From b240c88e7ded3cd09122870f6c2b2fe01c1f4215 Mon Sep 17 00:00:00 2001 From: Nikolay Govorov Date: Sun, 11 Jan 2026 22:27:17 +0000 Subject: Setup packaging for linux --- .github/workflows/build.yml | 67 +++++++++++++++++++++++++++++++++++-- .gitignore | 1 + nfpm.yaml | 43 ++++++++++++++++++++++++ pkg/scripts/postinstall.sh | 15 +++++++++ pkg/scripts/preremove.sh | 8 +++++ pkg/zorian.service | 46 +++++++++++++++++++++++++ pkg/zorian.toml | 3 ++ 7 files changed, 180 insertions(+), 3 deletions(-) create mode 100644 nfpm.yaml create mode 100644 pkg/scripts/postinstall.sh create mode 100644 pkg/scripts/preremove.sh create mode 100644 pkg/zorian.service create mode 100644 pkg/zorian.toml diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 26eaea2..28ea39b 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -3,6 +3,7 @@ name: Build on: push: branches: [main] + tags: ["v*"] pull_request: branches: [main] @@ -32,17 +33,77 @@ jobs: run: cargo clippy --all-targets --all-features -- -D warnings build: - name: Build (${{ matrix.os }}) - runs-on: ${{ matrix.os }} + name: Build (${{ matrix.arch }}) + runs-on: ${{ matrix.runner }} needs: [lint] strategy: fail-fast: false matrix: - os: [ubuntu-latest, macos-latest, windows-latest] + include: + - runner: ubuntu-24.04 + arch: amd64 + - runner: ubuntu-24.04-arm + arch: arm64 steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2 + - run: cargo build --release - run: cargo test --all-features --release --locked + + - name: Install nfpm + run: | + echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | sudo tee /etc/apt/sources.list.d/goreleaser.list + sudo apt update && sudo apt install nfpm + + - name: Build packages + run: | + export ARCH=${{ matrix.arch }} + export VERSION=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[0].version') + + mkdir -p dist/ + for pkg in deb rpm archlinux; do + nfpm package --packager $pkg --target dist/ + done + + - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + with: + name: packages-${{ matrix.arch }} + path: dist/* + + release: + name: Update nightly tag + runs-on: ubuntu-latest + needs: [build] + if: github.ref == 'refs/heads/main' + permissions: + contents: write + steps: + - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + + - name: Update 'nightly' tag + run: | + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + + git tag -f nightly + git push origin --force tag nightly + + - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 + with: + pattern: packages-* + path: dist + merge-multiple: true + + - name: Create GitHub Release + uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0 + with: + name: nightly + tag_name: nightly + files: dist/* + body: | + **Release checks**: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.gitignore b/.gitignore index ea8c4bf..4f96631 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ /target +/dist diff --git a/nfpm.yaml b/nfpm.yaml new file mode 100644 index 0000000..09b92dd --- /dev/null +++ b/nfpm.yaml @@ -0,0 +1,43 @@ +# SPDX-FileCopyrightText: 2026 Nikolay Govorov +# SPDX-License-Identifier: AGPL-3.0-or-later + +# yaml-language-server: $schema=https://nfpm.goreleaser.com/schema.json +# vim: set ts=2 sw=2 tw=0 fo=cnqoj + +name: zorian +arch: ${ARCH} +version: ${VERSION} +license: AGPL-3.0-or-later +platform: linux +maintainer: Nikolay Govorov +description: Tiny packages caching proxy + +contents: + - src: ./LICENSE + dst: /usr/share/doc/zorian/LICENSE + - src: ./README.md + dst: /usr/share/doc/zorian/README.md + + - src: target/release/zorian + dst: /usr/local/bin/zorian + file_info: + mode: 0755 + + - src: pkg/zorian.toml + dst: /etc/zorian.toml + type: config|noreplace + file_info: + mode: 0644 + owner: zorian + + - src: pkg/zorian.service + dst: /usr/lib/systemd/system/zorian.service + file_info: + mode: 0644 + +scripts: + postinstall: pkg/scripts/postinstall.sh + preremove: pkg/scripts/preremove.sh + +rpm: + group: System Environment/Daemons diff --git a/pkg/scripts/postinstall.sh b/pkg/scripts/postinstall.sh new file mode 100644 index 0000000..f6f2c15 --- /dev/null +++ b/pkg/scripts/postinstall.sh @@ -0,0 +1,15 @@ +#!/bin/sh +# SPDX-FileCopyrightText: 2026 Nikolay Govorov +# SPDX-License-Identifier: AGPL-3.0-or-later + +set -e + +if ! getent group zorian >/dev/null; then + groupadd --system zorian +fi + +if ! getent passwd zorian >/dev/null; then + useradd --system --gid zorian --no-create-home --shell /usr/sbin/nologin zorian +fi + +systemctl daemon-reload diff --git a/pkg/scripts/preremove.sh b/pkg/scripts/preremove.sh new file mode 100644 index 0000000..9236820 --- /dev/null +++ b/pkg/scripts/preremove.sh @@ -0,0 +1,8 @@ +#!/bin/sh +# SPDX-FileCopyrightText: 2026 Nikolay Govorov +# SPDX-License-Identifier: AGPL-3.0-or-later + +set -e + +systemctl stop zorian.service || true +systemctl disable zorian.service || true diff --git a/pkg/zorian.service b/pkg/zorian.service new file mode 100644 index 0000000..dc43e72 --- /dev/null +++ b/pkg/zorian.service @@ -0,0 +1,46 @@ +# SPDX-FileCopyrightText: 2026 Nikolay Govorov +# SPDX-License-Identifier: AGPL-3.0-or-later + +[Unit] +Description=Zorian server (tiny packages caching proxy) +Requires=network-online.target +Wants=time-sync.target +After=time-sync.target network-online.target remote-fs.target nss-lookup.target + +[Service] +Type=exec +User=zorian +Group=zorian +ExecPaths=/usr/local/bin/zorian /usr/lib +ExecStart=/usr/local/bin/zorian --config=/etc/zorian.toml --pid-file=%t/%p/%p.pid +LimitCORE=infinity +LimitNOFILE=500000 +Restart=always +RestartSec=30 +# %p is resolved to the systemd unit name +RuntimeDirectory=%p + +LockPersonality=yes +MemoryDenyWriteExecute=yes +NoExecPaths=/ +NoNewPrivileges=yes +PrivateDevices=yes +PrivateTmp=true +ProcSubset=pid +ProtectClock=yes +ProtectControlGroups=yes +ProtectHome=yes +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectProc=invisible +ProtectSystem=strict +RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX +RestrictNamespaces=yes +RestrictSUIDSGID=yes +UMask=0077 + +[Install] +# service should not start from the rescue shell (rescue.target). +WantedBy=multi-user.target diff --git a/pkg/zorian.toml b/pkg/zorian.toml new file mode 100644 index 0000000..cae76fd --- /dev/null +++ b/pkg/zorian.toml @@ -0,0 +1,3 @@ +# SPDX-FileCopyrightText: 2026 Nikolay Govorov +# SPDX-License-Identifier: AGPL-3.0-or-later + -- Gilti