ci: sign multi-architecture package repository
This commit is contained in:
Fimeg
parent
e0c8128832
commit
3a83666ef5
4 changed files with 61 additions and 25 deletions
|
|
@ -96,47 +96,64 @@ jobs:
|
|||
git clone "${GITHUB_SERVER_URL}/Fimeg/tuie.git" "$GITHUB_WORKSPACE/src/tuie"
|
||||
git -C "$GITHUB_WORKSPACE/src/tuie" checkout aa43e335c8f5a3cd2c78e397a1a8dfe534a6bc35
|
||||
|
||||
- name: Cross-compile aarch64
|
||||
- name: Build release binaries
|
||||
run: |
|
||||
set -euo pipefail
|
||||
cd "$GITHUB_WORKSPACE/src/Souveraine"
|
||||
# Persistent target dir: fresh clones per run, warm compile cache.
|
||||
# Persistent target dirs: fresh clones per run, warm compile cache.
|
||||
export CARGO_TARGET_DIR="$HOME/.cache/souveraine-ci-target"
|
||||
export SOUVERAINE_AARCH64_SYSROOT="$HOME/aarch64-sysroot"
|
||||
./scripts/build-cross.sh
|
||||
BIN="$CARGO_TARGET_DIR/aarch64-unknown-linux-gnu/release/souveraine"
|
||||
file "$BIN" | grep -q aarch64 || { echo "built binary is not aarch64" >&2; exit 1; }
|
||||
cp "$BIN" souveraine-aarch64
|
||||
sha256sum souveraine-aarch64 > souveraine-aarch64.sha256
|
||||
|
||||
- name: Package aarch64 pacman artifact
|
||||
export CARGO_TARGET_DIR="$HOME/.cache/souveraine-ci-target-x86_64"
|
||||
cargo build --release
|
||||
BIN="$CARGO_TARGET_DIR/release/souveraine"
|
||||
file "$BIN" | grep -q 'x86-64' || { echo "built binary is not x86_64" >&2; exit 1; }
|
||||
cp "$BIN" souveraine-x86_64
|
||||
sha256sum souveraine-aarch64 souveraine-x86_64 > souveraine-binaries.sha256
|
||||
|
||||
- name: Package and sign pacman repository
|
||||
run: |
|
||||
set -euo pipefail
|
||||
cd "$GITHUB_WORKSPACE/src/Souveraine"
|
||||
PKGVER="0.1.r$(git rev-list --count HEAD).g${GITHUB_SHA:0:12}"
|
||||
WORK="$GITHUB_WORKSPACE/pacman-package"
|
||||
REPO="$GITHUB_WORKSPACE/pacman-repo"
|
||||
ARCHIVE_KEY="3CD9E99E222C2A174986FC9AFF4949AA20C8E911"
|
||||
rm -rf "$WORK" "$REPO"
|
||||
mkdir -p "$WORK" "$REPO"
|
||||
cp souveraine-aarch64 packaging/souveraine.service LICENSE "$WORK/"
|
||||
cp packaging/arch/PKGBUILD.prebuilt "$WORK/PKGBUILD"
|
||||
(
|
||||
cd "$WORK"
|
||||
export SOUVERAINE_PKGVER="$PKGVER"
|
||||
# The payload was cross-compiled above; tell makepkg to label the
|
||||
# archive for that payload, not for this x86_64 runner host.
|
||||
CARCH=aarch64 makepkg --nodeps --noconfirm --cleanbuild
|
||||
)
|
||||
PKG=$(find "$WORK" -maxdepth 1 -name 'souveraine-*.pkg.tar.zst' -print -quit)
|
||||
test -n "$PKG"
|
||||
bsdtar -tf "$PKG" | grep -qx 'usr/bin/souveraine'
|
||||
cp "$PKG" "$REPO/"
|
||||
repo-add "$REPO/souveraine.db.tar.zst" "$REPO/$(basename "$PKG")"
|
||||
|
||||
for ARCH in aarch64 x86_64; do
|
||||
PKG_WORK="$WORK/$ARCH"
|
||||
mkdir -p "$PKG_WORK"
|
||||
cp "souveraine-$ARCH" "$PKG_WORK/souveraine-binary"
|
||||
cp packaging/souveraine.service LICENSE "$PKG_WORK/"
|
||||
cp packaging/arch/PKGBUILD.prebuilt "$PKG_WORK/PKGBUILD"
|
||||
(
|
||||
cd "$PKG_WORK"
|
||||
export SOUVERAINE_PKGVER="$PKGVER"
|
||||
export SOUVERAINE_PKGARCH="$ARCH"
|
||||
CARCH="$ARCH" makepkg --nodeps --noconfirm --cleanbuild
|
||||
)
|
||||
PKG=$(find "$PKG_WORK" -maxdepth 1 -name 'souveraine-*.pkg.tar.zst' -print -quit)
|
||||
test -n "$PKG"
|
||||
bsdtar -tf "$PKG" | grep -qx 'usr/bin/souveraine'
|
||||
cp "$PKG" "$REPO/"
|
||||
gpg --batch --yes --local-user "$ARCHIVE_KEY" --detach-sign "$REPO/$(basename "$PKG")"
