packaging: add raspbian/bullseye and option to skip signing (#5099)

Signed-off-by: Patrick Stephens <[email protected]>
fluent · Mar 17, 2022 · f0ce4b3 · f0ce4b3
1 parent 4653b3f
commit f0ce4b3
Show file tree

Hide file tree

Showing 4 changed files with 18 additions and 15 deletions.
diff --git a/.github/workflows/call-build-packages.yaml b/.github/workflows/call-build-packages.yaml
@@ -185,7 +185,7 @@ jobs:
           gpg --export -a "${{ steps.import_gpg.outputs.name }}" > ./latest/fluentbit.key
           rpm --import ./latest/fluentbit.key
 
-          ./update-repos.sh "${{ inputs.version }}" "./latest/"
+          ./update-repos.sh "./latest/"
           echo "${{ inputs.version }}" > "./latest/latest-version.txt"
           aws s3 sync "./latest/" "s3://$AWS_S3_BUCKET" --delete --follow-symlinks --no-progress ${ENDPOINT}
         env:

diff --git a/.github/workflows/staging-release.yaml b/.github/workflows/staging-release.yaml
@@ -96,7 +96,7 @@ jobs:
       run: |
         rm -f packaging/releases/*.repo
         LATEST_VERSION=$(cat packaging/releases/latest-version.txt)
-        packaging/update-repos.sh "$VERSION" packaging/releases/
+        packaging/update-repos.sh packaging/releases/
         rm -f packaging/releases/latest-version.txt
       env:
         GPG_KEY: ${{ steps.import_gpg.outputs.name }}

diff --git a/packaging/remove-version.sh b/packaging/remove-version.sh
@@ -12,4 +12,4 @@ find "$BASE_PATH" -type f \( -iname "*-bit-${VERSION}*.rpm" -o -iname "*-bit-${V
 
 # Update the repo metadata now
 # VERSION is only used to find the RPM to sign so without it will skip signing
-"$SCRIPT_DIR/update-repos.sh" "$VERSION" "$BASE_PATH"
+"$SCRIPT_DIR/update-repos.sh" "$BASE_PATH"
diff --git a/packaging/update-repos.sh b/packaging/update-repos.sh
@@ -1,23 +1,25 @@
 #!/bin/bash
 set -eux
-# VERSION must be defined
-VERSION=${VERSION:-$1}
 # Where the base of all the repos is
-BASE_PATH=${BASE_PATH:-$2}
+BASE_PATH=${BASE_PATH:-$1}
+# Set true to prevent signing
+DISABLE_SIGNING=${DISABLE_SIGNING:-false}
+if [[ "$DISABLE_SIGNING" != "true" ]]; then
+    echo "RPM signing configuration"
+    rpm -q gpg-pubkey --qf '%{name}-%{version}-%{release} --> %{summary}\n'
+fi
 
 RPM_REPO_PATHS=("amazonlinux/2" "centos/7" "centos/8")
 
-echo "RPM signing configuration"
-rpm -q gpg-pubkey --qf '%{name}-%{version}-%{release} --> %{summary}\n'
-
 for RPM_REPO in "${RPM_REPO_PATHS[@]}"; do
     echo "Updating $RPM_REPO"
     REPO_DIR=$( realpath -sm "$BASE_PATH/$RPM_REPO" )
     [[ ! -d "$REPO_DIR" ]] && continue
 
-    # Sign all RPMs created for this target, cover both fluent-bit and td-agent-bit packages
-    find "$REPO_DIR" -name "*-bit-*.rpm" -exec rpm --define "_gpg_name $GPG_KEY" --addsign {} \;
-
+    if [[ "$DISABLE_SIGNING" != "true" ]]; then
+        # Sign all RPMs created for this target, cover both fluent-bit and td-agent-bit packages
+        find "$REPO_DIR" -name "*-bit-*.rpm" -exec rpm --define "_gpg_name $GPG_KEY" --addsign {} \;
+    fi
     # Create full metadata for all RPMs in the directory
     createrepo -dvp "$REPO_DIR"
 
@@ -40,12 +42,12 @@ EOF
 done
 
 DEB_REPO_PATHS=( "debian/bullseye"
-                 "debian/stretch"
                  "debian/buster"
                  "ubuntu/xenial"
                  "ubuntu/bionic"
                  "ubuntu/focal"
-                 "raspbian/buster" )
+                 "raspbian/buster"
+                 "raspbian/bullseye" )
 
 for DEB_REPO in "${DEB_REPO_PATHS[@]}"; do
     REPO_DIR=$(realpath -sm "$BASE_PATH/$DEB_REPO" )
@@ -63,7 +65,8 @@ for DEB_REPO in "${DEB_REPO_PATHS[@]}"; do
 
     cat << EOF > "$APTLY_CONFIG"
 {
-    "rootDir": "$APTLY_ROOTDIR/"
+    "rootDir": "$APTLY_ROOTDIR/",
+    "gpgDisableSign": $DISABLE_SIGNING,
 }
 EOF
     cat "$APTLY_CONFIG"