Joachim Schlöffel
36ca06819a
Build Alpine Packages / preflight (push) Successful in 37s
Build Alpine Packages / preflight (pull_request) Successful in 36s
Build Alpine Packages / build (lavinmq) (push) Failing after 2s
Build Alpine Packages / build (seaweedfs) (push) Failing after 3s
Build Alpine Packages / build (gitea) (pull_request) Failing after 2s
Build Alpine Packages / build (greptimedb) (pull_request) Failing after 3s
Build Alpine Packages / build (lavinmq) (pull_request) Failing after 2s
Build Alpine Packages / build (greptimedb) (push) Failing after 16s
Build Alpine Packages / build (gitea) (push) Failing after 16s
Build Alpine Packages / verify-and-publish (push) Skipped
Build Alpine Packages / build (seaweedfs) (pull_request) Failing after 2s
Build Alpine Packages / verify-and-publish (pull_request) Skipped
84 lines
2.2 KiB
Bash
Executable File
84 lines
2.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
repo_name="${ALPINE_REPO_NAME:-local}"
|
|
arches="${ALPINE_ARCHES:-x86_64 aarch64}"
|
|
artifact_root="${APK_CI_ARTIFACTS_DIR:-${repo_root}/packages/worker-artifacts}"
|
|
package_root="${APK_CI_PACKAGE_ROOT:-${repo_root}/packages/${repo_name}}"
|
|
|
|
require_command() {
|
|
command -v "$1" >/dev/null 2>&1 || {
|
|
printf 'missing required command: %s\n' "$1" >&2
|
|
exit 2
|
|
}
|
|
}
|
|
|
|
copy_key() {
|
|
local key="$1"
|
|
local destination="$2"
|
|
local digest
|
|
|
|
digest="$(sha256sum "${key}" | awk '{print $1}')"
|
|
cp "${key}" "${destination}/${digest}.rsa.pub"
|
|
}
|
|
|
|
require_command abuild-keygen
|
|
require_command abuild-sign
|
|
require_command apk
|
|
|
|
if [[ ! -d "${artifact_root}" ]]; then
|
|
printf 'missing worker artifacts directory: %s\n' "${artifact_root}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
rm -rf "${package_root}"
|
|
mkdir -p "${package_root}" "${HOME}/.abuild"
|
|
|
|
if ! compgen -G "${HOME}/.abuild/*.rsa" > /dev/null; then
|
|
abuild-keygen -a -n
|
|
fi
|
|
|
|
shopt -s nullglob
|
|
merge_private_keys=("${HOME}"/.abuild/*.rsa)
|
|
merge_public_keys=("${HOME}"/.abuild/*.rsa.pub)
|
|
shopt -u nullglob
|
|
|
|
if [[ "${#merge_private_keys[@]}" -ne 1 || "${#merge_public_keys[@]}" -ne 1 ]]; then
|
|
printf 'expected exactly one merge signing key in %s/.abuild\n' "${HOME}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
for arch in ${arches}; do
|
|
destination="${package_root}/${arch}"
|
|
mkdir -p "${destination}"
|
|
|
|
while IFS= read -r -d '' apk; do
|
|
cp "${apk}" "${destination}/"
|
|
done < <(find "${artifact_root}" -type f -path "*/${arch}/*.apk" -print0)
|
|
|
|
shopt -s nullglob
|
|
apks=("${destination}"/*.apk)
|
|
shopt -u nullglob
|
|
if [[ "${#apks[@]}" -eq 0 ]]; then
|
|
rmdir "${destination}"
|
|
continue
|
|
fi
|
|
|
|
while IFS= read -r -d '' key; do
|
|
copy_key "${key}" "${destination}"
|
|
done < <(find "${artifact_root}" -type f -path "*/${arch}/*.rsa.pub" -print0)
|
|
copy_key "${merge_public_keys[0]}" "${destination}"
|
|
|
|
(
|
|
cd "${destination}"
|
|
apk index --rewrite-arch "${arch}" -o APKINDEX.tar.gz ./*.apk
|
|
abuild-sign -k "${merge_private_keys[0]}" APKINDEX.tar.gz
|
|
)
|
|
done
|
|
|
|
if ! compgen -G "${package_root}"/*/*.apk > /dev/null; then
|
|
printf 'no APK files found in worker artifacts: %s\n' "${artifact_root}" >&2
|
|
exit 1
|
|
fi
|