MeWeb/.gitea/scripts/packages.sh

#!/bin/sh
set -eu
version=${1:-}
root=${PACKAGES_ROOT:-/var/www/packages.arasaka.software}
keep=${PACKAGES_KEEP:-5}
url=https://packages.arasaka.software
fingerprint=F92C166E9B1C13EDD1629E76888DCF969D133FB2
if [ -n "$version" ]; then
  releases=$(pwd)/releases/$version
  deb=$releases/MeWeb-$version-linux-x64.deb
  rpm=$releases/MeWeb-$version-linux-x64.rpm
  test -f "$deb"
  test -f "$rpm"
elif [ ! -e "$root/apt" ] || [ ! -e "$root/rpm" ]; then
  echo "no repositories at $root yet: the first release makes them"
  exit 0
fi
tools=$(dpkg-query -W -f '${Package} ${Version}\n' apt-utils createrepo-c dpkg gnupg rpm)
named=$(echo "$tools" | paste -sd, - | sed 's/,/, /g')
stamp=$( { echo "$tools"; cat "$0"; } | sha256sum | cut -d' ' -f1)

exec 9>>"$root/.lock"
flock -w 2700 9
if [ -z "$version" ] && [ "$(cat "$(readlink -f "$root/apt")/../built-from" 2>/dev/null)" = "$stamp" ]; then
  echo "nothing new: the repositories are already built with $named"
  exit 0
fi
echo "$named"

keys=$(mktemp -d)
trap 'rm -rf "$keys"' EXIT
export GNUPGHOME="$keys"
printf '%s\n' "$PACKAGES_SIGNING_KEY" | gpg --batch --quiet --import
gpg --batch --with-colons --list-secret-keys | grep -q "^fpr:::::::::$fingerprint:$"
gpg --batch --armor --export "$fingerprint" > "$keys/public.asc"

if [ -n "$version" ]; then
  rpmsign --define "__gpg /usr/bin/gpg" --define "_gpg_name $fingerprint" --define "_gpg_path $keys" --addsign "$rpm" >/dev/null
  rpmkeys --dbpath "$keys/rpmdb" --import "$keys/public.asc"
  rpmkeys --dbpath "$keys/rpmdb" -K "$rpm" | grep -q 'digests signatures OK'

  full=$(dpkg-deb -f "$deb" Version)
  test "$(dpkg-deb -f "$deb" Package)" = meweb
  test "${full%-*}" = "$version"
  debname=meweb_${full}_$(dpkg-deb -f "$deb" Architecture).deb
  rpmname=$(rpm -qp --nosignature --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}.rpm' "$rpm")
  test "$(rpm -qp --nosignature --qf '%{NAME} %{VERSION}' "$rpm")" = "meweb $version"
fi

snap=$root/.snap/$(date -u +%Y%m%d%H%M%S)-${version:-tools}
mkdir -p "$snap/apt/pool/main" "$snap/rpm"
if [ -d "$root/apt/pool/main" ]; then cp -al "$root/apt/pool/main/." "$snap/apt/pool/main/"; fi
if [ -d "$root/rpm" ]; then
  for folder in "$root"/rpm/*/; do
    [ "$(basename "$folder")" = repodata ] || cp -al "$folder" "$snap/rpm/"
  done
fi
mkdir -p "$snap/apt/pool/main/m/meweb" "$snap/rpm/meweb"
if [ -n "$version" ]; then
  rm -f "$snap/apt/pool/main/m/meweb/$debname" "$snap/rpm/meweb/$rpmname"
  cp "$deb" "$snap/apt/pool/main/m/meweb/$debname"
  cp "$rpm" "$snap/rpm/meweb/$rpmname"
fi
for folder in "$snap/apt/pool/main/m/meweb" "$snap/rpm/meweb"; do
  ls "$folder" | sed -E 's/^meweb[_-]([0-9.]+)-.*/\1/' | sort -uV | head -n "-$keep" | while read -r old; do
    rm -f "$folder/meweb_$old-"* "$folder/meweb-$old-"*
  done
done
if [ -z "$version" ]; then
  debname=$(ls "$snap/apt/pool/main/m/meweb" | sort -V | tail -n 1)
  rpmname=$(ls "$snap/rpm/meweb" | sort -V | tail -n 1)
  full=$(dpkg-deb -f "$snap/apt/pool/main/m/meweb/$debname" Version)
fi

