mirror of
https://github.com/3proxy/3proxy.git
synced 2026-08-26 09:55:48 +08:00
55761128b3
Do not rely on the gpg-agent passphrase cache surviving between steps: the signing command gets the passphrase from a file. A test signature is made first, so a wrong passphrase or a key which can not sign fails with a clear gpg error instead of an rpm which is silently left unsigned. On failure the rpm version, the sign command and the key capabilities are printed.
181 lines
7.5 KiB
YAML
181 lines
7.5 KiB
YAML
name: RPM/DEB build armhf
|
|
|
|
on:
|
|
release:
|
|
types: [published]
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
ci:
|
|
permissions:
|
|
contents: write
|
|
id-token: write
|
|
attestations: write
|
|
name: "${{ matrix.target }}"
|
|
strategy:
|
|
matrix:
|
|
target:
|
|
- ubuntu-latest
|
|
runs-on: ${{ matrix.target }}
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- name: env
|
|
run: |
|
|
pwd
|
|
echo "RELEASE=$(cat RELEASE)" >> $GITHUB_ENV
|
|
echo "VERSION=$(date +%y%m%d%H%M%S)" >> $GITHUB_ENV
|
|
- name: Linux libraries
|
|
run: |
|
|
sudo apt update
|
|
sudo dpkg --add-architecture armhf
|
|
echo "Types: deb" > ~/ubuntu.sources
|
|
echo "URIs: http://archive.ubuntu.com/ubuntu/" >> ~/ubuntu.sources
|
|
echo "Suites: noble noble-updates noble-backports" >> ~/ubuntu.sources
|
|
echo "Components: main restricted universe multiverse" >> ~/ubuntu.sources
|
|
echo "Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg" >> ~/ubuntu.sources
|
|
echo "Architectures: amd64" >> ~/ubuntu.sources
|
|
echo "" >> ~/ubuntu.sources
|
|
echo "Types: deb" >> ~/ubuntu.sources
|
|
echo "URIs: http://security.ubuntu.com/ubuntu/" >> ~/ubuntu.sources
|
|
echo "Suites: noble-security" >> ~/ubuntu.sources
|
|
echo "Components: main restricted universe multiverse" >> ~/ubuntu.sources
|
|
echo "Architectures: amd64" >> ~/ubuntu.sources
|
|
echo "Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg" >> ~/ubuntu.sources
|
|
echo "" >> ~/ubuntu.sources
|
|
echo "Types: deb" >>~/ubuntu.sources
|
|
echo "URIs: http://ports.ubuntu.com/ubuntu-ports/" >>~/ubuntu.sources
|
|
echo "Suites: noble noble-updates" >>~/ubuntu.sources
|
|
echo "Components: main restricted universe multiverse" >>~/ubuntu.sources
|
|
echo "Architectures: armhf" >>~/ubuntu.sources
|
|
echo "Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg" >>~/ubuntu.sources
|
|
sudo cp ~/ubuntu.sources /etc/apt/sources.list.d/ubuntu.sources
|
|
sudo apt update
|
|
sudo apt install libssl3t64:armhf openssl:armhf libssl-dev:armhf libpam0g:armhf libpam0g-dev:armhf libpcre2-dev:armhf rpm crossbuild-essential-armhf build-essential debhelper
|
|
- name: configure rpm env
|
|
run: |
|
|
mkdir ~/debian
|
|
mkdir -p ~/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
|
|
tar -czf ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz --transform "s,^,3proxy-$RELEASE/," .
|
|
ln -s ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/rpmbuild/SOURCES/$RELEASE.tar.gz
|
|
cp scripts/rh/3proxy.spec ~/rpmbuild/SPECS/3proxy-$RELEASE.spec
|
|
cp ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/debian/3proxy_$RELEASE.orig.tar.gz
|
|
- name: rpmbuild
|
|
run: |
|
|
ret=`pwd`
|
|
cd ~/rpmbuild/SPECS
|
|
PATH=/usr/arm-linux-gnueabihf/bin:$PATH
|
|
export PATH=$PATH
|
|
CC=arm-linux-gnueabihf-gcc
|
|
export CC=$CC
|
|
export RPATH=/usr/arm-linux-gnueabihf/lib:$RPATH
|
|
export LD_LIBRARY_PATH=/usr/arm-linux-gnueabihf/lib:$LD_LIBRARY_PATH
|
|
rpmbuild -ba --define "PAMLIB pam0g" --define "_arch arm" --define "cross yes" --target=arm-linux-gnueabihf 3proxy-$RELEASE.spec
|
|
cd $ret
|
|
mv ~/rpmbuild/RPMS/arm/3proxy-$RELEASE-1.arm.rpm 3proxy-$RELEASE.arm.rpm
|
|
- name: Get artifact rpm
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: "3proxy-${{ env.RELEASE }}-arm.rpm"
|
|
path: "*.rpm"
|
|
- name: debbuild
|
|
run: |
|
|
ret=`pwd`
|
|
cd ~/debian/
|
|
