mirror of
https://github.com/ben-grande/qusal.git
synced 2024-10-01 02:35:49 -04:00
fc22726ee8
Passing files to Dom0 is always dangerous: - Passing a git repository is dangerous as it can have ignored modified files and signature verification will pass. - Passing an archive is troublesome for updates. - Passing an RPM package depends on the RPM verification to be correct, some times it is not. - Passing a RPM repository definition is less troublesome for the user, as it is a small file to verify the contents and update mechanism is via the package manager. Trust in RPM verification is still required. Many improvements were made to the build scripts: - requires-program: Single function to check if program is installed; - spec-get: Sort project names for the usage message; - spec-get: Only running commands that are necessary; - spec-get: Fix empty summary when readme has copyright header; - spec-gen: Fix grep warning of escaped symbol; - spec-build: Sign RPM and verify signature; - spec-build: Only lint the first SPEC for faster runtime; - yumrepo-gen: Generate a local yum repository with signed metadata; - qubesbuilder-gen: Generate a .qubesbuilder based on tracked projects; - release: Build, sign and push all RPMs to repository. Goal is to be able to build with qubes-builderv2 Qubes Executor. For: https://github.com/ben-grande/qusal/issues/37
32 lines
936 B
Bash
Executable File
32 lines
936 B
Bash
Executable File
#!/bin/sh
|
|
|
|
## SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
|
|
##
|
|
## SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
set -eu
|
|
|
|
command -v git >/dev/null || { echo "Missing program: git" >&2; exit 1; }
|
|
cd "$(git rev-parse --show-toplevel)" || exit 1
|
|
./scripts/requires-program.sh createrepo_c gpg
|
|
|
|
key_id="$(git config --get user.signingKey)" || true
|
|
build_dir="${HOME}/rpmbuild"
|
|
qubes_release="r4.2"
|
|
repo="current"
|
|
dist="fc37"
|
|
yum_repo_root="$HOME/rpmrepo"
|
|
yum_repo="${yum_repo_root}/${qubes_release}/${repo}/host/${dist}"
|
|
|
|
mkdir -p "${yum_repo}/rpm"
|
|
find "${build_dir}/RPMS/" -type f -name "*.rpm" \
|
|
-exec cp {} "${yum_repo}/rpm/" \;
|
|
createrepo_c --checksum sha512 "${yum_repo}"
|
|
if test -n "${key_id}"; then
|
|
rm -f -- "${yum_repo}/repodata/repomd.xml.asc"
|
|
gpg --batch --no-tty --detach-sign --armor --local-user "${key_id}" \
|
|
-- "${yum_repo}/repodata/repomd.xml"
|
|
fi
|
|
|
|
## TODO: rsync to remote host
|