diff --git a/.github/actions/cargo-cache/action.yml b/.github/actions/cargo-cache/action.yml new file mode 100644 index 0000000000..1923d8cf64 --- /dev/null +++ b/.github/actions/cargo-cache/action.yml @@ -0,0 +1,38 @@ +name: Use cargo artifacts cache +description: > + Cache the cargo build artifacts with rust-cache. Never caches ~/.cargo/bin: + when saving the cache, rust-cache deletes all binaries that were already + present there, which on persistent self-hosted runners wipes the tools + installed by prepare-runner. Harmless on ephemeral runners, but kept + consistent everywhere. + +inputs: + workspaces: + description: "Workspaces to cache, as 'workspace -> target' lines." + required: false + default: crates + key: + description: "Additional part of the cache key." + required: false + default: "" + cache-directories: + description: "Additional non-workspace directories to cache." + required: false + default: "" + save-if: + description: "Condition for saving the cache after the job." + required: false + default: "true" + +runs: + using: composite + + steps: + - name: Use cargo artifacts cache + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + with: + cache-bin: "false" + cache-directories: ${{ inputs.cache-directories }} + key: ${{ inputs.key }} + save-if: ${{ inputs.save-if }} + workspaces: ${{ inputs.workspaces }} diff --git a/.github/dependabot.yml b/.github/dependabot.yml index da37f79007..7361a3db63 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,6 +4,7 @@ updates: directories: - / - .github/actions/build-deps/ + - .github/actions/cargo-cache/ - .github/actions/release-info/ - .github/actions/set-compiler-env/ - .github/actions/setup-conan/ diff --git a/.github/workflows/build-nix-images.yml b/.github/workflows/build-nix-images.yml index fe2f43fdcc..813edd8aff 100644 --- a/.github/workflows/build-nix-images.yml +++ b/.github/workflows/build-nix-images.yml @@ -58,7 +58,7 @@ jobs: base_image: debian:bookworm - name: rhel base_image: registry.access.redhat.com/ubi9/ubi:latest - uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32 + uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@65d5a0bd72be4ecea95cff0673a6e0672ab5243a with: image_name: xrpld/nix-${{ matrix.distro.name }} dockerfile: nix/docker/Dockerfile diff --git a/.github/workflows/build-packaging-images.yml b/.github/workflows/build-packaging-images.yml index fbabc25ac3..c927942fca 100644 --- a/.github/workflows/build-packaging-images.yml +++ b/.github/workflows/build-packaging-images.yml @@ -39,7 +39,7 @@ jobs: # AlmaLinux rather than UBI9, which does not ship rpm-sign. - name: rhel base_image: almalinux:9 - uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32 + uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@65d5a0bd72be4ecea95cff0673a6e0672ab5243a with: image_name: xrpld/packaging-${{ matrix.distro.name }} dockerfile: package/Dockerfile diff --git a/.github/workflows/build-pre-commit-image.yml b/.github/workflows/build-pre-commit-image.yml index d0eba6b495..71f083b686 100644 --- a/.github/workflows/build-pre-commit-image.yml +++ b/.github/workflows/build-pre-commit-image.yml @@ -30,7 +30,7 @@ jobs: permissions: contents: read packages: write - uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32 + uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@65d5a0bd72be4ecea95cff0673a6e0672ab5243a with: image_name: xrpld/pre-commit dockerfile: bin/pre-commit/Dockerfile diff --git a/.github/workflows/check-tools.yml b/.github/workflows/check-tools.yml index c7a00e8b49..1169140481 100644 --- a/.github/workflows/check-tools.yml +++ b/.github/workflows/check-tools.yml @@ -79,7 +79,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare runner - uses: XRPLF/actions/prepare-runner@51af40f99ea91a08c3528ddf16d98132dcc7e63c + uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13 with: enable_ccache: false diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index ac5fe46722..905e910591 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -14,7 +14,7 @@ on: jobs: # Call the workflow in the XRPLF/actions repo that runs the pre-commit hooks. run-hooks: - uses: XRPLF/actions/.github/workflows/pre-commit.yml@3ba08d6ddf114092891d48491fc2e26c3ba15552 + uses: