Use packages publish script from shared infra - mirum - Unnamed repository; edit this file 'description' to name the repository.

diff options


context:
space:
mode:

author	Nikolay Govorov <me@govorov.online>	2026-08-21 03:34:07 +0100
committer	Nikolay Govorov <me@govorov.online>	2026-08-21 03:56:32 +0100
commit	c0315809e2ec7aea1a78b78c62b3289bc4603fdf (patch)
tree	2853b3f6f20ace97e9c81e5287506a476a346f9c
parent	22f5730a4e21b3dc1cb96f99cc30fa7e676941ad (diff)
download	tar tar.gz tar.bz2 tar.lz tar.xz tar.zst zip

Use packages publish script from shared infra

Diffstat

-rw-r--r--	.github/workflows/build.yml	25	+17 −8
-rw-r--r--	README.md	24	+10 −14
-rw-r--r--	Taskfile.yml	96	+2 −94
-rw-r--r--	mise.lock	14	+0 −14
-rw-r--r--	mise.toml	6	+4 −2
-rw-r--r--	nfpm.yaml	6	+3 −3
-rw-r--r--	packaging/apt-ftparchive.conf	29	+0 −29

7 files changed, 36 insertions, 164 deletions

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 99da313..cf36b5e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml

@@ -18,6 +18,11 @@ jobs:

build:

name: Build and publish Nightly

runs-on: ubuntu-latest

+ concurrency:

+ group: >-

+ package-publish-mirum-${{ github.ref == 'refs/heads/main' && 'nightly'

+ || startsWith(github.ref, 'refs/tags/v') && 'stable' || github.ref }}

+ cancel-in-progress: false

permissions:

contents: write

steps:

@@ -40,6 +45,7 @@ jobs:

GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}

GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

APK_PRIVATE_KEY: ${{ secrets.APK_PRIVATE_KEY }}

+ PACKAGE_KEY_VERSION: ${{ vars.PACKAGE_KEY_VERSION }}

- name: Lint

run: task lint

@@ -54,17 +60,20 @@ jobs:

git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

. build/dist/build.env

task publish:release CHANNEL=$CHANNEL VERSION=$VERSION

- task publish:repos \

- CHANNEL=$CHANNEL \

- S3_BUCKET=${{ vars.S3_BUCKET }} \

- S3_PUBLIC_URL=${{ vars.S3_PUBLIC_URL }} \

- S3_PROVIDER="${{ vars.S3_PROVIDER || 'Other' }}" \

- S3_REGION=${{ vars.S3_REGION }} \

- S3_ENDPOINT=${{ vars.S3_ENDPOINT }} \

- GPG_KEY_ID=${{ vars.GPG_KEY_ID }}

+ mise run publish -- \

+ --service mirum \

+ --channel "$CHANNEL" \

+ --input build/dist \

+ deb rpm apk

env:

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}

GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

+ GPG_KEY_ID: ${{ vars.GPG_KEY_ID }}

+ APK_PRIVATE_KEY: ${{ secrets.APK_PRIVATE_KEY }}

+ PACKAGE_KEY_VERSION: ${{ vars.PACKAGE_KEY_VERSION }}

+ S3_BUCKET: ${{ vars.S3_BUCKET }}

+ S3_ENDPOINT: ${{ vars.S3_ENDPOINT }}

+ S3_PUBLIC_URL: ${{ vars.S3_PUBLIC_URL }}

S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}

S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}

diff --git a/README.md b/README.md
index 8cb272c..a9f4640 100644
--- a/README.md
+++ b/README.md

@@ -139,8 +139,8 @@ Please note that the project is in its infancy and is **not** intended for produ

```bash

sudo apt install curl gnupg

-curl -fsSL https://dl.mirum.dev/public.gpg | sudo gpg --dearmor -o /usr/share/keyrings/mirum.gpg

-echo "deb [signed-by=/usr/share/keyrings/mirum.gpg] https://dl.mirum.dev/apt/ nightly main" | sudo tee /etc/apt/sources.list.d/mirum.list

+curl -fsSL https://pkg.dimidiumlabs.io/packages.gpg | sudo gpg --dearmor -o /usr/share/keyrings/dimidiumlabs.gpg

+echo "deb [signed-by=/usr/share/keyrings/dimidiumlabs.gpg] https://pkg.dimidiumlabs.io/mirum/apt/ nightly main" | sudo tee /etc/apt/sources.list.d/mirum.list

sudo apt update && sudo apt install mirum

# Start the server

@@ -154,10 +154,10 @@ sudo systemctl enable --now mirum-worker@default

