thepraandClaude Opus 5.5
599ea2bf84
Build / Desktop, server and tools (push) Successful in 1m17s
.gitea/scripts/packages.sh signs the rpm with the org secret PACKAGES_SIGNING_KEY, publishes the deb and rpm into a new snapshot of the repository, signs its metadata and rewrites SHA256SUMS.txt, on the nuvola runner. Tested against a copy of the live repository with Debian 13 apt and Fedora 44 dnf. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KizzWs2WQPWN2qgE7G6r8B
100 lines
4.5 KiB
Bash
Executable File
100 lines
4.5 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
version=$1
|
|
releases=$(pwd)/releases/$version
|
|
root=${PACKAGES_ROOT:-/var/www/packages.arasaka.software}
|
|
keep=${PACKAGES_KEEP:-5}
|
|
url=https://packages.arasaka.software
|
|
fingerprint=F92C166E9B1C13EDD1629E76888DCF969D133FB2
|
|
deb=$releases/MeWeb-$version-linux-x64.deb
|
|
rpm=$releases/MeWeb-$version-linux-x64.rpm
|
|
test -f "$deb"
|
|
test -f "$rpm"
|
|
|
|
exec 9>>"$root/.lock"
|
|
flock -w 2700 9
|
|
|
|
keys=$(mktemp -d)
|
|
trap 'rm -rf "$keys"' EXIT
|
|
export GNUPGHOME="$keys"
|
|
printf '%s\n' "$PACKAGES_SIGNING_KEY" | gpg --batch --quiet --import
|
|
gpg --batch --with-colons --list-secret-keys | grep -q "^fpr:::::::::$fingerprint:$"
|
|
gpg --batch --armor --export "$fingerprint" > "$keys/public.asc"
|
|
|
|
rpmsign --define "__gpg /usr/bin/gpg" --define "_gpg_name $fingerprint" --define "_gpg_path $keys" --addsign "$rpm" >/dev/null
|
|
rpmkeys --dbpath "$keys/rpmdb" --import "$keys/public.asc"
|
|
rpmkeys --dbpath "$keys/rpmdb" -K "$rpm" | grep -q 'digests signatures OK'
|
|
|
|
full=$(dpkg-deb -f "$deb" Version)
|
|
test "$(dpkg-deb -f "$deb" Package)" = meweb
|
|
test "${full%-*}" = "$version"
|
|
debname=meweb_${full}_$(dpkg-deb -f "$deb" Architecture).deb
|
|
rpmname=$(rpm -qp --nosignature --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}.rpm' "$rpm")
|
|
test "$(rpm -qp --nosignature --qf '%{NAME} %{VERSION}' "$rpm")" = "meweb $version"
|
|
|
|
snap=$root/.snap/$(date -u +%Y%m%d%H%M%S)-$version
|
|
mkdir -p "$snap/apt/pool/main" "$snap/rpm"
|
|
if [ -d "$root/apt/pool/main" ]; then cp -al "$root/apt/pool/main/." "$snap/apt/pool/main/"; fi
|
|
if [ -d "$root/rpm" ]; then
|
|
for folder in "$root"/rpm/*/; do
|
|
[ "$(basename "$folder")" = repodata ] || cp -al "$folder" "$snap/rpm/"
|
|
done
|
|
fi
|
|
mkdir -p "$snap/apt/pool/main/m/meweb" "$snap/rpm/meweb"
|
|
rm -f "$snap/apt/pool/main/m/meweb/$debname" "$snap/rpm/meweb/$rpmname"
|
|
cp "$deb" "$snap/apt/pool/main/m/meweb/$debname"
|
|
cp "$rpm" "$snap/rpm/meweb/$rpmname"
|
|
for folder in "$snap/apt/pool/main/m/meweb" "$snap/rpm/meweb"; do
|
|
ls "$folder" | sed -E 's/^meweb[_-]([0-9.]+)-.*/\1/' | sort -uV | head -n "-$keep" | while read -r old; do
|
|
