ci: sign multi-architecture package repository

.gitea/workflows/ci.yml

@@ -96,47 +96,64 @@ jobs:
           git clone "${GITHUB_SERVER_URL}/Fimeg/tuie.git" "$GITHUB_WORKSPACE/src/tuie"
           git -C "$GITHUB_WORKSPACE/src/tuie" checkout aa43e335c8f5a3cd2c78e397a1a8dfe534a6bc35
 
-      - name: Cross-compile aarch64
+      - name: Build release binaries
         run: |
           set -euo pipefail
           cd "$GITHUB_WORKSPACE/src/Souveraine"
-          # Persistent target dir: fresh clones per run, warm compile cache.
+          # Persistent target dirs: fresh clones per run, warm compile cache.
           export CARGO_TARGET_DIR="$HOME/.cache/souveraine-ci-target"
           export SOUVERAINE_AARCH64_SYSROOT="$HOME/aarch64-sysroot"
           ./scripts/build-cross.sh
           BIN="$CARGO_TARGET_DIR/aarch64-unknown-linux-gnu/release/souveraine"
           file "$BIN" | grep -q aarch64 || { echo "built binary is not aarch64" >&2; exit 1; }
           cp "$BIN" souveraine-aarch64
-          sha256sum souveraine-aarch64 > souveraine-aarch64.sha256
 
-      - name: Package aarch64 pacman artifact
+          export CARGO_TARGET_DIR="$HOME/.cache/souveraine-ci-target-x86_64"
+          cargo build --release
+          BIN="$CARGO_TARGET_DIR/release/souveraine"
+          file "$BIN" | grep -q 'x86-64' || { echo "built binary is not x86_64" >&2; exit 1; }
+          cp "$BIN" souveraine-x86_64
+          sha256sum souveraine-aarch64 souveraine-x86_64 > souveraine-binaries.sha256
+
+      - name: Package and sign pacman repository
         run: |
           set -euo pipefail
           cd "$GITHUB_WORKSPACE/src/Souveraine"
           PKGVER="0.1.r$(git rev-list --count HEAD).g${GITHUB_SHA:0:12}"
           WORK="$GITHUB_WORKSPACE/pacman-package"
           REPO="$GITHUB_WORKSPACE/pacman-repo"
+          ARCHIVE_KEY="3CD9E99E222C2A174986FC9AFF4949AA20C8E911"
           rm -rf "$WORK" "$REPO"
           mkdir -p "$WORK" "$REPO"
-          cp souveraine-aarch64 packaging/souveraine.service LICENSE "$WORK/"
+
-          cp packaging/arch/PKGBUILD.prebuilt "$WORK/PKGBUILD"
+          for ARCH in aarch64 x86_64; do
+            PKG_WORK="$WORK/$ARCH"
+            mkdir -p "$PKG_WORK"
+            cp "souveraine-$ARCH" "$PKG_WORK/souveraine-binary"
+            cp packaging/souveraine.service LICENSE "$PKG_WORK/"
+            cp packaging/arch/PKGBUILD.prebuilt "$PKG_WORK/PKGBUILD"
             (
-            cd "$WORK"
+              cd "$PKG_WORK"
               export SOUVERAINE_PKGVER="$PKGVER"
-            # The payload was cross-compiled above; tell makepkg to label the
+              export SOUVERAINE_PKGARCH="$ARCH"
-            # archive for that payload, not for this x86_64 runner host.
+              CARCH="$ARCH" makepkg --nodeps --noconfirm --cleanbuild
-            CARCH=aarch64 makepkg --nodeps --noconfirm --cleanbuild
             )
-          PKG=$(find "$WORK" -maxdepth 1 -name 'souveraine-*.pkg.tar.zst' -print -quit)
+            PKG=$(find "$PKG_WORK" -maxdepth 1 -name 'souveraine-*.pkg.tar.zst' -print -quit)
             test -n "$PKG"
             bsdtar -tf "$PKG" | grep -qx 'usr/bin/souveraine'
             cp "$PKG" "$REPO/"
-          repo-add "$REPO/souveraine.db.tar.zst" "$REPO/$(basename "$PKG")"
+            gpg --batch --yes --local-user "$ARCHIVE_KEY" --detach-sign "$REPO/$(basename "$PKG")"
+          done
+
+          repo-add --include-sigs --sign --key "$ARCHIVE_KEY" \
+            "$REPO/souveraine.db.tar.zst" "$REPO"/*.pkg.tar.zst
           # Pacman requests <repo>.db; release assets cannot preserve the
-          # symlink repo-add normally creates, so replace it with a real copy.
+          # symlink repo-add normally creates, so replace it with real files.
           rm -f "$REPO/souveraine.db"
           cp "$REPO/souveraine.db.tar.zst" "$REPO/souveraine.db"
-          sha256sum "$REPO/$(basename "$PKG")" "$REPO/souveraine.db" \
+          cp "$REPO/souveraine.db.tar.zst.sig" "$REPO/souveraine.db.sig"
+          cp packaging/arch/souveraine-archive-key.asc "$REPO/"
+          sha256sum "$REPO"/*.pkg.tar.zst "$REPO/souveraine.db" \
             > "$REPO/souveraine-repo.sha256"
 
