+# SPDX-FileCopyrightText: 2026 Nikolay Govorov

+# SPDX-License-Identifier: 0BSD

+

+name: CI

+

+on:

+ push:

+ branches: [main]

+ pull_request:

+ branches: [main]

+

+permissions:

+ contents: read

+

+jobs:

+ package:

+ name: Package task

+ runs-on: ubuntu-latest

+ steps:

+ - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

+

+ - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3

+ with:

+ version: 2026.7.5

+ experimental: true

+ install: false

+

+ - name: Check package contract

+ run: |

+ tests/package

+ tests/package-integration

+## Packaging

+

+Projects build and stage their own binaries and keep their nFPM configuration.

+The shared [`package`](tasks/package) task creates only the formats explicitly

+requested by a project: nFPM packages (`deb`, `rpm`, or `apk`) and portable

+archives (`tar.gz` or `zip`). Repository publication is intentionally outside

+this task.

+

+```console

+mise run package -- \

+ --version VERSION --arch ARCH --output DIR \

+ [--config nfpm.yaml] [--apk-public-key NAME.rsa.pub] \

+ deb rpm apk

+

+mise run package -- \

+ --archive-root DIR --archive-name NAME --output DIR \

+ tar.gz zip

+```

+

+#!/bin/sh -eu

+ '^((<!--|#|//|/\*|\*)[[:space:]]*)?(Copyright[[:space:]]+(\([cC]\)|©)|SPDX-FileCopyrightText:)' \

+#!/bin/sh -eu

+# SPDX-FileCopyrightText: 2026 Nikolay Govorov

+# SPDX-License-Identifier: 0BSD

+#MISE description="Build release archives and signed Linux packages"

+#MISE tools={"nfpm"="2.47.0"}

+

+usage() {

+ echo "usage: mise run package -- --output DIR [--config FILE] [--version VERSION --arch ARCH] [--apk-public-key FILE] [--archive-root DIR --archive-name NAME] deb|rpm|apk|tar.gz|zip..." >&2

+ exit 2

+}

+

+setup_gpg_signing() {

+ : "${GPG_KEY_ID:?package: GPG_KEY_ID is required with GPG_PRIVATE_KEY}"

+ : "${GPG_PASSPHRASE:?package: GPG_PASSPHRASE is required with GPG_PRIVATE_KEY}"

+

+ export GNUPGHOME="$work/gnupg"

+ mkdir -m 700 "$GNUPGHOME"

+

+ SIGNING_PRIVATE_KEY="$work/signing.asc"

+ printf '%s' "$GPG_PRIVATE_KEY" > "$SIGNING_PRIVATE_KEY"

+

+ chmod 600 "$SIGNING_PRIVATE_KEY"

+ printf '%s\n' "$GPG_PASSPHRASE" | gpg --batch --yes \

+ --pinentry-mode loopback --passphrase-fd 0 \

+ --import "$SIGNING_PRIVATE_KEY"

+

+ NFPM_PASSPHRASE=$GPG_PASSPHRASE

+ GPG_KEY_ID=$(printf '%s' "$GPG_KEY_ID" | sed 's/.*\(.\{16\}\)$/\1/')

+ export SIGNING_PRIVATE_KEY NFPM_PASSPHRASE GPG_KEY_ID

+ unset GPG_PRIVATE_KEY GPG_PASSPHRASE

+}

+

+config=nfpm.yaml

+version=

+arch=

+output=

+archive_root=

+archive_name=

+apk_public_key=

+formats=

+system_formats=

+archive_formats=

+

+while [ "$#" -gt 0 ]; do

+ case "$1" in

+ --config) [ "$#" -ge 2 ] || usage; config=$2; shift 2 ;;

+ --version) [ "$#" -ge 2 ] || usage; version=$2; shift 2 ;;

+ --arch) [ "$#" -ge 2 ] || usage; arch=$2; shift 2 ;;

+ --output) [ "$#" -ge 2 ] || usage; output=$2; shift 2 ;;

+ --archive-root) [ "$#" -ge 2 ] || usage; archive_root=$2; shift 2 ;;

+ --archive-name) [ "$#" -ge 2 ] || usage; archive_name=$2; shift 2 ;;

+ --apk-public-key) [ "$#" -ge 2 ] || usage; apk_public_key=$2; shift 2 ;;

+ deb|rpm|apk)

+ formats="$formats $1"

+ system_formats="$system_formats $1"

+ shift

+ ;;

+ tar.gz|zip)

+ formats="$formats $1"

+ archive_formats="$archive_formats $1"

+ shift

+ ;;

+ *) usage ;;

