Skip to content

Commit bc12e00

Browse files
jtdorjtdor
committed
Support the use of additional APT repositories
Add input parameters for configuring additional source repositories and for trusting additional keys in the build environment. Thanks to @leonheldattoradex for the related PRs #7 and #8. I adopted the support for deb822-style sources from them.
1 parent 6cedc67 commit bc12e00

File tree

7 files changed

+211
-1
lines changed

7 files changed

+211
-1
lines changed

‎.github/workflows/test.yml‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,131 @@ jobs:
156156
test -f debian/artifacts/test_1_amd64.buildinfo
157157
test -f debian/artifacts/test_1_amd64.changes
158158
159+
extra-repo-keys-ascii:
160+
needs: [single-package]
161+
runs-on: ubuntu-latest
162+
steps:
163+
- uses: actions/checkout@v4
164+
- id: download-keys
165+
run: |
166+
docker run --detach --mount="type=bind,src=${{ github.workspace }},dst=/workspace" --name=download-cont --rm --workdir=/workspace debian:stable-slim tail -f /dev/null
167+
docker exec download-cont apt-get update
168+
docker exec --user="$(id -u):$(id -g)" download-cont apt-get download debian-archive-keyring
169+
docker stop --time=1 download-cont
170+
dpkg-deb --extract debian-archive-keyring_*.deb debian-archive-keyring
171+
{
172+
printf 'debian-archive-keys<<EOF\n'
173+
cat debian-archive-keyring/etc/apt/trusted.gpg.d/*.asc
174+
printf 'EOF\n'
175+
} >>"$GITHUB_OUTPUT"
176+
- uses: ./
177+
env:
178+
DEB_BUILD_OPTIONS: noautodbgsym
179+
with:
180+
buildpackage-opts: --build=binary --no-sign
181+
docker-image: test/Dockerfile_extra-repo-keys
182+
# An output value instead of an environment variable is used here to
183+
# not interfere with Docker’s environment down the line.
184+
extra-repo-keys: ${{ steps.download-keys.outputs.debian-archive-keys }}
185+
source-dir: test
186+
- run: |
187+
dpkg --info debian/artifacts/test_1_amd64.deb
188+
dpkg --contents debian/artifacts/test_1_amd64.deb | grep ./usr/bin/mybin
189+
test -f debian/artifacts/test_1_amd64.buildinfo
190+
test -f debian/artifacts/test_1_amd64.changes
191+
192+
extra-repo-keys-files:
193+
needs: [single-package]
194+
runs-on: ubuntu-latest
195+
steps:
196+
- uses: actions/checkout@v4
197+
- id: download-keys
198+
run: |
199+
docker run --detach --mount="type=bind,src=${{ github.workspace }},dst=/workspace" --name=download-cont --rm --workdir=/workspace debian:stable-slim tail -f /dev/null
200+
docker exec download-cont apt-get update
201+
docker exec --user="$(id -u):$(id -g)" download-cont apt-get download debian-archive-keyring
202+
docker stop --time=1 download-cont
203+
dpkg-deb --extract debian-archive-keyring_*.deb debian-archive-keyring
204+
{
205+
printf 'debian-archive-keys<<EOF\n'
206+
ls -1 --directory debian-archive-keyring/etc/apt/trusted.gpg.d/*.asc
207+
printf 'EOF\n'
208+
} >>"$GITHUB_OUTPUT"
209+
- uses: ./
210+
env:
211+
DEB_BUILD_OPTIONS: noautodbgsym
212+
with:
213+
buildpackage-opts: --build=binary --no-sign
214+
docker-image: test/Dockerfile_extra-repo-keys
215+
# An output value instead of an environment variable is used here to
216+
# not interfere with Docker’s environment down the line.
217+
extra-repo-keys: ${{ steps.download-keys.outputs.debian-archive-keys }}
218+
source-dir: test
219+
- run: |
220+
dpkg --info debian/artifacts/test_1_amd64.deb
221+
dpkg --contents debian/artifacts/test_1_amd64.deb | grep ./usr/bin/mybin
222+
test -f debian/artifacts/test_1_amd64.buildinfo
223+
test -f debian/artifacts/test_1_amd64.changes
224+
225+
extra-repos:
226+
needs: [setup-hook]
227+
runs-on: ubuntu-latest
228+
steps:
229+
- uses: actions/checkout@v4
230+
- run: cat test/Makefile_extra-repos >>test/Makefile
231+
- uses: ./
232+
env:
233+
DEB_BUILD_OPTIONS: noautodbgsym
234+
with:
235+
buildpackage-opts: --build=binary --no-sign
236+
extra-repos: |
237+
# These are intentionally given as two entries:
238+
deb http://deb.debian.org/debian stable contrib
239+
deb http://deb.debian.org/debian stable non-free
240+
setup-hook: |
241+
apt-get update # Called here manually only for testing purposes!
242+
! apt-cache policy | grep -E ' *release.*[ ,]o=Debian[,$$]' | grep -E '[ ,]c=contrib[,$$]'
243+
! apt-cache policy | grep -E ' *release.*[ ,]o=Debian[,$$]' | grep -E '[ ,]c=non-free[,$$]'
244+
source-dir: test
245+
- run: |
246+
dpkg --info debian/artifacts/test_1_amd64.deb
247+
dpkg --contents debian/artifacts/test_1_amd64.deb | grep ./usr/bin/mybin
248+
test -f debian/artifacts/test_1_amd64.buildinfo
249+
test -f debian/artifacts/test_1_amd64.changes
250+
251+
extra-repos-deb822:
252+
needs: [setup-hook]
253+
runs-on: ubuntu-latest
254+
steps:
255+
- uses: actions/checkout@v4
256+
- run: cat test/Makefile_extra-repos >>test/Makefile
257+
- uses: ./
258+
env:
259+
DEB_BUILD_OPTIONS: noautodbgsym
260+
with:
261+
buildpackage-opts: --build=binary --no-sign
262+
extra-repos: |
263+
# These are intentionally given as two entries:
264+
Types: deb
265+
URIs: http://deb.debian.org/debian
266+
Suites: stable
267+
Components: contrib
268+
269+
Types: deb
270+
URIs: http://deb.debian.org/debian
271+
Suites: stable
272+
Components: non-free
273+
setup-hook: |
274+
apt-get update # Called here manually only for testing purposes!
275+
! apt-cache policy | grep -E ' *release.*[ ,]o=Debian[,$$]' | grep -E '[ ,]c=contrib[,$$]'
276+
! apt-cache policy | grep -E ' *release.*[ ,]o=Debian[,$$]' | grep -E '[ ,]c=non-free[,$$]'
277+
source-dir: test
278+
- run: |
279+
dpkg --info debian/artifacts/test_1_amd64.deb
280+
dpkg --contents debian/artifacts/test_1_amd64.deb | grep ./usr/bin/mybin
281+
test -f debian/artifacts/test_1_amd64.buildinfo
282+
test -f debian/artifacts/test_1_amd64.changes
283+
159284
full-build:
160285
runs-on: ubuntu-latest
161286
steps:

‎README.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,25 @@ settings are required.
9595

9696
Optional and empty by default.
9797

98+
#### `extra-repos`
99+
Extra APT repositories to configure as sources in the build environment.
100+
101+
Entries can be given in either format supported by APT: one-line style or
102+
deb822 style, see
103+
[`man sources.list`](https://manpages.debian.org/sources.list.5).
104+
105+
Optional and empty by default.
106+
107+
#### `extra-repo-keys`
108+
Extra keys for APT to trust in the build environment. Useful in combination
109+
with [`extra-repos`](#extra-repos).
110+
111+
The parameter can be used to pass either one or multiple ASCII-armored keys, or
112+
a newline-separated list of paths to key files in ASCII-armored or binary
113+
format. Paths to key files must be relative to the workspace.
114+
115+
Optional and empty by default.
116+
98117
#### `host-arch`
99118
The architecture packages are built for. If this parameter is set,
100119
cross-compilation is set up with `apt-get` and `dpkg-buildpackage` as described

‎action.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,12 @@ inputs:
2626
extra-docker-args:
2727
description: Additional arguments to 'docker run' when starting the build container
2828
required: false
29+
extra-repo-keys:
30+
description: Extra ASCII-armored APT repository keys or paths to keyring files to trust in the build environment
31+
required: false
32+
extra-repos:
33+
description: Extra APT repositories to configure in the build environment (one-line-style or deb822-style format)
34+
required: false
2935
host-arch:
3036
description: Foreign architecture to setup cross-compilation for
3137
required: false
@@ -50,6 +56,8 @@ runs:
5056
INPUT_DOCKER_IMAGE: ${{ inputs.docker-image }}
5157
INPUT_EXTRA_BUILD_DEPS: ${{ inputs.extra-build-deps }}
5258
INPUT_EXTRA_DOCKER_ARGS: ${{ inputs.extra-docker-args }}
59+
INPUT_EXTRA_REPO_KEYS: ${{ inputs.extra-repo-keys }}
60+
INPUT_EXTRA_REPOS: ${{ inputs.extra-repos }}
5361
INPUT_HOST_ARCH: ${{ inputs.host-arch }}
5462
INPUT_SETUP_HOOK: ${{ inputs.setup-hook }}
5563
INPUT_SOURCE_DIR: ${{ inputs.source-dir }}

‎scripts/install_build_deps‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,13 @@ fi
2424
# essential packages. It is reasonably safe to blindly assume it is installed.
2525
printf "man-db man-db/auto-update boolean false\n" | debconf-set-selections
2626

27+
if printf "%s\n" "$INPUT_EXTRA_REPOS" | grep -q '^deb'; then
28+
extra_repos_ext=.list
29+
else
30+
extra_repos_ext=.sources
31+
fi
32+
printf "%s\n" "$INPUT_EXTRA_REPOS" >"/etc/apt/sources.list.d/build-deb-action${extra_repos_ext}"
33+
2734
apt-get update
2835

