Added script to publish to ppa launchpad

Author: Hakky54

.github/workflows/publish-apt.yml

@@ -46,15 +46,34 @@ jobs:
           mkdir -p binary/aarch64
           tar -xzf crip-linux-aarch64.tar.gz -C binary/aarch64
 
-      - name: Create orig tarball
+      - name: Obtain orig tarball
         env:
           VERSION: ${{ steps.version.outputs.tag }}
         run: |
-          SOURCE_DIR="crip-${VERSION}"
-          mkdir -p "${SOURCE_DIR}/binaries"
-          cp binary/amd64/crip "${SOURCE_DIR}/binaries/crip-amd64"
-          cp binary/aarch64/crip "${SOURCE_DIR}/binaries/crip-arm64"
-          tar -czf "crip_${VERSION}.orig.tar.gz" "${SOURCE_DIR}"
+          ORIG_TARBALL="crip_${VERSION}.orig.tar.gz"
+
+          # Try to download the orig tarball already on Launchpad (from a previous distro upload).
+          # This ensures we use the exact same bytes, avoiding "different contents" rejections.
+          PPA_URL="https://ppa.launchpadcontent.net/hakky554/apps/ubuntu/pool/main/c/crip/${ORIG_TARBALL}"
+          echo "==> Trying to download existing orig tarball from PPA: ${PPA_URL}"
+          if curl -fsSL "${PPA_URL}" -o "${ORIG_TARBALL}"; then
+            echo "==> Downloaded existing orig tarball from PPA"
+          else
+            echo "==> No existing tarball on PPA, creating a new reproducible one"
+            SOURCE_DIR="crip-${VERSION}"
+            mkdir -p "${SOURCE_DIR}/binaries"
+            cp binary/amd64/crip "${SOURCE_DIR}/binaries/crip-amd64"
+            cp binary/aarch64/crip "${SOURCE_DIR}/binaries/crip-arm64"
+            # Reproducible tarball: fixed timestamps, sorted entries, gzip -n
+            REPRODUCIBLE_TIMESTAMP="2024-01-01 00:00:00"
+            find "${SOURCE_DIR}" -exec touch -d "${REPRODUCIBLE_TIMESTAMP}" {} +
+            tar --sort=name \
+                --mtime="${REPRODUCIBLE_TIMESTAMP}" \
+                --owner=root --group=root --numeric-owner \
+                -cf - "${SOURCE_DIR}" | gzip -n > "${ORIG_TARBALL}"
+          fi
+
+          echo "==> Orig tarball SHA256: $(sha256sum "${ORIG_TARBALL}")"
 
       - name: Upload orig tarball and binaries
         uses: actions/upload-artifact@v4

scripts/build-source-package.sh

@@ -7,9 +7,12 @@
 #
 # The optional include_orig flag (true/false, default true) controls whether the
 # orig tarball is included in the upload (-sa) or omitted (-sd). Launchpad requires
-# the orig tarball to be identical across all uploads for the same upstream version,
-# so only the first distro upload should include it; subsequent distros should set
-# this to "false" so Launchpad reuses the tarball already on file.
+# the orig tarball to be byte-identical across all uploads for the same upstream
+# version, so the first distro upload should use "true" and subsequent distros "false".
+#
+# When the orig tarball does not yet exist locally, the script first attempts to
+# download the exact copy already stored on Launchpad. If that fails (i.e. this is
+# the very first upload for this upstream version), a reproducible tarball is created.
 #
 # Example: ./scripts/build-source-package.sh 2.7.1 noble ABC123DEF456 true
 #          ./scripts/build-source-package.sh 2.7.1 jammy ABC123DEF456 false
@@ -25,17 +28,31 @@ PACKAGE_NAME="crip"
 SOURCE_DIR="${PACKAGE_NAME}-${VERSION}"
 ORIG_TARBALL="${PACKAGE_NAME}_${VERSION}.orig.tar.gz"
 
+# Launchpad PPA base URL for downloading existing orig tarballs
+PPA_POOL_URL="https://ppa.launchpadcontent.net/hakky554/apps/ubuntu/pool/main/c/crip"
+
 echo "==> Building source package for ${PACKAGE_NAME} ${VERSION} (${DISTRO})"
 
 # Create source directory with pre-built binaries
 mkdir -p "${SOURCE_DIR}/binaries"
 cp binary/amd64/crip "${SOURCE_DIR}/binaries/crip-amd64"
 cp binary/aarch64/crip "${SOURCE_DIR}/binaries/crip-arm64"
 
-# Reuse existing orig tarball if present (all distros must share the same one for Launchpad)
+# Obtain the orig tarball — must be byte-identical to what Launchpad already has
 if [ ! -f "${ORIG_TARBALL}" ]; then
-  echo "==> Creating orig tarball ${ORIG_TARBALL}"
-  tar -czf "${ORIG_TARBALL}" "${SOURCE_DIR}"
+  echo "==> Trying to download existing orig tarball from PPA"
+  if curl -fsSL "${PPA_POOL_URL}/${ORIG_TARBALL}" -o "${ORIG_TARBALL}"; then
+    echo "==> Downloaded existing orig tarball from PPA"
+  else
+    echo "==> No existing tarball on PPA, creating a new reproducible one"
+    REPRODUCIBLE_TIMESTAMP="2024-01-01 00:00:00"
+    find "${SOURCE_DIR}" -exec touch -d "${REPRODUCIBLE_TIMESTAMP}" {} +
+    tar --sort=name \
+        --mtime="${REPRODUCIBLE_TIMESTAMP}" \
+        --owner=root --group=root --numeric-owner \
+        -cf - "${SOURCE_DIR}" | gzip -n > "${ORIG_TARBALL}"
+  fi
+  echo "==> Orig tarball SHA256: $(sha256sum "${ORIG_TARBALL}")"
 fi
 
 # Create debian packaging directory