+ esac

+done

+

+[ -n "$output" ] && [ -n "$formats" ] || usage

+

+if [ -n "$system_formats" ]; then

+ [ -n "$version" ] && [ -n "$arch" ] || usage

+ [ -f "$config" ] || { echo "package: $config not found" >&2; exit 1; }

+fi

+

+if [ -n "$archive_formats" ]; then

+ [ -n "$archive_root" ] && [ -n "$archive_name" ] || usage

+ [ -d "$archive_root" ] || { echo "package: $archive_root not found" >&2; exit 1; }

+ case "$archive_name" in

+ *[!A-Za-z0-9._-]*|.|..) echo "package: invalid archive name: $archive_name" >&2; exit 1 ;;

+ esac

+fi

+

+case "$apk_public_key" in

+ *[!A-Za-z0-9._-]*|.|..) echo "package: invalid APK public key name: $apk_public_key" >&2; exit 1 ;;

+esac

+

+mkdir -p "$output"

+output=$(cd "$output" && pwd)

+

+work=$(mktemp -d)

+trap 'rm -rf "$work"' EXIT HUP INT TERM

+

+case " $system_formats " in

+ *" deb "*|*" rpm "*)

+ if [ -n "${GPG_PRIVATE_KEY:-}" ]; then

+ setup_gpg_signing

+ fi

+ ;;

+esac

+

+case " $system_formats " in

+ *" apk "*)

+ if [ -n "${APK_PRIVATE_KEY:-}" ]; then

+ APK_SIGNING_KEY="$work/signing.rsa"

+ printf '%s' "$APK_PRIVATE_KEY" > "$APK_SIGNING_KEY"

+ chmod 600 "$APK_SIGNING_KEY"

+ export APK_SIGNING_KEY

+ unset APK_PRIVATE_KEY

+ fi

+ if [ -n "${APK_SIGNING_KEY:-}" ]; then

+ [ -n "$apk_public_key" ] || {

+ echo "package: --apk-public-key is required for signed APK packages" >&2

+ exit 1

+ }

+ openssl rsa -in "$APK_SIGNING_KEY" -pubout -out "$output/$apk_public_key"

+ fi

+ ;;

+esac

+

+for format in $formats; do

+ case "$format" in

+ deb|rpm|apk)

+ ARCH=$arch VERSION=$version

+ export ARCH VERSION

+ nfpm package --config "$config" --packager "$format" --target "$output/"

+ ;;

+ tar.gz)

+ tar -czf "$output/$archive_name.tar.gz" -C "$archive_root" .

+ ;;

+ zip)

+ rm -f "$output/$archive_name.zip"

+ (cd "$archive_root" && zip -qry "$output/$archive_name.zip" .)

+ ;;

+ esac

+done

+#!/bin/sh

+# SPDX-FileCopyrightText: 2026 Nikolay Govorov

+# SPDX-License-Identifier: 0BSD

+

+set -eu

+

+root=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)

+work=$(mktemp -d)

+trap 'rm -rf "$work"' EXIT HUP INT TERM

+

+mkdir -p "$work/bin" "$work/stage/sub" "$work/out"

+printf 'payload\n' > "$work/stage/tool"

+printf 'nested\n' > "$work/stage/sub/file"

+printf 'outside\n' > "$work/outside"

+ln -s "$work/outside" "$work/stage/outside-link"

+

+cat > "$work/bin/nfpm" <<'EOF'

+#!/bin/sh

+set -eu

+[ -z "${GPG_PRIVATE_KEY:-}" ] && [ -z "${APK_PRIVATE_KEY:-}" ] || {

+ echo 'raw private key leaked to nFPM' >&2

+ exit 1

+}

+printf 'ARCH=%s\nVERSION=%s\nGPG_KEY_ID=%s\n' "$ARCH" "$VERSION" "${GPG_KEY_ID:-}" >> "$PACKAGE_TEST_LOG"

+while [ "$#" -gt 0 ]; do

+ case "$1" in

+ --packager) packager=$2; shift 2 ;;

+ --target) target=$2; shift 2 ;;

+ *) shift ;;

+ esac

+done

+printf '%s\n' "$packager" >> "$PACKAGE_TEST_LOG"

+: > "$target/test.$packager"

+EOF

+

+cat > "$work/bin/gpg" <<'EOF'

+#!/bin/sh

+set -eu

+printf 'gpg\n' >> "$PACKAGE_TEST_LOG"

+EOF

+

+cat > "$work/bin/openssl" <<'EOF'

+#!/bin/sh

+set -eu

+while [ "$#" -gt 0 ]; do

+ case "$1" in

+ -out) output=$2; shift 2 ;;

+ *) shift ;;

+ esac

+done

+printf 'public key\n' > "$output"

+EOF

+

+chmod +x "$work/bin/nfpm" "$work/bin/gpg" "$work/bin/openssl"

+printf 'name: test\n' > "$work/nfpm.yaml"

