diff --git a/.github/workflows/publish-apt-repository.yml b/.github/workflows/publish-apt-repository.yml new file mode 100644 index 0000000..c65434e --- /dev/null +++ b/.github/workflows/publish-apt-repository.yml @@ -0,0 +1,115 @@ +name: Publish APT repository + +on: + push: + branches: [main] + paths: + - apt-repository/** + - .github/workflows/publish-apt-repository.yml + workflow_dispatch: + +permissions: + contents: read + pages: write + id-token: write + +concurrency: + group: pages + cancel-in-progress: false + +jobs: + build: + name: Build signed APT repository + runs-on: ubuntu-26.04 + env: + APT_REPOSITORY_SIGNING_KEY: ${{ secrets.APT_REPOSITORY_SIGNING_KEY }} + APT_REPOSITORY_SIGNING_PASSPHRASE: ${{ secrets.APT_REPOSITORY_SIGNING_PASSPHRASE }} + EXPECTED_SIGNING_FINGERPRINT: ${{ secrets.APT_REPOSITORY_SIGNING_FINGERPRINT }} + GNUPGHOME: ${{ runner.temp }}/gnupg + + steps: + - name: Checkout + uses: actions/checkout@v7 + with: + persist-credentials: false + + - name: Configure GitHub Pages + uses: actions/configure-pages@v6 + + - name: Install repository build tools + run: | + sudo apt-get update + sudo apt-get install --yes apt-utils gnupg + + - name: Import and verify repository signing key + run: | + if [[ -z "$EXPECTED_SIGNING_FINGERPRINT" ]]; then + echo "APT_REPOSITORY_SIGNING_FINGERPRINT Actions secret is required." >&2 + exit 1 + fi + mkdir --mode=0700 "$GNUPGHOME" + printf '%s' "$APT_REPOSITORY_SIGNING_KEY" | gpg --batch --import + signing_fingerprint="$(gpg --batch --with-colons --list-secret-keys \ + | awk -F: '$1 == "fpr" { print $10; exit }')" + if [[ "$signing_fingerprint" != "$EXPECTED_SIGNING_FINGERPRINT" ]]; then + echo "The imported signing key does not match APT_REPOSITORY_SIGNING_FINGERPRINT." >&2 + exit 1 + fi + printf '%s\n' "$signing_fingerprint" > "$RUNNER_TEMP/signing-fingerprint" + + - name: Generate and sign repository metadata + run: | + site_dir="$RUNNER_TEMP/site" + distribution_dir="$site_dir/dists/stable" + signing_fingerprint="$(<"$RUNNER_TEMP/signing-fingerprint")" + mkdir --parents "$site_dir" + cp --archive apt-repository/. "$site_dir/" + find "$site_dir" -type f -name .gitkeep -delete + mkdir --parents "$distribution_dir/main/binary-all" "$distribution_dir/main/source" + + ( + cd "$site_dir" + apt-ftparchive packages pool/main > dists/stable/main/binary-all/Packages + gzip --keep --force dists/stable/main/binary-all/Packages + apt-ftparchive sources pool/main > dists/stable/main/source/Sources + gzip --keep --force dists/stable/main/source/Sources + + apt-ftparchive \ + -o APT::FTPArchive::Release::Origin="itsallcode" \ + -o APT::FTPArchive::Release::Label="OpenFastTrace" \ + -o APT::FTPArchive::Release::Suite="stable" \ + -o APT::FTPArchive::Release::Codename="stable" \ + -o APT::FTPArchive::Release::Architectures="all" \ + -o APT::FTPArchive::Release::Components="main" \ + -o APT::FTPArchive::Release::Description="OpenFastTrace Debian packages" \ + release dists/stable > dists/stable/Release + ) + + gpg --batch --yes --local-user "$signing_fingerprint" \ + --pinentry-mode loopback --passphrase "$APT_REPOSITORY_SIGNING_PASSPHRASE" \ + --armor --detach-sign --output "$distribution_dir/Release.gpg" "$distribution_dir/Release" + gpg --batch --yes --local-user "$signing_fingerprint" \ + --pinentry-mode loopback --passphrase "$APT_REPOSITORY_SIGNING_PASSPHRASE" \ + --clearsign --output "$distribution_dir/InRelease" "$distribution_dir/Release" + gpg --batch --armor --export "$signing_fingerprint" \ + > "$site_dir/itsallcode-archive-keyring.asc" + printf '%s\n' "$signing_fingerprint" \ + > "$site_dir/itsallcode-archive-keyring.fingerprint" + + - name: Upload GitHub Pages artifact + uses: actions/upload-pages-artifact@v5 + with: + path: ${{ runner.temp }}/site + + deploy: + name: Deploy APT repository + needs: build + runs-on: ubuntu-26.04 + environment: + name: github-pages + url: ${{ steps.deployment.outputs.page_url }} + + steps: + - name: Deploy to GitHub Pages + id: deployment + uses: actions/deploy-pages@v5 