|
| 1 | +#!/usr/bin/env bash |
| 2 | + |
| 3 | +# This script is used to publish new RPM packages to the CLI RPM repository |
| 4 | +# Usage: ./publish-rpm-packages.sh |
| 5 | +set -eo pipefail |
| 6 | + |
| 7 | +PACKAGES_BUCKET_URL="https://packages.stackit.cloud" |
| 8 | +PUBLIC_KEY_FILE_PATH="keys/key.gpg" |
| 9 | +RPM_REPO_PATH="rpm/cli" |
| 10 | +RPM_BUCKET_NAME="distribution" |
| 11 | +GORELEASER_PACKAGES_FOLDER="dist/" |
| 12 | + |
| 13 | +# We need to disable the key database daemon (keyboxd) |
| 14 | +# This can be done by removing "use-keyboxd" from ~/.gnupg/common.conf (see https://github.com/gpg/gnupg/blob/master/README) |
| 15 | +echo -n >~/.gnupg/common.conf |
| 16 | + |
| 17 | +# Create RPM repository directory structure |
| 18 | +printf ">>> Creating RPM repository structure \n" |
| 19 | +mkdir -p rpm-repo/x86_64 |
| 20 | +mkdir -p rpm-repo/i386 |
| 21 | +mkdir -p rpm-repo/aarch64 |
| 22 | + |
| 23 | +# Copy RPM packages to appropriate architecture directories |
| 24 | +printf "\n>>> Copying RPM packages to architecture directories \n" |
| 25 | + |
| 26 | +# Copy x86_64 packages (amd64) |
| 27 | +for rpm_file in "${GORELEASER_PACKAGES_FOLDER}"*_amd64.rpm; do |
| 28 | + if [ -f "$rpm_file" ]; then |
| 29 | + cp "$rpm_file" rpm-repo/x86_64/ |
| 30 | + printf "Copied %s to x86_64/\n" "$(basename "$rpm_file")" |
| 31 | + fi |
| 32 | +done |
| 33 | + |
| 34 | +# Copy i386 packages |
| 35 | +for rpm_file in "${GORELEASER_PACKAGES_FOLDER}"*_386.rpm; do |
| 36 | + if [ -f "$rpm_file" ]; then |
| 37 | + cp "$rpm_file" rpm-repo/i386/ |
| 38 | + printf "Copied %s to i386/\n" "$(basename "$rpm_file")" |
| 39 | + fi |
| 40 | +done |
| 41 | + |
| 42 | +# Copy aarch64 packages (arm64) |
| 43 | +for rpm_file in "${GORELEASER_PACKAGES_FOLDER}"*_arm64.rpm; do |
| 44 | + if [ -f "$rpm_file" ]; then |
| 45 | + cp "$rpm_file" rpm-repo/aarch64/ |
| 46 | + printf "Copied %s to aarch64/\n" "$(basename "$rpm_file")" |
| 47 | + fi |
| 48 | +done |
| 49 | + |
| 50 | +# Download existing repository content (RPMs and metadata) if it exists |
| 51 | +printf "\n>>> Downloading existing repository content \n" |
| 52 | +aws s3 sync s3://${RPM_BUCKET_NAME}/${RPM_REPO_PATH}/ rpm-repo/ --endpoint-url "${AWS_ENDPOINT_URL}" --exclude "*.asc" || echo "No existing repository found, creating new one" |
| 53 | + |
| 54 | +# Create repository metadata for each architecture |
| 55 | +printf "\n>>> Creating repository metadata \n" |
| 56 | +for arch in x86_64 i386 aarch64; do |
| 57 | + if [ -d "rpm-repo/${arch}" ] && [ -n "$(find "rpm-repo/${arch}" -mindepth 1 -maxdepth 1 -print -quit)" ]; then |
| 58 | + printf "Creating metadata for %s...\n" "$arch" |
| 59 | + |
| 60 | + # List what we're working with |