```bash

# DNF5 (Fedora 41+, RHEL 10+)

-sudo dnf config-manager addrepo --from-repofile=https://dl.mirum.dev/rpm/nightly/mirum-nightly.repo

+sudo dnf config-manager addrepo --from-repofile=https://pkg.dimidiumlabs.io/mirum/rpm/nightly/mirum-nightly.repo

# DNF4 (Fedora 40 and older, RHEL 8/9)

-sudo curl -o /etc/yum.repos.d/mirum-nightly.repo https://dl.mirum.dev/rpm/nightly/mirum-nightly.repo

+sudo curl -o /etc/yum.repos.d/mirum-nightly.repo https://pkg.dimidiumlabs.io/mirum/rpm/nightly/mirum-nightly.repo

sudo dnf install mirum

@@ -171,8 +171,8 @@ sudo systemctl enable --now mirum-worker@default

**openSUSE:**

```bash

-sudo rpm --import https://dl.mirum.dev/public.gpg

-sudo zypper addrepo https://dl.mirum.dev/rpm/nightly/ mirum-nightly

+sudo rpm --import https://pkg.dimidiumlabs.io/packages.gpg

+sudo zypper addrepo https://pkg.dimidiumlabs.io/mirum/rpm/nightly/ mirum-nightly

sudo zypper refresh

sudo zypper install mirum

@@ -185,15 +185,11 @@ sudo systemctl enable --now mirum-worker@default

**Alpine:**

-No repository yet — grab the signing key and the signed `.apk` from the nightly

-release:

```sh

-sudo wget -O /etc/apk/keys/mirum.rsa.pub https://dl.mirum.dev/mirum.rsa.pub

-# Download the .apk for your arch from

-# https://github.com/dimidiumlabs/mirum/releases/tag/nightly

-sudo apk add ./mirum_<version>_<arch>.apk

+sudo wget -O /etc/apk/keys/packages.0001.rsa.pub https://pkg.dimidiumlabs.io/keys/packages.0001.rsa.pub

+echo "https://pkg.dimidiumlabs.io/mirum/apk/nightly" | sudo tee -a /etc/apk/repositories

+sudo apk update

+sudo apk add mirum

# Start the server

sudo rc-update add mirum-server default

diff --git a/Taskfile.yml b/Taskfile.yml
index f803a40..8e9b060 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml

@@ -250,104 +250,12 @@ tasks:

--version "{{.VERSION}}" \

--arch "$arch" \

--output "{{.DIST_DIR}}" \

- --apk-public-key mirum.rsa.pub \

$formats

rm -rf {{.BUILD_DIR}}/tmp

done

printf 'VERSION={{.VERSION}}\nCHANNEL={{.CHANNEL}}\n' > {{.DIST_DIR}}/build.env

- publish:repos:

- desc: Publish packages to APT and RPM repositories on S3

- requires:

- vars:

- [

- CHANNEL,

- S3_BUCKET,

- S3_PUBLIC_URL,

- S3_PROVIDER,

- S3_REGION,

- S3_ENDPOINT,

- GPG_KEY_ID,

- ]

- cmds:

- - |

- set -e

- export GNUPGHOME=$(mktemp -d)

- RCLONE_CONF=$(mktemp)

- chmod 700 "$GNUPGHOME"

- cleanup() { rm -rf "$GNUPGHOME" "$RCLONE_CONF"; }

- trap cleanup EXIT

- cat > "$RCLONE_CONF" << EOF

- [s3]

- type = s3

- provider = {{.S3_PROVIDER}}

- access_key_id = ${S3_ACCESS_KEY_ID}

- secret_access_key = ${S3_SECRET_ACCESS_KEY}

- region = {{.S3_REGION}}

- endpoint = {{.S3_ENDPOINT}}

- EOF

- export RCLONE_CONFIG="$RCLONE_CONF"

- printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" --import

- echo "allow-loopback-pinentry" >> "$GNUPGHOME/gpg-agent.conf"

- gpgconf --kill gpg-agent

- # Upload static files

- gpg --export --armor "{{.GPG_KEY_ID}}" > "$GNUPGHOME/public.gpg"

- rclone copyto "$GNUPGHOME/public.gpg" "s3:{{.S3_BUCKET}}/public.gpg"

- rclone copy packaging/dl/ "s3:{{.S3_BUCKET}}/"