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 267b638..c7d149b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -29,6 +29,7 @@ jobs: VERSION: ${{ inputs.version }} PACKAGE_REVISION: ${{ inputs.package_revision }} PACKAGE_VERSION: ${{ inputs.version }}-${{ inputs.package_revision }} + PACKAGE_POOL_DIR: apt-repository/pool/main/o/openfasttrace steps: - name: Checkout @@ -44,58 +45,64 @@ jobs: script: | core.setFailed('Not running on main branch. Start this workflow from main.') - - name: Install Debian build dependencies + - name: Validate committed package artifacts run: | - sudo apt-get update - sudo apt-get install --yes \ - appstream \ - build-essential \ - curl \ - debhelper \ - devscripts \ - dpkg-dev \ - imagemagick \ - maven \ - openjdk-17-jdk-headless \ - pandoc \ - shellcheck \ - wget + readonly orig_tarball="openfasttrace_${VERSION}.orig.tar.gz" + readonly debian_tarball="openfasttrace_${PACKAGE_VERSION}.debian.tar.xz" + readonly dsc_file="openfasttrace_${PACKAGE_VERSION}.dsc" + readonly binary_package="openfasttrace_${PACKAGE_VERSION}_all.deb" + readonly checksum_file="openfasttrace_${PACKAGE_VERSION}.SHA256SUMS" + readonly artifacts=( + "$orig_tarball" + "$debian_tarball" + "$dsc_file" + "$binary_package" + "$checksum_file" + ) - - name: Configure Maven toolchain - run: | - jdk_home="$(dirname "$(dirname "$(readlink -f "$(command -v javac)")")")" - mkdir --parents "$HOME/.m2" - cat > "$HOME/.m2/toolchains.xml" < - - - jdk - - 17 - - - $jdk_home - - - - EOF - - - name: Create source package - run: ./create-source-package.sh "$VERSION" "$PACKAGE_REVISION" + if [[ ! -d "$PACKAGE_POOL_DIR" ]]; then + echo "Error: The APT package pool is missing: $PACKAGE_POOL_DIR" >&2 + echo "Mitigation: merge the package pull request that adds version $PACKAGE_VERSION before releasing it." >&2 + exit 1 + fi - - name: Create binary package - run: ./create-binary-package.sh "$VERSION" "$PACKAGE_REVISION" - - - name: Generate SHA-256 checksums - run: | + missing_artifacts=0 + for artifact in "${artifacts[@]}"; do + if [[ ! -f "$PACKAGE_POOL_DIR/$artifact" ]]; then + echo "Error: Missing committed package artifact: $PACKAGE_POOL_DIR/$artifact" >&2 + missing_artifacts=1 + fi + done + if [[ "$missing_artifacts" -ne 0 ]]; then + echo "Mitigation: create and stage the package, then commit and merge the staged files:" >&2 + echo " ./create-source-package.sh $VERSION $PACKAGE_REVISION" >&2 + echo " ./create-binary-package.sh $VERSION $PACKAGE_REVISION" >&2 + echo " ./stage-apt-package.sh $VERSION $PACKAGE_REVISION" >&2 + exit 1 + fi ( - cd out - sha256sum \ - "openfasttrace_${VERSION}.orig.tar.gz" \ - "openfasttrace_${PACKAGE_VERSION}.debian.tar.xz" \ - "openfasttrace_${PACKAGE_VERSION}.dsc" \ - "openfasttrace_${PACKAGE_VERSION}_all.deb" - ) > out/SHA256SUMS + cd "$PACKAGE_POOL_DIR" + if ! sha256sum --check "$checksum_file"; then + echo "Error: The checksum manifest for $PACKAGE_VERSION does not match the committed package artifacts." >&2 + echo "Mitigation: regenerate the staged package with ./stage-apt-package.sh $VERSION $PACKAGE_REVISION and commit the updated files." >&2 + exit 1 + fi + ) + if [[ "$(dpkg-deb --field "$PACKAGE_POOL_DIR/$binary_package" Package)" != "openfasttrace" ]]; then + echo "Error: $binary_package is not an openfasttrace package." >&2 + echo "Mitigation: stage the package produced by ./create-binary-package.sh $VERSION $PACKAGE_REVISION." >&2 + exit 1 + fi + if [[ "$(dpkg-deb --field "$PACKAGE_POOL_DIR/$binary_package" Version)" != "$PACKAGE_VERSION" ]]; then + echo "Error: $binary_package does not declare Debian version $PACKAGE_VERSION." >&2 + echo "Mitigation: stage matching source and binary artifacts for version $PACKAGE_VERSION." >&2 + exit 1 + fi + if [[ "$(dpkg-deb --field "$PACKAGE_POOL_DIR/$binary_package" Architecture)" != "all" ]]; then + echo "Error: $binary_package is not architecture-independent." >&2 + echo "Mitigation: stage the OpenFastTrace all-architecture package for version $PACKAGE_VERSION." >&2 + exit 