repo-index.sh (2416B)
1 #!/bin/sh 2 # mk/repo-index.sh - (re)build and sign APKINDEX.tar.gz for an arch repo dir 3 # 4 # Usage: ./mk/repo-index.sh [arch] 5 # 6 # Index generation uses host `apk index`; signing follows the abuild-sign 7 # layout (gzipped sig tar record prepended to the index, RSA/SHA1 over the 8 # index bytes) using only our own tooling. 9 set -eu 10 11 HERE=$(cd "$(dirname "$0")" && pwd) 12 ROOT=$(cd "${HERE}/.." && pwd) 13 # ARCH from $ARCH env or first arg, normalise arm64 -> aarch64 14 ARCH="${ARCH:-${1:-x86_64}}" 15 if [ $# -ge 1 ]; then case "$1" in x86_64|aarch64|arm64) ARCH="$1";; esac; fi 16 case "${ARCH}" in arm64) ARCH=aarch64 ;; esac 17 case "${ARCH}" in x86_64|aarch64) ;; *) echo "repo-index.sh: unsupported ARCH ${ARCH}" >&2; exit 1 ;; esac 18 REPODIR="${ROOT}/build/repo/${ARCH}" 19 20 [ -d "${REPODIR}" ] || { echo "repo-index.sh: no such dir: ${REPODIR}" >&2; exit 1; } 21 22 # The apk we built must win over any system one, exactly as mk/build.sh does. 23 # Without this the bare `apk index` below resolves against whatever the host 24 # happens to have -- which works on a developer box that installed apk-tools 25 # and fails in a clean CI container, where nothing provides it at all. 26 export PATH="${ROOT}/build/host/bin:${PATH}" 27 command -v apk >/dev/null 2>&1 || { 28 echo "repo-index.sh: no apk on PATH; run ./mk/bootstrap-host.sh first" >&2 29 exit 1 30 } 31 32 . "${HERE}/sign-key.inc" 33 KEY=$(resolve_sign_key) || { echo "repo-index.sh: no signing key (mk/keymgmt.sh use)" >&2; exit 1; } 34 KEYNAME=$(basename "${KEY}" .rsa) 35 36 if [ ! -x "${HERE}/pax-tar" ] || [ "${HERE}/pax-tar.c" -nt "${HERE}/pax-tar" ]; then 37 cc -std=c99 -O2 -Wall -Wextra -o "${HERE}/pax-tar" "${HERE}/pax-tar.c" 38 fi 39 40 cd "${REPODIR}" 41 echo "==> indexing ${REPODIR}" 42 apk index --allow-untrusted -o APKINDEX.tar.gz *.apk 43 44 echo "==> signing APKINDEX.tar.gz with ${KEYNAME}" 45 openssl dgst -sha1 -sign "${KEY}" -out ".SIGN.RSA.${KEYNAME}.rsa.pub" APKINDEX.tar.gz 46 mkdir -p "${ROOT}/build/work/.idxsig" 47 cp ".SIGN.RSA.${KEYNAME}.rsa.pub" "${ROOT}/build/work/.idxsig/" 48 "${HERE}/pax-tar" --no-checksum "${ROOT}/build/work/.idxsig" idxsig.tar 49 sigsiz=$(stat -c%s idxsig.tar) 50 head -c $((sigsiz - 1024)) idxsig.tar > idxsignotr.tar 51 gzip -n -9 -f idxsignotr.tar 52 cat idxsignotr.tar.gz APKINDEX.tar.gz > APKINDEX.signed.tar.gz 53 mv APKINDEX.signed.tar.gz APKINDEX.tar.gz 54 rm -f ".SIGN.RSA.${KEYNAME}.rsa.pub" idxsig.tar idxsignotr.tar.gz 55 rm -rf "${ROOT}/build/work/.idxsig" 56 echo "==> done: ${REPODIR}/APKINDEX.tar.gz"