Skip to content

Commit 91a485c

Browse files
committed
feat: refactor overall pipeline, add pkg signing and repo database
BREAKING CHANGE: the build script and its options were heavily changed
1 parent 51c9848 commit 91a485c

File tree

6 files changed

+161
-62
lines changed

6 files changed

+161
-62
lines changed

.github/workflows/build-publish.yml

Lines changed: 15 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -26,49 +26,40 @@ jobs:
2626
run: |
2727
pacman -Syu --noconfirm
2828
29-
- name: Build greetd
29+
- name: Import builder private key for package signing
3030
run: |
31-
source ./packages
32-
sudo -u builder ./build.sh $GREETD_URL $GREETD_VER
31+
echo -e "${{ secrets.GPG_PRIVATE_KEY }}" | sudo -u builder gpg --import --batch --no-tty
3332
34-
- name: Build greetd-gtkgreet
33+
- name: Initialize pacman secret key, import and trust builder public key
3534
run: |
36-
source ./packages
37-
sudo -u builder ./build.sh $GREETD_GTKGREET_URL $GREETD_GTKGREET_VER
35+
pacman-key --init
36+
pacman-key --add builder_public_key.asc
37+
pacman-key --lsign-key 25267573FD638312C5EBE4C40C758F9503EDE7AF
3838
39-
- name: Build wf-config
39+
- name: Build packages
4040
run: |
41-
source ./packages
42-
sudo -u builder ./build.sh $WF_CONFIG_URL $WF_CONFIG_VER
43-
44-
- name: Build wayfire
45-
run: |
46-
pacman -U /tmp/*pkgbuild/wf-config*.zst --noconfirm
47-
source ./packages
48-
sudo -u builder ./build.sh $WAYFIRE_URL $WAYFIRE_VER
49-
50-
- name: Prepare artifacts
51-
run: |
52-
mkdir ~/build
53-
mv /tmp/*pkgbuild/*.zst ~/build/
41+
sudo -u builder \
42+
PACKAGE_AUTHOR="Builder <[email protected]>" \
43+
PACKAGE_GPG_ID=25267573FD638312C5EBE4C40C758F9503EDE7AF \
44+
./build.sh
5445
5546
- name: Upload artifacts
5647
uses: actions/upload-artifact@v2
5748
with:
5849
name: packages
59-
path: ~/build/*.zst
50+
path: /home/builder/build/*
6051

6152
- name: Add packages to new release
6253
if: github.event_name == 'release' && github.event.action == 'created'
6354
run: |
6455
pacman -S curl jq --noconfirm
6556
RELEASE=$(jq --raw-output '.release.id' "$GITHUB_EVENT_PATH")
6657
67-
for PACKAGE in ~/build/*.zst; do
58+
for FILE in /home/builder/build/*; do
6859
curl -sSL \
6960
-X POST \
7061
-H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
71-
-T ${PACKAGE} \
62+
-T ${FILE} \
7263
--header "Content-Type: application/octet-stream" \
73-
https://uploads.github.com/repos/${GITHUB_REPOSITORY}/releases/${RELEASE}/assets?name=${PACKAGE##*/}
64+
https://uploads.github.com/repos/${GITHUB_REPOSITORY}/releases/${RELEASE}/assets?name=${FILE##*/}
7465
done

README.md

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,21 +2,46 @@
22

33
Arch Linux AUR package builds, published via GitHub Releases.
44

5-
![GitHub](https://github.com/karras/aur-package-builds/workflows/Build%20&%20Publish/badge.svg?branch=main)
5+
[![Build & Publish](https://github.com/karras/aur-package-builds/actions/workflows/build-publish.yml/badge.svg)](https://github.com/karras/aur-package-builds/actions/workflows/build-publish.yml)
66

77
## Packages
88

9-
The following packages are covered:
9+
The following packages are covered (see [package.lst](./package.lst)):
1010