1 + fi - name: Create GitHub release run: | @@ -103,10 +110,10 @@ jobs: --target main \ --title "$PACKAGE_VERSION: OpenFastTrace Debian Package" \ --generate-notes \ - "out/openfasttrace_${VERSION}.orig.tar.gz" \ - "out/openfasttrace_${PACKAGE_VERSION}.debian.tar.xz" \ - "out/openfasttrace_${PACKAGE_VERSION}.dsc" \ - "out/openfasttrace_${PACKAGE_VERSION}_all.deb" \ - out/SHA256SUMS + "$PACKAGE_POOL_DIR/openfasttrace_${VERSION}.orig.tar.gz" \ + "$PACKAGE_POOL_DIR/openfasttrace_${PACKAGE_VERSION}.debian.tar.xz" \ + "$PACKAGE_POOL_DIR/openfasttrace_${PACKAGE_VERSION}.dsc" \ + "$PACKAGE_POOL_DIR/openfasttrace_${PACKAGE_VERSION}_all.deb" \ + "$PACKAGE_POOL_DIR/openfasttrace_${PACKAGE_VERSION}.SHA256SUMS" env: GH_TOKEN: ${{ github.token }} diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 4f6d585..eab3e68 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -26,7 +26,7 @@ We also will not accept contributions that are clearly generated by AI agents bu ## Testing -We are happy if you test the package, especially on Debian-derived platforms that are not covered by our automation. If you find a packaging bug, please open an [issue](https://github.com/itsallcode/openfasttrace-debian-package/issues/new). Include enough information to reproduce it, such as the distribution, version, architecture, package version, command, and output. +We are happy if you test the package, especially on Debian-derived platforms that are not covered by our automation. If you find a packaging bug, please open an [issue](https://github.com/itsallcode/itsallcode-apt-repository/issues/new). Include enough information to reproduce it, such as the distribution, version, architecture, package version, command, and output. Before submitting a packaging change, run the relevant checks. The full integration test builds the source and binary packages, checks their contents, runs ShellCheck, and validates AppStream metadata: @@ -36,7 +36,7 @@ Before submitting a packaging change, run the relevant checks. The full integrat ## Ideas -If you have an idea to improve packaging or distribution, open a [feature request](https://github.com/itsallcode/openfasttrace-debian-package/issues/new). +If you have an idea to improve packaging or distribution, open a [feature request](https://github.com/itsallcode/itsallcode-apt-repository/issues/new). # Style Guides diff --git a/README.md b/README.md index 680939d..a964db6 100644 --- a/README.md +++ b/README.md @@ -2,11 +2,11 @@ This repository builds Debian packages for [OpenFastTrace](https://github.com/itsallcode/openfasttrace) (OFT), a requirement tracing suite. OFT keeps track of whether you implemented everything planned in your specifications and identifies obsolete parts of a product. -[![Build Debian package](https://github.com/itsallcode/openfasttrace-debian-package/actions/workflows/build.yml/badge.svg)](https://github.com/itsallcode/openfasttrace-debian-package/actions/workflows/build.yml) +[![Build Debian package](https://github.com/itsallcode/itsallcode-apt-repository/actions/workflows/build.yml/badge.svg)](https://github.com/itsallcode/itsallcode-apt-repository/actions/workflows/build.yml) ## Getting the Package -Pre-built source and binary packages are available from the [GitHub releases](https://github.com/itsallcode/openfasttrace-debian-package/releases). Install the binary package with its Java runtime dependency: +Pre-built source and binary packages are available from the [GitHub releases](https://github.com/itsallcode/itsallcode-apt-repository/releases). Install the binary package with its Java runtime dependency: ```sh sudo apt install ./openfasttrace_-_all.deb @@ -28,9 +28,10 @@ On Debian or a derived distribution, install the tools listed by the preconditio ./check-preconditions.sh ./create-source-package.sh [package-revision] ./create-binary-package.sh [package-revision] +./stage-apt-package.sh [package-revision] ``` -The resulting artifacts are placed in `out/`. The scripts download the specified OpenFastTrace source