- if [ -f "{{.DIST_DIR}}/mirum.rsa.pub" ]; then

- rclone copyto "{{.DIST_DIR}}/mirum.rsa.pub" "s3:{{.S3_BUCKET}}/mirum.rsa.pub"

- fi

- # APT repository

- CHANNEL={{.CHANNEL}}

- mkdir -p /tmp/apt-cache apt-repo

- rclone copy "s3:{{.S3_BUCKET}}/apt/" apt-repo/

- for ch in stable nightly; do

- mkdir -p apt-repo/pool/$ch

- for arch in {{.LINUX_PKG_TARGETS}}; do

- mkdir -p apt-repo/dists/$ch/main/binary-$arch

- done

- cp {{.DIST_DIR}}/*.deb apt-repo/pool/$CHANNEL/

- cd apt-repo

- apt-ftparchive generate "$(pwd)/../packaging/apt-ftparchive.conf"

- apt-ftparchive \

- -o APT::FTPArchive::Release::Codename=$CHANNEL \

- -o APT::FTPArchive::Release::Components=main \

- -o APT::FTPArchive::Release::Architectures="{{.LINUX_PKG_TARGETS}}" \

- release dists/$CHANNEL/ > dists/$CHANNEL/Release

- gpg --default-key="{{.GPG_KEY_ID}}" --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" -abs -o dists/$CHANNEL/Release.gpg dists/$CHANNEL/Release

- gpg --default-key="{{.GPG_KEY_ID}}" --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" --clearsign -o dists/$CHANNEL/InRelease dists/$CHANNEL/Release

- cd ..

- rclone copy apt-repo/ "s3:{{.S3_BUCKET}}/apt/" --progress

- # RPM repository

- mkdir -p rpm-repo

- rclone copy "s3:{{.S3_BUCKET}}/rpm/$CHANNEL/" rpm-repo/

- cp {{.DIST_DIR}}/*.rpm rpm-repo/

- createrepo_c --update rpm-repo/

- gpg --default-key="{{.GPG_KEY_ID}}" --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" --detach-sign --armor rpm-repo/repodata/repomd.xml

- cat > rpm-repo/mirum-${CHANNEL}.repo << REPOEOF

- [mirum-${CHANNEL}]

- name=Mirum ${CHANNEL}

- gpgkey={{.S3_PUBLIC_URL}}/public.gpg

- baseurl={{.S3_PUBLIC_URL}}/rpm/${CHANNEL}/

- enabled=1

- gpgcheck=1

- REPOEOF

- rclone copy rpm-repo/ "s3:{{.S3_BUCKET}}/rpm/$CHANNEL/" --progress

publish:release:

desc: Create or update a GitHub Release

requires:

@@ -367,11 +275,11 @@ tasks:

done

- gh release create "$TAG" {{.DIST_DIR}}/*.deb {{.DIST_DIR}}/*.rpm {{.DIST_DIR}}/*.apk {{.DIST_DIR}}/*.rsa.pub {{.DIST_DIR}}/*.tar.gz {{.DIST_DIR}}/*.zip {{.DIST_DIR}}/SHA256SUMS \

+ gh release create "$TAG" {{.DIST_DIR}}/*.deb {{.DIST_DIR}}/*.rpm {{.DIST_DIR}}/*.apk {{.DIST_DIR}}/*.tar.gz {{.DIST_DIR}}/*.zip {{.DIST_DIR}}/SHA256SUMS \

--title "$NAME" \

$( [ "{{.CHANNEL}}" = "nightly" ] && echo "--prerelease" ) \

--notes "**Version**: {{.VERSION}}" \

- || gh release upload "$TAG" {{.DIST_DIR}}/*.deb {{.DIST_DIR}}/*.rpm {{.DIST_DIR}}/*.apk {{.DIST_DIR}}/*.rsa.pub {{.DIST_DIR}}/*.tar.gz {{.DIST_DIR}}/*.zip {{.DIST_DIR}}/SHA256SUMS --clobber

+ || gh release upload "$TAG" {{.DIST_DIR}}/*.deb {{.DIST_DIR}}/*.rpm {{.DIST_DIR}}/*.apk {{.DIST_DIR}}/*.tar.gz {{.DIST_DIR}}/*.zip {{.DIST_DIR}}/SHA256SUMS --clobber

# Local dev env

devenv:config:

diff --git a/mise.lock b/mise.lock
index ea51012..c1cad8c 100644
--- a/mise.lock
+++ b/mise.lock

@@ -56,20 +56,6 @@ url = "https://nodejs.org/dist/v24.18.0/node-v24.18.0-linux-arm64.tar.gz"

checksum = "sha256:783130984963db7ba9cbd01089eaf2c2efb055c7c1693c943174b967b3050cb8"

url = "https://nodejs.org/dist/v24.18.0/node-v24.18.0-linux-x64.tar.gz"

-[[tools.rclone]]

-version = "1.74.4"

-backend = "aqua:rclone/rclone"

-[tools.rclone."platforms.linux-arm64"]

-checksum = "sha256:97685285c9ad6a0cf17d5844115d2a67245af6444db672187074bd9c358de419"

-url = "https://github.com/rclone/rclone/releases/download/v1.74.4/rclone-v1.74.4-linux-arm64.zip"

-url_api = "https://api.github.com/repos/rclone/rclone/releases/assets/470550100"

-[tools.rclone."platforms.linux-x64"]

-checksum = "sha256:fe435e0c36228e7c2f116a8701f01127bb1f694005fc11d1f27186c8bca4115d"

-url = "https://github.com/rclone/rclone/releases/download/v1.74.4/rclone-v1.74.4-linux-amd64.zip"

-url_api = "https://api.github.com/repos/rclone/rclone/releases/assets/470549540"

[[tools.task]]

version = "3.52.0"

backend = "aqua:go-task/task"

diff --git a/mise.toml b/mise.toml
index 1be13f0..e23f620 100644
--- a/mise.toml
+++ b/mise.toml

@@ -11,7 +11,6 @@ buf = "1.67.0"

gh = "2.96.0"

go = "1.26.6"

node = "24.18.0"

-rclone = "1.74.4"

task = "3.52.0" # Removed after Taskfile.yml is migrated to mise tasks.

zig = "0.16.0"

@@ -19,18 +18,21 @@ zig = "0.16.0"

# APT

"apt:apt-utils" = "latest"

"apt:createrepo-c" = "latest"

+"apt:debsigs" = "latest"

"apt:gnupg" = "latest"

"apt:openssl" = "latest"

+"apt:rpm" = "latest"

"apt:zip" = "latest"

# DNF

"dnf:createrepo_c" = "latest"

"dnf:gnupg2" = "latest"

"dnf:openssl" = "latest"

+"dnf:rpm" = "latest"

"dnf:zip" = "latest"

[task_config]

dir = "{{cwd}}"

includes = [

- "git::https://github.com/dimidiumlabs/infra.git//tasks?ref=9e7330a3e5bde39a87e0ac1b76c9e85db7a6d64a",

+ "git::https://github.com/dimidiumlabs/infra.git//tasks?ref=4a4589fdb968686a7c91b380ff369aba23bd8662",

]

diff --git a/nfpm.yaml b/nfpm.yaml
index e3c23af..a0fc6ad 100644
--- a/nfpm.yaml
+++ b/nfpm.yaml

@@ -127,6 +127,6 @@ rpm:

apk:

signature:

key_file: ${APK_SIGNING_KEY}

- # nfpm appends ".rsa.pub" to this value when embedding the signature;

- # clients must install the public key as /etc/apk/keys/mirum.rsa.pub.

- key_name: mirum

+ # nFPM appends ".rsa.pub"; the versioned basename lets clients retain

+ # historical package keys during rotation.

+ key_name: packages.${PACKAGE_KEY_VERSION}

diff --git a/packaging/apt-ftparchive.conf b/packaging/apt-ftparchive.conf
deleted file mode 100644
--- a/packaging/apt-ftparchive.conf
+++ /dev/null

@@ -1,29 +0,0 @@

-// SPDX-FileCopyrightText: 2026 Nikolay Govorov

-// SPDX-License-Identifier: AGPL-3.0-or-later

-Dir {

- ArchiveDir ".";

- CacheDir "/tmp/apt-cache";

-};

-Default {

- Packages::Compress ". gzip";

- Packages::Extensions ".deb";

-};

-TreeDefault {

- Packages "$(DIST)/$(SECTION)/binary-$(ARCH)/Packages";

- BinCacheDB "packages-$(DIST)-$(ARCH).db";

-};

-Tree "dists/stable" {

- Sections "main";

- Architectures "amd64 arm64 riscv64 ppc64le";

- Directory "pool/stable";

-};

-Tree "dists/nightly" {

- Sections "main";

- Architectures "amd64 arm64 riscv64 ppc64le";

- Directory "pool/nightly";

-};