1111
* [greetd](https://aur.archlinux.org/packages/greetd/)
1212
* [greetd-gtkgreet](https://aur.archlinux.org/packages/greetd-gtkgreet/)
1313
* [wayfire](https://aur.archlinux.org/packages/wayfire/)
1414
* [wf-config](https://aur.archlinux.org/packages/wf-config/)
1515

16-
## Builds
16+
## Usage
1717

1818
The actual package builds can be found in the latest
19-
[Releases](https://github.com/karras/aur-package-builds/releases).
19+
[Releases](https://github.com/karras/aur-package-builds/releases). All releases
20+
also include the required repository database in order to install them directly
21+
via pacman:
22+
23+
* Import and trust the [package signing key](./builder_public_key.asc):
24+
```sh
25+
pacman-key --add builder_public_key.asc
26+
pacman-key --lsign-key 25267573FD638312C5EBE4C40C758F9503EDE7AF
27+
```
28+
29+
* Add the repository to `/etc/pacman.conf` (replace `$RELEASE` in the URL with
30+
the desired version):
31+
```ini
32+
[karras]
33+
Server = https://github.com/karras/aur-package-builds/releases/download/$RELEASE
34+
```
35+
36+
* Refresh the local repository databases:
37+
```sh
38+
pacman -Sy
39+
```
40+
41+
* Install the required packages (e.g. `wayfire`):
42+
```sh
43+
pacman -S wayfire
44+
```
2045

2146
## License
2247

build.sh

Lines changed: 83 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,42 +1,105 @@
1-
#!/bin/sh
1+
#!/bin/sh -
22
#
3-
# Creates a directory in /tmp, clones the AUR repository into it and finally
4-
# builds the package. Definitely not gold, lots of room for improvement.
3+
# Creates a temporary build directory in /tmp and builds all packages in there
4+
# based on the provided package list file. Also supports signing the packages
5+
# and creates an appropriate repository database. The articats are finally
6+
# stored in one build directory.
57
#
6-
# ./build.sh GIT_URL [COMMIT_HASH]
8+
# Supported environment variables:
9+
#
10+
# PACKAGE_AUTHOR: Defines who is the packager, set to 'John Doe
11+
# <[email protected]>' if not defined
12+
#
13+
# PACKAGE_BASE_URL: Base URL where the source repositories are located,
14+
# set to 'https://aur.archlinux.org' if not defined
15+
#
16+
# PACKAGE_CONFIG: File containing the package list to build, set to
17+
# 'packages.lst' if not defined
18+
#
19+
# PACKAGE_DESTINATION: Defines where to store the built packages, set to
20+
# '$HOME/build' if not defined
21+
#
22+
# PACKAGE_GPG_ID: GPG ID of the private key to use for signing the
23+
# packages, if not set the packages will not be signed
24+
#
25+
# USAGE: ./build.sh
726

827
set -eo pipefail
928

10-
# Required tools
11-
DEPENDENCIES="mktemp git"
29+
readonly DEPENDENCIES="id git makepkg pacman-key repo-add"
30+
31+
readonly PKG_BASE_URL="${PACKAGE_BASE_URL:-https://aur.archlinux.org}"
32+
readonly PKG_CFG="${PACKAGE_CONFIG:-packages.lst}"
33+
34+
# Specific options for makepkg and repo-add, see their respective man pages
35+
export GPGKEY="${PACKAGE_GPG_ID:-}"
36+
export PKGDEST="${PACKAGE_DESTINATION:-${HOME}/build}"
37+
export PACKAGER="${PACKAGE_AUTHOR:-John Doe <john@example.com>}"
1238

13-
# Test if dependencies are available
39+
# Required by makepkg to ensure signature files are stored along the packages
40+
export SRCPKGDEST="${PKGDEST}"
41+
42+
# Check if all dependencies are available
1443
for DEPENDENCY in ${DEPENDENCIES}; do
1544
if [[ ! $(type "${DEPENDENCY}" 2> /dev/null) ]]; then
1645
echo "Dependency '${DEPENDENCY}' not found in PATH, exiting..."
1746
exit 1
1847
fi
1948
done
2049