XRPLF/actions/.github/workflows/pre-commit.yml@f1952595d212e86169935135efc66294b4574131 with: runs_on: ubuntu-latest container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-f56b79f" }' diff --git a/.github/workflows/publish-docs.yml b/.github/workflows/publish-docs.yml index 3b863f2b33..b8ca7751ab 100644 --- a/.github/workflows/publish-docs.yml +++ b/.github/workflows/publish-docs.yml @@ -47,7 +47,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare runner - uses: XRPLF/actions/prepare-runner@51af40f99ea91a08c3528ddf16d98132dcc7e63c + uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13 with: enable_ccache: false diff --git a/.github/workflows/reusable-build-test-config.yml b/.github/workflows/reusable-build-test-config.yml index 89bfc7463b..656e6ec85b 100644 --- a/.github/workflows/reusable-build-test-config.yml +++ b/.github/workflows/reusable-build-test-config.yml @@ -129,7 +129,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare runner - uses: XRPLF/actions/prepare-runner@51af40f99ea91a08c3528ddf16d98132dcc7e63c + uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13 with: enable_ccache: ${{ inputs.ccache_enabled }} @@ -163,7 +163,7 @@ jobs: compiler: ${{ inputs.compiler }} - name: Use cargo artifacts cache - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + uses: ./.github/actions/cargo-cache with: cache-directories: ${{ env.BUILD_DIR }}/corrosion key: ${{ inputs.config_name }} diff --git a/.github/workflows/reusable-clang-tidy.yml b/.github/workflows/reusable-clang-tidy.yml index 8dd1af9d99..6847ff9b57 100644 --- a/.github/workflows/reusable-clang-tidy.yml +++ b/.github/workflows/reusable-clang-tidy.yml @@ -27,7 +27,7 @@ jobs: determine-files: permissions: contents: read - uses: XRPLF/actions/.github/workflows/determine-tidy-files.yml@d041ac9f1fa9f07a4ba335eb4c1c82233fb3fef6 + uses: XRPLF/actions/.github/workflows/determine-tidy-files.yml@70145243b905dc3e040a61d39c00e178cfb96f71 run-clang-tidy: name: Run clang tidy @@ -43,7 +43,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare runner - uses: XRPLF/actions/prepare-runner@51af40f99ea91a08c3528ddf16d98132dcc7e63c + uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13 with: enable_ccache: false @@ -60,7 +60,7 @@ jobs: compiler: ${{ env.COMPILER }} - name: Use cargo artifacts cache - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + uses: ./.github/actions/cargo-cache with: cache-directories: ${{ env.BUILD_DIR }}/corrosion save-if: ${{ github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release') }} diff --git a/.github/workflows/reusable-rust.yml b/.github/workflows/reusable-rust.yml index e9d281c692..83301f97ad 100644 --- a/.github/workflows/reusable-rust.yml +++ b/.github/workflows/reusable-rust.yml @@ -33,9 +33,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Use cargo artifacts cache - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - with: - workspaces: crates + uses: ./.github/actions/cargo-cache - name: Run clippy run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings @@ -48,9 +46,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Use cargo artifacts cache - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - with: - workspaces: crates + uses: ./.github/actions/cargo-cache - name: Generate coverage report run: cargo llvm-cov nextest --workspace --all-features --locked --no-tests=warn --lcov --output-path lcov.info @@ -76,9 +72,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Use cargo artifacts cache - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - with: - workspaces: crates + uses: ./.github/actions/cargo-cache - name: Build documentation env: diff --git a/.github/workflows/upload-conan-deps.yml b/.github/workflows/upload-conan-deps.yml index 65a3f9c5b6..184f13cc5e 100644 --- a/.github/workflows/upload-conan-deps.yml +++ b/.github/workflows/upload-conan-deps.yml @@ -68,7 +68,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare runner - uses: XRPLF/actions/prepare-runner@c00c22ada3bd6bcda48fcb0d62fbbab49fec8a0f + uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13 with: enable_ccache: false diff --git a/cmake/XrplCompiler.cmake b/cmake/XrplCompiler.cmake index 2b46739d97..29c1dfe478 100644 --- a/cmake/XrplCompiler.cmake +++ b/cmake/XrplCompiler.cmake @@ -120,7 +120,10 @@ if(MSVC) _SILENCE_ALL_CXX17_DEPRECATION_WARNINGS $<$,$>:_CRTDBG_MAP_ALLOC> ) - target_link_libraries(common INTERFACE -errorreport:none -machine:X64) + target_link_libraries( + common + INTERFACE -errorreport:none -machine:X64 -ignore:4099 + ) else() target_compile_options( common diff --git a/crates/Cargo.lock b/crates/Cargo.lock index bc38558c16..70247f8e19 100644 --- a/crates/Cargo.lock +++ b/crates/Cargo.lock @@ -57,9 +57,9 @@ dependencies = [ [[package]] name = "cxx" -version = "1.0.198" +version = "1.0.199" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6fe442a792c7c736eea18b32a7f8a3b63cf8aafabda6760042dc2fdeda456291" +checksum = "824894a4a85dca76d4c95c2b9098c036f5a29f627b30c12780774f6654e60974" dependencies = [ "cc", "cxx-build", @@ -72,9 +72,9 @@ dependencies = [ [[package]] name = "cxx-build" -version = "1.0.198" +version = "1.0.199" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e3184a94384c663718698311a78a51ac00c484c10b4eeac06fb0a068c5f64fa2" +checksum = "f1ae0b651ea5b0000b19513aef5a03f194d7e3486f2d9258b658da8677fe9036" dependencies = [ "cc", "codespan-reporting", @@ -87,9 +87,9 @@ dependencies = [ [[package]] name = "cxxbridge-cmd" -version = "1.0.198" +version = "1.0.199" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0148d8fd1199329ddf1d157a5e134e51ceff37c6a7ddd38615c399d81cb05d8d" +checksum = "fb05f91d3fb8435d9bab6ac5ce6ac1868be774325fb7fb2a91be39393b21388e" dependencies = [ "clap", "codespan-reporting", @@ -101,15 +101,15 @@ dependencies = [ [[package]] name = "cxxbridge-flags" -version = "1.0.198" +version = "1.0.199" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "52850339faed2eaadd24e286dc1d8268cc6f8a7bd9524d713adc9099566b4c89" +checksum = "bf293202e0e3e98495785745389e8d0755b217e66f19194a5c695c25e03282ef" [[package]] name = "cxxbridge-macro" -version = "1.0.198" +version = "1.0.199" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2c77c856545d886c9bd5215409ebb63b925e262135248b50c79e5a5f194ee47c" +checksum = "ca001d746947c7249ed9d332a10f7a59daedbafeb0ec68c5c18a7db7a93f6ccc" dependencies = [ "indexmap", "proc-macro2", diff --git a/docs/install.md b/docs/install.md index 9699150fdb..a3e2fefa02 100644 --- a/docs/install.md +++ b/docs/install.md @@ -65,7 +65,7 @@ wherever it appears in the repository configuration. 4. Add the repository, using the channel you picked in [Release channels](#release-channels): ```bash - echo "deb [signed-by=/etc/apt/keyrings/xrplf.asc] https://packages.xrplf.org/repository/deb-stable focal main" | \ + echo "deb [signed-by=/etc/apt/keyrings/xrplf.asc] https://packages.xrplf.org/repository/deb-stable any main" | \ sudo tee /etc/apt/sources.list.d/xrplf.list ``` @@ -98,13 +98,13 @@ wherever it appears in the repository configuration. enabled=1 baseurl=https://packages.xrplf.org/repository/rpm-stable/ gpgcheck=1 - repo_gpgcheck=0 + repo_gpgcheck=1 gpgkey=https://packages.xrplf.org/xrplf.asc REPOFILE ``` `gpgcheck=1` verifies each package against the key above. - `repo_gpgcheck` is off because the repository metadata is generated by the server and is not signed. + `repo_gpgcheck=1` verifies the repository metadata, which the server signs with the same key. 3. Install the `xrpld` package: diff --git a/package/README.md b/package/README.md index 9c40861530..54b1e57204 100644 --- a/package/README.md +++ b/package/README.md @@ -126,15 +126,15 @@ release defaults to 1 and is overridable with `-Dpkg_release=N`. Packages are published to the XRPLF repositories on Sonatype Nexus at `https://packages.xrplf.org`. The `release-info` action decides the channel from -the event, and `publish_pkg.sh` maps that channel to a repository pair: +the event, and `publish_pkg.sh` maps that channel to its repositories: -| Event | Version | Channel | DEB repository | RPM repository | -| ------------------------ | ----------------- | -------------- | ------------------ | ------------------ | -| tag | `X.Y.Z` | `stable` | `deb-stable` | `rpm-stable` | -| tag | `X.Y.Z-rcN` | `unstable` | `deb-unstable` | `rpm-unstable` | -| tag | `X.Y.Z-bN` | `experimental` | `deb-experimental` | `rpm-experimental` | -| push to `develop` | `xrpld --version` | `develop` | `deb-develop` | `rpm-develop` | -| tag, non-public codebase | _any_ | `private` | `deb-private` | `rpm-private` | +| Event | Version | Channel | DEB repository | RPM upload repository | +| ------------------------ | ----------------- | -------------- | ------------------ | ------------------------- | +| tag | `X.Y.Z` | `stable` | `deb-stable` | `rpm-stable-hosted` | +| tag | `X.Y.Z-rcN` | `unstable` | `deb-unstable` | `rpm-unstable-hosted` | +| tag | `X.Y.Z-bN` | `experimental` | `deb-experimental` | `rpm-experimental-hosted` | +| push to `develop` | `xrpld --version` | `develop` | `deb-develop` | `rpm-develop-hosted` | +| tag, non-public codebase | _any_ | `private` | `deb-private` | `rpm-private-hosted` | Only a tag names a channel — do not extend that to `develop`, where `BuildInfo.cpp`'s `versionString` moves through `-bN`, `-rcN` and even the final @@ -155,12 +155,15 @@ Conan remote. Nexus owns the repository metadata; nothing here indexes anything. Worth knowing: -- Each apt-hosted repository needs a distribution and a PGP signing keypair - configured in Nexus, which rejects one created without a keypair. Nexus signs - the apt metadata with it, never the packages. -- Hosted yum repositories cannot be signed by Nexus at all, so `sign_rpm.sh` - signs the RPMs before they are uploaded, and rpm clients verify with - `gpgcheck=1` rather than `repo_gpgcheck=1`. +- Each apt-hosted repository needs a distribution (ours use `any`) and a PGP + signing keypair configured in Nexus, which rejects one created without a + keypair. Nexus signs the apt metadata with it, never the packages. +- Hosted yum repositories cannot be signed by Nexus, so each `rpm--hosted` + repository sits behind a `rpm-` yum group repository whose metadata + Nexus signs. Uploads go to the hosted repository; clients point at the group + and verify the metadata with `repo_gpgcheck=1`. Nexus never signs the RPMs + themselves, so `sign_rpm.sh` signs them before they are uploaded, and clients + verify them with `gpgcheck=1`. - yum metadata is rebuilt asynchronously, so a successful publish is not immediately installable. - Each job uploads only what it built, and uploads are not transactional, so a diff --git a/package/publish_pkg.sh b/package/publish_pkg.sh index be36b531de..8ea9b189f4 100755 --- a/package/publish_pkg.sh +++ b/package/publish_pkg.sh @@ -7,10 +7,13 @@ set -euo pipefail # Usage: publish_pkg.sh [package-dir] # # channel release channel, selecting the 'deb-' and -# 'rpm-' repository pair +# 'rpm--hosted' repositories # package-dir searched recursively for *.deb, *.ddeb and *.rpm ('build' by # default) # +# RPMs are uploaded to the hosted repository, but yum clients install from the +# 'rpm-' group repository in front of it, which serves signed metadata. +# # NEXUS_USERNAME and NEXUS_PASSWORD are required. NEXUS_URL overrides the target # instance, and DRY_RUN=1 lists the uploads without performing them. @@ -24,7 +27,7 @@ if [[ -z "${channel}" ]]; then fi deb_repo="deb-${channel}" -rpm_repo="rpm-${channel}" +rpm_repo="rpm-${channel}-hosted" if [[ -z "${DRY_RUN:-}" ]]; then : "${NEXUS_USERNAME:?is required}" "${NEXUS_PASSWORD:?is required}" diff --git a/package/sign_rpm.sh b/package/sign_rpm.sh index 7a1d6f00e3..250e806dd7 100755 --- a/package/sign_rpm.sh +++ b/package/sign_rpm.sh @@ -1,9 +1,10 @@ #!/usr/bin/env bash set -euo pipefail -# Sign the RPMs built by build_pkg.sh. Nexus cannot sign hosted yum metadata, so -# the packages carry the signature themselves and rpm clients verify them with -# gpgcheck=1. +# Sign the RPMs built by build_pkg.sh. Nexus signs the yum repository metadata +# (via the 'rpm-' group repository), but never the packages themselves, +# so they carry their own signature. Clients verify the packages with gpgcheck=1 +# and the metadata with repo_gpgcheck=1. # # Usage: sign_rpm.sh [package-dir] # @@ -12,8 +13,9 @@ set -euo pipefail # PKG_SIGNING_KEY must hold an armoured PGP private key. It has no flag, to keep # the key out of the process list. # -# There is no DEB equivalent: apt trusts the repository metadata, which Nexus -# signs, rather than the packages themselves. +# The DEBs are deliberately not signed: embedded DEB signatures exist (debsigs), +# but apt does not verify them by default and trusts the repository metadata, +# which Nexus signs, instead. pkg_dir="${1:-build}"