commit 5f5930fe96ffcd3e342a57e0f3f12b0629895705
parent 6d3909104e9cf65a521e8615091548260f5f4ac1
Author: Robin Bron <robin.bron@yourhosting.nl>
Date: Fri, 25 Sep 2026 12:39:09 +0200
Always run the index for packages that have been published
Diffstat:
6 files changed, 79 insertions(+), 11 deletions(-)
diff --git a/.conductor.yml b/.conductor.yml
@@ -410,7 +410,7 @@ tasks:
- ./mk/publish.sh --arch "$ARCH" unos-keys
index:
- needs:
+ after:
- pkg-zlib
- pkg-openssl
- pkg-apk-tools
@@ -445,6 +445,6 @@ tasks:
- ./mk/bootstrap-host.sh
# Pull every published package down so the index describes the whole
# repo, not just whatever this container happened to build.
- - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL"
+ - ./mk/repo-pull.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL"
- ./mk/repo-index.sh
- ./mk/publish.sh --arch "$ARCH" --index-only
diff --git a/mk/gen-pipeline.sh b/mk/gen-pipeline.sh
@@ -122,7 +122,7 @@ HEADER
# each rebuild the index from their own partial view of the repo.
cat <<'FOOTER'
index:
- needs:
+ after:
FOOTER
for p in $(cd "${ROOT}" && ./mk/deps.sh order); do
printf ' - %s\n' "$(task_name "$p")"
@@ -135,7 +135,7 @@ FOOTER
- ./mk/bootstrap-host.sh
# Pull every published package down so the index describes the whole
# repo, not just whatever this container happened to build.
- - ./mk/sysroot.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL"
+ - ./mk/repo-pull.sh --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL"
- ./mk/repo-index.sh
- ./mk/publish.sh --arch "$ARCH" --index-only
FOOTER
diff --git a/mk/publish.sh b/mk/publish.sh
@@ -77,7 +77,9 @@ put() {
printf ' would PUT %s -> %s\n' "${src}" "${key}"
return 0
fi
- url="${BUCKET_ENDPOINT%/}/${BUCKET_NAME}/${key}"
+ # `+` must be percent-encoded or SigV4 signs it while S3 reads it as a space.
+ enc=$(printf '%s' "${key}" | sed 's/+/%2B/g')
+ url="${BUCKET_ENDPOINT%/}/${BUCKET_NAME}/${enc}"
sha=$(sha256sum "${src}" | cut -d' ' -f1)
code=$(curl -sS -o /dev/null -w '%{http_code}' \
--aws-sigv4 "aws:amz:${BUCKET_REGION}:s3" \
diff --git a/mk/repo-index.sh b/mk/repo-index.sh
@@ -38,8 +38,10 @@ if [ ! -x "${HERE}/pax-tar" ] || [ "${HERE}/pax-tar.c" -nt "${HERE}/pax-tar" ];
fi
cd "${REPODIR}"
-echo "==> indexing ${REPODIR}"
-apk index --allow-untrusted -o APKINDEX.tar.gz *.apk
+set -- ./*.apk
+[ -e "$1" ] || { echo "repo-index.sh: no .apk files in ${REPODIR}" >&2; exit 1; }
+echo "==> indexing ${REPODIR} ($# packages)"
+apk index --allow-untrusted -o APKINDEX.tar.gz "$@"
echo "==> signing APKINDEX.tar.gz with ${KEYNAME}"
openssl dgst -sha1 -sign "${KEY}" -out ".SIGN.RSA.${KEYNAME}.rsa.pub" APKINDEX.tar.gz
diff --git a/mk/repo-pull.sh b/mk/repo-pull.sh
@@ -0,0 +1,65 @@
+#!/bin/sh
+# mk/repo-pull.sh - download every published .apk into build/repo/<arch>.
