A daily job keeps the tools behind the deb and rpm repositories current
Build / Desktop, server and tools (push) Successful in 1m28s
Build / Desktop, server and tools (push) Successful in 1m28s
The box updates the tools that build packages.arasaka.software every morning, and packages.yml rebuilds and re-signs the apt and rpm repositories when those tools change, so a broken update shows up the same morning, not at the next release. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T9uhaCTSycTh1r8At679Pz
This commit is contained in:
thepraandClaude Opus 5.5 committed
1 parent
10a85e6bc5
commit
e112c1dc1e
3 files changed
+87
-24
No files matched your search
+48
-23
@@ -1,18 +1,31 @@
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
version=$1
|
||||
releases=$(pwd)/releases/$version
|
||||
version=${1:-}
|
||||
root=${PACKAGES_ROOT:-/var/www/packages.arasaka.software}
|
||||
keep=${PACKAGES_KEEP:-5}
|
||||
url=https://packages.arasaka.software
|
||||
fingerprint=F92C166E9B1C13EDD1629E76888DCF969D133FB2
|
||||
deb=$releases/MeWeb-$version-linux-x64.deb
|
||||
rpm=$releases/MeWeb-$version-linux-x64.rpm
|
||||
test -f "$deb"
|
||||
test -f "$rpm"
|
||||
if [ -n "$version" ]; then
|
||||
releases=$(pwd)/releases/$version
|
||||
deb=$releases/MeWeb-$version-linux-x64.deb
|
||||
rpm=$releases/MeWeb-$version-linux-x64.rpm
|
||||
test -f "$deb"
|
||||
test -f "$rpm"
|
||||
elif [ ! -e "$root/apt" ] || [ ! -e "$root/rpm" ]; then
|
||||
echo "no repositories at $root yet: the first release makes them"
|
||||
exit 0
|
||||
fi
|
||||
tools=$(dpkg-query -W -f '${Package} ${Version}\n' apt-utils createrepo-c dpkg gnupg rpm)
|
||||
named=$(echo "$tools" | paste -sd, - | sed 's/,/, /g')
|
||||
stamp=$( { echo "$tools"; cat "$0"; } | sha256sum | cut -d' ' -f1)
|
||||
|
||||
exec 9>>"$root/.lock"
|
||||
flock -w 2700 9
|
||||
if [ -z "$version" ] && [ "$(cat "$(readlink -f "$root/apt")/../built-from" 2>/dev/null)" = "$stamp" ]; then
|
||||
echo "nothing new: the repositories are already built with $named"
|
||||
exit 0
|
||||
fi
|
||||
echo "$named"
|
||||
|
||||
keys=$(mktemp -d)
|
||||
trap 'rm -rf "$keys"' EXIT
|
||||
@@ -21,18 +34,20 @@ printf '%s\n' "$PACKAGES_SIGNING_KEY" | gpg --batch --quiet --import
|
||||
gpg --batch --with-colons --list-secret-keys | grep -q "^fpr:::::::::$fingerprint:$"
|
||||
gpg --batch --armor --export "$fingerprint" > "$keys/public.asc"
|
||||
|
||||
rpmsign --define "__gpg /usr/bin/gpg" --define "_gpg_name $fingerprint" --define "_gpg_path $keys" --addsign "$rpm" >/dev/null
|
||||
rpmkeys --dbpath "$keys/rpmdb" --import "$keys/public.asc"
|
||||
rpmkeys --dbpath "$keys/rpmdb" -K "$rpm" | grep -q 'digests signatures OK'
|
||||
if [ -n "$version" ]; then
|
||||
rpmsign --define "__gpg /usr/bin/gpg" --define "_gpg_name $fingerprint" --define "_gpg_path $keys" --addsign "$rpm" >/dev/null
|
||||
rpmkeys --dbpath "$keys/rpmdb" --import "$keys/public.asc"
|
||||
rpmkeys --dbpath "$keys/rpmdb" -K "$rpm" | grep -q 'digests signatures OK'
|
||||
|
||||
full=$(dpkg-deb -f "$deb" Version)
|
||||
test "$(dpkg-deb -f "$deb" Package)" = meweb
|
||||
test "${full%-*}" = "$version"
|
||||
debname=meweb_${full}_$(dpkg-deb -f "$deb" Architecture).deb
|
||||
rpmname=$(rpm -qp --nosignature --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}.rpm' "$rpm")
|
||||
test "$(rpm -qp --nosignature --qf '%{NAME} %{VERSION}' "$rpm")" = "meweb $version"
|
||||
full=$(dpkg-deb -f "$deb" Version)
|
||||
test "$(dpkg-deb -f "$deb" Package)" = meweb
|
||||
test "${full%-*}" = "$version"
|
||||
debname=meweb_${full}_$(dpkg-deb -f "$deb" Architecture).deb
|
||||
rpmname=$(rpm -qp --nosignature --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}.rpm' "$rpm")
|
||||
test "$(rpm -qp --nosignature --qf '%{NAME} %{VERSION}' "$rpm")" = "meweb $version"
|
||||
fi
|
||||
|
||||
snap=$root/.snap/$(date -u +%Y%m%d%H%M%S)-$version
