From a3a2c85c41e4b241039a62ccf1462e9183512fff Mon Sep 17 00:00:00 2001 From: Ayaz Salikhov Date: Thu, 20 Aug 2026 13:05:18 +0000 Subject: [PATCH] build: Use debian `any` distribution & signed (hosted) rpm repo (#8053) --- docs/install.md | 6 +++--- package/README.md | 31 +++++++++++++++++-------------- package/publish_pkg.sh | 7 +++++-- package/sign_rpm.sh | 12 +++++++----- 4 files changed, 32 insertions(+), 24 deletions(-) diff --git a/docs/install.md b/docs/install.md index 9699150fdb..a3e2fefa02 100644 --- a/docs/install.md +++ b/docs/install.md @@ -65,7 +65,7 @@ wherever it appears in the repository configuration. 4. Add the repository, using the channel you picked in [Release channels](#release-channels): ```bash - echo "deb [signed-by=/etc/apt/keyrings/xrplf.asc] https://packages.xrplf.org/repository/deb-stable focal main" | \ + echo "deb [signed-by=/etc/apt/keyrings/xrplf.asc] https://packages.xrplf.org/repository/deb-stable any main" | \ sudo tee /etc/apt/sources.list.d/xrplf.list ``` @@ -98,13 +98,13 @@ wherever it appears in the repository configuration. enabled=1 baseurl=https://packages.xrplf.org/repository/rpm-stable/ gpgcheck=1 - repo_gpgcheck=0 + repo_gpgcheck=1 gpgkey=https://packages.xrplf.org/xrplf.asc REPOFILE ``` `gpgcheck=1` verifies each package against the key above. - `repo_gpgcheck` is off because the repository metadata is generated by the server and is not signed. + `repo_gpgcheck=1` verifies the repository metadata, which the server signs with the same key. 3. Install the `xrpld` package: diff --git a/package/README.md b/package/README.md index 9c40861530..54b1e57204 100644 --- a/package/README.md +++ b/package/README.md @@ -126,15 +126,15 @@ release defaults to 1 and is overridable with `-Dpkg_release=N`. Packages are published to the XRPLF repositories on Sonatype Nexus at `https://packages.xrplf.org`. The `release-info` action decides the channel from -the event, and `publish_pkg.sh` maps that channel to a repository pair: +the event, and `publish_pkg.sh` maps that channel to its repositories: -| Event | Version | Channel | DEB repository | RPM repository | -| ------------------------ | ----------------- | -------------- | ------------------ | ------------------ | -| tag | `X.Y.Z` | `stable` | `deb-stable` | `rpm-stable` | -| tag | `X.Y.Z-rcN` | `unstable` | `deb-unstable` | `rpm-unstable` | -| tag | `X.Y.Z-bN` | `experimental` | `deb-experimental` | `rpm-experimental` | -| push to `develop` | `xrpld --version` | `develop` | `deb-develop` | `rpm-develop` | -| tag, non-public codebase | _any_ | `private` | `deb-private` | `rpm-private` | +| Event | Version | Channel | DEB repository | RPM upload repository | +| ------------------------ | ----------------- | -------------- | ------------------ | ------------------------- | +| tag | `X.Y.Z` | `stable` | `deb-stable` | `rpm-stable-hosted` | +| tag | `X.Y.Z-rcN` | `unstable` | `deb-unstable` | `rpm-unstable-hosted` | +| tag | `X.Y.Z-bN` | `experimental` | `deb-experimental` | `rpm-experimental-hosted` | +| push to `develop` | `xrpld --version` | `develop` | `deb-develop` | `rpm-develop-hosted` | +| tag, non-public codebase | _any_ | `private` | `deb-private` | `rpm-private-hosted` | Only a tag names a channel — do not extend that to `develop`, where `BuildInfo.cpp`'s `versionString` moves through `-bN`, `-rcN` and even the final @@ -155,12 +155,15 @@ Conan remote. Nexus owns the repository metadata; nothing here indexes anything. Worth knowing: -- Each apt-hosted repository needs a distribution and a PGP signing keypair - configured in Nexus, which rejects one created without a keypair. Nexus signs - the apt metadata with it, never the packages. -- Hosted yum repositories cannot be signed by Nexus at all, so `sign_rpm.sh` - signs the RPMs before they are uploaded, and rpm clients verify with - `gpgcheck=1` rather than `repo_gpgcheck=1`. +- Each apt-hosted repository needs a distribution (ours use `any`) and a PGP + signing keypair configured in Nexus, which rejects one created without a + keypair. Nexus signs the apt metadata with it, never the packages. +- Hosted yum repositories cannot be signed by Nexus, so each `rpm--hosted` + repository sits behind a `rpm-` yum group repository whose metadata + Nexus signs. Uploads go to the hosted repository; clients point at the group + and verify the metadata with `repo_gpgcheck=1`. Nexus never signs the RPMs + themselves, so `sign_rpm.sh` signs them before they are uploaded, and clients + verify them with `gpgcheck=1`. - yum metadata is rebuilt asynchronously, so a successful publish is not immediately installable. - Each job uploads only what it built, and uploads are not transactional, so a diff --git a/package/publish_pkg.sh b/package/publish_pkg.sh index be36b531de..8ea9b189f4 100755 --- a/package/publish_pkg.sh +++ b/package/publish_pkg.sh @@ -7,10 +7,13 @@ set -euo pipefail # Usage: publish_pkg.sh [package-dir] # # channel release channel, selecting the 'deb-' and -# 'rpm-' repository pair +# 'rpm--hosted' repositories # package-dir searched recursively for *.deb, *.ddeb and *.rpm ('build' by # default) # +# RPMs are uploaded to the hosted repository, but yum clients install from the +# 'rpm-' group repository in front of it, which serves signed metadata. +# # NEXUS_USERNAME and NEXUS_PASSWORD are required. NEXUS_URL overrides the target # instance, and DRY_RUN=1 lists the uploads without performing them. @@ -24,7 +27,7 @@ if [[ -z "${channel}" ]]; then fi deb_repo="deb-${channel}" -rpm_repo="rpm-${channel}" +rpm_repo="rpm-${channel}-hosted" if [[ -z "${DRY_RUN:-}" ]]; then : "${NEXUS_USERNAME:?is required}" "${NEXUS_PASSWORD:?is required}" diff --git a/package/sign_rpm.sh b/package/sign_rpm.sh index 7a1d6f00e3..250e806dd7 100755 --- a/package/sign_rpm.sh +++ b/package/sign_rpm.sh @@ -1,9 +1,10 @@ #!/usr/bin/env bash set -euo pipefail -# Sign the RPMs built by build_pkg.sh. Nexus cannot sign hosted yum metadata, so -# the packages carry the signature themselves and rpm clients verify them with -# gpgcheck=1. +# Sign the RPMs built by build_pkg.sh. Nexus signs the yum repository metadata +# (via the 'rpm-' group repository), but never the packages themselves, +# so they carry their own signature. Clients verify the packages with gpgcheck=1 +# and the metadata with repo_gpgcheck=1. # # Usage: sign_rpm.sh [package-dir] # @@ -12,8 +13,9 @@ set -euo pipefail # PKG_SIGNING_KEY must hold an armoured PGP private key. It has no flag, to keep # the key out of the process list. # -# There is no DEB equivalent: apt trusts the repository metadata, which Nexus -# signs, rather than the packages themselves. +# The DEBs are deliberately not signed: embedded DEB signatures exist (debsigs), +# but apt does not verify them by default and trusts the repository metadata, +# which Nexus signs, instead. pkg_dir="${1:-build}"