5aaf71e80a
yay (yay-bin, AUR-only like calamares/bibata) republished to [breadway] via the same PKGBUILD + Forgejo workflow pattern, so users can reach the wider AUR beyond bakery's bread ecosystem. Disk encryption: Calamares' partition module already has LUKS support enabled by default, but the checkbox led nowhere — no cryptsetup on the live/target image, no mkinitcpio encrypt hook, no GRUB cryptodisk wiring. An encrypted install would partition fine and then never boot. Added cryptsetup, pinned luksGeneration to luks1 (GRUB doesn't support LUKS2 + Argon2id), and post-install.sh now detects an encrypted root (lsblk TYPE == crypt) and conditionally adds the encrypt hook + GRUB_ENABLE_CRYPTODISK + --modules="cryptodisk luks luks2" on both grub-install passes. No effect on a normal unencrypted install. Secure Boot: self-signed via sbctl (shipped in packages.x86_64). BOS can't ship a Microsoft-signed shim without going through Microsoft's own paid UEFI CA process, so post-install.sh enrolls BOS's own keys automatically only when the firmware is already in Setup Mode (sbctl status --json), signs the kernel/bootloader, and leaves it alone otherwise — sbctl's own pacman hook re-signs on every future kernel/GRUB update, no further wiring needed. Release signing: generated a dedicated Ed25519 "BOS Release Signing" key (not reused from anything else), stored as the GPG_PRIVATE_KEY Forgejo Actions secret. release-iso.yml now generates SHA256SUMS and a detached SHA256SUMS.asc signature alongside every ISO upload; public key committed at KEYS.asc with verification instructions in the README. README updated: fixed a stale "greetd + tuigreet" line (breadgreet since round 3), documented yay/encryption/secure-boot/verification.
36 lines
1.4 KiB
YAML
36 lines
1.4 KiB
YAML
name: Build and publish yay-bin
|
|
|
|
# yay (and every AUR helper) is AUR-only — not in Arch's official repos — so
|
|
# BOS maintains an in-house PKGBUILD and publishes the built package to the
|
|
# [breadway] repo, same as bibata-cursor-theme and calamares. Prebuilt
|
|
# release tarball, no build step.
|
|
on:
|
|
push:
|
|
paths:
|
|
- 'packaging/yay-bin/**'
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
yay-bin:
|
|
runs-on: [self-hosted, hestia]
|
|
container:
|
|
image: archlinux:latest
|
|
steps:
|
|
- name: Build and publish
|
|
env:
|
|
PUBLISH_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
pacman -Syu --noconfirm base-devel git
|
|
useradd -m builder
|
|
git config --global --add safe.directory '*'
|
|
git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
|
|
"https://git.breadway.dev/${GITHUB_REPOSITORY}.git" /home/builder/src
|
|
chown -R builder:builder /home/builder/src
|
|
su builder -c "cd /home/builder/src/packaging/yay-bin && makepkg -f --noconfirm --nocheck"
|
|
PKG=$(find /home/builder/src/packaging/yay-bin -name '*.pkg.tar.zst' | head -1)
|
|
curl -fsS -X PUT \
|
|
-H "Authorization: token ${PUBLISH_TOKEN}" \
|
|
-H "Content-Type: application/octet-stream" \
|
|
--data-binary "@${PKG}" \
|
|
"https://git.breadway.dev/api/packages/Breadway/arch/os"
|