Fimeg/souveraine
Watch
1
0
Fork
You've already forked souveraine
 0
Code Releases Activity

ci: sign multi-architecture package repository

Browse source
This commit is contained in:
Fimeg 2026-07-12 21:11:34 -04:00
commit 3a83666ef5
4 changed files with 61 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

59
.gitea/workflows/ci.yml
View file

@ -96,47 +96,64 @@ jobs:
git clone "${GITHUB_SERVER_URL}/Fimeg/tuie.git" "$GITHUB_WORKSPACE/src/tuie"
git -C "$GITHUB_WORKSPACE/src/tuie" checkout aa43e335c8f5a3cd2c78e397a1a8dfe534a6bc35
- name: Cross-compile aarch64
- name: Build release binaries
run: |
set -euo pipefail
cd "$GITHUB_WORKSPACE/src/Souveraine"
# Persistent target dir: fresh clones per run, warm compile cache.
# Persistent target dirs: fresh clones per run, warm compile cache.
export CARGO_TARGET_DIR="$HOME/.cache/souveraine-ci-target"
export SOUVERAINE_AARCH64_SYSROOT="$HOME/aarch64-sysroot"
./scripts/build-cross.sh
BIN="$CARGO_TARGET_DIR/aarch64-unknown-linux-gnu/release/souveraine"
file "$BIN" | grep -q aarch64 || { echo "built binary is not aarch64" >&2; exit 1; }
cp "$BIN" souveraine-aarch64
sha256sum souveraine-aarch64 > souveraine-aarch64.sha256
- name: Package aarch64 pacman artifact
export CARGO_TARGET_DIR="$HOME/.cache/souveraine-ci-target-x86_64"
cargo build --release
BIN="$CARGO_TARGET_DIR/release/souveraine"
file "$BIN" | grep -q 'x86-64' || { echo "built binary is not x86_64" >&2; exit 1; }
cp "$BIN" souveraine-x86_64
sha256sum souveraine-aarch64 souveraine-x86_64 > souveraine-binaries.sha256
- name: Package and sign pacman repository
run: |
set -euo pipefail
cd "$GITHUB_WORKSPACE/src/Souveraine"
PKGVER="0.1.r$(git rev-list --count HEAD).g${GITHUB_SHA:0:12}"
WORK="$GITHUB_WORKSPACE/pacman-package"
REPO="$GITHUB_WORKSPACE/pacman-repo"
ARCHIVE_KEY="3CD9E99E222C2A174986FC9AFF4949AA20C8E911"
rm -rf "$WORK" "$REPO"
mkdir -p "$WORK" "$REPO"
cp souveraine-aarch64 packaging/souveraine.service LICENSE "$WORK/"
cp packaging/arch/PKGBUILD.prebuilt "$WORK/PKGBUILD"
(
cd "$WORK"
export SOUVERAINE_PKGVER="$PKGVER"
# The payload was cross-compiled above; tell makepkg to label the
# archive for that payload, not for this x86_64 runner host.
CARCH=aarch64 makepkg --nodeps --noconfirm --cleanbuild
)
PKG=$(find "$WORK" -maxdepth 1 -name 'souveraine-*.pkg.tar.zst' -print -quit)
test -n "$PKG"
bsdtar -tf "$PKG" | grep -qx 'usr/bin/souveraine'
cp "$PKG" "$REPO/"
repo-add "$REPO/souveraine.db.tar.zst" "$REPO/$(basename "$PKG")"
for ARCH in aarch64 x86_64; do
PKG_WORK="$WORK/$ARCH"
mkdir -p "$PKG_WORK"
cp "souveraine-$ARCH" "$PKG_WORK/souveraine-binary"
cp packaging/souveraine.service LICENSE "$PKG_WORK/"
cp packaging/arch/PKGBUILD.prebuilt "$PKG_WORK/PKGBUILD"
(
cd "$PKG_WORK"
export SOUVERAINE_PKGVER="$PKGVER"
export SOUVERAINE_PKGARCH="$ARCH"
CARCH="$ARCH" makepkg --nodeps --noconfirm --cleanbuild
)
PKG=$(find "$PKG_WORK" -maxdepth 1 -name 'souveraine-*.pkg.tar.zst' -print -quit)
test -n "$PKG"
bsdtar -tf "$PKG" | grep -qx 'usr/bin/souveraine'
cp "$PKG" "$REPO/"
gpg --batch --yes --local-user "$ARCHIVE_KEY" --detach-sign "$REPO/$(basename "$PKG")"
done
repo-add --include-sigs --sign --key "$ARCHIVE_KEY" \
"$REPO/souveraine.db.tar.zst" "$REPO"/*.pkg.tar.zst
# Pacman requests <repo>.db; release assets cannot preserve the
# symlink repo-add normally creates, so replace it with a real copy.
# symlink repo-add normally creates, so replace it with real files.
rm -f "$REPO/souveraine.db"
cp "$REPO/souveraine.db.tar.zst" "$REPO/souveraine.db"
sha256sum "$REPO/$(basename "$PKG")" "$REPO/souveraine.db" \
cp "$REPO/souveraine.db.tar.zst.sig" "$REPO/souveraine.db.sig"
cp packaging/arch/souveraine-archive-key.asc "$REPO/"
sha256sum "$REPO"/*.pkg.tar.zst "$REPO/souveraine.db" \
> "$REPO/souveraine-repo.sha256"
- name: Publish rolling edge prerelease
@ -161,7 +178,7 @@ jobs:
-d "{\"tag_name\":\"edge\",\"target_commitish\":\"${GITHUB_SHA}\",\"name\":\"edge (${DESC})\",\"body\":\"Rolling aarch64 build of public HEAD (${GITHUB_SHA}). Built on the archdev node, published only when CI is green.\",\"prerelease\":true}" \
| python3 -c "import json,sys; print(json.load(sys.stdin)['id'])")
for f in souveraine-aarch64 souveraine-aarch64.sha256 \
for f in souveraine-aarch64 souveraine-x86_64 souveraine-binaries.sha256 \
"$GITHUB_WORKSPACE"/pacman-repo/*; do
curl -sf -X POST -H "$AUTH" \
"$API/repos/${GITHUB_REPOSITORY}/releases/${REL_ID}/assets?name=$(basename "$f")" \