+#
+# ./mk/repo-pull.sh --arch x86_64 --repo https://repo.unos.finwo.net
+#
+# Names are derived from the templates rather than from APKINDEX, so this
+# works before a valid index exists. Packages that are not published (failed
+# or skipped builds) are simply absent.
+set -eu
+
+HERE=$(cd "$(dirname "$0")" && pwd)
+ROOT=$(cd "${HERE}/.." && pwd)
+
+ARCH="${ARCH:-x86_64}"
+BASE=""
+
+while [ $# -gt 0 ]; do
+ case "$1" in
+ --arch) ARCH="$2"; shift 2 ;;
+ --arch=*) ARCH="${1#--arch=}"; shift ;;
+ --repo) BASE="$2"; shift 2 ;;
+ --repo=*) BASE="${1#--repo=}"; shift ;;
+ -h|--help) sed -n '2,9p' "$0"; exit 0 ;;
+ *) echo "repo-pull.sh: unknown argument: $1" >&2; exit 1 ;;
+ esac
+done
+
+case "${ARCH}" in arm64) ARCH=aarch64 ;; esac
+case "${ARCH}" in x86_64|aarch64) ;; *) echo "repo-pull.sh: unsupported ARCH ${ARCH}" >&2; exit 1 ;; esac
+
+[ -n "${BASE}" ] || { echo "repo-pull.sh: --repo is required" >&2; exit 1; }
+command -v curl >/dev/null 2>&1 || { echo "repo-pull.sh: curl is required" >&2; exit 1; }
+
+OUT="${ROOT}/build/repo/${ARCH}"
+mkdir -p "${OUT}"
+
+echo "==> pulling published packages from ${BASE} (${ARCH})"
+
+found=0
+for p in $("${ROOT}/mk/deps.sh" list); do
+ TEMPLATE="${ROOT}/packages/${p}/template"
+ [ -f "${TEMPLATE}" ] || continue
+
+ eval "$( (
+ version=; revision=0
+ SYSROOT=; DESTDIR=; WRKSRC=; FILESDIR=; WORK=; SRCDEST=; UNOS_MKDIR=
+ die() { :; } ; msg() { :; } ; vinstall() { :; } ; vmkdir() { :; }
+ . "${TEMPLATE}" >/dev/null 2>&1 || true
+ printf 'VERSION=%s\nREVISION=%s\n' "${version}" "${revision}"
+ ) )"
+ [ -n "${VERSION}" ] || continue
+
+ APK_NAME="${p}-${VERSION}-r${REVISION}.apk"
+ url=$(printf '%s' "${BASE%/}/${ARCH}/${APK_NAME}" \
+ | sed 's#://#___PROTO___#; s#//*#/#g; s#___PROTO___#://#')
+
+ if curl -fsSL -o "${OUT}/${APK_NAME}" "${url}" 2>/dev/null; then
+ printf ' %s\n' "${APK_NAME}"
+ found=$((found + 1))
+ else
+ rm -f "${OUT}/${APK_NAME}"
+ fi
+done
+
+echo "==> pulled ${found} package(s) into ${OUT}"
diff --git a/packages/glibc/template b/packages/glibc/template
@@ -50,8 +50,7 @@ do_install() {
make install DESTDIR="${DESTDIR}"
# make install does not create the locale dir itself
mkdir -p "${DESTDIR}/usr/lib/locale"
- # localedef is linked against the just-built libc (2.44) but the host is
- # bookworm (2.36); run it against its own libs so GLIBC_2.38+ symbols resolve.
- LD_LIBRARY_PATH="${WORK}/build:${WORK}/build/elf${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}" \
- ./locale/localedef --prefix="${DESTDIR}" -i C -f UTF-8 C.UTF-8
+ # localedef links against the just-built libc, which needs the just-built
+ # loader too; testrun.sh wires up both.
+ ./testrun.sh ./locale/localedef --prefix="${DESTDIR}" -i C -f UTF-8 C.UTF-8
}