release, incorporate this repository's `debian/` packaging metadata, and build the package. +The build artifacts are placed in `out/`. The scripts download the specified OpenFastTrace source release, incorporate this repository's `debian/` packaging metadata, and build the package. `stage-apt-package.sh` validates the resulting source and binary packages, then copies them into the Debian archive pool under `apt-repository/` for inclusion in a package pull request. ## Project Information diff --git a/SECURITY.md b/SECURITY.md index 954cc90..c436858 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -8,7 +8,7 @@ We provide security updates for the latest package release. Security fixes to Op ## Reporting a Vulnerability -If you discover a potential security issue in this packaging repository or its published packages, please report it privately via [GitHub Security Advisories](https://github.com/itsallcode/openfasttrace-debian-package/security/advisories/new). For a vulnerability in OpenFastTrace itself, use the [upstream security reporting channel](https://github.com/itsallcode/openfasttrace/security/advisories/new). +If you discover a potential security issue in this packaging repository or its published packages, please report it privately via [GitHub Security Advisories](https://github.com/itsallcode/itsallcode-apt-repository/security/advisories/new). For a vulnerability in OpenFastTrace itself, use the [upstream security reporting channel](https://github.com/itsallcode/openfasttrace/security/advisories/new). We follow coordinated disclosure and aim to: diff --git a/apt-repository/README.md b/apt-repository/README.md new file mode 100644 index 0000000..e2ad932 --- /dev/null +++ b/apt-repository/README.md @@ -0,0 +1,28 @@ +# OpenFastTrace APT Repository + +This directory is the document root published at `https://apt.itsallcode.org/openfasttrace`. The visitor-facing installation page is [index.html](index.html). + +## Installation + +Install the repository's public key in a dedicated keyring and add the signed repository source: + +```sh +sudo install --directory --mode=0755 /etc/apt/keyrings +curl --fail --silent --show-error --location \ + https://apt.itsallcode.org/openfasttrace/itsallcode-archive-keyring.asc \ + | sudo gpg --dearmor --yes --output /etc/apt/keyrings/itsallcode-archive-keyring.gpg +echo 'deb [signed-by=/etc/apt/keyrings/itsallcode-archive-keyring.gpg] https://apt.itsallcode.org/openfasttrace stable main' \ + | sudo tee /etc/apt/sources.list.d/openfasttrace.list > /dev/null +sudo apt update +sudo apt install openfasttrace +``` + +The public key fingerprint is published at `https://apt.itsallcode.org/openfasttrace/itsallcode-archive-keyring.fingerprint`. Check it before trusting a newly downloaded key. + +It follows the Debian archive layout: + +* `pool/main/o/openfasttrace/` contains the OpenFastTrace binary and source package artifacts. A package pull request adds its `.deb`, `.dsc`, original + source tarball, and Debian tarball here. +* `dists/stable/main/binary-all/` contains the generated binary package index for the architecture-independent OpenFastTrace package. +* `dists/stable/main/source/` contains the generated source package index. +* `dists/stable/` contains the generated and signed `Release`,`InRelease`, and `Release.gpg` files. diff --git a/apt-repository/dists/stable/main/binary-all/.gitkeep b/apt-repository/dists/stable/main/binary-all/.gitkeep new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/apt-repository/dists/stable/main/binary-all/.gitkeep @@ -0,0 +1 @@ + diff --git a/apt-repository/dists/stable/main/source/.gitkeep b/apt-repository/dists/stable/main/source/.gitkeep new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/apt-repository/dists/stable/main/source/.gitkeep @@ -0,0 +1 @@ + diff --git a/apt-repository/index.html b/apt-repository/index.html new file mode 100644 index 0000000..f8b3500 --- /dev/null +++ b/apt-repository/index.html @@ -0,0 +1,42 @@ + + + + + + itsallcode.org APT Repository + + +