tar xzf 3proxy_$RELEASE.orig.tar.gz
|
|
cd 3proxy-$RELEASE
|
|
echo "3proxy ($RELEASE-$VERSION) buster; urgency=medium" >debian/changelog
|
|
echo " " >>debian/changelog
|
|
echo " *3proxy $RELEASE build" >>debian/changelog
|
|
echo " " >>debian/changelog
|
|
echo " -- z3APA3A <3apa3a@3proxy.org> "`date "+%a, %d %b %Y %H:%M:%S %z"` >>debian/changelog
|
|
echo "">>debian/changelog
|
|
PATH=/usr/arm-linux-gnueabihf/bin:$PATH
|
|
export PATH=$PATH
|
|
CC=arm-linux-gnueabihf-gcc
|
|
export CC=$CC
|
|
export RPATH=/usr/arm-linux-gnueabihf/lib:$RPATH
|
|
export LD_LIBRARY_PATH=/usr/arm-linux-gnueabihf/lib:$LD_LIBRARY_PATH
|
|
dpkg-buildpackage
|
|
cd $ret
|
|
cp ~/debian/3proxy_$RELEASE-"$VERSION"_armhf.deb ./3proxy-$RELEASE.arm.deb
|
|
- name: Get artifact deb
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: "3proxy-${{ env.RELEASE }}-arm.deb"
|
|
path: "*.deb"
|
|
- name: Import signing key
|
|
if: github.event_name == 'release'
|
|
env:
|
|
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
|
|
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
|
|
run: |
|
|
if [ -z "$GPG_PRIVATE_KEY" ]; then echo "GPG_PRIVATE_KEY is not set"; exit 1; fi
|
|
mkdir -p ~/.gnupg && chmod 700 ~/.gnupg
|
|
printf 'allow-loopback-pinentry\ndefault-cache-ttl 7200\nmax-cache-ttl 7200\n' > ~/.gnupg/gpg-agent.conf
|
|
gpgconf --kill gpg-agent || true
|
|
printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --import
|
|
KEYID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/{print $5; exit}')
|
|
echo "GPG_KEYID=$KEYID" >> $GITHUB_ENV
|
|
echo prime > /tmp/prime.txt
|
|
gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
|
|
-u "$KEYID" --detach-sign -o /dev/null /tmp/prime.txt
|
|
rm -f /tmp/prime.txt
|
|
- name: Sign rpm
|
|
if: github.event_name == 'release'
|
|
env:
|
|
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
|
|
run: |
|
|
GPGBIN=$(command -v gpg)
|
|
if [ -z "$GPGBIN" ]; then echo "gpg not found"; exit 1; fi
|
|
umask 077
|
|
printf '%s' "$GPG_PASSPHRASE" > /tmp/gpgpass
|
|
echo test > /tmp/signtest
|
|
gpg --batch --yes --pinentry-mode loopback --passphrase-file /tmp/gpgpass \
|
|
-u "$GPG_KEYID" --detach-sign -o /tmp/signtest.sig /tmp/signtest
|
|
echo "key can sign"
|
|
{ echo "%_gpg_name $GPG_KEYID"
|
|
echo "%__gpg $GPGBIN"
|
|
echo '%__gpg_sign_cmd %{__gpg} gpg --batch --no-armor --pinentry-mode loopback --passphrase-file /tmp/gpgpass --no-secmem-warning --digest-algo sha256 -u "%{_gpg_name}" -sbo %{__signature_filename} %{__plaintext_filename}'
|
|
} > ~/.rpmmacros
|
|
rpm --addsign *.rpm
|
|
rm -f /tmp/gpgpass /tmp/signtest /tmp/signtest.sig
|
|
for f in *.rpm; do
|
|
sig=$(rpm -qp --qf '%{RSAHEADER:pgpsig}' "$f" 2>/dev/null)
|
|
case "$sig" in ""|"(none)")
|
|
echo "$f is not signed"
|
|
echo "--- rpm version ---"; rpm --version
|
|
echo "--- sign cmd ---"; rpm --eval '%{__gpg_sign_cmd}'
|
|
echo "--- secret keys ---"; gpg --list-secret-keys --with-colons | grep -E '^(sec|ssb):' || true
|
|
exit 1 ;;
|
|
esac
|
|
echo "$f: $sig"
|
|
done
|
|
- name: Checksums and detached signatures
|
|
if: github.event_name == 'release'
|
|
env:
|
|
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
|
|
run: |
|
|
sha256sum *.rpm *.deb > SHA256SUMS-arm
|
|
for f in *.deb SHA256SUMS-arm; do
|
|
gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
|
|
-u "$GPG_KEYID" --armor --detach-sign "$f"
|
|
done
|
|
sha256sum -c SHA256SUMS-arm
|
|
gpg --verify SHA256SUMS-arm.asc SHA256SUMS-arm
|
|
- name: Attest build provenance
|
|
if: github.event_name == 'release'
|
|
uses: actions/attest-build-provenance@v2
|
|
with:
|
|
subject-path: |
|
|
*.rpm
|
|
*.deb
|
|
- name: Upload to release
|
|
if: github.event_name == 'release'
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
TAG: ${{ github.event.release.tag_name }}
|
|
run: gh release upload "$TAG" *.rpm *.deb *.deb.asc SHA256SUMS-arm SHA256SUMS-arm.asc
|