3proxy/.github/workflows/build-rpm-arm64.yml

name: RPM/DEB build aarch64

on:
  release:
    types: [published]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  ci:
    permissions:
      contents: write
      id-token: write
      attestations: write
    name: "${{ matrix.target }}"
    strategy:
      matrix:
        target:
          - ubuntu-24.04-arm
    runs-on: ${{ matrix.target }}
    steps:
    - uses: actions/checkout@v7
    - name: env
      run: |
       pwd
       echo "RELEASE=$(cat RELEASE)" >> $GITHUB_ENV
       echo "VERSION=$(date +%y%m%d%H%M%S)" >> $GITHUB_ENV       
    - name: echo env
      run: echo "release $RELEASE version $VERSION"
    - name: Linux libraries
      run: |
       sudo apt update
       sudo apt install libssl-dev libpam-dev libpcre2-dev rpm build-essential debhelper       
    - name: configure rpm env
      run: |
       mkdir ~/debian
       mkdir -p ~/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
       tar -czf ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz --transform "s,^,3proxy-$RELEASE/," .
       ln -s ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/rpmbuild/SOURCES/$RELEASE.tar.gz
       cp scripts/rh/3proxy.spec ~/rpmbuild/SPECS/3proxy-$RELEASE.spec
       cp ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/debian/3proxy_$RELEASE.orig.tar.gz       
    - name: rpmbuild
      run: |
       ret=`pwd`
       cd ~/rpmbuild/SPECS
       rpmbuild -ba 3proxy-$RELEASE.spec
       cd $ret
       mv ~/rpmbuild/RPMS/aarch64/3proxy-$RELEASE-1.aarch64.rpm 3proxy-$RELEASE.arm64.rpm       
    - name: Get artifact rpm
      uses: actions/upload-artifact@v7
      with:
       name: "3proxy-${{ env.RELEASE }}-arm64.rpm"
       path: "*.rpm"
    - name: debbuild
      run: |
        ret=`pwd`
        cd ~/debian/
        tar xzf 3proxy_$RELEASE.orig.tar.gz
        cd 3proxy-$RELEASE
        echo "3proxy ($RELEASE-$VERSION) buster; urgency=medium" >debian/changelog
        echo " " >>debian/changelog
        echo "  *3proxy $RELEASE build" >>debian/changelog
        echo " " >>debian/changelog
        echo " -- z3APA3A <3apa3a@3proxy.org>  "`date "+%a, %d %b %Y %H:%M:%S %z"` >>debian/changelog
        echo "">>debian/changelog
        dpkg-buildpackage
        cd $ret
        cp ~/debian/3proxy_$RELEASE-"$VERSION"_arm64.deb ./3proxy-$RELEASE.arm64.deb        
    - name: Get artifact deb
      uses: actions/upload-artifact@v7
      with:
       name: "3proxy-${{ env.RELEASE }}-arm64.deb"
       path: "*.deb"
    - name: Import signing key
      if: github.event_name == 'release'
      env:
       GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
      run: |
       if [ -z "$GPG_PRIVATE_KEY" ]; then echo "GPG_PRIVATE_KEY is not set"; exit 1; fi
       mkdir -p ~/.gnupg && chmod 700 ~/.gnupg
       printf 'allow-loopback-pinentry\ndefault-cache-ttl 7200\nmax-cache-ttl 7200\n' > ~/.gnupg/gpg-agent.conf
       gpgconf --kill gpg-agent || true
       printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --import
       KEYID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/{print $5; exit}')
       echo "GPG_KEYID=$KEYID" >> $GITHUB_ENV
       echo prime > /tmp/prime.txt
       gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
           -u "$KEYID" --detach-sign -o /dev/null /tmp/prime.txt
       rm -f /tmp/prime.txt       
    - name: Sign rpm
      if: github.event_name == 'release'
      env:
       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
      run: |
       GPGBIN=$(command -v gpg)
       if [ -z "$GPGBIN" ]; then echo "gpg not found"; exit 1; fi
       umask 077
       printf '%s' "$GPG_PASSPHRASE" > /tmp/gpgpass
       echo test > /tmp/signtest
       gpg --batch --yes --pinentry-mode loopback --passphrase-file /tmp/gpgpass \
           -u "$GPG_KEYID" --detach-sign -o /tmp/signtest.sig /tmp/signtest
       echo "key can sign"
       { echo "%_gpg_name $GPG_KEYID"
         echo "%__gpg $GPGBIN"
         echo '%__gpg_sign_cmd %{__gpg} gpg --batch --no-armor --pinentry-mode loopback --passphrase-file /tmp/gpgpass --no-secmem-warning --digest-algo sha256 -u "%{_gpg_name}" -sbo %{__signature_filename} %{__plaintext_filename}'
       } > ~/.rpmmacros
       rpm --addsign *.rpm
       rm -f /tmp/gpgpass /tmp/signtest /tmp/signtest.sig
       for f in *.rpm; do
         sig=$(rpm -qp --qf '%{RSAHEADER:pgpsig}' "$f" 2>/dev/null)
         case "$sig" in ""|"(none)")
           sig=$(rpm -qp --qf '%{DSAHEADER:pgpsig}' "$f" 2>/dev/null) ;;
         esac
         case "$sig" in ""|"(none)")
           echo "$f is not signed"
           echo "--- rpm version ---"; rpm --version
           echo "--- sign cmd ---"; rpm --eval '%{__gpg_sign_cmd}'
           echo "--- secret keys ---"; gpg --list-secret-keys --with-colons | grep -E '^(sec|ssb):' || true
           exit 1 ;;
         esac
         echo "$f: $sig"
       done       
    - name: Checksums and detached signatures
      if: github.event_name == 'release'
      env:
       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
      run: |
       sha256sum *.rpm *.deb > SHA256SUMS-arm64
       for f in *.deb SHA256SUMS-arm64; do
         gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
             -u "$GPG_KEYID" --armor --detach-sign "$f"
       done
       sha256sum -c SHA256SUMS-arm64
       gpg --verify SHA256SUMS-arm64.asc SHA256SUMS-arm64       
    - name: Attest build provenance
      if: github.event_name == 'release'
      uses: actions/attest-build-provenance@v2
      with:
        subject-path: |
          *.rpm
          *.deb          
    - name: Upload to release
      if: github.event_name == 'release'
      env:
       GH_TOKEN: ${{ github.token }}
       TAG: ${{ github.event.release.tag_name }}
      run: gh release upload "$TAG" *.rpm *.deb *.deb.asc SHA256SUMS-arm64 SHA256SUMS-arm64.asc