marfrit
07b4d5383e
build and publish packages / distcc-avahi-aarch64 (push) Successful in 5s
build and publish packages / mesa-panvk-bifrost-aarch64 (push) Successful in 4s
build and publish packages / mesa-panvk-bifrost-video-aarch64 (push) Successful in 4s
build and publish packages / lmcp-any (push) Successful in 5s
build and publish packages / lmcp-debian (push) Successful in 4s
build and publish packages / claude-his-any (push) Successful in 4s
build and publish packages / aish-any (push) Successful in 4s
build and publish packages / ffmpeg-v4l2-request-aarch64 (push) Successful in 5s
build and publish packages / claude-his-debian (push) Successful in 5s
build and publish packages / aish-debian (push) Successful in 5s
build and publish packages / libva-v4l2-request-fourier-aarch64 (push) Successful in 4s
build and publish packages / mpv-fourier-aarch64 (push) Successful in 4s
build and publish packages / ffmpeg-v4l2-request-debian (push) Has been cancelled
build and publish packages / libva-v4l2-request-fourier-debian (push) Has been cancelled
build and publish packages / mpv-fourier-debian (push) Has been cancelled
build and publish packages / daedalus-v4l2-debian (push) Has been cancelled
build and publish packages / daedalus-v4l2-dkms-debian (push) Has been cancelled
build and publish packages / sicd-arch (push) Has been cancelled
build and publish packages / sic-agent-arch (push) Has been cancelled
build and publish packages / sicd-debian (push) Has been cancelled
build and publish packages / sic-agent-debian (push) Has been cancelled
build and publish packages / reauktion-home-ca-any (push) Has been cancelled
build and publish packages / reauktion-home-ca-debian (push) Has been cancelled
The package was referenced in memory as already published but never actually existed in this repo or on packages.reauktion.de — only an unpublished Arch build was staged on hertz. Adds real PKGBUILD + dpkg-deb packaging (cert committed alongside, no upstream tarball) and wires both into build.yml following the lmcp/aish dual-arch + debian publish pattern.
61 lines
2.2 KiB
Bash
Executable File
61 lines
2.2 KiB
Bash
Executable File
#!/bin/bash
|
|
# Build reauktion-home-ca_<ver>_all.deb from this directory using dpkg-deb
|
|
# directly. Run from inside the runner container, which has dpkg installed.
|
|
#
|
|
# No upstream tarball: this is PKI trust material (the reauktion.de Home CA
|
|
# root cert), not software with its own release cadence. The .crt is
|
|
# committed alongside this script instead of being fetched.
|
|
set -euo pipefail
|
|
|
|
PKGVER=20260716
|
|
PKGREL=1
|
|
HERE=$(dirname "$(readlink -f "$0")")
|
|
|
|
# Reproducible build: pin all file mtimes + ar member timestamps so repeat
|
|
# builds produce identical bytes (reprepro refuses re-includes otherwise).
|
|
export SOURCE_DATE_EPOCH=1784505600
|
|
|
|
work=$(mktemp -d)
|
|
trap "rm -rf $work" EXIT
|
|
|
|
ROOT="$work/pkgroot"
|
|
mkdir -p "$ROOT/DEBIAN" \
|
|
"$ROOT/usr/local/share/ca-certificates" \
|
|
"$ROOT/usr/share/doc/reauktion-home-ca"
|
|
|
|
install -m 644 "$HERE/reauktion-home-ca.crt" \
|
|
"$ROOT/usr/local/share/ca-certificates/reauktion-home-ca.crt"
|
|
|
|
cp "$HERE/debian/copyright" "$ROOT/usr/share/doc/reauktion-home-ca/copyright"
|
|
cp "$HERE/debian/changelog" "$ROOT/usr/share/doc/reauktion-home-ca/changelog.Debian"
|
|
gzip -9 -n "$ROOT/usr/share/doc/reauktion-home-ca/changelog.Debian"
|
|
|
|
install -m 755 "$HERE/debian/postinst" "$ROOT/DEBIAN/postinst"
|
|
install -m 755 "$HERE/debian/postrm" "$ROOT/DEBIAN/postrm"
|
|
|
|
cat > "$ROOT/DEBIAN/control" <<EOF
|
|
Package: reauktion-home-ca
|
|
Version: ${PKGVER}-${PKGREL}
|
|
Section: admin
|
|
Priority: optional
|
|
Architecture: all
|
|
Depends: ca-certificates
|
|
Maintainer: Markus Fritsche <mfritsche@reauktion.de>
|
|
Homepage: https://git.reauktion.de/marfrit/marfrit-packages
|
|
Description: reauktion.de Home CA trust anchor for internal *.fritz.box HTTPS
|
|
Installs the private, name-constrained root CA used to sign internal
|
|
*.fritz.box and reauktion.de HTTPS services, so clients don't need -k
|
|
or browser exceptions to reach them.
|
|
.
|
|
Name constraints permit only fritz.box, reauktion.de, and localhost —
|
|
a leaked key can forge certificates for no other domain.
|
|
.
|
|
SHA256 fingerprint:
|
|
A3:32:17:6D:17:CF:F7:24:23:05:88:E0:6A:5E:5A:37:82:B9:BA:B5:BC:A1:2E:52:E3:88:3C:54:19:8B:F9:86
|
|
EOF
|
|
|
|
# Build the .deb. Output to current dir of the caller.
|
|
DEB_OUT=reauktion-home-ca_${PKGVER}-${PKGREL}_all.deb
|
|
dpkg-deb --root-owner-group --build "$ROOT" "$HERE/$DEB_OUT"
|
|
echo "built: $HERE/$DEB_OUT"
|