reauktion-home-ca: add Arch + Debian packaging and CI publish jobs

The package was referenced in memory as already published but never actually existed in this repo or on packages.reauktion.de — only an unpublished Arch build was staged on hertz. Adds real PKGBUILD + dpkg-deb packaging (cert committed alongside, no upstream tarball) and wires both into build.yml following the lmcp/aish dual-arch + debian publish pattern.
2026-07-20 10:35:43 +02:00
parent 108fc4fba7
commit 07b4d5383e
10 changed files with 373 additions and 0 deletions
@@ -0,0 +1,60 @@
+#!/bin/bash
+# Build reauktion-home-ca_<ver>_all.deb from this directory using dpkg-deb
+# directly. Run from inside the runner container, which has dpkg installed.
+#
+# No upstream tarball: this is PKI trust material (the reauktion.de Home CA
+# root cert), not software with its own release cadence. The .crt is
+# committed alongside this script instead of being fetched.
+set -euo pipefail
+
+PKGVER=20260716
+PKGREL=1
+HERE=$(dirname "$(readlink -f "$0")")
+
+# Reproducible build: pin all file mtimes + ar member timestamps so repeat
+# builds produce identical bytes (reprepro refuses re-includes otherwise).
+export SOURCE_DATE_EPOCH=1784505600
+
+work=$(mktemp -d)
+trap "rm -rf $work" EXIT
+
+ROOT="$work/pkgroot"
+mkdir -p "$ROOT/DEBIAN" \
+         "$ROOT/usr/local/share/ca-certificates" \
+         "$ROOT/usr/share/doc/reauktion-home-ca"
+
+install -m 644 "$HERE/reauktion-home-ca.crt" \
+    "$ROOT/usr/local/share/ca-certificates/reauktion-home-ca.crt"
+
+cp "$HERE/debian/copyright" "$ROOT/usr/share/doc/reauktion-home-ca/copyright"
+cp "$HERE/debian/changelog" "$ROOT/usr/share/doc/reauktion-home-ca/changelog.Debian"
+gzip -9 -n "$ROOT/usr/share/doc/reauktion-home-ca/changelog.Debian"
+
+install -m 755 "$HERE/debian/postinst" "$ROOT/DEBIAN/postinst"
+install -m 755 "$HERE/debian/postrm"   "$ROOT/DEBIAN/postrm"
+
+cat > "$ROOT/DEBIAN/control" <<EOF
+Package: reauktion-home-ca
+Version: ${PKGVER}-${PKGREL}
+Section: admin
+Priority: optional
+Architecture: all
+Depends: ca-certificates
+Maintainer: Markus Fritsche <mfritsche@reauktion.de>
+Homepage: https://git.reauktion.de/marfrit/marfrit-packages
+Description: reauktion.de Home CA trust anchor for internal *.fritz.box HTTPS
+ Installs the private, name-constrained root CA used to sign internal
+ *.fritz.box and reauktion.de HTTPS services, so clients don't need -k
+ or browser exceptions to reach them.
+ .
+ Name constraints permit only fritz.box, reauktion.de, and localhost —
+ a leaked key can forge certificates for no other domain.
+ .
+ SHA256 fingerprint:
+ A3:32:17:6D:17:CF:F7:24:23:05:88:E0:6A:5E:5A:37:82:B9:BA:B5:BC:A1:2E:52:E3:88:3C:54:19:8B:F9:86
+EOF
+
+# Build the .deb. Output to current dir of the caller.
+DEB_OUT=reauktion-home-ca_${PKGVER}-${PKGREL}_all.deb
+dpkg-deb --root-owner-group --build "$ROOT" "$HERE/$DEB_OUT"
+echo "built: $HERE/$DEB_OUT"
@@ -0,0 +1,9 @@
+reauktion-home-ca (20260716-1) bookworm trixie; urgency=medium
+
+  * Initial release. Trust anchor for the reauktion.de Home CA (created
+    2026-07-16 on hertz:/opt/herding/pki/), a name-constrained root
+    permitted only for fritz.box, reauktion.de, and localhost. Installs
+    to /usr/local/share/ca-certificates/ and runs update-ca-certificates
+    on install/remove via maintainer scripts.
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Mon, 20 Jul 2026 00:00:00 +0000
@@ -0,0 +1,18 @@
+Package: reauktion-home-ca
+Version: 20260716-1
+Section: admin
+Priority: optional
+Architecture: all
+Depends: ca-certificates
+Maintainer: Markus Fritsche <mfritsche@reauktion.de>
+Homepage: https://git.reauktion.de/marfrit/marfrit-packages
+Description: reauktion.de Home CA trust anchor for internal *.fritz.box HTTPS
+ Installs the private, name-constrained root CA used to sign internal
+ *.fritz.box and reauktion.de HTTPS services, so clients don't need -k
+ or browser exceptions to reach them.
+ .
+ Name constraints permit only fritz.box, reauktion.de, and localhost —
+ a leaked key can forge certificates for no other domain.
+ .
+ SHA256 fingerprint:
+ A3:32:17:6D:17:CF:F7:24:23:05:88:E0:6A:5E:5A:37:82:B9:BA:B5:BC:A1:2E:52:E3:88:3C:54:19:8B:F9:86
@@ -0,0 +1,9 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: reauktion-home-ca
+Source: https://git.reauktion.de/marfrit/marfrit-packages
+
+Files: *
+Copyright: 2026 Markus Fritsche <mfritsche@reauktion.de>
+License: proprietary
+ Private PKI trust material for the reauktion.de / fritz.box fleet.
