mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-22 07:48:26 +00:00
0f1fd18c25
Add OpenWrt .apk packaging for OpenWrt 25+, where apk-tools is the mandatory package manager. The existing .ipk continues to cover OpenWrt 24.x and earlier. Built SDK-free like the .ipk: it reuses the cargo-zigbuild cross-compile and the shared installed-filesystem payload under openwrt-ipk/files, and assembles the ADB container with the official `apk mkpkg` applet from apk-tools 3.0.5 built from source, so no OpenWrt SDK image is needed. The package-openwrt workflow is refactored so a single compile-binaries job cross-compiles and strips each arch once; both the .ipk and .apk packagers consume the binaries via a new --bin-dir flag instead of each recompiling. A build-apk job (aarch64, x86_64) builds apk-tools, packages, and structurally verifies the .apk with `apk adbdump`. Releases now publish .apk artifacts and checksums alongside .ipk; the release download is scoped to fips_* so the shared raw-binary artifacts are not swept into the published release. apk-version.sh maps a release tag or commit height to an apk-tools-valid version, covered by a case-table test. Packages are unsigned, installed with `apk add --allow-untrusted`, matching the .ipk posture. Also fix the OpenWrt control socket: the init script now pre-creates /run/fips before starting the daemon, the procd equivalent of the systemd unit's RuntimeDirectory=fips. Without it, on a fresh boot the daemon resolves its control socket to /tmp (since /run/fips does not yet exist), while fips-gateway later creates /run/fips for its own gateway.sock, leaving fipsctl/fipstop resolving a /run/fips/control.sock the daemon never bound.
75 lines
2.6 KiB
Bash
Executable File
75 lines
2.6 KiB
Bash
Executable File
#!/bin/sh
|
|
# Emit an apk-tools-compatible version string for FIPS.
|
|
#
|
|
# apk-tools enforces a strict version grammar:
|
|
# <digit>(.<digit>)*(_<suffix><digit>*)*(-r<N>)
|
|
# where <suffix> is a recognised pre-release/post-release token
|
|
# (alpha, beta, pre, rc, cvs, svn, git, hg, p).
|
|
#
|
|
# Unlike a regex rewrite of an already-flattened version string, this
|
|
# helper builds the apk version directly from the *structured* inputs the
|
|
# caller already has (a release tag, or a commit height). There is no
|
|
# parsing-back-out of a "branch.height.hash" blob, so there is no fragile
|
|
# reparse step to get wrong.
|
|
#
|
|
# Usage:
|
|
# apk-version.sh tag <git-tag> # e.g. v1.2.3, v1.2.3-rc1
|
|
# apk-version.sh dev <height> # e.g. 1234 (git rev-list --count HEAD)
|
|
# apk-version.sh auto # derive from the current git checkout
|
|
#
|
|
# Examples:
|
|
# apk-version.sh tag v1.2.3 -> 1.2.3-r0
|
|
# apk-version.sh tag v1.2.3-rc1 -> 1.2.3_rc1-r0
|
|
# apk-version.sh dev 1234 -> 0.0.0_git1234-r0
|
|
set -eu
|
|
|
|
mode="${1:-auto}"
|
|
|
|
case "$mode" in
|
|
tag) raw_tag="${2:?tag mode requires a tag argument}"; height="" ;;
|
|
dev) raw_tag=""; height="${2:?dev mode requires a height argument}" ;;
|
|
auto)
|
|
if raw_tag="$(git describe --exact-match --tags 2>/dev/null)"; then
|
|
height=""
|
|
else
|
|
raw_tag=""
|
|
height="$(git rev-list --count HEAD 2>/dev/null || echo 0)"
|
|
fi
|
|
;;
|
|
*)
|
|
echo "usage: $0 [auto | tag <git-tag> | dev <height>]" >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
|
|
if [ -n "$raw_tag" ]; then
|
|
# Release tag: vX.Y.Z or vX.Y.Z-<pre>. Strip the leading 'v', split the
|
|
# core (X.Y.Z) from the pre-release token, and map our hyphen separator
|
|
# to apk's '_' pre-release marker.
|
|
body="${raw_tag#v}"
|
|
core="${body%%-*}"
|
|
case "$body" in
|
|
*-*) pre="${body#*-}" ;;
|
|
*) pre="" ;;
|
|
esac
|
|
|
|
case "$pre" in
|
|
"") suffix="" ;;
|
|
alpha*|beta*|pre*|rc*) suffix="_${pre}" ;;
|
|
*)
|
|
# Unknown pre-release token: apk would reject or misorder it, so
|
|
# drop it rather than emit an invalid version. The human-readable
|
|
# PACKAGE_VERSION (the raw tag) is still used for the filename.
|
|
suffix=""
|
|
;;
|
|
esac
|
|
|
|
printf '%s%s-r0\n' "$core" "$suffix"
|
|
else
|
|
# Untagged build: no meaningful semver, so anchor at 0.0.0 and encode the
|
|
# monotonic commit height as a _git pre-release component. This keeps apk's
|
|
# ordering sane across dev builds without smuggling the hash/branch into a
|
|
# field that cannot represent them.
|
|
printf '0.0.0_git%s-r0\n' "${height:-0}"
|
|
fi
|