blob: 09ce3790e2b9678381d0619cbb54d472145468a6 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
|
name: Publish prebuilt linux-raveos kernel
on:
workflow_dispatch:
concurrency:
group: raveos-repo-publish
cancel-in-progress: false
jobs:
publish:
runs-on: iso-builder
steps:
- name: Check prebuilt packages
run: |
set -euo pipefail
SRC="$HOME/kernel-kesz"
ls "$SRC"/linux-*.pkg.tar.zst
for pkg in "$SRC"/linux-*.pkg.tar.zst; do
bsdtar -xOf "$pkg" .PKGINFO | grep -E '^(pkgname|pkgver) ='
done
( cd "$SRC" && sha256sum -c SHA256SUMS )
- name: Fetch core repo via rsync
run: |
set -euo pipefail
RSYNC_SSH="ssh -p 2222 -i $HOME/.ssh/vps_backup_key -o StrictHostKeyChecking=accept-new -o BatchMode=yes"
rm -rf /tmp/raveos-core-repo /tmp/builtpkgs
mkdir -p /tmp/raveos-core-repo/x86_64 /tmp/builtpkgs
rsync -az -e "$RSYNC_SSH" \
root@10.66.66.1:/root/docker/repo/repo/x86_64/ /tmp/raveos-core-repo/x86_64/
test -f /tmp/raveos-core-repo/x86_64/raveos-core-repo.db.tar.xz
cp -v "$HOME"/kernel-kesz/linux-*.pkg.tar.zst /tmp/builtpkgs/
- name: Import GPG signing key
env:
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
run: |
set -euo pipefail
export GNUPGHOME=/tmp/raveos-gnupg
rm -rf "$GNUPGHOME"
mkdir -m 700 "$GNUPGHOME"
printf '%s' "$GPG_PRIVATE_KEY" | base64 -d | gpg --batch --import
- name: Sign packages
env:
GPG_PASSPHRASE: ${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}
run: |
set -euo pipefail
export GNUPGHOME=/tmp/raveos-gnupg
PASSFILE=$(mktemp)
chmod 600 "$PASSFILE"
trap 'rm -f "$PASSFILE"' EXIT
printf '%s' "$GPG_PASSPHRASE" > "$PASSFILE"
for pkg in /tmp/builtpkgs/*.pkg.tar.zst; do
gpg --batch --yes --pinentry-mode loopback \
--passphrase-file "$PASSFILE" \
--local-user 25C7668F1235F5664F037671BDB2A9CE6EBFF113 \
--detach-sign --no-armor "$pkg"
done
- name: Update repo database and sync to VPS
env:
GPG_PASSPHRASE: ${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}
run: |
set -euo pipefail
CORE="/tmp/raveos-core-repo/x86_64"
for pkg in /tmp/builtpkgs/*.pkg.tar.zst; do
PKGNAME=$(bsdtar -xOf "$pkg" .PKGINFO | awk -F' = ' '/^pkgname =/{print $2; exit}')
rm -f "$CORE/${PKGNAME}-"[0-9]*.pkg.tar.zst* 2>/dev/null || true
cp -v "$pkg" "$pkg.sig" "$CORE/"
done
export GNUPGHOME=/tmp/raveos-gnupg
cd "$CORE"
repo-add raveos-core-repo.db.tar.xz *.pkg.tar.zst
PASSFILE=$(mktemp)
chmod 600 "$PASSFILE"
trap 'rm -f "$PASSFILE"' EXIT
printf '%s' "$GPG_PASSPHRASE" > "$PASSFILE"
for f in raveos-core-repo.db.tar.xz raveos-core-repo.files.tar.xz; do
gpg --batch --yes --pinentry-mode loopback \
--passphrase-file "$PASSFILE" \
--local-user 25C7668F1235F5664F037671BDB2A9CE6EBFF113 \
--detach-sign --no-armor -o "$f.sig" "$f"
done
ln -sf raveos-core-repo.db.tar.xz.sig raveos-core-repo.db.sig
ln -sf raveos-core-repo.files.tar.xz.sig raveos-core-repo.files.sig
RSYNC_SSH="ssh -p 2222 -i $HOME/.ssh/vps_backup_key -o StrictHostKeyChecking=accept-new -o BatchMode=yes"
rsync -az --delete -e "$RSYNC_SSH" \
"$CORE/" root@10.66.66.1:/root/docker/repo/repo/x86_64/
rm -rf "$HOME/kernel-kesz"
echo "::notice title=Kernel published::prebuilt linux-raveos published"
- name: Cleanup
if: always()
run: |
gpgconf --homedir /tmp/raveos-gnupg --kill gpg-agent || true
rm -rf /tmp/raveos-gnupg /tmp/builtpkgs /tmp/raveos-core-repo || true
|