       - name: Publish rolling edge prerelease
@@ -161,7 +178,7 @@ jobs:
             -d "{\"tag_name\":\"edge\",\"target_commitish\":\"${GITHUB_SHA}\",\"name\":\"edge (${DESC})\",\"body\":\"Rolling aarch64 build of public HEAD (${GITHUB_SHA}). Built on the archdev node, published only when CI is green.\",\"prerelease\":true}" \
             | python3 -c "import json,sys; print(json.load(sys.stdin)['id'])")
 
-          for f in souveraine-aarch64 souveraine-aarch64.sha256 \
+          for f in souveraine-aarch64 souveraine-x86_64 souveraine-binaries.sha256 \
             "$GITHUB_WORKSPACE"/pacman-repo/*; do
             curl -sf -X POST -H "$AUTH" \
               "$API/repos/${GITHUB_REPOSITORY}/releases/${REL_ID}/assets?name=$(basename "$f")" \

packaging/arch/PKGBUILD.prebuilt

@@ -7,16 +7,16 @@ pkgname=souveraine
 pkgver="${SOUVERAINE_PKGVER:?CI must set SOUVERAINE_PKGVER}"
 pkgrel=1
 pkgdesc="Sovereign agent substrate — server, TUI, surfaces"
-arch=('aarch64')
+arch=("${SOUVERAINE_PKGARCH:?CI must set SOUVERAINE_PKGARCH}")
 url="https://gitea.wiuf.net/Fimeg/souveraine"
 license=('MIT')
-depends=('gcc-libs')
+depends=('gcc-libs' 'alsa-lib')
 options=('!strip')
-source=('souveraine-aarch64' 'souveraine.service' 'LICENSE')
+source=('souveraine-binary' 'souveraine.service' 'LICENSE')
 sha256sums=('SKIP' 'SKIP' 'SKIP')
 
 package() {
-    install -Dm755 "$srcdir/souveraine-aarch64" "$pkgdir/usr/bin/souveraine"
+    install -Dm755 "$srcdir/souveraine-binary" "$pkgdir/usr/bin/souveraine"
     sed 's|%h/.local/bin/souveraine|/usr/bin/souveraine|' "$srcdir/souveraine.service" \
         | install -Dm644 /dev/stdin "$pkgdir/usr/lib/systemd/user/souveraine.service"
     install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"

packaging/arch/souveraine-archive-key.asc

@@ -0,0 +1,10 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMEalQ47RYJKwYBBAHaRw8BAQdAr8Qx2Czxw1qJNp7Io9usd9P1ayqHYuuHCzNm
+9k6ocYO0NlNvdXZlcmFpbmUgUGFja2FnZSBBcmNoaXZlIDxwYWNrYWdlc0Bzb3V2
+ZXJhaW5lLmxvY2FsPoiWBBMWCgA+FiEEPNnpniIsKhdJhvya/0lJqiDI6REFAmpU
+OO0CGwMFCQPCZwAFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQ/0lJqiDI6RHb
+lgD9E8WBlE4agkW2bXq9X6Hz86lRWdlWOHkxUCnCZN3HMS8A/1WE8gL8U5A2grDD
+bWms5/iphtrh2S1Up031H9a+bvEL
+=/YGc
+-----END PGP PUBLIC KEY BLOCK-----

packaging/arch/souveraine-edge.conf

@@ -0,0 +1,9 @@
+# Install this file as /etc/pacman.d/souveraine-edge.conf, then add
+# `Include = /etc/pacman.d/souveraine-edge.conf` to /etc/pacman.conf.
+#
+# Bootstrap the archive key first:
+#   pacman-key --add souveraine-archive-key.asc
+#   pacman-key --lsign-key 3CD9E99E222C2A174986FC9AFF4949AA20C8E911
+[souveraine]
+SigLevel = Required DatabaseRequired
+Server = https://gitea.wiuf.net/Fimeg/souveraine/releases/download/edge