21-
if [[ -z "${1}" ]]; then
22-
echo "No AUR git URL provided as the first parameter, exiting..."
50+
# Check if we are executed as root which does not work with makepkg
51+
if [[ "$(id -u)" -eq 0 ]]; then
52+
echo "Script must not be executed as root, exiting..."
53+
exit 1
54+
fi
55+
56+
echo $HOME
57+
# Check if package config file exists
58+
if [[ ! -f "${PKG_CFG}" ]]; then
59+
echo "No file named '${PKG_CFG}' found at script location, exiting..."
2360
exit 1
2461
fi
2562

2663
# Create temporary build directory
27-
BUILD_DIR=$(mktemp --directory --suffix=pkgbuild)
64+
readonly TMP_BUILD_DIR=$(mktemp --directory --suffix=pkgbuild)
65+
66+
# Create package destination directory if required
67+
echo "All packages will be placed in '${PKGDEST}'"
68+
if [[ ! -d "${PKGDEST}" ]]; then
69+
mkdir "${PKGDEST}"
70+
fi
71+
72+
# Build all packages
73+
while read -r PACKAGE; do
74+
# Skip all lines starting with a hashtag
75+
[[ "${PACKAGE}" =~ ^#.*$ ]] && continue
76+
77+
echo "Starting build process for package '${PACKAGE}'"
78+
79+
# Clone source repository
80+
git clone "${PKG_BASE_URL}/${PACKAGE}" "${TMP_BUILD_DIR}/${PACKAGE}"
81+
82+
# Build package
83+
cd "${TMP_BUILD_DIR}/${PACKAGE}"
84+
if [[ ! -z "${GPGKEY}" ]]; then
85+
echo "Package will be built and signed with the GPG key '${GPGKEY}'"
86+
makepkg --noconfirm --syncdeps --install --sign
87+
else
88+
echo "Package will be built without signing it"
89+
makepkg --noconfirm --syncdeps --install
90+
fi
91+
done < "${PKG_CFG}"
2892

29-
# Clone (AUR) repository
30-
git clone "${1}" "${BUILD_DIR}"
93+
echo "Finished building all packages, check the '${PKGDEST}' directory"
3194

32-
# Switch to build directory
33-
cd "${BUILD_DIR}"
95+
ls -al "${PKGDEST}"
3496

35-
# Optionally checkout specific commit (i.e. AUR version pinning)
36-
if [[ ! -z "${2}" ]]; then
37-
echo "Checking out commit '${2}'"
38-
git checkout --quiet "${2}"
97+
if [[ ! -z "${GPGKEY}" ]]; then
98+
echo "Creating package repository database and sign it with the GPG key '${GPGKEY}'"
99+
repo-add --sign "${PKGDEST}/karras.db.tar.xz" ${PKGDEST}/*.zst
100+
else
101+
echo "Creating package repository database without signing it"
102+
repo-add "${PKGDEST}/karras.db.tar.xz" ${PKGDEST}/*.zst
39103
fi
40104

41-
# Build package
42-
makepkg --noconfirm --syncdeps
105+
echo "Finished generating repository database, check the '${PKGDEST}' directory"

