is the baseline
 * and the only thing `--sign` actually guarantees: it needs no
 * dpkg-sig/debsigs/appimagetool on the build host, cross-builds from any OS
 * with `gpg` installed, and is verified the same way upstream distributions
 * publish detached release signatures (`gpg --verify <artifact>.sig
 * <artifact>`). `embedDebSignatureIfAvailable` additionally embeds a
 * Debian-native signature into the `.deb` itself via `dpkg-sig --sign
 * builder` when that tool happens to be on PATH — purely opportunistic, its
 * failure never fails the build, and (important for callers) it MUST run
 * before `signLinuxArtifact` produces the detached `.sig`: `dpkg-sig --sign`
 * mutates the `.deb` in place (ar-appends a `_gpgbuilder` member), so
 * detach-signing first would leave `.sig` covering bytes the file no longer
 * has by the time dpkg-sig is done with it.
 *
 * The passphrase (if the imported key has one) is read only from
 * `$MURASAKI_GPG_PASSPHRASE` and piped to `gpg --passphrase-fd 0` — never
 * accepted through config or a file path in config. When that variable is
 * unset, `gpg` falls through to gpg-agent (an interactive pinentry prompt
 * locally, or a CI runner's own agent/loopback-pinentry setup) — see the
 * README "Signing & distribution" section.
 */
export interface ResolvedLinuxSigningOptions {
    /** `gpg --local-user` selector: key id, fingerprint, or email. */
    gpgKey: string;
    /** Piped to `gpg --passphrase-fd 0`; undefined relies on gpg-agent. */
    passphrase?: string;
}
/**
 * Resolves the GPG signing identity: `$MURASAKI_GPG_KEY` overrides
 * `config.sign.linux.gpgKey`. Throws an actionable error if `--sign` is
 * requested but neither resolves — Linux signing has no "let the tool pick
 * one" fallback the way Windows SignTool does (`/a`), because an unattended
 * `gpg --local-user` selector is required either way.
 */
export declare function resolveLinuxSigningOptions(config: MurasakiConfig, env?: NodeJS.ProcessEnv): ResolvedLinuxSigningOptions;
/** Build the exact `gpg --detach-sign` arguments. Exported for regression tests. */
export declare function gpgDetachSignArgs(artifactPath: string, sigPath: string, options: ResolvedLinuxSigningOptions): string[];
/** Build `gpg --verify` arguments for a detached signature. */
export declare function gpgVerifyArgs(sigPath: string, artifactPath: string): string[];
/** Whether `gpg` (GnuPG) is on PATH. */
export declare function detectGpg(env?: NodeJS.ProcessEnv): boolean;
/**
 * Detach-signs `artifactPath` (the `.AppImage`, the `.deb`, or `SHA256SUMS`)
 * into `<artifactPath>.sig`, then independently verifies the signature it
 * just produced — mirrors `signWindowsArtifact`'s sign-then-verify shape.
 * Returns the `.sig` path.
 */
export declare function signLinuxArtifact(artifactPath: string, config: MurasakiConfig, env?: NodeJS.ProcessEnv): string;
/** Whether `dpkg-sig` is on PATH. */
export declare function detectDpkgSig(env?: NodeJS.ProcessEnv): boolean;
/**
 * Opportunistically embeds a Debian-native signature into `debPath` via
 * `dpkg-sig --sign builder` (adds a `_gpgbuilder` ar member covering the
 * package's other members) — attempted only when `dpkg-sig` is on PATH, and
 * never a hard requirement: the caller must still run `signLinuxArtifact`
 * (the detached `.sig`, `--sign`'s real guarantee) AFTER this, not before —
 * `dpkg-sig --sign` mutates `debPath` in place, so detach-signing first would
 * produce a `.sig` for bytes the `.deb` no longer has once dpkg-sig is done.
 * Any failure here — tool present but the invocation didn't work, e.g. no
 * loopback-pinentry/agent access for an unattended passphrase — degrades to a
 * warning, never a thrown error.
 */
export declare function embedDebSignatureIfAvailable(debPath: string, options: ResolvedLinuxSigningOptions, env?: NodeJS.ProcessEnv): 'dpkg-sig' | 'none';
/**
 * Writes a `sha256sum`-compatible `SHA256SUMS` file (`<hex>  <relPath>` per
 * line, two-space binary-mode separator) at `sumsPath` for `entries` — the
 * same convention `sample-release.yml`'s `sha256sum -- * > SHA256SUMS` step
 * produces, so `sha256sum --check SHA256SUMS` (run from `sumsPath`'s parent
 * directory) verifies it unmodified.
 */
export declare function writeSha256Sums(sumsPath: string, entries: {
    relPath: string;
    absPath: string;
}[]): Promise<void>;
//# sourceMappingURL=linux-signing.d.ts.map