From d46e3d17bee2d6c4b4bdbba624b4612a4e04f172 Mon Sep 17 00:00:00 2001 From: emmanuelm41 Date: Thu, 18 Jun 2026 22:36:52 -0300 Subject: [PATCH] feat(_release-rust): opt-in Debian .deb build MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add an opt-in `build_deb` input (default false) that builds, signs and checksums a Debian .deb package for Linux musl targets, mirroring the existing `enable_signing` opt-in pattern. - gated on `inputs.build_deb && contains(matrix.target, 'linux')` - installs cargo-deb via taiki-e/install-action@v2 - `cargo deb --no-build` packages the already-built/stripped/signed binary (no recompile); arch mapped amd64/arm64 from the musl triple - asset named kache__.deb (version = github.ref_name minus v) - signed with zondax/actions/sign-linux-binary@v1 (detached .asc) and checksummed (.sha256) like the other assets, uploaded via the same path - consumer Cargo.toml must set [package.metadata.deb] depends = "" Default off → fully backward-compatible (v10 keeps floating). --- .github/workflows/_release-rust.yml | 72 +++++++++++++++++++++++++++++ 1 file changed, 72 insertions(+) diff --git a/.github/workflows/_release-rust.yml b/.github/workflows/_release-rust.yml index a549d5b..c3a934d 100644 --- a/.github/workflows/_release-rust.yml +++ b/.github/workflows/_release-rust.yml @@ -67,6 +67,12 @@ on: required: false type: string default: "" + # --- Debian packaging (opt-in; default off → no change for existing callers) --- + build_deb: + description: "Build a Debian .deb package for Linux targets via cargo-deb (opt-in; default off). Requires the consumer Cargo.toml to define [package.metadata.deb] with depends = \"\" for static-musl binaries." + required: false + type: boolean + default: false # --- Code signing (opt-in; default off → no change for existing callers) --- enable_signing: description: "Enable OS code signing of built binaries" @@ -494,15 +500,81 @@ jobs: > "${ARCHIVE}.sha256" fi + # --- Debian package (opt-in; Linux targets only). Builds a .deb from the + # ALREADY-built binary (--no-build → no recompile), packaged AFTER the + # strip + binary-signing steps above so the .deb carries the stripped, + # signed ELF. The .deb is then PGP-signed (detached .asc) and checksummed + # exactly like the tar.gz assets, and uploaded as a top-level release + # asset named kache__.deb. + # + # NOTE: the CONSUMING repo must define `[package.metadata.deb]` in its + # Cargo.toml with `depends = ""` (the static-musl binary has no shared-lib + # deps) — otherwise `cargo deb` runs dpkg-shlibdeps and fails. We do NOT add + # any Cargo metadata here; that belongs to the consumer's repo. + - name: Install cargo-deb + if: inputs.build_deb && contains(matrix.target, 'linux') + uses: taiki-e/install-action@v2 + with: + tool: cargo-deb + + - name: Build Debian package + id: deb + if: inputs.build_deb && contains(matrix.target, 'linux') + env: + TARGET: ${{ matrix.target }} + # Derive from the release tag the same git ref the release job + # uploads under (github.ref_name), dropping a leading "v": v1.2.3 → 1.2.3. + VERSION: ${{ github.ref_name }} + run: | + VERSION="${VERSION#v}" + # Map the Rust musl triple to the Debian arch used in the asset name. + case "$TARGET" in + x86_64-unknown-linux-musl) ARCH="amd64" ;; + aarch64-unknown-linux-musl) ARCH="arm64" ;; + *) echo "Unsupported Linux target for .deb: $TARGET" >&2; exit 1 ;; + esac + DEB="kache_${VERSION}_${ARCH}.deb" + # --no-build → package the binary already built/stripped/signed above. + cargo deb --no-build --target "$TARGET" --output "$DEB" + echo "deb=$DEB" >> "$GITHUB_OUTPUT" + + - name: Sign Debian package + if: inputs.build_deb && contains(matrix.target, 'linux') + uses: zondax/actions/sign-linux-binary@v1 + with: + target-path: ${{ steps.deb.outputs.deb }} + workload-identity-provider: ${{ secrets.pgp_sign_wif_provider }} + gcp-project-id: ${{ secrets.pgp_sign_gcp_project_id }} + service-account: ${{ secrets.pgp_sign_service_account }} + signer-token: ${{ secrets.pgp_signer_token }} + kms-key: ${{ secrets.pgp_sign_kms_key_version }} + cert-base64: ${{ secrets.pgp_cert_base64 }} + + - name: Checksum Debian package + if: inputs.build_deb && contains(matrix.target, 'linux') + env: + DEB: ${{ steps.deb.outputs.deb }} + run: | + if command -v sha256sum &>/dev/null; then + sha256sum "$DEB" > "${DEB}.sha256" + else + shasum -a 256 "$DEB" > "${DEB}.sha256" + fi + - name: Upload artifact uses: actions/upload-artifact@v7 with: name: ${{ inputs.binary_name }}-${{ matrix.target }} retention-days: 1 + # The .deb globs are no-ops on non-Linux / when build_deb is off + # (upload-artifact tolerates missing globbed paths). path: | ${{ inputs.binary_name }}-${{ matrix.target }}.${{ matrix.archive_ext }} ${{ inputs.binary_name }}-${{ matrix.target }}.${{ matrix.archive_ext }}.sha256 ${{ inputs.binary_name }}-${{ matrix.target }}.${{ matrix.archive_ext }}.asc + *.deb + *.deb.sha256 + *.deb.asc # --- Job 3: Create/upload GitHub Release --- release: