Bathymetrie-Daten Schweiz - submersion-app/submersion#1061

.github/workflows/build-all.yml

@@ -562,14 +562,25 @@ jobs:
         id: flutter-ver
         run: echo "version=$(cat ${{ env.FLUTTER_VERSION_FILE }})" >> "$GITHUB_OUTPUT"
 
+      # The runner image sets the glibc floor of everything shipped here.
+      # Deliberately left as ubuntu-latest: the released tarball has always
+      # required GLIBC_2.38, pinned by libsqlcipher.so and the two plugin
+      # libraries rather than by the app, so building on an older host would
+      # buy reach the project has never claimed at the cost of a container
+      # and its toolchain. See docs/guide/installation.md for the distro
+      # requirement this implies.
+      #
+      # binutils supplies readelf for scripts/linux_package_deps.py; the
+      # hosted image already has it, and it is named here so a future image
+      # change cannot remove it silently.
       - name: Install Linux dependencies
         run: |
           sudo apt-get update -y
           sudo apt-get install -y \
             clang cmake ninja-build pkg-config \
             libgtk-3-dev liblzma-dev libstdc++-12-dev \
             libsqlite3-dev libsecret-1-dev libwebkit2gtk-4.1-dev \
-            libssl-dev
+            libssl-dev binutils
 
       - name: Setup Flutter
         uses: subosito/flutter-action@v2
@@ -615,20 +626,109 @@ jobs:
         # app (issue #1129).
         run: python3 scripts/check_bundled_native_assets.py build/linux/x64/release/bundle
 
+      - name: Install packaging tools
+        run: |
+          sudo apt-get install -y ruby ruby-dev build-essential rpm python3-pil
+          sudo gem install --no-document fpm
+
+      # Staged before the tarball step, so the installer scripts the tarball
+      # carries never leak into the package trees.
+      # Shared with ci.yaml's build-linux job so the two cannot drift.
+      - name: Build .deb and .rpm
+        env:
+          TAG_NAME: ${{ inputs.version-tag }}
+        run: |
+          set -euo pipefail
+          VERSION="${TAG_NAME#v}"
+          scripts/release/build_linux_packages.sh \
+            --bundle build/linux/x64/release/bundle \
+            --version "$VERSION" \
+            --deb "Submersion-${TAG_NAME}-Linux-amd64.deb" \
+            --rpm "Submersion-${TAG_NAME}-Linux-x86_64.rpm"
+
+      # Runs after the package trees are staged, so these extras reach the
+      # tarball only. A tarball user has no package manager doing the work,
+      # so the archive carries its own installer and dependency map.
       - name: Create tarball
         env:
           TAG_NAME: ${{ inputs.version-tag }}
         run: |
-          cd build/linux/x64/release/bundle
+          set -euo pipefail
+          BUNDLE=build/linux/x64/release/bundle
+          cp scripts/release/linux_tarball_extras/install.sh "$BUNDLE/"
+          cp scripts/release/linux_tarball_extras/uninstall.sh "$BUNDLE/"
+          chmod +x "$BUNDLE/install.sh" "$BUNDLE/uninstall.sh"
+          cp scripts/data/linux_soname_map.json "$BUNDLE/deps.json"
+          python3 scripts/gen_udev_rules.py \
+            packages/libdivecomputer_plugin/third_party/libdivecomputer/src/descriptor.c \
+            > "$BUNDLE/60-submersion-divecomputers.rules"
+          cd "$BUNDLE"
           tar czf "$GITHUB_WORKSPACE/Submersion-${TAG_NAME}-Linux.tar.gz" .
 
-      - name: Upload Linux artifact
+      - name: Upload Linux artifacts
         uses: actions/upload-artifact@v7
         with:
-          name: linux-tar
-          path: Submersion-*.tar.gz
+          name: linux-packages
+          path: |
+            Submersion-*.tar.gz
+            Submersion-*.deb
+            Submersion-*.rpm
           retention-days: 5
 
+  # ============================================================================
+  # Verify Linux Packages
+  # ============================================================================
+  verify-linux-packages:
+    name: Verify Linux Packages
+    needs: build-linux
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      # Checkout first: actions/checkout cleans the workspace by default, so
+      # downloading the artifact before it would delete the download.
+      - name: Check out the verification script
+        uses: actions/checkout@v7
+        with:
+          sparse-checkout: scripts/release/verify_linux_package.sh
+          sparse-checkout-cone-mode: false
+
+      - name: Download Linux packages
+        uses: actions/download-artifact@v8
+        with:
+          name: linux-packages
+          path: packages
+
+      # Installing through the real package manager is the point: it proves
+      # every declared dependency is resolvable on a stock system, which is
+      # exactly what the tar.gz could never demonstrate.
+      # The .deb is verified against the runner's own Ubuntu release, not an
+      # older distro: build-linux runs on ubuntu-latest, so its binaries
+      # require that runner's glibc and cannot run anywhere older. The tag is
+      # derived rather than pinned so it keeps matching when GitHub moves
+      # ubuntu-latest. Mirrors the same step in ci.yaml.
+      - name: Install and run in clean containers
+        run: |
+          set -euo pipefail
+          UBUNTU_TAG="ubuntu:$(. /etc/os-release && echo "$VERSION_ID")"
+          echo "runner is $UBUNTU_TAG"
+          # Every image runs even when an earlier one fails, so one run says
+          # whether the .deb, the .rpm, or both are broken. Testing the exit
+          # status with `if !` keeps the failure from tripping `set -e`.
+          failed=()
+          for image in "$UBUNTU_TAG" fedora:latest; do
+            echo "=== $image ==="
+            if ! docker run --rm \
+              -v "$PWD/packages:/p" \
+              -v "$PWD/scripts/release/verify_linux_package.sh:/verify.sh:ro" \
+              "$image" bash /verify.sh; then
+              failed+=("$image")
+            fi
+          done
+          if [ "${#failed[@]}" -gt 0 ]; then
+            echo "::error::package verification failed on: ${failed[*]}"
+            exit 1
+          fi
+
   # ============================================================================
   # Android Build
   # ============================================================================
@@ -649,7 +749,7 @@ jobs:
         run: echo "version=$(cat ${{ env.FLUTTER_VERSION_FILE }})" >> "$GITHUB_OUTPUT"
 
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
         with:
           distribution: 'temurin'
           java-version: '21'
@@ -929,4 +1029,3 @@ jobs:
         run: |
           rm -f ios/fastlane/AuthKey.p8
           security delete-keychain $RUNNER_TEMP/app-signing.keychain-db 2>/dev/null || true
-