| 61 | + file_list=$(find "rpm-repo/${arch}" -maxdepth 1 -type f -exec basename {} \; | tr '\n' ' ') |
| 62 | + printf "Files in %s: %s\n" "$arch" "${file_list% }" |
| 63 | + |
| 64 | + # Create repository metadata |
| 65 | + createrepo_c --update rpm-repo/${arch} |
| 66 | + |
| 67 | + # Sign the repository metadata |
| 68 | + printf "Signing repository metadata for %s...\n" "$arch" |
| 69 | + # Remove existing signature file if it exists |
| 70 | + rm -f rpm-repo/${arch}/repodata/repomd.xml.asc |
| 71 | + gpg --batch --pinentry-mode loopback --detach-sign --armor \ |
| 72 | + --local-user "${GPG_PRIVATE_KEY_FINGERPRINT}" \ |
| 73 | + --passphrase "${GPG_PASSPHRASE}" \ |
| 74 | + rpm-repo/${arch}/repodata/repomd.xml |
| 75 | + |
| 76 | + # Verify the signature was created |
| 77 | + if [ -f "rpm-repo/${arch}/repodata/repomd.xml.asc" ]; then |
| 78 | + printf "Repository metadata signed successfully for %s\n" "$arch" |
| 79 | + else |
| 80 | + printf "WARNING: Repository metadata signature not created for %s\n" "$arch" |
| 81 | + fi |
| 82 | + else |
| 83 | + printf "No packages found for %s, skipping...\n" "$arch" |
| 84 | + fi |
| 85 | +done |
| 86 | + |
| 87 | +# Upload the updated repository to S3 in two phases (repodata pointers last) |
| 88 | +# clients reading the repo won't see a state where repomd.xml points to files not uploaded yet. |
| 89 | +printf "\n>>> Uploading repository to S3 (phase 1: all except repomd*) \n" |
| 90 | +aws s3 sync rpm-repo/ s3://${RPM_BUCKET_NAME}/${RPM_REPO_PATH}/ \ |
| 91 | + --endpoint-url "${AWS_ENDPOINT_URL}" \ |
| 92 | + --delete \ |
| 93 | + --exclude "*/repodata/repomd.xml" \ |
| 94 | + --exclude "*/repodata/repomd.xml.asc" |
| 95 | + |
| 96 | +printf "\n>>> Uploading repository to S3 (phase 2: repomd* only) \n" |
| 97 | +aws s3 sync rpm-repo/ s3://${RPM_BUCKET_NAME}/${RPM_REPO_PATH}/ \ |
| 98 | + --endpoint-url "${AWS_ENDPOINT_URL}" \ |
| 99 | + --exclude "*" \ |
| 100 | + --include "*/repodata/repomd.xml" \ |
| 101 | + --include "*/repodata/repomd.xml.asc" |
| 102 | + |
| 103 | +# Upload the public key |
| 104 | +# Also uploaded in APT publish; intentionally redundant |
| 105 | +# Safe to overwrite and ensures updates if APT fails or key changes. |
| 106 | +printf "\n>>> Uploading public key \n" |
| 107 | +gpg --armor --export "${GPG_PRIVATE_KEY_FINGERPRINT}" > public-key.asc |
| 108 | +aws s3 cp public-key.asc s3://${RPM_BUCKET_NAME}/${PUBLIC_KEY_FILE_PATH} --endpoint-url "${AWS_ENDPOINT_URL}" |
| 109 | + |
| 110 | +printf "\n>>> RPM repository published successfully! \n" |
| 111 | +printf "Repository URL: %s/%s/ \n" "$PACKAGES_BUCKET_URL" "$RPM_REPO_PATH" |
| 112 | +printf "Public key URL: %s/%s \n" "$PACKAGES_BUCKET_URL" "$PUBLIC_KEY_FILE_PATH" |
0 commit comments