mirum - Unnamed repository; edit this file 'description' to name the repository.

diff options


context:
space:
mode:

Diffstat

-rw-r--r--	.github/workflows/build.yml	35	+24 −11
-rw-r--r--	Taskfile.yml	181	+25 −156
-rw-r--r--	mise.lock	46	+0 −46
-rw-r--r--	mise.toml	3	+0 −3
-rw-r--r--	nfpm.yaml	2	+2 −0
-rw-r--r--	packaging/apt-ftparchive.conf	29	+0 −29

6 files changed, 51 insertions, 245 deletions

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 99da313..f646a7e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml

@@ -16,7 +16,7 @@ on:

jobs:

build:

- name: Build and publish Nightly

+ name: Build and publish

runs-on: ubuntu-latest

permissions:

contents: write

@@ -34,9 +34,19 @@ jobs:

- name: Install dependencies

run: mise bootstrap --locked --yes --update

+ - name: Build

+ if: github.event_name == 'pull_request'

+ run: task cross

- name: Build and package

- run: task package GIT_REF=${{ github.ref }} GPG_KEY_ID=${{ vars.GPG_KEY_ID }}

+ if: github.event_name == 'push'

+ run: >-

+ task package

+ GIT_REF=${{ github.ref }}

+ RELEASE_SEQUENCE=${{ github.run_number }}

+ RELEASE_COMMIT=${{ github.sha }}

env:

+ GPG_KEY_ID: ${{ vars.GPG_KEY_ID }}

GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}

GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

APK_PRIVATE_KEY: ${{ secrets.APK_PRIVATE_KEY }}

@@ -53,17 +63,20 @@ jobs:

git config user.name "github-actions[bot]"

git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

. build/dist/build.env

- task publish:release CHANNEL=$CHANNEL VERSION=$VERSION

- task publish:repos \

- CHANNEL=$CHANNEL \

- S3_BUCKET=${{ vars.S3_BUCKET }} \

- S3_PUBLIC_URL=${{ vars.S3_PUBLIC_URL }} \

- S3_PROVIDER="${{ vars.S3_PROVIDER || 'Other' }}" \

- S3_REGION=${{ vars.S3_REGION }} \

- S3_ENDPOINT=${{ vars.S3_ENDPOINT }} \

- GPG_KEY_ID=${{ vars.GPG_KEY_ID }}

+ mise run publish -- \

+ --name mirum \

+ --repository "${{ github.server_url }}/${{ github.repository }}" \

+ --version "$VERSION" \

+ --input build/dist \

+ --s3-bucket "${{ vars.S3_BUCKET }}" \

+ --s3-public-url "${{ vars.S3_PUBLIC_URL }}" \

+ --s3-provider "${{ vars.S3_PROVIDER || 'Other' }}" \

+ --s3-region "${{ vars.S3_REGION }}" \

+ --s3-endpoint "${{ vars.S3_ENDPOINT }}" \

+ --github-release

env:

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

+ GPG_KEY_ID: ${{ vars.GPG_KEY_ID }}

GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}

GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}

diff --git a/Taskfile.yml b/Taskfile.yml
index dc2d7fc..e4c5b80 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml

@@ -210,48 +210,29 @@ tasks:

- cd {{.DIST_DIR}} && sha256sum *.tar.gz *.zip > SHA256SUMS

package:

- desc: Cross-compile all platforms and build deb/rpm packages for Linux

+ desc: Cross-compile all platforms and build signed Linux packages

deps: [cross]

vars:

VERSION:

sh: |

ref="${GIT_REF:-$(git describe --tags --exact-match 2>/dev/null || echo "")}"

- if [[ "$ref" == refs/tags/v* ]]; then

- echo "${ref#refs/tags/v}"

- elif [[ "$ref" == v* ]]; then

- echo "${ref#v}"

- else

- echo "$(cat VERSION)~nightly.$(git log -1 --format=%ct)"

