agw
bdbd6f5978
push-aur.sh: mktemp -d creates the work directory as 0700 root, so the
builder user could not enter it to run makepkg ('cd: Permission denied'),
and the git steps afterwards would refuse a tree owned by another user. Give
builder the whole tree for makepkg and hand it back to root before git.
record-state.sh: 'git diff --quiet' ignores untracked files, so the first
state.json was reported as unchanged and never committed, which would have
rebuilt and republished every night. Stage it before comparing.
Both were found by the first publishing run; push-aur.sh was then tested end
to end in a clean Arch container with a dummy key.
Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9
75 lines
2.7 KiB
Bash
Executable File
75 lines
2.7 KiB
Bash
Executable File
#!/bin/bash
|
|
# Publish the generated PKGBUILD to the AUR.
|
|
#
|
|
# Runs natively inside an `archlinux:base-devel` container (so makepkg is
|
|
# available), matching the pattern already used by agw/pi3-smart-workspace.
|
|
#
|
|
# AUR_SSH_PRIVATE_KEY private key registered with aur.archlinux.org
|
|
# $1 path to the generated PKGBUILD
|
|
|
|
set -euo pipefail
|
|
|
|
PKGBUILD_PATH="${1:?path to PKGBUILD is required}"
|
|
: "${AUR_SSH_PRIVATE_KEY:?AUR_SSH_PRIVATE_KEY is required}"
|
|
PKGNAME="${PKGNAME:-jasp-desktop-bin}"
|
|
|
|
mkdir -p ~/.ssh
|
|
printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > ~/.ssh/aur
|
|
chmod 600 ~/.ssh/aur
|
|
ssh-keyscan -H aur.archlinux.org >> ~/.ssh/known_hosts 2>/dev/null || true
|
|
cat > ~/.ssh/config <<'EOF'
|
|
Host aur.archlinux.org
|
|
User aur
|
|
IdentityFile ~/.ssh/aur
|
|
StrictHostKeyChecking accept-new
|
|
EOF
|
|
|
|
workdir="$(mktemp -d)"
|
|
|
|
echo ":: cloning AUR repo $PKGNAME"
|
|
# A package that does not exist on the AUR yet clones as an empty repo.
|
|
git clone "ssh://aur@aur.archlinux.org/${PKGNAME}.git" "$workdir/aur" 2>&1 || true
|
|
if [[ ! -d "$workdir/aur/.git" ]]; then
|
|
mkdir -p "$workdir/aur"
|
|
git -C "$workdir/aur" init -b master
|
|
git -C "$workdir/aur" remote add origin "ssh://aur@aur.archlinux.org/${PKGNAME}.git"
|
|
fi
|
|
|
|
cp "$PKGBUILD_PATH" "$workdir/aur/PKGBUILD"
|
|
|
|
# makepkg refuses to run as root.
|
|
if ! id builder &>/dev/null; then
|
|
useradd -m builder
|
|
echo "builder ALL=(ALL) NOPASSWD: ALL" >>/etc/sudoers
|
|
fi
|
|
# The whole tree, not just aur/: mktemp -d creates $workdir as 0700 root, and
|
|
# builder could not even enter it to run makepkg ("cd: Permission denied").
|
|
chown -R builder:builder "$workdir"
|
|
|
|
echo ":: generating .SRCINFO"
|
|
# The sha256sum is already correct from gen-pkgbuild.py (taken from the file we
|
|
# just uploaded), so there is no need to re-download ~1.5 GB with updpkgsums.
|
|
sudo -u builder bash -c "cd '$workdir/aur' && makepkg --printsrcinfo > .SRCINFO"
|
|
# Hand the tree back to root: the git commands below run as root, and git
|
|
# refuses to work in a repository owned by another user ("dubious ownership").
|
|
chown -R root:root "$workdir"
|
|
|
|
cd "$workdir/aur"
|
|
git config user.name "${AUR_GIT_NAME:-Asger Geel Weirsoe}"
|
|
git config user.email "${AUR_GIT_EMAIL:-asger@weircon.dk}"
|
|
git add PKGBUILD .SRCINFO
|
|
|
|
if git diff --staged --quiet; then
|
|
echo ":: no changes — nothing to push"
|
|
exit 0
|
|
fi
|
|
|
|
version="$(awk -F= '/^pkgver=/{v=$2} /^pkgrel=/{r=$2} END{print v"-"r}' PKGBUILD)"
|
|
git commit -m "Update to ${version}"
|
|
# Push HEAD explicitly rather than a branch name: cloning a package that does
|
|
# not exist on the AUR yet yields an empty repo whose initial branch depends on
|
|
# the runner's init.defaultBranch, which may not be master.
|
|
git push -u origin HEAD:master
|
|
|
|
echo ":: pushed ${PKGNAME} ${version} to the AUR"
|