itsallcode.org APT Repository

+

+ This repository provides itsallcode.org's Debian packages for the stable suite and main component. OpenFastTrace is the most prominent example. +

+ +

Installing Packages From This Repository

+
    +
  1. +

    Install the archive key in a dedicated APT keyring.

    + 
    sudo install --directory --mode=0755 /etc/apt/keyrings
+curl --fail --silent --show-error --location \
+  https://apt.itsallcode.org/openfasttrace/itsallcode-archive-keyring.asc \
+  | sudo gpg --dearmor --yes --output /etc/apt/keyrings/itsallcode-archive-keyring.gpg
    +
    2. +
  2. +

    Add the signed repository source.

    + 
    echo 'deb [signed-by=/etc/apt/keyrings/itsallcode-archive-keyring.gpg] https://apt.itsallcode.org/openfasttrace stable main' \
+  | sudo tee /etc/apt/sources.list.d/openfasttrace.list > /dev/null
    +
    3. +
  3. +

    Update APT and install the package.

    + 
    sudo apt update
    +
    4. +
  4. +

    Install a package, for example openfasttrace.

    + 
    sudo apt install openfasttrace
    +
    5. +
+ +

+ Before trusting the key, verify its published fingerprint. The ASCII-armored public key is also available directly. +

+ + diff --git a/apt-repository/itsallcode-archive-keyring.asc b/apt-repository/itsallcode-archive-keyring.asc new file mode 100644 index 0000000..1c4115b --- /dev/null +++ b/apt-repository/itsallcode-archive-keyring.asc @@ -0,0 +1,52 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBGqdUuwBEAC3B8XtrR4LX0yo/6O4u3bn1zM7DZ0FYttV9m861esx4tbAD3VK +/X1mGvQB+5KzYTiO9A1Ayfh6JIGARE9EiTTf5gKFq7Y4k6aiiwRY+vihAO6e9hoJ +VHUPpzhzfHnmNNHqB36bRIxXoHg+9cKId4hnocjX8tLhXck+WW7HGakQj2jt1Gcy +DYuWBy18AF+CuxIENnHvmbS3v1dnlOkyvIHuOaYETX99PmoFFzMzgzIN+Xg7nfDs +2T2rA+hs+hFG06NPRe7tuv/20dCHHqu9mPmJOfkwhfV4LtmCUx8lUcGOI+Klj6qv +zmmzVhbpdVazwRNFXjPFJl1SOzaL4V4xev5azfOAy6sSx7I+vOe2DKRj3wgkccH5 +yxALXLCLbInN6njnkw0yym7eHQQd/kZTb+ETNdyiubbXzWQc42ZfCPuB1MxgOKVt +CkFGKbzHiXXVP9y6eRKQv4F1It+V62upTw59z5n/BE86ag+7GmZCo5zaE3uPDaSd +qcrcPJLM171WMSAWkch20771VMU97j0h2G+hc3KQ1p4TYMsYHh/lYIXyTfucrQg8 +wQAUwIE5wx7nQ+9xrjap9QG5YGIWdwI9Kof3iRPz1zjY2EiHQ0a5u8/QQhnuRcMP +nUJbkTMVb+WEUr2ilvl2dBfIh2yd2ngfWxKCEPV25si73Jiyii6Wl235zwARAQAB +tDdpdHNhbGxjb2RlLm9yZyBBUFQgQXJjaGl2ZSA8bWFpbnRhaW5lcnNAaXRzYWxs +Y29kZS5vcmc+iQJUBBMBCgA+FiEEN6s00W+G6WXeclmf/k6cowMVTqQFAmqdUuwC +GwMFCQlmAYAFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQ/k6cowMVTqTCGBAA +nCBj2/GlpjicWNgVqpkX+fX3eHVTYxoktRjDy5fOmYCA8FcVYA2TCAzA42PtmDtX +9KHB19ysCZ0UHfZHNuqzoa7BAUXNEpQeX3Kcnnka7Ebm65HqGmwiSrcDLNc4i50e +3R86M4hLog0Q9CssAzyTp2M5U5Sm/wciG6hRtE0WcVxqT/GpEj6de7/lDmPJ0vvf +1mF2fMERkWBtAcWS6l/4nZ+7uQ1B7cskrX0F+IY2xUfhZHEhMemTMn3dQstyRYMQ +HdQHF5Y9X+BoLP9HQ7PoVs4glkhQscQIf5H1/lGXSS7uT7Or2OHW2zZnxEfrayXx +m0Pjft4lhbnPvrlP1x34K0LqtkuvV/zsy/jl7mE9LhRPP4QSJobxiC+3gZzL8iyp +5PdZtW7Ky+d066NUmBIT7qVK1lG6MjoJgyb0yE10hcCFRspgYgNI90h4qDi/gfte ++zaEvljqvg3P+NGFUvOhejLQa9D0FNw4t1oZfj2Nq10gjThTi4Ek+AdhagT2Ojwf +EROcQE/rPvpuHUFfSXqNpw6aEg5FpwG1Vp1mKENnWBO5gypX1+j+YaGp01S988/3 +JZO9nVnpidBBnhveFdDEcY7qksyaZlDcyqjy8cdWlwZgnBoueN31BmDszHi5Wdha +tSij7STJjE7h4GhIO+vuwVmml2LZNGDZIR1x4AJZ1EG5Ag0Eap1S7AEQAOr1Vjqq +AjhssnujokZVtBZd2LOa08MV79EvvyovalTVllrlcWFWciQLqLezQM1c33HHlTED +ZNRvlqgTdzR+jROtxZMU6CtlrQEu4NJQGCfjnzfIEit3UWyIZiSb14OcjyxUHZrr +d6a8hoDTWuTnFwSxeS6EAQ3JFjgMFlQ2vdPPSKgmsMHNPwELRTo6p+ja2HQsZ7Av +pr+J/hMx8J8HjjZ4wDdmYRM30Ssqmg9uRk2V2fizKTSOef3N/5r1VeIKnGp5tTw3 +d3VW2JtjD/f8Dpo9tTQC+5aqC5XQucdhtWo888pcFQNEEVGdO/IKGXX3DU7TeONi +mzy2mi6LYzxmPc0YREHZ93EWFXvOd8G29Git5jU8SQQoR7dYNCmGWPKSEPJDmmuB +ILYOJZ6OEpOVJJXKzu8TJW6lv73h1/wl3LYVpx9Xmns1mqmbdFYc4GzXeLM+zmaP +uXNKCN+dJLm/BwwO5Jwnv6tC7YGKoOATCjLIeYD5Yzzb+lvFc9kLWw3tPfVezlMp +e0M356ksJEKjyzKdaam190SKchEGrlvMq59Y9cnVH4/2aBDyeJXWl7Z1r+g+Huya +YCY8LAmZWeIwwNhsBmo5WPRUaMYkcfKGuS2K33fr7aBtMxeECwUXgDvGlf2Irxe7 +ag8640RN9biqKuZ1uRFzGdEImDsQFLgZUm5FABEBAAGJAjwEGAEKACYWIQQ3qzTR +b4bpZd5yWZ/+TpyjAxVOpAUCap1S7AIbDAUJCWYBgAAKCRD+TpyjAxVOpONqD/0X +i2HqmBgMLLYzlBOBAaNf3HGRwxOOzUAd8JV5fL1SImmzZdXq6huRJbvCsmC+anNd +cXlHLJ6Wx6Ggv5XJEOh0gYV3LcCOojEMQRX3F/PbQG0Zw8us2H+6JBu4+gKmNj1i +m0KFtP14yHxwl8KJka4CX69p0CQICYbWlZL/bQwErOzoQx8Q/V2pB2ob8kyO/Cwu +Mmq+OXSGu5eCAZKs2k3W7cmyeGtGRql9dTZUmKC/ezySxqsYP7ToxucZdSbCSw6u +xVDspm3ShVw8Pi/Uw3anNtE0hB+xSDPwQE6uCs/N2YTDZF8EK6yAzFBO75xf8D5d +XAiSNexaWfuVBlE7U5acUYeUsQ1k6vnNxUTVytp93an1oxIftNi5Q6gdink4UOr7 +IvabkaBVYEoqJ1k4DMmq2wqJvvifWp/h1CGU3s8fTMdjxVnpf5iHTJTN9oWHnuVh +s61EeVuSsA2jvR0TTSpIQJmUifcjocGOWCG42aMLVqhJG6yjTqjOK/2ZTt0AA/1v +YfYrC5ZZGtWxuUlw77yPhcIYk1PD6LN+fc+xqgEWY9L9XjW6zfCMgAjP5mahyn+h +5aTNNTK+2wlxCc7Z5NulfdZ+bs8i4ht479RDwTkSUfJ/u29i9wwAr11OAi/qtx9u +2oqVcT0GaaTUASy1PRHuXeL9saIoQLg7Z8Am4Yd2kg== +=4/oi +-----END PGP PUBLIC KEY BLOCK----- diff --git a/apt-repository/pool/main/o/openfasttrace/.gitkeep b/apt-repository/pool/main/o/openfasttrace/.gitkeep new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/apt-repository/pool/main/o/openfasttrace/.gitkeep @@ -0,0 +1 @@ + diff --git a/apt-repository/pool/main/o/openfasttrace/openfasttrace_4.9.0-1.SHA256SUMS b/apt-repository/pool/main/o/openfasttrace/openfasttrace_4.9.0-1.SHA256SUMS new file mode 100644 index 0000000..8136ad7 --- /dev/null +++ b/apt-repository/pool/main/o/openfasttrace/openfasttrace_4.9.0-1.SHA256SUMS @@ -0,0 +1,4 @@ +2a3632d50a89cc3fdbdc02bdb406148e9c15cd5bcb1bf1b3c4a3cc80ae18e70f openfasttrace_4.9.0.orig.tar.gz +87ac2622697954b00ffff08f52d7e68c7099ed68e90fb178d1fcd2f0ff4fa49b openfasttrace_4.9.0-1.debian.tar.xz +f5c8f571e72162e1dd3feee1d6fa551515ff627fc49a1ae96e2abbe00d3e5c44 openfasttrace_4.9.0-1.dsc +e45610ec6fd7f82f012a141e718b3f50541bbe5fdec1c8bdcdc8caf0e071b717 openfasttrace_4.9.0-1_all.deb diff --git a/apt-repository/pool/main/o/openfasttrace/openfasttrace_4.9.0-1.debian.tar.xz b/apt-repository/pool/main/o/openfasttrace/openfasttrace_4.9.0-1.debian.tar.xz new file mode 100644 index 0000000..e308511 Binary files /dev/null and b/apt-repository/pool/main/o/openfasttrace/openfasttrace_4.9.0-1.debian.tar.xz differ diff --git a/apt-repository/pool/main/o/openfasttrace/openfasttrace_4.9.0-1.dsc b/apt-repository/pool/main/o/openfasttrace/openfasttrace_4.9.0-1.dsc new file mode 100644 index 0000000..2d3ca32 --- /dev/null +++ b/apt-repository/pool/main/o/openfasttrace/openfasttrace_4.9.0-1.dsc @@ -0,0 +1,22 @@ +Format: 3.0 (quilt) +Source: openfasttrace +Binary: openfasttrace +Architecture: all +Version: 4.9.0-1 +Maintainer: itsallcode.org +Homepage: https://github.com/itsallcode/openfasttrace +Standards-Version: 4.6.2 +Vcs-Browser: https://github.com/itsallcode/openfasttrace-debian-package +Vcs-Git: https://github.com/itsallcode/openfasttrace-debian-package.git +Build-Depends: debhelper-compat (= 13), openjdk-17-jdk-headless, maven, pandoc, appstream +Package-List: + openfasttrace deb misc optional arch=all +Checksums-Sha1: + 40aa70b08d3d9cbedb5ce8b2defa841530255389 1481732 openfasttrace_4.9.0.orig.tar.gz + 41c021190ac246720fd2a29dba1ee8420ffcbf48 200024 openfasttrace_4.9.0-1.debian.tar.xz +Checksums-Sha256: + 2a3632d50a89cc3fdbdc02bdb406148e9c15cd5bcb1bf1b3c4a3cc80ae18e70f 1481732 openfasttrace_4.9.0.orig.tar.gz + 87ac2622697954b00ffff08f52d7e68c7099ed68e90fb178d1fcd2f0ff4fa49b 200024 openfasttrace_4.9.0-1.debian.tar.xz +Files: + 2bb6886f814011e0904f3d62a4d7a845 1481732 openfasttrace_4.9.0.orig.tar.gz + 45784983ab0046f7d9cd80a4c18c8184 200024 openfasttrace_4.9.0-1.debian.tar.xz diff --git a/apt-repository/pool/main/o/openfasttrace/openfasttrace_4.9.0-1_all.deb b/apt-repository/pool/main/o/openfasttrace/openfasttrace_4.9.0-1_all.deb new file mode 100644 index 0000000..685f780 Binary files /dev/null and b/apt-repository/pool/main/o/openfasttrace/openfasttrace_4.9.0-1_all.deb differ diff --git