- fi

- CHANNEL:

- sh: |

- ref="${GIT_REF:-$(git describe --tags --exact-match 2>/dev/null || echo "")}"

- if [[ "$ref" == refs/tags/v* || "$ref" == v* ]]; then echo stable; else echo nightly; fi

- env:

- VERSION: "{{.VERSION}}"

+ case "$ref" in

+ refs/tags/v*) version="${ref#refs/tags/v}" ;;

+ v*) version="${ref#v}" ;;

+ *)

+ sequence="${RELEASE_SEQUENCE:-$(git log -1 --format=%ct)}"

+ commit="${RELEASE_COMMIT:-$(git rev-parse HEAD)}"

+ printf '%s-nightly.%s.g%.12s\n' "$(cat VERSION)" "$sequence" "$commit"

+ exit

+ ;;

+ esac

+ [ "$version" = "$(cat VERSION)" ] || {

+ echo "tag version $version does not match VERSION" >&2

+ exit 1

+ }

+ echo "$version"

cmds:

- |

- cleanup() { rm -rf "$GNUPGHOME" /tmp/mirum-signing.asc /tmp/mirum-apk.rsa 2>/dev/null; }

- trap cleanup EXIT

- if [ -n "${GPG_PRIVATE_KEY:-}" ]; then

- export GNUPGHOME=$(mktemp -d)

- chmod 700 "$GNUPGHOME"

- printf '%s' "$GPG_PRIVATE_KEY" > /tmp/mirum-signing.asc

- chmod 600 /tmp/mirum-signing.asc

- gpg --batch --yes --passphrase "$GPG_PASSPHRASE" --import /tmp/mirum-signing.asc

- export GPG_KEY_ID="{{.GPG_KEY_ID}}"

- export SIGNING_PRIVATE_KEY="/tmp/mirum-signing.asc"

- export NFPM_PASSPHRASE="$GPG_PASSPHRASE"

- fi

- if [ -n "${APK_PRIVATE_KEY:-}" ]; then

- printf '%s' "$APK_PRIVATE_KEY" > /tmp/mirum-apk.rsa

- chmod 600 /tmp/mirum-apk.rsa

- export APK_SIGNING_KEY="/tmp/mirum-apk.rsa"

- openssl rsa -in /tmp/mirum-apk.rsa -pubout -out "{{.DIST_DIR}}/mirum.rsa.pub"

- fi

for arch in {{.LINUX_PKG_TARGETS}}; do

mkdir -p {{.BUILD_DIR}}/tmp

for cmd in cmd/*/; do

@@ -259,132 +240,20 @@ tasks:

[ "$bin" = "mirum-agent" ] && continue

cp "{{.BUILD_DIR}}/${bin}-linux-${arch}" "{{.BUILD_DIR}}/tmp/${bin}"

done

- ARCH=$arch nfpm package --packager deb --target {{.DIST_DIR}}/

- ARCH=$arch nfpm package --packager rpm --target {{.DIST_DIR}}/

- # Alpine does not build for loong64

+ formats="deb rpm"

if [ "$arch" != "loong64" ]; then

- ARCH=$arch nfpm package --packager apk --target {{.DIST_DIR}}/

+ formats="$formats apk"

+ mise run package -- \

+ --version "{{.VERSION}}" \

+ --arch "$arch" \

+ --output "{{.DIST_DIR}}" \

+ $formats

rm -rf {{.BUILD_DIR}}/tmp

done

- printf 'VERSION={{.VERSION}}\nCHANNEL={{.CHANNEL}}\n' > {{.DIST_DIR}}/build.env

- publish:repos:

- desc: Publish packages to APT and RPM repositories on S3

- requires:

- vars:

- [

- CHANNEL,

- S3_BUCKET,

- S3_PUBLIC_URL,

- S3_PROVIDER,

- S3_REGION,

- S3_ENDPOINT,

- GPG_KEY_ID,

- ]

- cmds:

- - |

- set -e

- export GNUPGHOME=$(mktemp -d)

- RCLONE_CONF=$(mktemp)

- chmod 700 "$GNUPGHOME"

- cleanup() { rm -rf "$GNUPGHOME" "$RCLONE_CONF"; }

- trap cleanup EXIT

- cat > "$RCLONE_CONF" << EOF

- [s3]

- type = s3

- provider = {{.S3_PROVIDER}}

- access_key_id = ${S3_ACCESS_KEY_ID}

- secret_access_key = ${S3_SECRET_ACCESS_KEY}

- region = {{.S3_REGION}}

- endpoint = {{.S3_ENDPOINT}}

- EOF

- export RCLONE_CONFIG="$RCLONE_CONF"

- printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" --import

- echo "allow-loopback-pinentry" >> "$GNUPGHOME/gpg-agent.conf"

- gpgconf --kill gpg-agent

- # Upload static files

- gpg --export --armor "{{.GPG_KEY_ID}}" > "$GNUPGHOME/public.gpg"

- rclone copyto "$GNUPGHOME/public.gpg" "s3:{{.S3_BUCKET}}/public.gpg"

- rclone copy packaging/dl/ "s3:{{.S3_BUCKET}}/"

- if [ -f "{{.DIST_DIR}}/mirum.rsa.pub" ]; then

- rclone copyto "{{.DIST_DIR}}/mirum.rsa.pub" "s3:{{.S3_BUCKET}}/mirum.rsa.pub"

- fi

- # APT repository

- CHANNEL={{.CHANNEL}}

- mkdir -p /tmp/apt-cache apt-repo

- rclone copy "s3:{{.S3_BUCKET}}/apt/" apt-repo/

- for ch in stable nightly; do

- mkdir -p apt-repo/pool/$ch

- for arch in {{.LINUX_PKG_TARGETS}}; do

- mkdir -p apt-repo/dists/$ch/main/binary-$arch

- done

- cp {{.DIST_DIR}}/*.deb apt-repo/pool/$CHANNEL/

- cd apt-repo

- apt-ftparchive generate "$(pwd)/../packaging/apt-ftparchive.conf"

- apt-ftparchive \

- -o APT::FTPArchive::Release::Codename=$CHANNEL \

- -o APT::FTPArchive::Release::Components=main \

- -o APT::FTPArchive::Release::Architectures="{{.LINUX_PKG_TARGETS}}" \

- release dists/$CHANNEL/ > dists/$CHANNEL/Release

- gpg --default-key="{{.GPG_KEY_ID}}" --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" -abs -o dists/$CHANNEL/Release.gpg dists/$CHANNEL/Release

- gpg --default-key="{{.GPG_KEY_ID}}" --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" --clearsign -o dists/$CHANNEL/InRelease dists/$CHANNEL/Release

- cd ..

- rclone copy apt-repo/ "s3:{{.S3_BUCKET}}/apt/" --progress

- # RPM repository

- mkdir -p rpm-repo

- rclone copy "s3:{{.S3_BUCKET}}/rpm/$CHANNEL/" rpm-repo/

- cp {{.DIST_DIR}}/*.rpm rpm-repo/

- createrepo_c --update rpm-repo/

- gpg --default-key="{{.GPG_KEY_ID}}" --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" --detach-sign --armor rpm-repo/repodata/repomd.xml

- cat > rpm-repo/mirum-${CHANNEL}.repo << REPOEOF

- [mirum-${CHANNEL}]

- name=Mirum ${CHANNEL}

- gpgkey={{.S3_PUBLIC_URL}}/public.gpg

- baseurl={{.S3_PUBLIC_URL}}/rpm/${CHANNEL}/

- enabled=1

- gpgcheck=1

- REPOEOF

- rclone copy rpm-repo/ "s3:{{.S3_BUCKET}}/rpm/$CHANNEL/" --progress

- publish:release:

