Enable Debian Build,Sign,Publish via GH Actions

.github/workflows/alpine.yml

@@ -0,0 +1,184 @@
+name: Alpine Packages
+on:
+  push:
+    paths:
+      - ".github/workflows/alpine.yml"
+      - "alpine/**"
+
+jobs:
+  alpine-build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-24.04
+            arch: x86_64
+            docker_arch: amd64
+          - runner: ubuntu-24.04-arm
+            arch: aarch64
+            docker_arch: arm64
+          - runner: ubuntu-24.04-riscv
+            arch: riscv64
+            docker_arch: riscv64
+
+    runs-on: ${{ matrix.runner }}
+    name: Alpine Build
+    permissions:
+      packages: write
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          submodules: recursive
+
+      - name: Setup up Docker Buildx
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+
+      - name: Make builder container image
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: alpine
+          file: alpine/Dockerfile
+          platforms: linux/${{ matrix.docker_arch }}
+          tags: cartesi/apk-builder-${{ matrix.docker_arch }}
+          load: true
+          push: false
+          cache-from: type=gha,scope=${{ matrix.docker_arch }}
+          cache-to: type=gha,scope=${{ matrix.docker_arch }},mode=max
+
+      - name: Generate disposable build keys
+        working-directory: alpine
+        run: make key KEY_NAME=disposable
+
+      - name: Build not riscv64 packages
+        id: build-all
+        if: matrix.arch != 'riscv64'
+        continue-on-error: true
+        working-directory: alpine
+        run: make packages TARGET_ARCH=${{ matrix.arch }} KEY_NAME=disposable
+
+      - name: Test not riscv64 packages
+        id: test-all
+        if: matrix.arch != 'riscv64'
+        continue-on-error: true
+        working-directory: alpine
+        run: make -k test TARGET_ARCH=${{ matrix.arch }} KEY_NAME=disposable
+
+      - name: Build riscv64 packages only
+        id: build-riscv64
+        if: matrix.arch == 'riscv64'
+        continue-on-error: true
+        working-directory: alpine
+        run: make -k packages TARGET_ARCH=${{ matrix.arch }} KEY_NAME=disposable PACKAGES="cartesi-machine-linux-image cartesi-machine-rootfs-image cartesi-machine-guest-linux-headers cartesi-machine-guest-tools"
+
+      - name: Test riscv64 packages only
+        id: test-riscv64
+        if: matrix.arch == 'riscv64'
+        continue-on-error: true
+        working-directory: alpine
+        run: make -k test TARGET_ARCH=${{ matrix.arch }} KEY_NAME=disposable PACKAGES="cartesi-machine-linux-image cartesi-machine-rootfs-image cartesi-machine-guest-linux-headers cartesi-machine-guest-tools"
+
+      - name: Export builder container image
+        run: docker save cartesi/apk-builder-${{ matrix.docker_arch }} | gzip > /tmp/apk-builder-${{ matrix.docker_arch }}.tar.gz
+
+      - name: Upload builder container image
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: image-apk-builder-${{ matrix.docker_arch }}
+          path: /tmp/apk-builder-${{ matrix.docker_arch }}.tar.gz
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: artifacts-apk-${{ matrix.arch }}
+          path: cdn/apk
+
+  alpine-sign:
+    runs-on: ubuntu-24.04
+    name: Alpine Signing
+    needs: [alpine-build]
+    #FIXME: uncomment when process is validated
+    #if: (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v'))
+    environment: signing
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          submodules: recursive
+
+      - name: Download apk artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: artifacts-apk-*
+          path: cdn/apk/
+          merge-multiple: true
+
+      - name: Download builder images
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: image-apk-builder-*
+          path: /tmp/images
+
+      - name: Import builder image
+        run: find /tmp/images -name '*.tar.gz' | xargs -I {} docker image load --input {}
+
+      - name: Import APK signing key
+        working-directory: alpine
+        env:
+          APK_KEY: ${{ secrets.APK_KEY }}
+          APK_PUB_KEY: ${{ vars.APK_PUB_KEY }}
+        run: |
+          mkdir -p key
+          chmod 700 key
+          echo "$APK_KEY" > key/cartesi-apk-key.rsa
+          echo "$APK_PUB_KEY" > key/cartesi-apk-key.rsa.pub
+          echo "PACKAGER_PRIVKEY=/root/.abuild/cartesi-apk-key.rsa" > key/abuild.conf
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+
+      - name: Sign packages
+        working-directory: alpine
+        run: |
+          make re-sign TARGET_ARCH=x86_64  KEY_NAME=cartesi-apk-key
+          make re-sign TARGET_ARCH=aarch64 KEY_NAME=cartesi-apk-key
+          make re-sign TARGET_ARCH=riscv64 KEY_NAME=cartesi-apk-key
+
+      - name: Upload signed artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: signed-artifacts-apk
+          path: cdn/apk
+
+  publish:
+    name: Alpine Publish
+    needs: alpine-sign
+    #FIXME: uncomment when process is validated
+    #if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-24.04
+    permissions:
+      id-token: write
+    steps:
+      - name: Download signed archives
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: signed-artifacts-apk
+          path: incoming/apk/
+
+      - name: Replace disposable key with production public key
+        env:
+          APK_PUB_KEY: ${{ vars.APK_PUB_KEY }}
+        run: |
+          rm -f incoming/apk/keys/disposable.rsa.pub
+          echo "$APK_PUB_KEY" > incoming/apk/keys/cartesi-apk-key.rsa.pub
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
+        with:
+          role-to-assume: ${{ secrets.DIST_S3_ROLE_ARN }}
+          aws-region: us-east-1
+
+      - name: Publish to S3
+        run: aws s3 cp incoming/apk "s3://${{ secrets.DIST_S3_BUCKET_NAME }}/linux/apk" --recursive