+export PACKAGE_TEST_LOG="$work/package.log"

+PATH="$work/bin:$PATH"

+export PATH

+

+"$root/tasks/package" \

+ --output "$work/out" \

+ --archive-root "$work/stage" \

+ --archive-name test-linux-amd64 \

+ tar.gz zip

+

+test -f "$work/out/test-linux-amd64.tar.gz"

+test -f "$work/out/test-linux-amd64.zip"

+tar -tzf "$work/out/test-linux-amd64.tar.gz" | grep -q './tool'

+unzip -l "$work/out/test-linux-amd64.zip" | grep -q 'sub/file'

+test "$(unzip -p "$work/out/test-linux-amd64.zip" outside-link)" = "$work/outside"

+

+"$root/tasks/package" \

+ --config "$work/nfpm.yaml" \

+ --version '1.2.3~nightly.42' \

+ --arch arm64 \

+ --output "$work/out" \

+ deb rpm

+

+test -f "$work/out/test.deb"

+test -f "$work/out/test.rpm"

+grep -q '^ARCH=arm64$' "$work/package.log"

+grep -q '^VERSION=1.2.3~nightly.42$' "$work/package.log"

+

+GPG_PRIVATE_KEY=private \

+GPG_PASSPHRASE=passphrase \

+GPG_KEY_ID=0123456789ABCDEF0123456789ABCDEF01234567 \

+APK_PRIVATE_KEY=apk-private \

+ "$root/tasks/package" \

+ --config "$work/nfpm.yaml" \

+ --version 1.2.3 \

+ --arch amd64 \

+ --output "$work/out" \

+ --apk-public-key test.rsa.pub \

+ deb apk

+

+test -f "$work/out/test.apk"

+test -f "$work/out/test.rsa.pub"

+grep -q '^gpg$' "$work/package.log"

+grep -q '^GPG_KEY_ID=89ABCDEF01234567$' "$work/package.log"

+

+if "$root/tasks/package" --output "$work/out" deb 2>/dev/null; then

+ echo 'package test: accepted system format without version and architecture' >&2

+ exit 1

+fi

+

+if "$root/tasks/package" \

+ --output "$work/out" \

+ --archive-root "$work/stage" \

+ --archive-name '../escape' \

+ zip 2>/dev/null; then

+ echo 'package test: accepted unsafe archive name' >&2

+ exit 1

+fi

+

+if APK_SIGNING_KEY="$work/apk.rsa" "$root/tasks/package" \

+ --config "$work/nfpm.yaml" \

+ --version 1.2.3 \

+ --arch amd64 \

+ --output "$work/out" \

+ --apk-public-key '../escape' \

+ apk 2>/dev/null; then

+ echo 'package test: accepted unsafe APK public key name' >&2

+ exit 1

+fi

+#!/bin/sh

+# SPDX-FileCopyrightText: 2026 Nikolay Govorov

+# SPDX-License-Identifier: 0BSD

+

+set -eu

+

+root=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)

+work=$(mktemp -d)

+trap 'rm -rf "$work"' EXIT HUP INT TERM

+

+mkdir -p "$work/stage"

+printf 'package contract\n' > "$work/stage/package-contract"

+cat > "$work/nfpm.yaml" <<'EOF'

+name: package-contract

+arch: ${ARCH}

+version: ${VERSION}

+platform: linux

+maintainer: Dimidium Labs <me@govorov.online>

+description: Shared package task integration fixture

+license: 0BSD

+EOF

+

+mise --cd "$root" run package -- \

+ --config "$work/nfpm.yaml" \

+ --version '1.2.3~nightly.42' \

+ --arch amd64 \

+ --output "$work/out" \

+ --archive-root "$work/stage" \

+ --archive-name package-contract-linux-amd64 \

+ deb rpm apk tar.gz zip

+

+test "$(find "$work/out" -maxdepth 1 -name '*.deb' | wc -l)" -eq 1

+test "$(find "$work/out" -maxdepth 1 -name '*.rpm' | wc -l)" -eq 1

+test "$(find "$work/out" -maxdepth 1 -name '*.apk' | wc -l)" -eq 1

+test -f "$work/out/package-contract-linux-amd64.tar.gz"

+test -f "$work/out/package-contract-linux-amd64.zip"

+

+test "$(dpkg-deb -f "$work/out"/*.deb Package)" = package-contract

+test "$(dpkg-deb -f "$work/out"/*.deb Version)" = '1.2.3~nightly.42'

+test "$(dpkg-deb -f "$work/out"/*.deb Architecture)" = amd64

+tar -tzf "$work/out/package-contract-linux-amd64.tar.gz" | grep -q './package-contract'

+unzip -l "$work/out/package-contract-linux-amd64.zip" | grep -q 'package-contract'