+ Not for redistribution outside that fleet.
@@ -0,0 +1,8 @@
+#!/bin/sh
+set -e
+
+if [ "$1" = "configure" ]; then
+    update-ca-certificates
+fi
+
+exit 0
@@ -0,0 +1,8 @@
+#!/bin/sh
+set -e
+
+if [ "$1" = "remove" ] || [ "$1" = "purge" ]; then
+    update-ca-certificates
+fi
+
+exit 0
@@ -0,0 +1,33 @@
+-----BEGIN CERTIFICATE-----
+MIIFsTCCA5mgAwIBAgIUTAWmENkKSdBtjEqN55mD2S96BbMwDQYJKoZIhvcNAQEL
+BQAwQjEVMBMGA1UECgwMcmVhdWt0aW9uLmRlMSkwJwYDVQQDDCByZWF1a3Rpb24u
+ZGUgSG9tZSBDQSAoZnJpdHouYm94KTAeFw0yNjA3MTYyMTMzMjZaFw00NjA3MTEy
+MTMzMjZaMEIxFTATBgNVBAoMDHJlYXVrdGlvbi5kZTEpMCcGA1UEAwwgcmVhdWt0
+aW9uLmRlIEhvbWUgQ0EgKGZyaXR6LmJveCkwggIiMA0GCSqGSIb3DQEBAQUAA4IC
+DwAwggIKAoICAQCoXQg4BEvZ7PDZMvnRJtESFBPtWsdNFQz+YT1Z/mhWnNyAgfkY
+AQ5f9yzegyDrDdnm/nzv6h1Zpss+S6TE29lnLGtXaMnkNsLpdvnIi8j0Wgi2+DkA
+A9JTkvoDrgn9yJWcG9tFj6BPex4VvLUK55luFiv+y+2e/Xg6z4zhMJe0PwoUkb3+
+lUsBnNHbBQF2bH1suJx3xVgAdpZTpqBp/bfDyj0RgokSnD17jlxF2xC3nY3lCJ1M
+l676xToeoAMvDcGc0zjKwno/JtvB/ZzfF7jPNV47czMYboCpa7lSDtjwmCLpeVkP
+6HvXcg1riER+aLC1urGLNtC2hMiSBmjlm0KZfxdTZj9J1hHLUynlYCc+jHYfSXKS
+rP6i3EV4fKuMeuFyt/ribHMv+fsI2Te7IwOBA4VQg/d+q6qwTcRO09MJzEDtY5OU
+4EPlLvd2nNKeF3u0qCn+2t7TmIK9dpi4gVmxhnCRlD1SLDfwnznMiDydtZJr/Kh7
+rjKgTCBAulfS9N4RQ0kyFM9hPF2KNYu8Ef6DRb3wysN1W0ozs+sdYQA15hczEFDu
+gVxTcwQEd4B+1seUWsDKDqRogZHLoNVrPVWp+sK4E5msyLjHzcqTBt0tpVK+2ztq
+CgkwnmNPcexevrkkPz4PuxpwqDpEJ3CLutu/RCAwSZZGSM8q0ViIXreRcwIDAQAB
+o4GeMIGbMB8GA1UdIwQYMBaAFOT/M0xih1hOVqUu1dujtbAmfEjZMA8GA1UdEwEB
+/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBTk/zNMYodYTlalLtXb
+o7WwJnxI2TA4BgNVHR4BAf8ELjAsoCowC4IJZnJpdHouYm94MA6CDHJlYXVrdGlv
+bi5kZTALgglsb2NhbGhvc3QwDQYJKoZIhvcNAQELBQADggIBAI76BcH2ATaiSwUj
+yleSzhvFB2HjOjdQimo4vt6O6YWagYXXijC3VUJ2fY5/x/S20WuVXONfqVvBKmi9
+p7x/oz/UsmLtn/SHy253a37Uf62EV++JgNiaf1GuJXjgRAxtQ3fsWY3qw906yjN9
+2BqFBRRcX026HU7a9b921VCp1D8qDa43kIi9T69Fl+pNKYb2XJYda8EpehStK/02
+BQr2Owp3QGWBly5w+cjB1E77PhFYLb4jzPe2eDDs01zoDZ/IVaf2jPWiG+dGmV2Q
+J1O7u5OacwWS4WjhWYIMG3XSbkZkCIrrJFuKNEabhYlS9GxySfDn3vovWQQsJf6n
+uoeCOI/dN08snps2XMoaMbl8TeqrityQnDKhX5k8sxvO8/IrpHt4766YBHMcwcIr
+vU1zc9Yls5vOMc5adAGGj3WloCCtzTOiDPQC952nmA+8e6Pla4u4GFvwArS+LfKG
+R7c7pN6Q61bVRhM4liQ6n9djkaGuXSfkrjcWy+JsjyesHG62TxhUNDY7kqEo8V52
+oVFxWkZClQN0f5kxeXuPV+LCby4YiDq8kTkXp8jE0OvpPx4WR4pUG/nHBOE1O0b7
+GQTHwKaJs/CtfuwfJRk7ACjwEdV8G8mQxgRJB6e+pZMGqbigqWPcPTR9tnjdbg4V
+PMS6m3J+HDRSK/22ACSisUhJIQNL
+-----END CERTIFICATE-----