Public Access
f.weber
103ad311b7
Provides a self-contained, containerized aptly (Debian repo manager) stack with independently releasable image and Helm chart versions. - images/: aptly-server (aptly built from source, cross-compiled) and aptly-deb-builder (nfpm + dpkg-buildpackage) container images - rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack scripts consumed identically by Compose and the Helm chart, driven by one declarative state.yaml contract - compose/: test (ephemeral, open) and production docker-compose stacks with an nginx read/auth sidecar - charts/aptly/: aptly-native Helm chart covering every security posture from fully open to authenticated read+write, Ingress and Gateway API support (usable in parallel for migration scenarios), metrics, and declarative repo/mirror/publish reconciliation via a Helm hook - .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test) plus separately tagged image (image/v*) and chart (chart/v*) releases, weekly rebuilds, and a preflight workflow validating the runner's Docker/Helm-OCI capabilities - pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's signKey annotation (Helm can't verify Ed25519 keys) - docs/, README.md, charts/aptly/README.md: usage, security, and versioning documentation
51 lines
2.1 KiB
Docker
51 lines
2.1 KiB
Docker
# syntax=docker/dockerfile:1
|
|
#
|
|
# aptly-deb-builder — turns a source tree into a signed-and-pushable .deb in
|
|
# one command (aptly-release). Ships both packaging paths:
|
|
# - nfpm, for projects with no debian/ directory (a plain YAML descriptor)
|
|
# - the real Debian toolchain, for projects that already have a debian/ dir
|
|
#
|
|
# renovate: datasource=github-releases depName=goreleaser/nfpm
|
|
ARG NFPM_VERSION=2.47.0
|
|
ARG NFPM_SHA256_AMD64=3f1cf344bd0b57373ca55636a78c08b0491f7293d609a456a9ac3b0b150fda97
|
|
ARG NFPM_SHA256_ARM64=27419eb382695a7942be8ad52259f3ec1854fad001b3ae4baed34ce39a223b97
|
|
ARG RUNTIME_IMAGE=debian:trixie-slim
|
|
|
|
FROM ${RUNTIME_IMAGE}
|
|
ARG TARGETARCH
|
|
ARG NFPM_VERSION
|
|
ARG NFPM_SHA256_AMD64
|
|
ARG NFPM_SHA256_ARM64
|
|
|
|
LABEL org.opencontainers.image.title="aptly-deb-builder" \
|
|
org.opencontainers.image.description="Package, build and push .deb packages into an aptly repository in one step" \
|
|
org.opencontainers.image.source="https://git.morlana.online/f.weber/aptly-containerized" \
|
|
org.opencontainers.image.licenses="MIT"
|
|
|
|
# hadolint ignore=DL3008
|
|
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
|
|
--mount=type=cache,target=/var/lib/apt,sharing=locked \
|
|
apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates curl jq gnupg \
|
|
build-essential debhelper devscripts dpkg-dev fakeroot equivs \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
|
|
RUN set -eux; \
|
|
case "${TARGETARCH}" in \
|
|
amd64) sha256="${NFPM_SHA256_AMD64}" ;; \
|
|
arm64) sha256="${NFPM_SHA256_ARM64}" ;; \
|
|
*) echo "unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
|
|
esac; \
|
|
curl -fsSL -o /tmp/nfpm.deb "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_${TARGETARCH}.deb"; \
|
|
echo "${sha256} /tmp/nfpm.deb" | sha256sum -c -; \
|
|
dpkg -i /tmp/nfpm.deb; \
|
|
rm -f /tmp/nfpm.deb
|
|
|
|
COPY rootfs/usr/local/bin/aptly-pack rootfs/usr/local/bin/aptly-push rootfs/usr/local/bin/aptly-release /usr/local/bin/
|
|
COPY rootfs/usr/local/bin/lib/ /usr/local/bin/lib/
|
|
|
|
WORKDIR /work
|
|
ENTRYPOINT []
|
|
CMD ["bash"]
|