blob: f50b66c2c20bc7584b6c316191a791e38aba166c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
|
name: Build linux-raveos kernel
on:
push:
branches:
- main
paths:
- 'linux-raveos/**'
workflow_dispatch:
concurrency:
group: raveos-repo-publish
cancel-in-progress: false
jobs:
build:
runs-on: iso-builder
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Install build dependencies
run: |
set -euo pipefail
sudo pacman -Syu --noconfirm
sudo pacman -S --needed --noconfirm \
base-devel clang llvm lld bc binutils cpio gettext \
libelf openssl pahole perl python rust rust-bindgen \
rust-src xxhash xz zlib zstd rsync
- name: Fetch core repo via rsync
run: |
set -euo pipefail
RSYNC_SSH="ssh -p 2222 -i $HOME/.ssh/vps_backup_key -o StrictHostKeyChecking=accept-new -o BatchMode=yes"
rm -rf /tmp/raveos-core-repo
mkdir -p /tmp/raveos-core-repo/x86_64
rsync -az -e "$RSYNC_SSH" \
root@10.66.66.1:/root/docker/repo/repo/x86_64/ /tmp/raveos-core-repo/x86_64/
test -f /tmp/raveos-core-repo/x86_64/raveos-core-repo.db.tar.xz
mkdir -p /tmp/builtpkgs
- name: Import GPG signing key
run: |
set -euo pipefail
export GNUPGHOME=/tmp/raveos-gnupg
rm -rf "$GNUPGHOME"
mkdir -m 700 "$GNUPGHOME"
echo "${{ secrets.GPG_PRIVATE_KEY }}" | base64 -d | gpg --batch --import
- name: Build linux-raveos
run: |
set -euo pipefail
cd linux-raveos
rm -f *.pkg.tar.zst || true
makepkg -s --noconfirm -f
mkdir -p /tmp/builtpkgs
cp -v *.pkg.tar.zst /tmp/builtpkgs/
- name: Sign built packages
run: |
set -euo pipefail
export GNUPGHOME=/tmp/raveos-gnupg
PASSFILE=$(mktemp)
chmod 600 "$PASSFILE"
printf '%s' "${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}" > "$PASSFILE"
for pkg in /tmp/builtpkgs/*.pkg.tar.zst; do
[ -f "$pkg" ] || continue
gpg --batch --yes --pinentry-mode loopback \
--passphrase-file "$PASSFILE" \
--local-user 25C7668F1235F5664F037671BDB2A9CE6EBFF113 \
--detach-sign --no-armor "$pkg"
done
rm -f "$PASSFILE"
- name: Update repo database and sync to VPS
run: |
set -euo pipefail
BUILT=$(ls /tmp/builtpkgs/*.pkg.tar.zst 2>/dev/null || true)
if [ -z "$BUILT" ]; then
echo "Nincs csomag -> kihagyva"
exit 0
fi
CORE="/tmp/raveos-core-repo/x86_64"
for pkg in $BUILT; do
PKGNAME=$(bsdtar -xOf "$pkg" .PKGINFO | awk -F' = ' '/^pkgname =/{print $2; exit}')
rm -f "$CORE/${PKGNAME}-"[0-9]*.pkg.tar.zst* 2>/dev/null || true
cp -v "$pkg" "$CORE/"
[ -f "$pkg.sig" ] && cp -v "$pkg.sig" "$CORE/"
done
export GNUPGHOME=/tmp/raveos-gnupg
cd "$CORE"
ALLPKGS=$(ls *.pkg.tar.zst)
repo-add raveos-core-repo.db.tar.xz $ALLPKGS
PASSFILE=$(mktemp)
chmod 600 "$PASSFILE"
printf '%s' "${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}" > "$PASSFILE"
for f in raveos-core-repo.db.tar.xz raveos-core-repo.files.tar.xz; do
gpg --batch --yes --pinentry-mode loopback \
--passphrase-file "$PASSFILE" \
--local-user 25C7668F1235F5664F037671BDB2A9CE6EBFF113 \
--detach-sign --no-armor -o "$f.sig" "$f"
done
rm -f "$PASSFILE"
ln -sf raveos-core-repo.db.tar.xz.sig raveos-core-repo.db.sig
ln -sf raveos-core-repo.files.tar.xz.sig raveos-core-repo.files.sig
RSYNC_SSH="ssh -p 2222 -i $HOME/.ssh/vps_backup_key -o StrictHostKeyChecking=accept-new -o BatchMode=yes"
rsync -az --delete -e "$RSYNC_SSH" \
"$CORE/" root@10.66.66.1:/root/docker/repo/repo/x86_64/
echo "::notice title=Kernel published::linux-raveos published"
- name: Cleanup
if: always()
run: |
gpgconf --homedir /tmp/raveos-gnupg --kill gpg-agent || true
sudo rm -rf /tmp/raveos-gnupg || true
sudo rm -rf /tmp/builtpkgs || true
sudo rm -rf /tmp/raveos-core-repo || true
sudo rm -rf linux-raveos/src linux-raveos/pkg || true
df -h
|