Public Access
f.weber
103ad311b7
Provides a self-contained, containerized aptly (Debian repo manager) stack with independently releasable image and Helm chart versions. - images/: aptly-server (aptly built from source, cross-compiled) and aptly-deb-builder (nfpm + dpkg-buildpackage) container images - rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack scripts consumed identically by Compose and the Helm chart, driven by one declarative state.yaml contract - compose/: test (ephemeral, open) and production docker-compose stacks with an nginx read/auth sidecar - charts/aptly/: aptly-native Helm chart covering every security posture from fully open to authenticated read+write, Ingress and Gateway API support (usable in parallel for migration scenarios), metrics, and declarative repo/mirror/publish reconciliation via a Helm hook - .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test) plus separately tagged image (image/v*) and chart (chart/v*) releases, weekly rebuilds, and a preflight workflow validating the runner's Docker/Helm-OCI capabilities - pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's signKey annotation (Helm can't verify Ed25519 keys) - docs/, README.md, charts/aptly/README.md: usage, security, and versioning documentation
35 lines
1.2 KiB
Bash
Executable File
35 lines
1.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# aptly-release — aptly-pack + aptly-push in one call. The whole point of the
|
|
# deb-builder image: one command turns a source tree into a package on the
|
|
# repo, whichever of the four security presets is in effect.
|
|
#
|
|
# Usage: aptly-release [aptly-pack flags] -- [aptly-push flags]
|
|
# Anything before "--" goes to aptly-pack; anything after goes to aptly-push
|
|
# (files are appended automatically, do not pass them yourself).
|
|
#
|
|
# Example:
|
|
# aptly-release --config nfpm.yaml -- --repo stable --distribution stable
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
|
|
log() { printf '[aptly-release] %s\n' "$*" >&2; }
|
|
|
|
pack_args=()
|
|
push_args=()
|
|
target=pack_args
|
|
for a in "$@"; do
|
|
if [[ "$a" == "--" && "$target" == "pack_args" ]]; then
|
|
target=push_args
|
|
continue
|
|
fi
|
|
if [[ "$target" == "pack_args" ]]; then pack_args+=("$a"); else push_args+=("$a"); fi
|
|
done
|
|
|
|
log "packaging..."
|
|
mapfile -t debs < <("${SCRIPT_DIR}/aptly-pack" "${pack_args[@]}")
|
|
[[ "${#debs[@]}" -gt 0 ]] || { log "aptly-pack produced no output"; exit 1; }
|
|
for d in "${debs[@]}"; do log " built: ${d}"; done
|
|
|
|
log "pushing..."
|
|
exec "${SCRIPT_DIR}/aptly-push" "${push_args[@]}" "${debs[@]}"
|