CI: stage bakery from signed stable index, drop bread-theme cargo build
The tagged ISO workflow fetched bos-settings/src/Cargo.toml from the dev branch (404 after the Tauri split) and cargo-built bread-theme. bread-theme 0.7.1 is already on the stable index. Stage required bins, units, breadhelp content, and desktop/license files from the minisign-verified index instead; optional bread-emit/module-host skip until bread publishes them. Fail the bake if a required bin is missing.
This commit is contained in:
Breadway
parent
3ab97c1634
commit
a3ead6607a
16 changed files with 687 additions and 154 deletions
|
|
@ -41,8 +41,11 @@ passwd -l root || true
|
|||
# over to the target (unpackfs may skip it / perms differ), leaving the installed
|
||||
# system unable to verify package signatures — the first `pacman -Syu` then dies
|
||||
# with "keyring is not writable / required key missing". Initialise it here so a
|
||||
# fresh install can update out of the box. archlinux-keyring is already present;
|
||||
# [breadway] is SigLevel=Never so it needs no key.
|
||||
# fresh install can update out of the box. archlinux-keyring is already present
|
||||
# and is the only keyring populated — it verifies official Arch packages.
|
||||
# [breadway] stays SigLevel=Never (Forgejo does not serve pacman-compatible
|
||||
# db signatures). Do not import KEYS.asc here: that key signs ISO SHA256SUMS,
|
||||
# not the pacman repo; treating it as a repo key would be a lie.
|
||||
# ---------------------------------------------------------------------------
|
||||
if command -v pacman-key &>/dev/null; then
|
||||
pacman-key --init || echo "WARN: pacman-key --init failed"
