repo-index.sh (2680B)
1 #!/bin/sh 2 # mk/repo-index.sh - (re)build and sign APKINDEX.tar.gz for an arch repo dir 3 # 4 # Usage: ./mk/repo-index.sh [arch] 5 # 6 # Index generation uses host `apk index`; signing follows the abuild-sign 7 # layout (gzipped sig tar record prepended to the index, RSA/SHA1 over the 8 # index bytes) using only our own tooling. 9 set -eu 10 11 HERE=$(cd "$(dirname "$0")" && pwd) 12 ROOT=$(cd "${HERE}/.." && pwd) 13 14 # shellcheck disable=SC1091 15 . "${HERE}/channels.inc" 16 17 CHANNEL="${UNOS_CHANNEL:-lts}" 18 case "${1:-}" in 19 --channel) CHANNEL="${2:?--channel needs a value}"; shift 2 ;; 20 --channel=*) CHANNEL="${1#--channel=}"; shift ;; 21 esac 22 23 ARCH="${ARCH:-${1:-x86_64}}" 24 if [ $# -ge 1 ]; then case "$1" in x86_64|aarch64|arm64) ARCH="$1";; esac; fi 25 ARCH=$(chan_arch "${ARCH}") 26 case "${ARCH}" in x86_64|aarch64) ;; *) echo "repo-index.sh: unsupported ARCH ${ARCH}" >&2; exit 1 ;; esac 27 REPODIR=$(chan_repodir "${CHANNEL}" "${ARCH}") 28 29 [ -d "${REPODIR}" ] || { echo "repo-index.sh: no such dir: ${REPODIR}" >&2; exit 1; } 30 31 # The apk we built must win over any system one, exactly as mk/build.sh does. 32 # Without this the bare `apk index` below resolves against whatever the host 33 # happens to have -- which works on a developer box that installed apk-tools 34 # and fails in a clean CI container, where nothing provides it at all. 35 export PATH="${ROOT}/build/host/bin:${PATH}" 36 command -v apk >/dev/null 2>&1 || { 37 echo "repo-index.sh: no apk on PATH; run ./mk/bootstrap-host.sh first" >&2 38 exit 1 39 } 40 41 . "${HERE}/sign-key.inc" 42 KEY=$(resolve_sign_key) || { echo "repo-index.sh: no signing key (mk/keymgmt.sh use)" >&2; exit 1; } 43 KEYNAME=$(basename "${KEY}" .rsa) 44 45 if [ ! -x "${HERE}/pax-tar" ] || [ "${HERE}/pax-tar.c" -nt "${HERE}/pax-tar" ]; then 46 cc -std=c99 -O2 -Wall -Wextra -o "${HERE}/pax-tar" "${HERE}/pax-tar.c" 47 fi 48 49 cd "${REPODIR}" 50 set -- ./*.apk 51 [ -e "$1" ] || { echo "repo-index.sh: no .apk files in ${REPODIR}" >&2; exit 1; } 52 echo "==> indexing ${REPODIR} ($# packages)" 53 apk index --allow-untrusted -o APKINDEX.tar.gz "$@" 54 55 echo "==> signing APKINDEX.tar.gz with ${KEYNAME}" 56 openssl dgst -sha1 -sign "${KEY}" -out ".SIGN.RSA.${KEYNAME}.rsa.pub" APKINDEX.tar.gz 57 mkdir -p "${ROOT}/build/work/.idxsig" 58 cp ".SIGN.RSA.${KEYNAME}.rsa.pub" "${ROOT}/build/work/.idxsig/" 59 "${HERE}/pax-tar" --no-checksum "${ROOT}/build/work/.idxsig" idxsig.tar 60 sigsiz=$(stat -c%s idxsig.tar) 61 head -c $((sigsiz - 1024)) idxsig.tar > idxsignotr.tar 62 gzip -n -9 -f idxsignotr.tar 63 cat idxsignotr.tar.gz APKINDEX.tar.gz > APKINDEX.signed.tar.gz 64 mv APKINDEX.signed.tar.gz APKINDEX.tar.gz 65 rm -f ".SIGN.RSA.${KEYNAME}.rsa.pub" idxsig.tar idxsignotr.tar.gz 66 rm -rf "${ROOT}/build/work/.idxsig" 67 echo "==> done: ${REPODIR}/APKINDEX.tar.gz"