Skip to content

Commit 308aed9

Browse files
waybackarchiverwaybackarchiver
authored
Signing RPM packages (#507)
* Signing RPM packages * Add license header * Make shellcheck happy * Allow build package only * Pin image by hash * Correct dockerfile syntax * Exit without terminate
1 parent 11baccb commit 308aed9

File tree

6 files changed

+67
-12
lines changed

6 files changed

+67
-12
lines changed

‎.github/workflows/builder.yml

+2
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,8 @@ jobs:
137137
egress-policy: audit
138138
secrets:
139139
wayback-ipfs-apikey: ${{ secrets.WAYBACK_IPFS_APIKEY }}
140+
wayback-signing-key: ${{ secrets.GEMFURY_SIGNING_KEY }}
141+
wayback-signing-passpharse: ${{ secrets.GEMFURY_SIGNING_PASSPHARSE }}
140142

141143
aurpkg:
142144
name: Build AUR

‎.github/workflows/release.yml

+2
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,8 @@ jobs:
119119
artifact-path: build/package/wayback*.rpm
120120
secrets:
121121
wayback-ipfs-apikey: ${{ secrets.WAYBACK_IPFS_APIKEY }}
122+
wayback-signing-key: ${{ secrets.GEMFURY_SIGNING_KEY }}
123+
wayback-signing-passpharse: ${{ secrets.GEMFURY_SIGNING_PASSPHARSE }}
122124

123125
aurpkg:
124126
name: Build AUR

‎Makefile

+5-2
Original file line numberDiff line numberDiff line change
@@ -163,8 +163,11 @@ rpm: ## Build RPM package
163163
-t wayback-rpm-builder \
164164
-f build/redhat/Dockerfile .
165165
@$(DOCKER) run --rm \
166-
-v ${PWD}/build/package:/root/rpmbuild/RPMS/x86_64 wayback-rpm-builder \
167-
rpmbuild -bb --define "_wayback_version $(VERSION)" /root/rpmbuild/SPECS/wayback.spec
166+
-e WAYBACK_SIGNING_KEY="$${WAYBACK_SIGNING_KEY}" \
167+
-e WAYBACK_SIGNING_PASSPHARSE="$${WAYBACK_SIGNING_PASSPHARSE}" \
168+
-e VERSION="${VERSION}" \
169+
-v ${PWD}/build/package:/rpmbuild/RPMS/x86_64:Z \
170+
wayback-rpm-builder
168171

169172
debian: ## Build Debian packages
170173
@echo "-> Building deb package..."

‎build/redhat/Dockerfile

+19-10
Original file line numberDiff line numberDiff line change
@@ -13,16 +13,25 @@ RUN apk update && apk add --no-cache build-base ca-certificates git
1313
ENV WAYBACK_IPFS_APIKEY ${WAYBACK_IPFS_APIKEY}
1414

1515
WORKDIR /go/src/app
16+
1617
COPY . .
18+
1719
RUN make linux-amd64
1820

19-
FROM fedora:37
20-
RUN dnf install -y rpm-build systemd
21-
RUN mkdir -p /root/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
22-
RUN echo "%_topdir /root/rpmbuild" >> .rpmmacros
23-
COPY --from=builder /go/src/app/build/binary/wayback-linux-amd64 /root/rpmbuild/SOURCES/wayback
24-
COPY --from=builder /go/src/app/LICENSE /root/rpmbuild/SOURCES/
25-
COPY --from=builder /go/src/app/CHANGELOG.md /root/rpmbuild/SOURCES/
26-
COPY --from=builder /go/src/app/wayback.1 /root/rpmbuild/SOURCES/
27-
COPY --from=builder /go/src/app/build/systemd/wayback.service /root/rpmbuild/SOURCES/
28-
COPY --from=builder /go/src/app/build/redhat/wayback.spec /root/rpmbuild/SPECS/wayback.spec
21+
# FROM fedora:39 AS runtime
22+
FROM docker.io/library/fedora@sha256:61864fd19bbd64d620f338eb11dae9e8759bf7fa97302ac6c43865c48dccd679 AS runtime
23+
24+
WORKDIR /rpmbuild
25+
26+
RUN dnf install -y rpm-build rpm-sign systemd
27+
28+
COPY --from=builder /go/src/app/build/binary/wayback-linux-amd64 /rpmbuild/SOURCES/wayback
29+
COPY --from=builder /go/src/app/LICENSE /rpmbuild/SOURCES/
30+
COPY --from=builder /go/src/app/CHANGELOG.md /rpmbuild/SOURCES/
31+
COPY --from=builder /go/src/app/wayback.1 /rpmbuild/SOURCES/
32+
COPY --from=builder /go/src/app/build/systemd/wayback.service /rpmbuild/SOURCES/
33+
COPY --from=builder /go/src/app/build/redhat/wayback.spec /rpmbuild/SPECS/wayback.spec
34+
35+
COPY build/redhat/entrypoint.sh /entrypoint.sh
36+
37+
ENTRYPOINT "/entrypoint.sh"

‎build/redhat/entrypoint.sh

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
#!/bin/bash
2+
#
3+
# Copyright 2024 Wayback Archiver. All rights reserved.
4+
# Use of this source code is governed by the GNU GPL v3
5+
# license that can be found in the LICENSE file.
6+
7+
set -eu pipefail
8+
9+
WAYBACK_SIGNING_KEY="${WAYBACK_SIGNING_KEY:-}"
10+
WAYBACK_SIGNING_PASSPHARSE="${WAYBACK_SIGNING_PASSPHARSE:-}"
11+
VERSION="${VERSION:-1.0}"
12+
WORKDIR="/rpmbuild"
13+
14+
cat > ~/.rpmmacros<< EOF
15+
%_topdir /rpmbuild
16+
%_signature gpg
17+
%_gpg_name Wayback Archiver
18+
EOF
19+
20+
mkdir -p "${WORKDIR}/{BUILD,RPMS,SOURCES,SPECS,SRPMS}"
21+
22+
rpmbuild -bb --define "_wayback_version ${VERSION}" "${WORKDIR}/SPECS/wayback.spec"
23+
24+
if [ -z "${WAYBACK_SIGNING_KEY}" ]; then
25+
echo 'Build RPM package without signing.'
26+
exit 0
27+
fi
28+
29+
GPG_TTY="$(tty || true)"
30+
31+
export GPG_TTY
32+
33+
gpg --import --yes --pinentry-mode loopback --passphrase "${WAYBACK_SIGNING_PASSPHARSE}" <<< "${WAYBACK_SIGNING_KEY}"
34+
35+
find "${WORKDIR}/RPMS/x86_64" -type f -name "*.rpm" -exec rpm --verbose --define "_gpg_sign_cmd_extra_args --pinentry-mode loopback --passphrase ${WAYBACK_SIGNING_PASSPHARSE}" --addsign {} \;
36+
37+
find "${WORKDIR}/RPMS/x86_64" -type f -name "*.rpm" -exec rpm -qpi {} \;
38+

‎docs/changelog.md

+1
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
3434

3535
### Fixed
3636
- Load the config file always ([#498](https://github.com/wabarc/wayback/pull/498))
37+
- Signing RPM packages ([#507](https://github.com/wabarc/wayback/pull/507))
3738

3839
## [0.19.1] - 2023-03-21
3940

0 commit comments

Comments
 (0)