hash signing: Fix using default key

The default key needs to be specified before the file to sign

diff --git a/mkosi/__init__.py b/mkosi/__init__.py
index f554f25535f196fbbd42d77dce5ce02819a5f4b3..6cddc2dc419299015852f3b2f7a0f7841f5a81a1 100644 (file)
--- a/mkosi/__init__.py
+++ b/mkosi/__init__.py
@@ -837,16 +837,17 @@ def calculate_signature(state: MkosiState) -> None:
         return None
 
     with complete_step("Signing SHA256SUMS…"):
-        cmdline: list[PathString] = [
-            "gpg",
-            "--detach-sign",
-            "-o", state.staging / state.config.output_signature.name,
-            state.staging / state.config.output_checksum.name,
-        ]
+        cmdline: list[PathString] = ["gpg", "--detach-sign"]
 
+        # Need to specify key before file to sign
         if state.config.key is not None:
             cmdline += ["--default-key", state.config.key]
 
+        cmdline += [
+            "--output", state.staging / state.config.output_signature.name,
+            state.staging / state.config.output_checksum.name,
+        ]
+
         run(cmdline)