|
||||
snap=$root/.snap/$(date -u +%Y%m%d%H%M%S)-${version:-tools}
|
||||
mkdir -p "$snap/apt/pool/main" "$snap/rpm"
|
||||
if [ -d "$root/apt/pool/main" ]; then cp -al "$root/apt/pool/main/." "$snap/apt/pool/main/"; fi
|
||||
if [ -d "$root/rpm" ]; then
|
||||
@@ -41,14 +56,21 @@ if [ -d "$root/rpm" ]; then
|
||||
done
|
||||
fi
|
||||
mkdir -p "$snap/apt/pool/main/m/meweb" "$snap/rpm/meweb"
|
||||
rm -f "$snap/apt/pool/main/m/meweb/$debname" "$snap/rpm/meweb/$rpmname"
|
||||
cp "$deb" "$snap/apt/pool/main/m/meweb/$debname"
|
||||
cp "$rpm" "$snap/rpm/meweb/$rpmname"
|
||||
if [ -n "$version" ]; then
|
||||
rm -f "$snap/apt/pool/main/m/meweb/$debname" "$snap/rpm/meweb/$rpmname"
|
||||
cp "$deb" "$snap/apt/pool/main/m/meweb/$debname"
|
||||
cp "$rpm" "$snap/rpm/meweb/$rpmname"
|
||||
fi
|
||||
for folder in "$snap/apt/pool/main/m/meweb" "$snap/rpm/meweb"; do
|
||||
ls "$folder" | sed -E 's/^meweb[_-]([0-9.]+)-.*/\1/' | sort -uV | head -n "-$keep" | while read -r old; do
|
||||
rm -f "$folder/meweb_$old-"* "$folder/meweb-$old-"*
|
||||
done
|
||||
done
|
||||
if [ -z "$version" ]; then
|
||||
debname=$(ls "$snap/apt/pool/main/m/meweb" | sort -V | tail -n 1)
|
||||
rpmname=$(ls "$snap/rpm/meweb" | sort -V | tail -n 1)
|
||||
full=$(dpkg-deb -f "$snap/apt/pool/main/m/meweb/$debname" Version)
|
||||
fi
|
||||
|
||||
binary=$snap/apt/dists/stable/main/binary-amd64
|
||||
mkdir -p "$binary"
|
||||
@@ -74,6 +96,7 @@ if [ -f "$root/rpm/repodata/repomd.xml" ]; then
|
||||
done
|
||||
fi
|
||||
chmod -R u=rwX,go=rX "$snap"
|
||||
echo "$stamp" > "$snap/built-from"
|
||||
|
||||
for part in apt rpm; do
|
||||
ln -sfn ".snap/$(basename "$snap")/$part" "$root/$part.new"
|
||||
@@ -82,10 +105,12 @@ done
|
||||
ls -1d "$root"/.snap/* | sort | head -n -3 | while read -r old; do
|
||||
find "$old" -maxdepth 0 -mmin +1440 -exec rm -rf {} +
|
||||
done
|
||||
echo "published $debname and $rpmname in $root"
|
||||
echo "published $root/apt and $root/rpm, newest $debname and $rpmname"
|
||||
|
||||
(cd "$releases" && for file in $(ls | LC_ALL=C sort); do [ "$file" = SHA256SUMS.txt ] || sha256sum "$file"; done) > "$keys/sums"
|
||||
mv "$keys/sums" "$releases/SHA256SUMS.txt"
|
||||
if [ -n "$version" ]; then
|
||||
(cd "$releases" && for file in $(ls | LC_ALL=C sort); do [ "$file" = SHA256SUMS.txt ] || sha256sum "$file"; done) > "$keys/sums"
|
||||
mv "$keys/sums" "$releases/SHA256SUMS.txt"
|
||||
fi
|
||||
|
||||
if [ "$root" = /var/www/packages.arasaka.software ]; then
|
||||
curl -fsS "$url/apt/dists/stable/main/binary-amd64/Packages" | grep -qx "Version: $full"
|
||||
@@ -95,5 +120,5 @@ if [ "$root" = /var/www/packages.arasaka.software ]; then
|
||||
curl -fsS "$url/rpm/repodata/repomd.xml.asc" > "$keys/repomd.xml.asc"
|
||||
gpg --batch --quiet --verify "$keys/repomd.xml.asc" "$keys/repomd.xml"
|
||||
curl -fsSI "$url/rpm/meweb/$rpmname" > /dev/null
|
||||
echo "live at $url: meweb $version"
|
||||
echo "live at $url: meweb $full"
|
||||
fi
|
||||
@@ -0,0 +1,24 @@
|
||||
name: Package tools
|
||||
|
||||
on:
|
||||
schedule:
|
||||
- cron: '43 5 * * *'
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
refresh:
|
||||
name: The box's updated package tools, tried on the apt and rpm repositories
|
||||
runs-on: nuvola
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Check that the box brought the tools up to date this morning
|
||||
run: |
|
||||
systemctl show packages-tools -p Result -p ExecMainExitTimestamp
|
||||
systemctl is-active --quiet packages-tools.timer
|
||||
test "$(systemctl show packages-tools -p Result --value)" = success
|
||||
|
||||
- name: Rebuild the apt and rpm repositories on packages.arasaka.software when the tools changed
|
||||
env:
|
||||
PACKAGES_SIGNING_KEY: ${{ secrets.PACKAGES_SIGNING_KEY }}
|
||||
run: .gitea/scripts/packages.sh
|
||||
Reference in new issue
Block a user