From 5c3522eef5e7bbcc05fbd2d806cd3a3244549501 Mon Sep 17 00:00:00 2001 From: Nikolay Govorov Date: Mon, 12 Jan 2026 23:47:17 +0000 Subject: Setup signin for deb/rpm packages --- .github/workflows/build.yml | 40 +++++++++++++++++++++++++++++++------ README.md | 18 +++++++++-------- nfpm.yaml | 10 ++++++++++ pkg/scripts/postinstall.sh | 12 ----------- pkg/scripts/preinstall.sh | 17 ++++++++++++++++ 5 files changed, 71 insertions(+), 26 deletions(-) create mode 100644 pkg/scripts/preinstall.sh diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 8787a13..83b3fdc 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -12,6 +12,7 @@ on: env: CARGO_TERM_COLOR: always + RELEASE_TAG: dev jobs: lint: @@ -53,6 +54,12 @@ jobs: - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2 + - name: Import GPG key + uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec #v6.3.0 + with: + passphrase: ${{ secrets.GPG_PASSPHRASE }} + gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }} + - run: cargo build --release - run: cargo test --all-features --release --locked @@ -63,14 +70,22 @@ jobs: - name: Build packages run: | + export SIGNING_PRIVATE_KEY="/tmp/private.asc" + printf '%s' "$GPG_PRIVATE_KEY" > $SIGNING_PRIVATE_KEY + chmod 600 $SIGNING_PRIVATE_KEY + PKG_VERSION=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[0].version') - export VERSION="${PKG_VERSION}-dev.$(date +%s)+$(git rev-parse --short HEAD)" + export VERSION="${PKG_VERSION}~dev.$(git log -1 --format=%ct)" export ARCH=${{ matrix.arch }} mkdir -p dist/ - for pkg in deb rpm archlinux; do + for pkg in deb rpm; do nfpm package --packager $pkg --target dist/ done + env: + GPG_KEY_ID: ${{ vars.GPG_KEY_ID }} + GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} + NFPM_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: @@ -92,8 +107,8 @@ jobs: git config user.name "github-actions[bot]" git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - git tag -f dev - git push origin --force tag dev + git tag -f ${{ env.RELEASE_TAG }} + git push origin --force tag ${{ env.RELEASE_TAG }} - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: @@ -101,11 +116,24 @@ jobs: path: dist merge-multiple: true + - name: Export GPG public key + run: printf '%s' "$GPG_PUBLIC_KEY" > dist/public.gpg + env: + GPG_PUBLIC_KEY: ${{ secrets.GPG_PUBLIC_KEY }} + + - name: Delete old release assets + run: | + for asset in $(gh release view ${{ env.RELEASE_TAG }} --json assets --jq '.assets[].name' 2>/dev/null || true); do + gh release delete-asset ${{ env.RELEASE_TAG }} "$asset" --yes + done + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Create GitHub Release uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0 with: - name: dev - tag_name: dev + name: ${{ env.RELEASE_TAG }} + tag_name: ${{ env.RELEASE_TAG }} files: dist/* body: | Last successful build from `main` branch. diff --git a/README.md b/README.md index e70aca5..73118fd 100644 --- a/README.md +++ b/README.md @@ -8,24 +8,27 @@ Please note that the project is in its infancy and is **not** intended for produ **Use pre-bundled dev build:** +1. Install dependencies: + - Fedora/RedHat: `sudo dnf install yum-utils` + - Debian/Ubuntu: `sudo apt install apt-transport-https