a/apt-repository/pool/main/o/openfasttrace/openfasttrace_4.9.0.orig.tar.gz b/apt-repository/pool/main/o/openfasttrace/openfasttrace_4.9.0.orig.tar.gz new file mode 100644 index 0000000..92c1e9d Binary files /dev/null and b/apt-repository/pool/main/o/openfasttrace/openfasttrace_4.9.0.orig.tar.gz differ diff --git a/create-source-package.sh b/create-source-package.sh index f9c2269..33c83f7 100755 --- a/create-source-package.sh +++ b/create-source-package.sh @@ -6,8 +6,8 @@ set -e readonly OFT_REPO_URL="https://github.com/itsallcode/openfasttrace" -readonly DEBFULLNAME="Sebastian Bär" -readonly DEBEMAIL="sebastian@baer.zone" +readonly DEBFULLNAME="itsallcode.org" +readonly DEBEMAIL="maintainers@itsallcode.org" readonly BUILD_DIR="out" export DEBFULLNAME DEBEMAIL diff --git a/debian/changelog b/debian/changelog index 27db699..37df1d0 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,4 +1,4 @@ -openfasttrace (4.9.0-1) unstable; urgency=medium +openfasttrace (4.9.0-1) stable; urgency=medium * Importers for long coverage tags, Markdown and reStructuredText now collect the location of coverage IDs in documents and source code. @@ -11,17 +11,17 @@ openfasttrace (4.9.0-1) unstable; urgency=medium addCoveredId, and addDependsOnId. * #570: Collect source code location of specification item IDs - -- Sebastian Bär Sat, 05 Sep 2026 17:34:13 +0200 + -- itsallcode.org Sat, 05 Sep 2026 17:34:13 +0200 -openfasttrace (4.2.2-1) unstable; urgency=medium +openfasttrace (4.2.2-1) stable; urgency=medium * In this release we added support for SystemVerilog files. * #471: Add tag importer support for SystemVerilog files - -- Sebastian Bär Fri, 03 Apr 2026 16:35:26 +0200 + -- itsallcode.org Fri, 03 Apr 2026 16:35:26 +0200 openfasttrace (0.0.0-1) unstable; urgency=medium * Initial release. - -- Sebastian Bär Fri, 03 Apr 2026 16:27:42 +0200 + -- itsallcode.org Fri, 03 Apr 2026 16:27:42 +0200 diff --git a/debian/control b/debian/control index d6b5289..97847f2 100644 --- a/debian/control +++ b/debian/control @@ -1,14 +1,14 @@ Source: openfasttrace Section: misc Priority: optional -Maintainer: Sebastian Bär +Maintainer: itsallcode.org # [impl->dsn~build-tools~1] Build-Depends: debhelper-compat (= 13), openjdk-17-jdk-headless, maven, pandoc, appstream Rules-Requires-Root: no Standards-Version: 4.6.2 Homepage: https://github.com/itsallcode/openfasttrace -Vcs-Browser: https://github.com/itsallcode/openfasttrace-debian-package -Vcs-Git: https://github.com/itsallcode/openfasttrace-debian-package.git +Vcs-Browser: https://github.com/itsallcode/itsallcode-apt-repository +Vcs-Git: https://github.com/itsallcode/itsallcode-apt-repository.git Package: openfasttrace Architecture: all diff --git a/debian/copyright b/debian/copyright index 3247db7..8ca2b5b 100644 --- a/debian/copyright +++ b/debian/copyright @@ -1,10 +1,10 @@ Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ Upstream-Name: openfasttrace -Upstream-Contact: Christoph Pirkl , Sebastian Bär +Upstream-Contact: Christoph Pirkl , itsallcode.org Source: https://github.com/itsallcode/openfasttrace Files: * -Copyright: 2016-2026 itsallcode, Christoph Pirkl , Sebastian Bär +Copyright: 2016-2026 itsallcode, Christoph Pirkl , itsallcode.org License: GPL-3.0 License: GPL-3.0 diff --git a/doc/system_requirements.md b/doc/system_requirements.md index 9904411..a9e99b2 100644 --- a/doc/system_requirements.md +++ b/doc/system_requirements.md @@ -220,12 +220,12 @@ Needs: dsn The packages must include the following constant metadata: * Organization: itsallcode -* Debian Package Maintainer: Sebastian Bär +* Debian Package Maintainer: itsallcode.org * Upstream Authors: * Christoph Pirkl - * Sebastian Bär + * itsallcode.org * Homepage URL: https://github.com/itsallcode/openfasttrace -* Source URL: https://github.com/itsallcode/openfasttrace-debian-package +* Source URL: https://github.com/itsallcode/itsallcode-apt-repository * License: GPL-3.0 * Short Description: Requirement tracing suite for agile projects * Long Description: OpenFastTrace (OFT) is a requirement tracing suite. It helps developers and project managers track requirements throughout the software development lifecycle. diff --git a/stage-apt-package.sh b/stage-apt-package.sh new file mode 100755 index 0000000..23b73d1 --- /dev/null +++ b/stage-apt-package.sh @@ -0,0 +1,101 @@ +#!