103 lines
4.7 KiB
Docker
103 lines
4.7 KiB
Docker
# A release's packages replace the snapshot ones through `--build-context packages=<dir>`.
|
|
ARG BASE_URL=https://larvit.github.io/fejkdata
|
|
ARG EXPECTED_VERSION
|
|
|
|
FROM goreleaser/goreleaser:v2.18.3 AS snapshot
|
|
WORKDIR /w/src
|
|
COPY . .
|
|
RUN git init -q && git add -A && git -c user.name=snapshot -c user.email=snapshot@example.invalid commit -qm snapshot \
|
|
&& goreleaser release --snapshot --clean --skip=publish,docker,homebrew,scoop \
|
|
--config release-tooling/goreleaser.yaml
|
|
|
|
FROM scratch AS packages
|
|
COPY --from=snapshot /w/dist/*.deb /w/dist/*.rpm /w/dist/*.apk /
|
|
|
|
FROM debian:trixie-20260918-slim AS throwaway-keys-maker
|
|
RUN apt-get update && apt-get install -y --no-install-recommends gnupg openssl && rm -rf /var/lib/apt/lists/*
|
|
RUN export GNUPGHOME=/tmp/gnupg && mkdir -m 700 $GNUPGHOME \
|
|
&& gpg --batch --quiet --passphrase '' --quick-gen-key 'fejkdata throwaway <throwaway@example.invalid>' ed25519 sign never \
|
|
&& mkdir /keys && gpg --batch --armor --export-secret-keys > /keys/gpg.asc \
|
|
&& openssl genrsa -out /keys/rsa.pem 2048 2>/dev/null
|
|
|
|
FROM scratch AS throwaway-keys
|
|
COPY --from=throwaway-keys-maker /keys /
|
|
|
|
FROM debian:trixie-20260918-slim AS deb-rpm
|
|
ARG BASE_URL
|
|
RUN apt-get update && apt-get install -y --no-install-recommends apt-utils createrepo-c dpkg-dev gnupg \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
COPY --from=packages *.deb /site/deb/pool/
|
|
COPY --from=packages *.rpm /site/rpm/
|
|
WORKDIR /site
|
|
RUN --mount=type=secret,id=gpg,required=true --mount=type=tmpfs,target=/root/.gnupg \
|
|
gpg --batch --quiet --import /run/secrets/gpg \
|
|
&& gpg --armor --export > fejkdata.asc \
|
|
&& cd deb \
|
|
&& for arch in amd64 arm64; do \
|
|
mkdir -p dists/stable/main/binary-$arch \
|
|
&& dpkg-scanpackages --arch $arch pool > dists/stable/main/binary-$arch/Packages \
|
|
&& gzip -9k dists/stable/main/binary-$arch/Packages; \
|
|
done \
|
|
&& apt-ftparchive -o APT::FTPArchive::Release::Origin=fejkdata \
|
|
-o APT::FTPArchive::Release::Suite=stable -o APT::FTPArchive::Release::Codename=stable \
|
|
-o APT::FTPArchive::Release::Components=main \
|
|
-o "APT::FTPArchive::Release::Architectures=amd64 arm64" \
|
|
release dists/stable > dists/stable/Release \
|
|
&& gpg --batch --yes --clearsign -o dists/stable/InRelease dists/stable/Release \
|
|
&& gpg --batch --yes --armor --detach-sign -o dists/stable/Release.gpg dists/stable/Release \
|
|
&& cd ../rpm \
|
|
&& createrepo_c --quiet . \
|
|
&& gpg --batch --yes --armor --detach-sign repodata/repomd.xml \
|
|
&& printf '[fejkdata]\nname=fejkdata\nbaseurl=%s/rpm\nrepo_gpgcheck=1\ngpgcheck=0\ngpgkey=%s/fejkdata.asc\n' \
|
|
"$BASE_URL" "$BASE_URL" > fejkdata.repo
|
|
|
|
FROM alpine:3.24.2 AS apk
|
|
RUN apk add --no-cache abuild openssl
|
|
COPY --from=packages *.apk /packages/
|
|
RUN --mount=type=secret,id=rsa,required=true,target=/keys/fejkdata.rsa \
|
|
mkdir -p /site/apk/x86_64 /site/apk/aarch64 \
|
|
&& openssl rsa -in /keys/fejkdata.rsa -pubout -out /site/apk/fejkdata.rsa.pub 2>/dev/null \
|
|
&& cp /packages/*_linux_amd64.apk /site/apk/x86_64/ \
|
|
&& cp /packages/*_linux_arm64.apk /site/apk/aarch64/ \
|
|
&& for arch in x86_64 aarch64; do \
|
|
cd /site/apk/$arch \
|
|
&& apk index --quiet --allow-untrusted -o APKINDEX.tar.gz *.apk \
|
|
&& mv *.apk "fejkdata-$(tar -xzOf APKINDEX.tar.gz APKINDEX | sed -n 's/^V://p').apk" \
|
|
&& abuild-sign -q -k /keys/fejkdata.rsa APKINDEX.tar.gz; \
|
|
done
|
|
|
|
FROM scratch AS site
|
|
COPY --from=deb-rpm /site /
|
|
COPY --from=apk /site /
|
|
|
|
FROM debian:trixie-20260918-slim AS check-deb
|
|
ARG EXPECTED_VERSION
|
|
COPY --from=site / /site
|
|
RUN echo 'deb [signed-by=/site/fejkdata.asc] file:/site/deb stable main' > /etc/apt/sources.list.d/fejkdata.list \
|
|
&& apt-get update -o Dir::Etc::SourceList=/etc/apt/sources.list.d/fejkdata.list -o Dir::Etc::SourceParts=- \
|
|
&& apt-get install -y fejkdata \
|
|
&& fejkdata --version > /checked \
|
|
&& { [ -z "$EXPECTED_VERSION" ] || [ "$(cat /checked)" = "fejkdata $EXPECTED_VERSION" ]; }
|
|
|
|
FROM fedora:43@sha256:a651ddf48ea28a06ed4e1e6519f51c9f47e7a5a138722ade87369b8fbb7e5b42 AS check-rpm
|
|
ARG EXPECTED_VERSION
|
|
COPY --from=site / /site
|
|
RUN sed -e 's#^baseurl=.*#baseurl=file:///site/rpm#' -e 's#^gpgkey=.*#gpgkey=file:///site/fejkdata.asc#' \
|
|
/site/rpm/fejkdata.repo > /etc/yum.repos.d/fejkdata.repo \
|
|
&& dnf install -y --repo fejkdata fejkdata \
|
|
&& fejkdata --version > /checked \
|
|
&& { [ -z "$EXPECTED_VERSION" ] || [ "$(cat /checked)" = "fejkdata $EXPECTED_VERSION" ]; }
|
|
|
|
FROM alpine:3.24.2 AS check-apk
|
|
ARG EXPECTED_VERSION
|
|
COPY --from=site / /site
|
|
RUN cp /site/apk/fejkdata.rsa.pub /etc/apk/keys/ \
|
|
&& apk add --no-cache --repositories-file /dev/null -X /site/apk fejkdata \
|
|
&& fejkdata --version > /checked \
|
|
&& { [ -z "$EXPECTED_VERSION" ] || [ "$(cat /checked)" = "fejkdata $EXPECTED_VERSION" ]; }
|
|
|
|
FROM scratch AS checks
|
|
COPY --from=check-deb /checked /deb
|
|
COPY --from=check-rpm /checked /rpm
|
|
COPY --from=check-apk /checked /apk
|