2936
# shellcheck disable=SC2086

‎scripts/run‎

Lines changed: 44 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,8 @@ build_dir=$(mktemp --directory --tmpdir="${RUNNER_TEMP-}" build-deb-action-XXXXX
4646
trap clean_up EXIT INT HUP TERM
4747

4848
env_file=$build_dir/env
49+
extra_repo_keys_file=$build_dir/build-deb-action.asc
50+
extra_repo_key_files_file=$build_dir/extra_repo_key_files
4951
gitconfig_file=$build_dir/gitconfig
5052

5153
INPUT_ARTIFACTS_DIR=${INPUT_ARTIFACTS_DIR:-.}
@@ -60,6 +62,36 @@ if ! check_path_prefix "$INPUT_SOURCE_DIR" "$GITHUB_WORKSPACE"; then
6062
exit 2
6163
fi
6264

65+
touch "$extra_repo_key_files_file"
66+
if [ "$INPUT_EXTRA_REPO_KEYS" ]; then
67+
printf '%s\n' "$INPUT_EXTRA_REPO_KEYS" >"$extra_repo_keys_file"
68+
69+
while read -r extra_repo_key_file; do
70+
[ "$extra_repo_key_file" ] || continue
71+
72+
if [ ! -f "$extra_repo_key_file" ]; then
73+
if [ -s "$extra_repo_key_files_file" ]; then
74+
error "extra-repo-keys cannot contain both ASCII-armored keys and key file paths"
75+
exit 2
76+
fi
77+
78+
# Looks like (an) ASCII-armored key(s)
79+
break
80+
fi
81+
82+
if ! check_path_prefix "$extra_repo_key_file" "$GITHUB_WORKSPACE"; then
83+
error "A path to a key file in extra-repo-keys is not in GITHUB_WORKSPACE"
84+
exit 2
85+
fi
86+
87+
printf '%s\n' "$extra_repo_key_file" >>"$extra_repo_key_files_file"
88+
done <"$extra_repo_keys_file"
89+
90+
if [ ! -s "$extra_repo_key_files_file" ]; then
91+
printf '/github/build/%s\n' "${extra_repo_keys_file##*/}" >"$extra_repo_key_files_file"
92+
fi
93+
fi
94+
6395
if [ -f "$INPUT_DOCKER_IMAGE" ]; then
6496
if ! check_path_prefix "$INPUT_DOCKER_IMAGE" "$GITHUB_WORKSPACE"; then
6597
error "docker-image is the path of a Dockerfile but it is not in GITHUB_WORKSPACE"
@@ -77,9 +109,12 @@ if [ -f "$INPUT_DOCKER_IMAGE" ]; then
77109
fi
78110

79111
start_group "Starting build container"
80-
# Docker does not like variable values containing newlines in an --env-file.
112+
# Docker does not like variable values containing newlines in an --env-file, we
113+
# will pass them separately:
81114
env \
82115
--unset=INPUT_BEFORE_BUILD_HOOK \
116+
--unset=INPUT_EXTRA_REPO_KEYS \
117+
--unset=INPUT_EXTRA_REPOS \
83118
--unset=INPUT_SETUP_HOOK \
84119
>"$env_file"
85120

@@ -91,6 +126,7 @@ container_id=$(
91126
--env-file="$env_file" \
92127
--env=GITHUB_ACTION_PATH=/github/action \
93128
--env=GITHUB_WORKSPACE=/github/workspace \
129+
--env=INPUT_EXTRA_REPOS \
94130
--mount="type=bind,src=${GITHUB_ACTION_PATH},dst=/github/action,ro" \
95131
--mount="type=bind,src=${build_dir},dst=/github/build" \
96132
--mount="type=bind,src=${GITHUB_WORKSPACE},dst=/github/workspace" \
@@ -103,6 +139,13 @@ container_id=$(
103139
end_group
104140

105141
start_group "Setting up build container"
142+
while read -r extra_repo_key_file; do
143+
docker exec "$container_id" install \
144+
--mode=644 \
145+
--target-directory=/etc/apt/trusted.gpg.d \
146+
"$extra_repo_key_file"
147+
done <"$extra_repo_key_files_file"
148+
106149
# git is always available here outside the build container, in the environment
107150
# of a run step.
108151

‎test/Dockerfile_extra-repo-keys‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
FROM debian:stable-slim
2+
3+
RUN rm /etc/apt/trusted.gpg.d/debian-archive-*.asc

‎test/Makefile_extra-repos‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
2+
.PHONY: test
3+
test:
4+
apt-cache policy | grep -E ' *release.*[ ,]o=Debian[,$$]' | grep -E '[ ,]c=contrib[,$$]'
5+
apt-cache policy | grep -E ' *release.*[ ,]o=Debian[,$$]' | grep -E '[ ,]c=non-free[,$$]'

0 commit comments

Comments
 (0)