- desc: Create or update a GitHub Release

- requires:

- vars: [CHANNEL, VERSION]

- cmds:

- - |

- if [ "{{.CHANNEL}}" = "stable" ]; then

- TAG="v{{.VERSION}}"

- NAME="{{.VERSION}}"

- else

- TAG="nightly"

- NAME="nightly"

- git tag -f nightly

- git push origin --force tag nightly

- for asset in $(gh release view nightly --json assets --jq '.assets[].name' 2>/dev/null || true); do

- gh release delete-asset nightly "$asset" --yes

- done

- fi

- gh release create "$TAG" {{.DIST_DIR}}/*.deb {{.DIST_DIR}}/*.rpm {{.DIST_DIR}}/*.apk {{.DIST_DIR}}/*.rsa.pub {{.DIST_DIR}}/*.tar.gz {{.DIST_DIR}}/*.zip {{.DIST_DIR}}/SHA256SUMS \

- --title "$NAME" \

- $( [ "{{.CHANNEL}}" = "nightly" ] && echo "--prerelease" ) \

- --notes "**Version**: {{.VERSION}}" \

- || gh release upload "$TAG" {{.DIST_DIR}}/*.deb {{.DIST_DIR}}/*.rpm {{.DIST_DIR}}/*.apk {{.DIST_DIR}}/*.rsa.pub {{.DIST_DIR}}/*.tar.gz {{.DIST_DIR}}/*.zip {{.DIST_DIR}}/SHA256SUMS --clobber

+ printf 'VERSION={{.VERSION}}\n' > {{.DIST_DIR}}/build.env

# Local dev env

devenv:config:

diff --git a/mise.lock b/mise.lock
index afea5fa..1244c79 100644
--- a/mise.lock
+++ b/mise.lock

@@ -16,22 +16,6 @@ url = "https://github.com/bufbuild/buf/releases/download/v1.67.0/buf-Linux-x86_6

url_api = "https://api.github.com/repos/bufbuild/buf/releases/assets/386413039"

provenance = "minisign"

-[[tools.gh]]

-version = "2.96.0"

-backend = "aqua:cli/cli"

-[tools.gh."platforms.linux-arm64"]

-checksum = "sha256:06f86ec7103d41993b76cd78072f43595c34aaa56506d971d9860e67140bf909"

-url = "https://github.com/cli/cli/releases/download/v2.96.0/gh_2.96.0_linux_arm64.tar.gz"

-url_api = "https://api.github.com/repos/cli/cli/releases/assets/464728549"

-provenance = "github-attestations"

-[tools.gh."platforms.linux-x64"]

-checksum = "sha256:83d5c2ccad5498f58bf6368acb1ab32588cf43ab3a4b1c301bf36328b1c8bd60"

-url = "https://github.com/cli/cli/releases/download/v2.96.0/gh_2.96.0_linux_amd64.tar.gz"

-url_api = "https://api.github.com/repos/cli/cli/releases/assets/464728543"

-provenance = "github-attestations"

[[tools.go]]

version = "1.26.5"

backend = "core:go"

@@ -44,22 +28,6 @@ url = "https://dl.google.com/go/go1.26.5.linux-arm64.tar.gz"

checksum = "sha256:5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053"

url = "https://dl.google.com/go/go1.26.5.linux-amd64.tar.gz"

-[[tools.nfpm]]

-version = "2.47.0"

-backend = "aqua:goreleaser/nfpm"

-[tools.nfpm."platforms.linux-arm64"]

-checksum = "sha256:1c0f5f2999b9a974bfb04fdb0cc3306096de530ac5dbb25d739cc5f5219c919c"

-url = "https://github.com/goreleaser/nfpm/releases/download/v2.47.0/nfpm_2.47.0_Linux_arm64.tar.gz"

-url_api = "https://api.github.com/repos/goreleaser/nfpm/releases/assets/453316744"

-provenance = "cosign"

-[tools.nfpm."platforms.linux-x64"]