rm -f "$folder/meweb_$old-"* "$folder/meweb-$old-"*
|
|
done
|
|
done
|
|
|
|
binary=$snap/apt/dists/stable/main/binary-amd64
|
|
mkdir -p "$binary"
|
|
(cd "$snap/apt" && apt-ftparchive packages pool) > "$binary/Packages"
|
|
gzip -9nc "$binary/Packages" > "$binary/Packages.gz"
|
|
(cd "$snap/apt/dists/stable" && apt-ftparchive \
|
|
-o APT::FTPArchive::Release::Origin=Arasaka -o APT::FTPArchive::Release::Label=Arasaka \
|
|
-o APT::FTPArchive::Release::Suite=stable -o APT::FTPArchive::Release::Codename=stable \
|
|
-o APT::FTPArchive::Release::Architectures=amd64 -o APT::FTPArchive::Release::Components=main \
|
|
-o APT::FTPArchive::Release::NotAutomatic=yes -o APT::FTPArchive::Release::ButAutomaticUpgrades=yes \
|
|
-o "APT::FTPArchive::Release::Description=Arasaka packages" release .) > "$keys/Release"
|
|
mv "$keys/Release" "$snap/apt/dists/stable/Release"
|
|
gpg --batch --yes --local-user "$fingerprint" --clearsign -o "$snap/apt/dists/stable/InRelease" "$snap/apt/dists/stable/Release"
|
|
gpg --batch --yes --local-user "$fingerprint" --armor --detach-sign -o "$snap/apt/dists/stable/Release.gpg" "$snap/apt/dists/stable/Release"
|
|
|
|
createrepo_c --quiet "$snap/rpm"
|
|
repodata=$snap/rpm/repodata
|
|
gpg --batch --yes --local-user "$fingerprint" --armor --detach-sign -o "$repodata/repomd.xml.asc" "$repodata/repomd.xml"
|
|
cp "$keys/public.asc" "$repodata/repomd.xml.key"
|
|
if [ -f "$root/rpm/repodata/repomd.xml" ]; then
|
|
grep -o 'repodata/[^"]*' "$root/rpm/repodata/repomd.xml" | while read -r href; do
|
|
[ -e "$snap/rpm/$href" ] || cp "$root/rpm/$href" "$snap/rpm/$href"
|
|
done
|
|
fi
|
|
chmod -R u=rwX,go=rX "$snap"
|
|
|
|
for part in apt rpm; do
|
|
ln -sfn ".snap/$(basename "$snap")/$part" "$root/$part.new"
|
|
mv -T -f "$root/$part.new" "$root/$part"
|
|
done
|
|
ls -1d "$root"/.snap/* | sort | head -n -3 | while read -r old; do
|
|
find "$old" -maxdepth 0 -mmin +1440 -exec rm -rf {} +
|
|
done
|
|
echo "published $debname and $rpmname in $root"
|
|
|
|
(cd "$releases" && for file in $(ls | LC_ALL=C sort); do [ "$file" = SHA256SUMS.txt ] || sha256sum "$file"; done) > "$keys/sums"
|
|
mv "$keys/sums" "$releases/SHA256SUMS.txt"
|
|
|
|
if [ "$root" = /var/www/packages.arasaka.software ]; then
|
|
curl -fsS "$url/apt/dists/stable/main/binary-amd64/Packages" | grep -qx "Version: $full"
|
|
curl -fsS "$url/apt/dists/stable/InRelease" > "$keys/InRelease"
|
|
gpg --batch --quiet --verify "$keys/InRelease"
|
|
curl -fsS "$url/rpm/repodata/repomd.xml" > "$keys/repomd.xml"
|
|
curl -fsS "$url/rpm/repodata/repomd.xml.asc" > "$keys/repomd.xml.asc"
|
|
gpg --batch --quiet --verify "$keys/repomd.xml.asc" "$keys/repomd.xml"
|
|
curl -fsSI "$url/rpm/meweb/$rpmname" > /dev/null
|
|
echo "live at $url: meweb $version"
|
|
fi
|