fspjo
e8333709a5
Build Alpine Packages / preflight (push) Successful in 12s
Build Alpine Packages / build (gitea) (push) Successful in 21s
Build Alpine Packages / build (lavinmq) (push) Successful in 2m54s
Build Alpine Packages / build (seaweedfs) (push) Successful in 20m49s
Build Alpine Packages / build (greptimedb) (push) Successful in 1h42m55s
Build Alpine Packages / verify-and-publish (push) Failing after 1m26s
Reviewed-on: #10
104 lines
2.7 KiB
Bash
Executable File
104 lines
2.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
repo_name="${ALPINE_REPO_NAME:-local}"
|
|
arches="${ALPINE_ARCHES:-x86_64 aarch64}"
|
|
artifact_root="${APK_CI_ARTIFACTS_DIR:-${repo_root}/packages/worker-artifacts}"
|
|
package_root="${APK_CI_PACKAGE_ROOT:-${repo_root}/packages/${repo_name}}"
|
|
keys_root="$(mktemp -d)"
|
|
|
|
cleanup() {
|
|
rm -rf "${keys_root}"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
require_command() {
|
|
command -v "$1" >/dev/null 2>&1 || {
|
|
printf 'missing required command: %s\n' "$1" >&2
|
|
exit 2
|
|
}
|
|
}
|
|
|
|
copy_key() {
|
|
local key="$1"
|
|
local destination="$2"
|
|
local key_name
|
|
|
|
key_name="$(basename "${key}")"
|
|
if [[ -e "${destination}/${key_name}" ]]; then
|
|
if cmp -s "${key}" "${destination}/${key_name}"; then
|
|
return
|
|
fi
|
|
printf 'conflicting public keys named %s\n' "${key_name}" >&2
|
|
exit 1
|
|
fi
|
|
cp "${key}" "${destination}/${key_name}"
|
|
}
|
|
|
|
require_command abuild-keygen
|
|
require_command abuild-sign
|
|
require_command apk
|
|
|
|
if [[ ! -d "${artifact_root}" ]]; then
|
|
printf 'missing worker artifacts directory: %s\n' "${artifact_root}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
rm -rf "${package_root}"
|
|
mkdir -p "${package_root}" "${HOME}/.abuild"
|
|
|
|
if ! compgen -G "${HOME}/.abuild/*.rsa" > /dev/null; then
|
|
abuild-keygen -a -n
|
|
fi
|
|
|
|
shopt -s nullglob
|
|
merge_private_keys=("${HOME}"/.abuild/*.rsa)
|
|
merge_public_keys=("${HOME}"/.abuild/*.rsa.pub)
|
|
shopt -u nullglob
|
|
|
|
if [[ "${#merge_private_keys[@]}" -ne 1 || "${#merge_public_keys[@]}" -ne 1 ]]; then
|
|
printf 'expected exactly one merge signing key in %s/.abuild\n' "${HOME}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
for arch in ${arches}; do
|
|
destination="${package_root}/${arch}"
|
|
keys_dir="${keys_root}/${arch}"
|
|
mkdir -p "${destination}"
|
|
|
|
while IFS= read -r -d '' apk; do
|
|
cp "${apk}" "${destination}/"
|
|
done < <(find "${artifact_root}" -type f -path "*/${arch}/*.apk" -print0)
|
|
|
|
shopt -s nullglob
|
|
apks=("${destination}"/*.apk)
|
|
shopt -u nullglob
|
|
if [[ "${#apks[@]}" -eq 0 ]]; then
|
|
rmdir "${destination}"
|
|
continue
|
|
fi
|
|
|
|
while IFS= read -r -d '' key; do
|
|
copy_key "${key}" "${destination}"
|
|
mkdir -p "${keys_dir}"
|
|
copy_key "${key}" "${keys_dir}"
|
|
done < <(find "${artifact_root}" -type f -path "*/${arch}/*.rsa.pub" -print0)
|
|
if ! compgen -G "${keys_dir}/*.rsa.pub" > /dev/null; then
|
|
printf 'missing worker signing key for %s artifacts\n' "${arch}" >&2
|
|
exit 1
|
|
fi
|
|
copy_key "${merge_public_keys[0]}" "${destination}"
|
|
|
|
(
|
|
cd "${destination}"
|
|
apk --keys-dir "${keys_dir}" index --rewrite-arch "${arch}" -o APKINDEX.tar.gz ./*.apk
|
|
abuild-sign -k "${merge_private_keys[0]}" APKINDEX.tar.gz
|
|
)
|
|
done
|
|
|
|
if ! compgen -G "${package_root}"/*/*.apk > /dev/null; then
|
|
printf 'no APK files found in worker artifacts: %s\n' "${artifact_root}" >&2
|
|
exit 1
|
|
fi
|