-checksum = "sha256:0660ca602b2d2d2ae4781a06c692b3eeb9d437ffea05b831d76e41f4a3188783"

-url = "https://github.com/goreleaser/nfpm/releases/download/v2.47.0/nfpm_2.47.0_Linux_x86_64.tar.gz"

-url_api = "https://api.github.com/repos/goreleaser/nfpm/releases/assets/453316748"

-provenance = "cosign"

[[tools.node]]

version = "24.18.0"

backend = "core:node"

@@ -72,20 +40,6 @@ url = "https://nodejs.org/dist/v24.18.0/node-v24.18.0-linux-arm64.tar.gz"

checksum = "sha256:783130984963db7ba9cbd01089eaf2c2efb055c7c1693c943174b967b3050cb8"

url = "https://nodejs.org/dist/v24.18.0/node-v24.18.0-linux-x64.tar.gz"

-[[tools.rclone]]

-version = "1.74.4"

-backend = "aqua:rclone/rclone"

-[tools.rclone."platforms.linux-arm64"]

-checksum = "sha256:97685285c9ad6a0cf17d5844115d2a67245af6444db672187074bd9c358de419"

-url = "https://github.com/rclone/rclone/releases/download/v1.74.4/rclone-v1.74.4-linux-arm64.zip"

-url_api = "https://api.github.com/repos/rclone/rclone/releases/assets/470550100"

-[tools.rclone."platforms.linux-x64"]

-checksum = "sha256:fe435e0c36228e7c2f116a8701f01127bb1f694005fc11d1f27186c8bca4115d"

-url = "https://github.com/rclone/rclone/releases/download/v1.74.4/rclone-v1.74.4-linux-amd64.zip"

-url_api = "https://api.github.com/repos/rclone/rclone/releases/assets/470549540"

[[tools.task]]

version = "3.52.0"

backend = "aqua:go-task/task"

diff --git a/mise.toml b/mise.toml
index e3757c4..c57b549 100644
--- a/mise.toml
+++ b/mise.toml

@@ -8,11 +8,8 @@ experimental = true

[tools]

buf = "1.67.0"

-gh = "2.96.0"

go = "1.26.5"

-nfpm = "2.47.0"

node = "24.18.0"

-rclone = "1.74.4"

task = "3.52.0" # Removed after Taskfile.yml is migrated to mise tasks.

zig = "0.16.0"

diff --git a/nfpm.yaml b/nfpm.yaml
index e3c23af..ec28380 100644
--- a/nfpm.yaml
+++ b/nfpm.yaml

@@ -7,6 +7,8 @@

name: mirum

arch: ${ARCH}

version: ${VERSION}

+release: ${RELEASE}

+version_schema: none

license: AGPL-3.0-or-later

platform: linux

maintainer: Nikolay Govorov <me@govorov.online>

diff --git a/packaging/apt-ftparchive.conf b/packaging/apt-ftparchive.conf
deleted file mode 100644
--- a/packaging/apt-ftparchive.conf
+++ /dev/null

@@ -1,29 +0,0 @@

-// SPDX-FileCopyrightText: 2026 Nikolay Govorov

-// SPDX-License-Identifier: AGPL-3.0-or-later

-Dir {

- ArchiveDir ".";

- CacheDir "/tmp/apt-cache";

-};

-Default {

- Packages::Compress ". gzip";

- Packages::Extensions ".deb";

-};

-TreeDefault {

- Packages "$(DIST)/$(SECTION)/binary-$(ARCH)/Packages";

- BinCacheDB "packages-$(DIST)-$(ARCH).db";

-};

-Tree "dists/stable" {

- Sections "main";

- Architectures "amd64 arm64 riscv64 ppc64le";

- Directory "pool/stable";

-};

-Tree "dists/nightly" {

- Sections "main";

- Architectures "amd64 arm64 riscv64 ppc64le";

- Directory "pool/nightly";

-};