ca-certificates curl gnupg` 1. Download the package for your distribution from the [releases page](https://github.com/mrdimidium/Zorian/releases/tag/dev) 1. Install via system package manager: ```bash # Debian/Ubuntu - sudo dpkg -i zorian_*.deb - # Fedora - sudo dnf install zorian-*.rpm - # Arch Linux - sudo pacman -U zorian-*.pkg.tar.zst + curl -fsSL https://github.com/mrdimidium/Zorian/releases/download/dev/public.gpg | sudo gpg --dearmor -o /usr/share/keyrings/zorian.gpg + sudo dpkg -i zorian_*.deb + + # Fedora/RedHat + sudo rpm --import https://github.com/mrdimidium/Zorian/releases/download/dev/public.gpg + sudo dnf install zorian-*.rpm ``` -1. start systemd service: `sudo systemctl enable --now zorian` +1. Start systemd service: `sudo systemctl enable --now zorian` **Build from source:** 1. Install build dependencies: - - Arch Linux: `sudo pacman -S base-devel openssl pkg-config` - Fedora/RedHat: `sudo dnf install gcc openssl-devel pkg-config` - Debian/Ubuntu: `sudo apt install build-essential libssl-dev pkg-config` 1. Clone and build via cargo: @@ -38,7 +41,6 @@ Please note that the project is in its infancy and is **not** intended for produ # Build linux package packages via nfpm (ihttps://nfpm.goreleaser.com/) nfpm package -p deb --target dist/ nfpm package -p rpm --target dist/ - nfpm package -p archlinux --target dist/ # Install binary manually sudo groupadd --system zorian diff --git a/nfpm.yaml b/nfpm.yaml index 473712c..356145b 100644 --- a/nfpm.yaml +++ b/nfpm.yaml @@ -44,8 +44,18 @@ contents: scripts: + preinstall: pkg/scripts/preinstall.sh postinstall: pkg/scripts/postinstall.sh preremove: pkg/scripts/preremove.sh +deb: + signature: + method: debsign + key_id: ${GPG_KEY_ID} + key_file: ${SIGNING_PRIVATE_KEY} + rpm: group: System Environment/Daemons + signature: + key_id: ${GPG_KEY_ID} + key_file: ${SIGNING_PRIVATE_KEY} diff --git a/pkg/scripts/postinstall.sh b/pkg/scripts/postinstall.sh index 2373a73..8a1e7cf 100644 --- a/pkg/scripts/postinstall.sh +++ b/pkg/scripts/postinstall.sh @@ -4,18 +4,6 @@ set -e -PROGRAM=zorian -ZORIAN_USER=${ZORIAN_USER:-zorian} -ZORIAN_GROUP=${ZORIAN_GROUP:-${ZORIAN_USER}} - -if ! getent group $ZORIAN_GROUP >/dev/null; then - groupadd --system $ZORIAN_GROUP -fi - -if ! getent passwd $ZORIAN_USER >/dev/null; then - useradd --system --gid $ZORIAN_GROUP --no-create-home --shell /usr/sbin/nologin $ZORIAN_USER -fi - if [ -x "/bin/systemctl" ] && [ -d /run/systemd/system ] && [ -f /usr/lib/systemd/system/zorian.service ]; then /bin/systemctl daemon-reload /bin/systemctl enable zorian diff --git a/pkg/scripts/preinstall.sh b/pkg/scripts/preinstall.sh new file mode 100644 index 0000000..2828c95 --- /dev/null +++ b/pkg/scripts/preinstall.sh @@ -0,0 +1,17 @@ +#!/bin/sh +# SPDX-FileCopyrightText: 2026 Nikolay Govorov +# SPDX-License-Identifier: AGPL-3.0-or-later + +set -e + +PROGRAM=zorian +ZORIAN_USER=${ZORIAN_USER:-zorian} +ZORIAN_GROUP=${ZORIAN_GROUP:-${ZORIAN_USER}} + +if ! getent group $ZORIAN_GROUP >/dev/null; then + groupadd --system $ZORIAN_GROUP +fi + +if ! getent passwd $ZORIAN_USER >/dev/null; then + useradd --system --gid $ZORIAN_GROUP --no-create-home --shell /usr/sbin/nologin $ZORIAN_USER +fi -- Gilti