c-ludenberg
ba245056c4
Replace the maintainer key in antergos-next-keyring with the new Antergos NeXT Package Signing key (AA644A09..., sign subkey 3F1B219A..., expires 2028-08-16). CI now signs the repo database with it (--detach-sign, loopback pinentry from SIGNING_KEY / SIGNING_PASSPHRASE secrets). Client SigLevel switches from 'Optional TrustAll' to 'DatabaseRequired PackageOptional' — the signed DB authenticates every package via its checksums.
81 lines
2.2 KiB
YAML
81 lines
2.2 KiB
YAML
name: Build Packages
|
|
|
|
on:
|
|
push:
|
|
branches: [master]
|
|
workflow_dispatch:
|
|
schedule:
|
|
- cron: "0 0 * * 1"
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: artixlinux/artixlinux:base-dinit
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install deps
|
|
run: |
|
|
pacman -Syu --noconfirm --needed --overwrite='*' \
|
|
python-yaml \
|
|
git \
|
|
sudo \
|
|
base-devel \
|
|
debugedit
|
|
|
|
- name: Create builder user
|
|
run: |
|
|
useradd -m builder
|
|
echo "builder ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
|
|
|
|
- name: Build packages
|
|
run: python build-packages.py
|
|
|
|
- name: Set up repo
|
|
run: |
|
|
mkdir -p repo/antergos-pkgs/os/x86_64
|
|
cp /tmp/pkgout/*.pkg.tar.zst repo/antergos-pkgs/os/x86_64/
|
|
|
|
- name: Generate repo database
|
|
run: |
|
|
cd repo/antergos-pkgs/os/x86_64
|
|
repo-add antergos-pkgs.db.tar.gz *.pkg.tar.zst
|
|
|
|
- name: Sign repo database
|
|
env:
|
|
SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
|
|
SIGNING_PASSPHRASE: ${{ secrets.SIGNING_PASSPHRASE }}
|
|
run: |
|
|
if [[ -n "$SIGNING_KEY" && -n "$SIGNING_PASSPHRASE" ]]; then
|
|
export GNUPGHOME=/tmp/gpg-sign
|
|
mkdir -p "$GNUPGHOME" && chmod 700 "$GNUPGHOME"
|
|
echo "$SIGNING_KEY" | base64 -d > /tmp/signing-key.gpg
|
|
gpg --batch --import /tmp/signing-key.gpg
|
|
cd repo/antergos-pkgs/os/x86_64
|
|
gpg --batch --yes --pinentry-mode loopback --passphrase "$SIGNING_PASSPHRASE" \
|
|
--detach-sign --output antergos-pkgs.db.tar.gz.sig antergos-pkgs.db.tar.gz
|
|
rm -rf "$GNUPGHOME" /tmp/signing-key.gpg
|
|
else
|
|
echo "Signing secrets not set — skipping signature"
|
|
fi
|
|
|
|
- name: Copy to root for flat-URL compat
|
|
run: |
|
|
cp repo/antergos-pkgs/os/x86_64/*.pkg.tar.zst repo/
|
|
cp repo/antergos-pkgs/os/x86_64/antergos-pkgs.db* repo/
|
|
|
|
- name: Generate index and package list
|
|
run: python generate-index.py
|
|
|
|
- name: Deploy to Pages
|
|
uses: peaceiris/actions-gh-pages@v3
|
|
with:
|
|
github_token: ${{ secrets.GITHUB_TOKEN }}
|
|
publish_dir: ./repo
|
|
keep_files: false
|