|
||||
done
|
||||
|
||||
repo-add --include-sigs --sign --key "$ARCHIVE_KEY" \
|
||||
"$REPO/souveraine.db.tar.zst" "$REPO"/*.pkg.tar.zst
|
||||
# Pacman requests <repo>.db; release assets cannot preserve the
|
||||
# symlink repo-add normally creates, so replace it with a real copy.
|
||||
# symlink repo-add normally creates, so replace it with real files.
|
||||
rm -f "$REPO/souveraine.db"
|
||||
cp "$REPO/souveraine.db.tar.zst" "$REPO/souveraine.db"
|
||||
sha256sum "$REPO/$(basename "$PKG")" "$REPO/souveraine.db" \
|
||||
cp "$REPO/souveraine.db.tar.zst.sig" "$REPO/souveraine.db.sig"
|
||||
cp packaging/arch/souveraine-archive-key.asc "$REPO/"
|
||||
sha256sum "$REPO"/*.pkg.tar.zst "$REPO/souveraine.db" \
|
||||
> "$REPO/souveraine-repo.sha256"
|
||||
|
||||
- name: Publish rolling edge prerelease
|
||||
|
|
@ -161,7 +178,7 @@ jobs:
|
|||
-d "{\"tag_name\":\"edge\",\"target_commitish\":\"${GITHUB_SHA}\",\"name\":\"edge (${DESC})\",\"body\":\"Rolling aarch64 build of public HEAD (${GITHUB_SHA}). Built on the archdev node, published only when CI is green.\",\"prerelease\":true}" \
|
||||
| python3 -c "import json,sys; print(json.load(sys.stdin)['id'])")
|
||||
|
||||
for f in souveraine-aarch64 souveraine-aarch64.sha256 \
|
||||
for f in souveraine-aarch64 souveraine-x86_64 souveraine-binaries.sha256 \
|
||||
"$GITHUB_WORKSPACE"/pacman-repo/*; do
|
||||
curl -sf -X POST -H "$AUTH" \
|
||||
"$API/repos/${GITHUB_REPOSITORY}/releases/${REL_ID}/assets?name=$(basename "$f")" \
|
||||
|
|
|
|||
|
|
@ -7,16 +7,16 @@ pkgname=souveraine
|
|||
pkgver="${SOUVERAINE_PKGVER:?CI must set SOUVERAINE_PKGVER}"
|
||||
pkgrel=1
|
||||
pkgdesc="Sovereign agent substrate — server, TUI, surfaces"
|
||||
arch=('aarch64')
|
||||
arch=("${SOUVERAINE_PKGARCH:?CI must set SOUVERAINE_PKGARCH}")
|
||||
url="https://gitea.wiuf.net/Fimeg/souveraine"
|
||||
license=('MIT')
|
||||
depends=('gcc-libs')
|
||||
depends=('gcc-libs' 'alsa-lib')
|
||||
options=('!strip')
|
||||
source=('souveraine-aarch64' 'souveraine.service' 'LICENSE')
|
||||
source=('souveraine-binary' 'souveraine.service' 'LICENSE')
|
||||
sha256sums=('SKIP' 'SKIP' 'SKIP')
|
||||
|
||||
package() {
|
||||
install -Dm755 "$srcdir/souveraine-aarch64" "$pkgdir/usr/bin/souveraine"
|
||||
install -Dm755 "$srcdir/souveraine-binary" "$pkgdir/usr/bin/souveraine"
|
||||
sed 's|%h/.local/bin/souveraine|/usr/bin/souveraine|' "$srcdir/souveraine.service" \
|
||||
| install -Dm644 /dev/stdin "$pkgdir/usr/lib/systemd/user/souveraine.service"
|
||||
install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
|
||||
|
|
|
|||
10
packaging/arch/souveraine-archive-key.asc
Normal file
10
packaging/arch/souveraine-archive-key.asc
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
|
||||
mDMEalQ47RYJKwYBBAHaRw8BAQdAr8Qx2Czxw1qJNp7Io9usd9P1ayqHYuuHCzNm
|
||||
9k6ocYO0NlNvdXZlcmFpbmUgUGFja2FnZSBBcmNoaXZlIDxwYWNrYWdlc0Bzb3V2
|
||||
ZXJhaW5lLmxvY2FsPoiWBBMWCgA+FiEEPNnpniIsKhdJhvya/0lJqiDI6REFAmpU
|
||||
OO0CGwMFCQPCZwAFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQ/0lJqiDI6RHb
|
||||
lgD9E8WBlE4agkW2bXq9X6Hz86lRWdlWOHkxUCnCZN3HMS8A/1WE8gL8U5A2grDD
|
||||
bWms5/iphtrh2S1Up031H9a+bvEL
|
||||
=/YGc
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
||||
9
packaging/arch/souveraine-edge.conf
Normal file
9
packaging/arch/souveraine-edge.conf
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
# Install this file as /etc/pacman.d/souveraine-edge.conf, then add
|
||||
# `Include = /etc/pacman.d/souveraine-edge.conf` to /etc/pacman.conf.
|
||||
#
|
||||
# Bootstrap the archive key first:
|
||||
# pacman-key --add souveraine-archive-key.asc
|
||||
# pacman-key --lsign-key 3CD9E99E222C2A174986FC9AFF4949AA20C8E911
|
||||
[souveraine]
|
||||
SigLevel = Required DatabaseRequired
|
||||
Server = https://gitea.wiuf.net/Fimeg/souveraine/releases/download/edge
|
||||
Loading…
Reference in a new issue