/bin/bash + +# stage-apt-package.sh - Stages built Debian packages in the APT archive pool + +set -euo pipefail + +readonly BUILD_DIR="out" +readonly PACKAGE_NAME="openfasttrace" +readonly ARCHIVE_POOL_DIR="apt-repository/pool/main/o/openfasttrace" + +validate_version() { + local -r version="$1" + if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then + echo "Error: Invalid version format '$version'. Expected ..." >&2 + return 1 + fi +} + +validate_package_revision() { + local -r package_revision="$1" + if [[ ! "$package_revision" =~ ^[1-9][0-9]*$ ]]; then + echo "Error: Invalid Debian package revision '$package_revision'. Expected a positive integer." >&2 + return 1 + fi +} + +require_file() { + local -r file="$1" + if [[ ! -f "$file" ]]; then + echo "Error: Required package artifact not found: $file" >&2 + return 1 + fi +} + +validate_binary_package() { + local -r package_file="$1" + local -r expected_version="$2" + + if [[ "$(dpkg-deb --field "$package_file" Package)" != "$PACKAGE_NAME" ]]; then + echo "Error: $package_file is not an $PACKAGE_NAME package." >&2 + return 1 + fi + + if [[ "$(dpkg-deb --field "$package_file" Version)" != "$expected_version" ]]; then + echo "Error: $package_file does not have version $expected_version." >&2 + return 1 + fi + + if [[ "$(dpkg-deb --field "$package_file" Architecture)" != "all" ]]; then + echo "Error: $package_file is not architecture-independent." >&2 + return 1 + fi +} + +stage_artifacts() { + local -r version="$1" + local -r package_revision="$2" + local -r package_version="$version-$package_revision" + local -r orig_tarball="$BUILD_DIR/${PACKAGE_NAME}_${version}.orig.tar.gz" + local -r debian_tarball="$BUILD_DIR/${PACKAGE_NAME}_${package_version}.debian.tar.xz" + local -r dsc_file="$BUILD_DIR/${PACKAGE_NAME}_${package_version}.dsc" + local -r binary_package="$BUILD_DIR/${PACKAGE_NAME}_${package_version}_all.deb" + local -r checksum_file="$ARCHIVE_POOL_DIR/${PACKAGE_NAME}_${package_version}.SHA256SUMS" + local -a artifacts=("$orig_tarball" "$debian_tarball" "$dsc_file" "$binary_package") + + for artifact in "${artifacts[@]}"; do + require_file "$artifact" + done + validate_binary_package "$binary_package" "$package_version" + + mkdir --parents "$ARCHIVE_POOL_DIR" + install --mode=0644 "${artifacts[@]}" "$ARCHIVE_POOL_DIR" + + ( + cd "$ARCHIVE_POOL_DIR" + sha256sum \ + "${PACKAGE_NAME}_${version}.orig.tar.gz" \ + "${PACKAGE_NAME}_${package_version}.debian.tar.xz" \ + "${PACKAGE_NAME}_${package_version}.dsc" \ + "${PACKAGE_NAME}_${package_version}_all.deb" \ + > "${PACKAGE_NAME}_${package_version}.SHA256SUMS" + ) + + echo "Staged package $package_version in $ARCHIVE_POOL_DIR." + echo "Checksum manifest: $checksum_file" +} + +main() { + if [[ $# -lt 1 || $# -gt 2 ]]; then + echo "Usage: $0 [package-revision]" >&2 + exit 1 + fi + + local -r version="$1" + local -r package_revision="${2:-1}" + validate_version "$version" + validate_package_revision "$package_revision" + stage_artifacts "$version" "$package_revision" +} + +main "$@" diff --git a/test-packaging.sh b/test-packaging.sh index 89310a6..10b6645 100755 --- a/test-packaging.sh +++ b/test-packaging.sh @@ -71,6 +71,7 @@ run_shellcheck() { "check-preconditions.sh" "create-source-package.sh" "create-binary-package.sh" + "stage-apt-package.sh" "test-packaging.sh" "debian/static/usr/bin/oft" )