update CI script

- Avoid using deprecated tool: apt-key.
- Use checked-in key to avoid malware.

.github/workflows/build.yml

@@ -28,10 +28,15 @@ jobs:
 
     - name: Install additional dependencies
       run: |
-        sudo apt-key adv --fetch-keys 'https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key'
-        sudo add-apt-repository 'deb https://download.01.org/intel-sgx/sgx_repo/ubuntu focal main'
-        sudo apt-key adv --fetch-keys 'https://apt.llvm.org/llvm-snapshot.gpg.key'
-        sudo add-apt-repository 'deb http://apt.llvm.org/focal/ llvm-toolchain-focal-11 main'
+        # install gpg
+        sudo apt-get update -y && sudo apt install -y gpg
+        # Add intel-sgx package repository, key is download from https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key
+        cat intel-sgx-deb.key | gpg --dearmor | sudo tee /usr/share/keyrings/intel-sgx-deb.gpg > /dev/null
+        echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/intel-sgx-deb.gpg] https://download.01.org/intel-sgx/sgx_repo/ubuntu focal main" | sudo tee /etc/apt/sources.list.d/intel-sgx-deb.list > /dev/null
+        # Add llbm package repository, key is download from https://apt.llvm.org/llvm-snapshot.gpg.key
+        cat llvm-snapshot.gpg.key | gpg --dearmor | sudo tee /usr/share/keyrings/llvm-snapshot.gpg > /dev/null
+        echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/llvm-snapshot.gpg] http://apt.llvm.org/focal/ llvm-toolchain-focal-11 main" | sudo tee /etc/apt/sources.list.d/llvm-snapshot.list > /dev/null
+        # Install dependencies for build & test
         sudo apt-get update -y
         sudo apt-get install -y faketime protobuf-compiler libsgx-dcap-ql-dev clang-11 musl-tools gcc-multilib