name: RPM/DEB build aarch64 on: release: types: [published] workflow_dispatch: permissions: contents: read jobs: ci: permissions: contents: write id-token: write attestations: write name: "${{ matrix.target }}" strategy: matrix: target: - ubuntu-24.04-arm runs-on: ${{ matrix.target }} steps: - uses: actions/checkout@v7 - name: env run: | pwd echo "RELEASE=$(cat RELEASE)" >> $GITHUB_ENV BUILDDATE=$(sed -n 's/^#define BUILDDATE "\(.*\)"$/\1/p' src/version.h) [ -n "$BUILDDATE" ] || BUILDDATE=$(date -u +%y%m%d%H%M%S) echo "VERSION=$BUILDDATE" >> $GITHUB_ENV SOURCE_DATE_EPOCH=$(date -u -d "20${BUILDDATE:0:2}-${BUILDDATE:2:2}-${BUILDDATE:4:2} ${BUILDDATE:6:2}:${BUILDDATE:8:2}:${BUILDDATE:10:2}" +%s) echo "SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH" >> $GITHUB_ENV - name: echo env run: echo "release $RELEASE version $VERSION" - name: Linux libraries run: | sudo apt update sudo apt install libssl-dev libpam-dev libpcre2-dev rpm build-essential debhelper - name: configure rpm env run: | mkdir ~/debian mkdir -p ~/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS} tar -czf ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz --transform "s,^,3proxy-$RELEASE/," . ln -s ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/rpmbuild/SOURCES/$RELEASE.tar.gz cp scripts/rh/3proxy.spec ~/rpmbuild/SPECS/3proxy-$RELEASE.spec cp ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/debian/3proxy_$RELEASE.orig.tar.gz - name: rpmbuild run: | mkdir -p rpmout for EL in 8 9 10; do docker run --rm \ -v "$HOME/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz:/src.tar.gz:ro" \ -v "$PWD/scripts/rh/3proxy.spec:/3proxy.spec:ro" \ -v "$PWD/rpmout:/out" \ -e RELEASE="$RELEASE" -e HOSTUID="$(id -u)" -e HOSTGID="$(id -g)" \ -e SOURCE_DATE_EPOCH="$SOURCE_DATE_EPOCH" \ "almalinux:$EL" bash -c ' set -e dnf -y install rpm-build gcc make openssl-devel pcre2-devel pam-devel tar gzip mkdir -p ~/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS} cp /src.tar.gz ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ln -sf ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/rpmbuild/SOURCES/$RELEASE.tar.gz cp /3proxy.spec ~/rpmbuild/SPECS/3proxy-$RELEASE.spec cd ~/rpmbuild/SPECS rpmbuild -ba \ --define "use_source_date_epoch_as_buildtime 1" \ --define "clamp_mtime_to_source_date_epoch 1" \ --define "_buildhost 3proxy.org" \ 3proxy-$RELEASE.spec cp ~/rpmbuild/RPMS/*/*.rpm /out/ chown "$HOSTUID:$HOSTGID" /out/*.rpm || chmod 0666 /out/*.rpm' done for f in rpmout/*.rpm; do dist=$(rpm -qp --qf '%{RELEASE}' "$f" | sed 's/^1\.//') arch=$(rpm -qp --qf '%{ARCH}' "$f") mv "$f" "3proxy-$RELEASE.$dist.$arch.rpm" done rmdir rpmout ls -l *.rpm - name: Get artifact rpm uses: actions/upload-artifact@v7 with: name: "3proxy-${{ env.RELEASE }}-arm64.rpm" path: "*.rpm" - name: debbuild run: | docker run --rm \ -v "$HOME/debian:/debian" \ -e RELEASE="$RELEASE" -e VERSION="$VERSION" \ -e SOURCE_DATE_EPOCH="$SOURCE_DATE_EPOCH" \ ubuntu:22.04 bash -c ' set -e export DEBIAN_FRONTEND=noninteractive apt-get update apt-get install -y build-essential debhelper fakeroot libssl-dev libpcre2-dev libpam0g-dev cd /debian tar xzf 3proxy_$RELEASE.orig.tar.gz cd 3proxy-$RELEASE { echo "3proxy ($RELEASE-$VERSION) buster; urgency=medium" echo " " echo " *3proxy $RELEASE build" echo " " echo " -- z3APA3A <3apa3a@3proxy.org> $(date -R -u -d @$SOURCE_DATE_EPOCH)" echo "" } > debian/changelog dpkg-buildpackage' cp ~/debian/3proxy_$RELEASE-"$VERSION"_arm64.deb ./3proxy-$RELEASE.arm64.deb - name: Get artifact deb uses: actions/upload-artifact@v7 with: name: "3proxy-${{ env.RELEASE }}-arm64.deb" path: "*.deb" - name: Import signing key if: github.event_name == 'release' env: GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} run: | if [ -z "$GPG_PRIVATE_KEY" ]; then echo "GPG_PRIVATE_KEY is not set"; exit 1; fi mkdir -p ~/.gnupg && chmod 700 ~/.gnupg printf 'allow-loopback-pinentry\ndefault-cache-ttl 7200\nmax-cache-ttl 7200\n' > ~/.gnupg/gpg-agent.conf gpgconf --kill gpg-agent || true printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --import KEYID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/{print $5; exit}') echo "GPG_KEYID=$KEYID" >> $GITHUB_ENV echo prime > /tmp/prime.txt gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \ -u "$KEYID" --detach-sign -o /dev/null /tmp/prime.txt rm -f /tmp/prime.txt - name: Sign rpm if: github.event_name == 'release' env: GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} run: | GPGBIN=$(command -v gpg) if [ -z "$GPGBIN" ]; then echo "gpg not found"; exit 1; fi umask 077 printf '%s' "$GPG_PASSPHRASE" > /tmp/gpgpass echo test > /tmp/signtest gpg --batch --yes --pinentry-mode loopback --passphrase-file /tmp/gpgpass \ -u "$GPG_KEYID" --detach-sign -o /tmp/signtest.sig /tmp/signtest echo "key can sign" { echo "%_gpg_name $GPG_KEYID" echo "%__gpg $GPGBIN" echo '%__gpg_sign_cmd %{__gpg} gpg --batch --no-armor --pinentry-mode loopback --passphrase-file /tmp/gpgpass --no-secmem-warning --digest-algo sha256 -u "%{_gpg_name}" -sbo %{__signature_filename} %{__plaintext_filename}' } > ~/.rpmmacros rpm --addsign *.rpm rm -f /tmp/gpgpass /tmp/signtest /tmp/signtest.sig for f in *.rpm; do sig=$(rpm -qp --qf '%{RSAHEADER:pgpsig}' "$f" 2>/dev/null) case "$sig" in ""|"(none)") sig=$(rpm -qp --qf '%{DSAHEADER:pgpsig}' "$f" 2>/dev/null) ;; esac case "$sig" in ""|"(none)") echo "$f is not signed" echo "--- rpm version ---"; rpm --version echo "--- sign cmd ---"; rpm --eval '%{__gpg_sign_cmd}' echo "--- secret keys ---"; gpg --list-secret-keys --with-colons | grep -E '^(sec|ssb):' || true exit 1 ;; esac echo "$f: $sig" done - name: Checksums and detached signatures if: github.event_name == 'release' env: GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} run: | sha256sum *.rpm *.deb > SHA256SUMS-arm64 for f in *.deb SHA256SUMS-arm64; do gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \ -u "$GPG_KEYID" --armor --detach-sign "$f" done sha256sum -c SHA256SUMS-arm64 gpg --verify SHA256SUMS-arm64.asc SHA256SUMS-arm64 - name: Attest build provenance if: github.event_name == 'release' uses: actions/attest-build-provenance@v2 with: subject-path: | *.rpm *.deb - name: Upload to release if: github.event_name == 'release' env: GH_TOKEN: ${{ github.token }} TAG: ${{ github.event.release.tag_name }} run: gh release upload "$TAG" *.rpm *.deb *.deb.asc SHA256SUMS-arm64 SHA256SUMS-arm64.asc