builder_public_key.asc

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
-----BEGIN PGP PUBLIC KEY BLOCK-----
2+
3+
mQINBGHcgawBEADeSzF9MuJ4K92RX6Es/fMd9bNS+4LTettXxkZXu1hI6u0Zy1Tw
4+
x8j+kVI6HOEC3FCxQF5d6gyaqiMfxXtobTcVIbMVqoCsHplSuV6MunBYbdc8ETm6
5+
VkLoslJOdgOYsH2DoKkJsGoG2r195yuVyF/yH8Si2tHW1qAIv/YrWxlpmjITqMIF
6+
xPQrruwXLNCu/LTsQ7xqXgAvqL++2LGyIlmtWMTQzcrcUCkMbo7jFDLcj3tjhDDP
7+
Z0iwvLtnwG70xtssSH5zvEga6IAeC8cR1daTT2XEwrALiu2MpaWFfWfF2LoJMTSn
8+
dyPyBlQEsHW/2lyo9NIJogGtlY+5qHnPD88Dol5Aawb0F+ti82ByDa9FpiF5ZQyr
9+
8UOEY8XBeu7A/CfG6ubbLjZXMo6jOYNxfk3lJDpkXULQKHKRocIYuyPa/D6t2ugA
10+
UpPSeA7jjxpyAQAVASXxmwA6dDcow7z6rADqxMMaQh6oB2GssYO8AXG8IFtunl+A
11+
pZFWDtalW8jSlQ+DjCR5AiVU0wtOsshiMCr0mqHgVO5Von/GKWWAGzJ7Imnx9djF
12+
3hWcKySg9XfuHqYOmOo2yZ+6kqRu5nVGNyQzctFpRyu7LVr0bH4p/UbaaOmvnGH0
13+
Ak2VetI590T9avG2GHEFyhyHjCyLMZbYtEcB7g8imudO6xKy3z/KXhHgpQARAQAB
14+
tBpCdWlsZGVyIDxidWlsZGVyQDB4NTM5LmNoPokCTgQTAQgAOBYhBCUmdXP9Y4MS
15+
xevkxAx1j5UD7eevBQJh3IGsAhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJ
16+
EAx1j5UD7eevElYQAICpQ0I9xuiFPNhIfSU7XEqwUyVS+ynqqdqyzsDHC0Dyhu8O
17+
3qztwOm4hBQEs0Bad46b1PK9nMiLruY6PATHoIO1SyM4KNTd5Lp0J0mQ9aalxwwB
18+
gXsxKvJPyx0MhEVGNKzTgWw5r9vqg4vH2dscFjV8FhaaE7f145KgmgR1RlniNb/I
19+
l+RbnBWTMYMu4z+Ur+iZrrW9/58yRY9LU5ncqqdqsYAQEVRIUkKLDR0tpfA2ncNk
20+
9K5hXCEdNlTP+Brc/zovfGS5HAFYWS7BB9X6q0dVpCxmiSw5rtIMd7DpO0jaU25U
21+
2FCDHQsLMj2DCkL0s4wrt0+eKocFrYmMCLFeeOXDIBRY09UigtNNCefkAVq0l2//
22+
zwci7T8ql+K6YLVE/b779/2qwmDPsNIldumjwfM/hA7Y7xG9l6hYiDenvThze3Us
23+
4hzFu5HrbDwXH8PF7ycdFImrfkFcCk7p4QWUd1xBxS4U4+geK3UL/Ur6g+9Fg980
24+
na5Zo2S2D7x0DwIr2iLjTv+M/HKZj1aE5Tk5j342jjFVCmXDagqehHOp0CqtUkcy
25+
07UyElyQk74AZTzVrBm+fOi4tlm6IjUxn16CT91fq2yzUACRcOxFf9prQEIQEPcw
26+
dfAWHBe3Jskda690Gd+atk2woAsJZ8T+lx/uG2kp9Z7VoOAo8rPP6FO2a+dW
27+
=7ndg
28+
-----END PGP PUBLIC KEY BLOCK-----

packages

Lines changed: 0 additions & 14 deletions
This file was deleted.

packages.lst

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# List of packages to build, each line contains a new package name. Order is
2+
# relevant if there are dependencies between the to be built packages.
3+
greetd
4+
greetd-gtkgreet
5+
wf-config
6+
wayfire

0 commit comments

Comments
 (0)