binary=$snap/apt/dists/stable/main/binary-amd64
mkdir -p "$binary"
(cd "$snap/apt" && apt-ftparchive packages pool) > "$binary/Packages"
gzip -9nc "$binary/Packages" > "$binary/Packages.gz"
(cd "$snap/apt/dists/stable" && apt-ftparchive \
  -o APT::FTPArchive::Release::Origin=Arasaka -o APT::FTPArchive::Release::Label=Arasaka \
  -o APT::FTPArchive::Release::Suite=stable -o APT::FTPArchive::Release::Codename=stable \
  -o APT::FTPArchive::Release::Architectures=amd64 -o APT::FTPArchive::Release::Components=main \
  -o APT::FTPArchive::Release::NotAutomatic=yes -o APT::FTPArchive::Release::ButAutomaticUpgrades=yes \
  -o "APT::FTPArchive::Release::Description=Arasaka packages" release .) > "$keys/Release"
mv "$keys/Release" "$snap/apt/dists/stable/Release"
gpg --batch --yes --local-user "$fingerprint" --clearsign -o "$snap/apt/dists/stable/InRelease" "$snap/apt/dists/stable/Release"
gpg --batch --yes --local-user "$fingerprint" --armor --detach-sign -o "$snap/apt/dists/stable/Release.gpg" "$snap/apt/dists/stable/Release"

createrepo_c --quiet "$snap/rpm"
repodata=$snap/rpm/repodata
gpg --batch --yes --local-user "$fingerprint" --armor --detach-sign -o "$repodata/repomd.xml.asc" "$repodata/repomd.xml"
cp "$keys/public.asc" "$repodata/repomd.xml.key"
if [ -f "$root/rpm/repodata/repomd.xml" ]; then
  grep -o 'repodata/[^"]*' "$root/rpm/repodata/repomd.xml" | while read -r href; do
    [ -e "$snap/rpm/$href" ] || cp "$root/rpm/$href" "$snap/rpm/$href"
  done
fi
chmod -R u=rwX,go=rX "$snap"
echo "$stamp" > "$snap/built-from"

for part in apt rpm; do
  ln -sfn ".snap/$(basename "$snap")/$part" "$root/$part.new"
  mv -T -f "$root/$part.new" "$root/$part"
done
ls -1d "$root"/.snap/* | sort | head -n -3 | while read -r old; do
  find "$old" -maxdepth 0 -mmin +1440 -exec rm -rf {} +
done
echo "published $root/apt and $root/rpm, newest $debname and $rpmname"

if [ -n "$version" ]; then
  (cd "$releases" && for file in $(ls | LC_ALL=C sort); do [ "$file" = SHA256SUMS.txt ] || sha256sum "$file"; done) > "$keys/sums"
  mv "$keys/sums" "$releases/SHA256SUMS.txt"
fi

if [ "$root" = /var/www/packages.arasaka.software ]; then
  curl -fsS "$url/apt/dists/stable/main/binary-amd64/Packages" | grep -qx "Version: $full"
  curl -fsS "$url/apt/dists/stable/InRelease" > "$keys/InRelease"
  gpg --batch --quiet --verify "$keys/InRelease"
  curl -fsS "$url/rpm/repodata/repomd.xml" > "$keys/repomd.xml"
  curl -fsS "$url/rpm/repodata/repomd.xml.asc" > "$keys/repomd.xml.asc"
  gpg --batch --quiet --verify "$keys/repomd.xml.asc" "$keys/repomd.xml"
  curl -fsSI "$url/rpm/meweb/$rpmname" > /dev/null
  echo "live at $url: meweb $full"
fi