.github/workflows/debian.yml

@@ -0,0 +1,189 @@
+name: Debian Packages
+on:
+  push:
+    paths:
+      - ".github/workflows/debian.yml"
+      - "debian/**"
+
+jobs:
+  debian-build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-24.04
+            arch: amd64
+            packages_allarch: "cartesi-machine-linux-image cartesi-machine-rootfs-image"
+          - runner: ubuntu-24.04-arm
+            arch: arm64
+            packages_allarch: ""
+          - runner: ubuntu-24.04-riscv
+            arch: riscv64
+            packages_allarch: ""
+
+    runs-on: ${{ matrix.runner }}
+    name: Debian Build
+    permissions:
+      packages: write
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          submodules: recursive
+
+      - name: Setup up Docker Buildx
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+
+      - name: Make builder container image
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: debian
+          file: debian/Dockerfile
+          platforms: linux/${{ matrix.arch }}
+          tags: cartesi/deb-builder-${{ matrix.arch }}
+          load: true
+          push: false
+          cache-from: type=gha,scope=${{ matrix.arch }}
+          cache-to: type=gha,scope=${{ matrix.arch }},mode=max
+
+      - name: Build not riscv64 packages
+        id: build-all
+        if: matrix.arch != 'riscv64'
+        continue-on-error: true
+        working-directory: debian
+        run: |
+            make packages \
+              TARGET_ARCH=${{ matrix.arch }} \
+              PACKAGES_ALLARCH="${{ matrix.packages_allarch }}"
+
+      - name: Test not riscv64 packages
+        id: test-all
+        if: matrix.arch != 'riscv64'
+        continue-on-error: true
+        working-directory: debian
+        run: |
+            make -k test \
+              TARGET_ARCH=${{ matrix.arch }} \
+              PACKAGES_ALLARCH="${{ matrix.packages_allarch }}"
+
+      - name: Build riscv64 packages only
+        id: build-riscv64
+        if: matrix.arch == 'riscv64'
+        continue-on-error: true
+        working-directory: debian
+        run: |
+            make -k packages \
+              TARGET_ARCH=${{ matrix.arch }} \
+              PACKAGES="cartesi-machine-guest-tools"
+
+      - name: Test riscv64 packages only
+        id: test-riscv64
+        if: matrix.arch == 'riscv64'
+        continue-on-error: true
+        working-directory: debian
+        run: |
+            make -k test \
+              TARGET_ARCH=${{ matrix.arch }} \
+              PACKAGES="cartesi-machine-guest-tools"
+
+      - name: Export builder container image
+        run: docker save cartesi/deb-builder-${{ matrix.arch }} | gzip > /tmp/deb-builder-${{ matrix.arch }}.tar.gz
+
+      - name: Upload builder container image
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: image-deb-builder-${{ matrix.arch }}
+          path: /tmp/deb-builder-${{ matrix.arch }}.tar.gz
+          compression-level: 0
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: artifacts-apt-${{ matrix.arch }}
+          path: cdn/apt
+
+  debian-sign:
+    runs-on: ubuntu-24.04
+    name: Debian Signing
+    needs: [debian-build]
+    #FIXME: uncoment when have final signing key
+    #if: (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v'))
+    environment: signing
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          submodules: recursive
+
+      - name: Download apt artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: artifacts-apt-*
+          path: cdn/apt/
+          merge-multiple: true
+
+      - name: Download builder images
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: image-deb-builder-amd64
+          path: /tmp/images
+
+      - name: Import builder images
+        run: find /tmp/images -name '*.tar.gz' | xargs -I {} docker image load --input {}
+
+      - name: Import GPG signing key
+        working-directory: debian
+        env:
+          DEB_KEY: ${{ secrets.DEB_KEY }}
+        run: |
+          mkdir -p key
+          chmod 700 key
+          echo "$DEB_KEY" | gpg --homedir "$(pwd)/key" --import
+
+      - name: Make index
+        working-directory: debian
+        run: make index
+
+      - name: Sign repository
+        working-directory: debian
+        run: make sign
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: signed-artifacts-apt
+          path: cdn
+
+  publish:
+    name: Debian Publish
+    needs: debian-sign
+    #FIXME: uncoment when process is validated
+    #if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-24.04
+    permissions:
+      id-token: write
+    steps:
+      - name: Download signed archives
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: signed-artifacts-apt
+          path: incoming/
+
+      - name: Write production GPG public key
+        env:
+          DEB_PUB_KEY: ${{ vars.DEB_PUB_KEY }}
+        run: |
+          mkdir -p incoming/apt/keys
+          echo "$DEB_PUB_KEY" > incoming/apt/keys/cartesi-deb-key.gpg
+          echo "$DEB_PUB_KEY" | gpg --dearmor -o incoming/apt/keys/cartesi-deb-key.gpg.bin
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
+        with:
+          role-to-assume: ${{ secrets.DIST_S3_ROLE_ARN }}
+          aws-region: us-east-1
+
+      - name: Publish to S3
+        run: aws s3 cp incoming/apt "s3://${{ secrets.DIST_S3_BUCKET_NAME }}/linux/apt" --recursive

.gitignore

@@ -0,0 +1,2 @@
+cdn
+key

README.md

@@ -1,2 +1,12 @@
-# linux-packages
-Cartesi Linux Packages Repository
+# Cartesi Linux Packages
+
+Cartesi Linux packages repository, containing packaging for:
+
+- Debian 13 (Trixie) - Host and Guest
+- Ubuntu 24.04 LTS (Noble) - Host and Guest
+- Alpine Linux 3.23 - Host and Guest
+
+Debian/Ubuntu packages are available in [debian](debian) subdirectory.
+Alpine packages are available in [alpine](alpine) subdirectory.
+
+You can find instructions on the sub directories.