|
||||
|
|
|
|||
|
|
@ -34,10 +34,13 @@ Include = /etc/pacman.d/mirrorlist
|
|||
# Packages are published to the Forgejo Arch registry (group "os") by the
|
||||
# .forgejo/workflows/*.yml workflows in this repo (and breadlock's).
|
||||
#
|
||||
# Forgejo signs the repo db with a key pacman can't look up, so TrustAll
|
||||
# fails. SigLevel = Never skips verification (acceptable for this private
|
||||
# repo over TLS). Future improvement: import Forgejo's signing key and
|
||||
# switch to SigLevel = Required for full package verification.
|
||||
# Forgejo's Arch package registry does not serve pacman-compatible db
|
||||
# signatures. SigLevel = Never is TLS-only integrity: the connection is
|
||||
# HTTPS (or rewritten to hestia's localhost:3002 in CI). breadlock (PAM)
|
||||
# rides this repo. Do NOT flip to SigLevel = Required unless a signed db
|
||||
# has been verified to work — Required without signatures breaks the ISO
|
||||
# and every install that uses [breadway]. KEYS.asc is the ISO SHA256SUMS
|
||||
# signing key, not a pacman repo key.
|
||||
# -----------------------------------------------------------------------
|
||||
# The section name must match Forgejo's served db filename
|
||||
# ({owner}.{group}.{domain}.db) — pacman fetches "<section>.db" from Server.
|
||||
|
|
|
|||
|
|
@ -2,13 +2,17 @@
|
|||
# bos-update — update all of BOS in one go.
|
||||
#
|
||||
# BOS packages come from two channels, so a full update touches both:
|
||||
# 1. pacman — Arch base/desktop + the [breadway] repo (bos-settings, etc.).
|
||||
# Every transaction is snapshotted by snap-pac, so you can roll
|
||||
# back from the GRUB "snapshots" submenu or BOS Settings.
|
||||
# 1. pacman — Arch base/desktop + the [breadway] repo (breadlock + AUR
|
||||
# republishes: calamares, zen-browser-bin, bibata, yay-bin,
|
||||
# powerlevel10k). [breadway] does NOT provide bos-settings
|
||||
# or other bakery desktop apps. Every transaction is
|
||||
# snapshotted by snap-pac; recover via the GRUB "snapshots"
|
||||
# submenu (grub-btrfs), not `snapper rollback`.
|
||||
# 2. bakery — the bread ecosystem apps in ~/.local/bin (whatever `bakery list`
|
||||
# reports as installed — bread, breadbar, breadbox, breadcrumbs,
|
||||
# breadpad, breadman, bread-theme, breadpaper, breadmon,
|
||||
# breadsearch, breadclip, breadshot, ...).
|
||||
# reports as installed — bakery, bread, breadbar, breadbox,
|
||||
# breadcrumbs, breadpad, breadman, bread-theme, breadpaper,
|
||||
# breadmon, breadsearch, breadclip, breadshot, bos-settings,
|
||||
# breadhelp, ...).
|
||||
#
|
||||
# Best-effort: a failure in one channel doesn't abort the other.
|
||||
set -uo pipefail
|
||||
|
|
|
|||
|
|
@ -1,22 +1,24 @@
|
|||
# Bakery binaries that MUST be baked into the live/installed skel.
|
||||
# Bakery binaries baked into the live/installed skel.
|
||||
#
|
||||
# build-local.sh derives BREAD_BINS from `bins` — this is the name list, not a
|
||||
# second hardcoded array. A missing binary fails the bake: a hollow ISO is
|
||||
# worse than a failed build.
|
||||
# build-local.sh and CI (scripts/ci-stage-bakery.py) read this file. A missing
|
||||
# *required* binary fails the bake: a hollow ISO is worse than a failed build.
|
||||
# optional_bins are baked when the verified stable index publishes them, and
|
||||
# skipped with a warning when it does not (today: bread 0.7.0 has no
|
||||
# bread-emit / bread-module-host).
|
||||
#
|
||||
# CI should populate the builder from the stable bakery index
|
||||
# A flat `bins` list is still accepted and treated as required_bins.
|
||||
#
|
||||
# CI populates the builder from the minisign-verified stable bakery index
|
||||
# (https://dl.breadway.dev/index.json). Local builds still snapshot whatever
|
||||
# is installed on the builder; this file only names what must be present.
|
||||
# is installed on the builder; this file only names what must / may be present.
|
||||
#
|
||||
# Not shipped (even if present on the builder): breadcast, breadarr.
|
||||
# Not shipped (even if they appear in the index): breadcast, breadarr.
|
||||
# breadlock is pacman (see packages.x86_64), not bakery.
|
||||
|
||||
bins = [
|
||||
required_bins = [
|
||||
"bakery",
|
||||
"bread",
|
||||
"breadd",
|
||||
"bread-emit",
|
||||
"bread-module-host",
|
||||
"breadman",
|
||||
"breadbar",
|
||||
"breadbox",
|
||||
|
|
@ -34,3 +36,9 @@ bins = [
|
|||
"bos-settings",
|
||||
"breadhelp",
|
||||
]
|
||||
|
||||
# Bake if the verified index publishes them; do not fail the ISO if absent.
|
||||
optional_bins = [
|
||||
"bread-emit",
|
||||
"bread-module-host",
|
||||
]
|
||||
|
|
|
|||
|
|
@ -34,10 +34,13 @@ Include = /etc/pacman.d/mirrorlist
|
|||
# Packages are published to the Forgejo Arch registry (group "os") by the
|
||||
# .forgejo/workflows/*.yml workflows in this repo (and breadlock's).
|
||||
#
|
||||
# Forgejo signs the repo db with a key pacman can't look up, so TrustAll
|
||||
# fails. SigLevel = Never skips verification (acceptable for this private
|
||||
# repo over TLS). Future improvement: import Forgejo's signing key and
|
||||
# switch to SigLevel = Required for full package verification.
|
||||
# Forgejo's Arch package registry does not serve pacman-compatible db
|
||||
# signatures. SigLevel = Never is TLS-only integrity: the connection is
|
||||
# HTTPS (or rewritten to hestia's localhost:3002 in CI). breadlock (PAM)
|
||||
# rides this repo. Do NOT flip to SigLevel = Required unless a signed db
|
||||
# has been verified to work — Required without signatures breaks the ISO
|
||||
# and every install that uses [breadway]. KEYS.asc is the ISO SHA256SUMS
|
||||
# signing key, not a pacman repo key.
|
||||
# -----------------------------------------------------------------------
|
||||
# The section name must match Forgejo's served db filename
|
||||
# ({owner}.{group}.{domain}.db) — pacman fetches "<section>.db" from Server.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue