diff --git a/.copr/Makefile b/.copr/Makefile new file mode 100644 index 0000000..e5a1f39 --- /dev/null +++ b/.copr/Makefile @@ -0,0 +1,7 @@ +# COPR SCM method: make srpm. Run from the repository root. +.PHONY: srpm +srpm: + dnf -y install rpm-build rpmdevtools + mkdir -p "$(outdir)" + spectool -g -R bb-auth.spec + rpmbuild -bs --define '_srcrpmdir $(outdir)' bb-auth.spec diff --git a/.github/workflows/arch.yml b/.github/workflows/arch.yml.disabled similarity index 100% rename from .github/workflows/arch.yml rename to .github/workflows/arch.yml.disabled diff --git a/.github/workflows/copr-release.yml b/.github/workflows/copr-release.yml new file mode 100644 index 0000000..a95604a --- /dev/null +++ b/.github/workflows/copr-release.yml @@ -0,0 +1,30 @@ +name: COPR release + +on: + release: + types: [published] + +permissions: + contents: read + +jobs: + validate: + uses: ./.github/workflows/fedora.yml + + copr: + needs: validate + if: github.event_name == 'release' && !github.event.release.prerelease + runs-on: ubuntu-latest + steps: + - name: Notify COPR of the validated tag + env: + COPR_WEBHOOK_URL: ${{ secrets.COPR_WEBHOOK_URL }} + shell: bash + run: | + set -euo pipefail + test -n "$COPR_WEBHOOK_URL" || { echo 'Missing COPR_WEBHOOK_URL secret'; exit 1; } + jq '{ref: .release.tag_name, ref_type: "tag", repository: .repository, sender: .sender, master_branch: .repository.default_branch}' \ + "$GITHUB_EVENT_PATH" > /tmp/copr-event.json + curl --fail-with-body --silent --show-error --connect-timeout 15 --max-time 60 \ + -H 'Content-Type: application/json' -H 'X-GitHub-Event: create' \ + --data-binary @/tmp/copr-event.json "$COPR_WEBHOOK_URL" diff --git a/.github/workflows/fedora.yml b/.github/workflows/fedora.yml new file mode 100644 index 0000000..c8819df --- /dev/null +++ b/.github/workflows/fedora.yml @@ -0,0 +1,60 @@ +name: Fedora validation + +on: + push: + branches: [main] + pull_request: + workflow_call: + +permissions: + contents: read + +jobs: + validate: + runs-on: ubuntu-latest + container: fedora:44 + steps: + - name: Install Git for checkout + run: dnf -y install git + - uses: actions/checkout@v7 + - name: Install build dependencies + run: | + dnf -y install rpm-build rpmdevtools dnf-plugins-core git diffutils + dnf -y builddep bb-auth.spec + - name: Validate version and prepare sources + shell: bash + env: + RELEASE_TAG: ${{ github.event.release.tag_name }} + run: | + set -euo pipefail + git config --global --add safe.directory "$GITHUB_WORKSPACE" + version=$(cat VERSION) + spec_version=$(rpmspec -q --qf '%{VERSION}\n' bb-auth.spec | head -n1) + test "$version" = "$spec_version" + mkdir -p /tmp/rpmbuild/{SOURCES,SPECS,BUILD,BUILDROOT,RPMS,SRPMS} + if [[ "$GITHUB_EVENT_NAME" == release ]]; then + test "$RELEASE_TAG" = "v$version" + spectool -g -C /tmp/rpmbuild/SOURCES bb-auth.spec + # Ensure the tag archive matches the checkout being validated. + mkdir /tmp/release-source + tar -xf "/tmp/rpmbuild/SOURCES/bb-auth-$version.tar.gz" -C /tmp/release-source + git archive --prefix="bb-auth-$version/" HEAD | tar -x -C /tmp + diff -r "/tmp/bb-auth-$version" "/tmp/release-source/bb-auth-$version" + else + git archive --prefix="bb-auth-$version/" HEAD | gzip > "/tmp/rpmbuild/SOURCES/bb-auth-$version.tar.gz" + fi + - name: Build RPM and run tests + run: rpmbuild -ba --define '_topdir /tmp/rpmbuild' bb-auth.spec + - name: Install RPM and check installed paths + shell: bash + run: | + set -euo pipefail + dnf -y install /tmp/rpmbuild/RPMS/*/bb-auth-[0-9]*.rpm + test -x /usr/libexec/bb-auth + test -x /usr/libexec/bb-auth-fallback + test -x /usr/libexec/bb-auth-bootstrap + test "$(readlink /usr/libexec/pinentry-bb)" = bb-auth + test "$(readlink /usr/libexec/bb-keyring-prompter)" = bb-auth + test -f /usr/lib/systemd/user/bb-auth.service + test -f /usr/share/dbus-1/services/org.bb.auth.service + test -f /usr/share/bb-auth/org.gnome.keyring.SystemPrompter.service diff --git a/CMakeLists.txt b/CMakeLists.txt index c1f0e3c..779db3b 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -6,6 +6,8 @@ string(STRIP ${VER_RAW} VER) project(bb-auth VERSION ${VER} LANGUAGES C CXX) +include(GNUInstallDirs) + set(CMAKE_CXX_STANDARD 23) set(CMAKE_CXX_STANDARD_REQUIRED ON) set(CMAKE_C_STANDARD 11) @@ -126,7 +128,8 @@ target_compile_definitions(bb-auth set(BB_AUTH_GCR_PROMPTER_BINARY "/usr/lib/gcr-prompter" CACHE STRING "Path to the system gcr-prompter binary") target_compile_definitions(bb-auth PRIVATE GCR_PROMPTER_BINARY="\\"${BB_AUTH_GCR_PROMPTER_BINARY}\\"") -include(GNUInstallDirs) +set(BB_AUTH_SYSTEMD_USER_UNIT_DIR "${CMAKE_INSTALL_LIBDIR}/systemd/user" + CACHE PATH "Installation directory for systemd user units") set(LIBEXECDIR ${CMAKE_INSTALL_FULL_LIBEXECDIR}) set(DATADIR ${CMAKE_INSTALL_FULL_DATADIR}) @@ -262,7 +265,7 @@ install(CODE " # Install systemd user service install(FILES ${CMAKE_BINARY_DIR}/bb-auth.service - DESTINATION "${CMAKE_INSTALL_LIBDIR}/systemd/user") + DESTINATION "${BB_AUTH_SYSTEMD_USER_UNIT_DIR}") # Install D-Bus service file install(FILES ${CMAKE_BINARY_DIR}/bb-auth-dbus.service diff --git a/PLAN.md b/PLAN.md index a3a9a2a..006e333 100644 --- a/PLAN.md +++ b/PLAN.md @@ -181,6 +181,8 @@ Do not: ## Changelog Notes +- 2026-09-10: Added tag-based Fedora RPM packaging, configurable systemd user-unit installation, and Fedora release validation before notifying COPR. Local build gates remain pending until development dependencies are available. + - 2026-02-18: AUR packaging switched to deterministic minimal default (`BB_AUTH_GTK_FALLBACK=OFF`), with optional GTK fallback build via explicit opt-in. - 2026-02-18: Removed in-tree GTK provider build/install from core; core packaging/CI now validates minimal Qt-first architecture. - 2026-02-18: Added provider conformance test suite and external provider packaging guide. diff --git a/README.md b/README.md index b14bc50..1cc30ba 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,7 @@ # bb-auth +[![Copr build status](https://copr.fedorainfracloud.org/coprs/branrgx/bb-auth/package/bb-auth/status_image/last_build.png)](https://copr.fedorainfracloud.org/coprs/branrgx/bb-auth/package/bb-auth/) + Unified Linux authentication daemon for: - polkit (`pkexec`) @@ -30,12 +32,15 @@ It prefers an external UI provider when available, and falls back to the built-i ## Install -Arch (AUR): +Fedora (COPR): ```bash -yay -S bb-auth-git +sudo dnf copr enable branrgx/bb-auth +sudo dnf install bb-auth ``` +Fedora packaging and release automation: [Fedora / COPR](docs/FEDORA_COPR.md). + Manual: ```bash diff --git a/bb-auth.spec b/bb-auth.spec new file mode 100644 index 0000000..a5dd3bf --- /dev/null +++ b/bb-auth.spec @@ -0,0 +1,78 @@ +Name: bb-auth +Version: 0.2.1 +Release: 1%{?dist} +Summary: Unified polkit, keyring, and pinentry authentication daemon + +License: BSD-3-Clause +URL: https://github.com/branrgx/bb-auth +Source0: %{url}/archive/refs/tags/v%{version}.tar.gz#/%{name}-%{version}.tar.gz + +BuildRequires: cmake +BuildRequires: make +BuildRequires: systemd-rpm-macros +BuildRequires: gcc +BuildRequires: gcc-c++ +BuildRequires: pkgconfig +BuildRequires: qt6-qtbase-devel +BuildRequires: polkit-devel +BuildRequires: polkit-qt6-1-devel +BuildRequires: gcr-devel +BuildRequires: glib2-devel +BuildRequires: json-glib-devel + +Requires: polkit +Requires: polkit-qt6-1 +Requires: gcr +Requires: json-glib +Requires: gnome-keyring + +%description +bb-auth is a unified Linux authentication daemon for Polkit, +GNOME Keyring prompts and GPG pinentry. + +It supports external UI providers, allowing desktop shells and other +interfaces to provide their own authentication frontend while retaining +a built-in Qt fallback. + +%prep +%autosetup +test "$(cat VERSION)" = "%{version}" + +%build +%cmake \ + -DCMAKE_BUILD_TYPE=Release \ + -DBB_AUTH_SYSTEMD_USER_UNIT_DIR=%{_userunitdir} \ + -DBB_AUTH_GCR_PROMPTER_BINARY=%{_libexecdir}/gcr-prompter + +%cmake_build + +%install +%cmake_install + +%check +QT_QPA_PLATFORM=offscreen QT_STYLE_OVERRIDE=Fusion %ctest + +%post +%systemd_user_post bb-auth.service + +%preun +%systemd_user_preun bb-auth.service + +%postun +%systemd_user_postun bb-auth.service + +%files +%license LICENSE +%doc README.md +%{_libexecdir}/bb-auth +%{_libexecdir}/bb-auth-fallback +%{_libexecdir}/bb-auth-bootstrap +%{_libexecdir}/bb-keyring-prompter +%{_libexecdir}/pinentry-bb +%{_userunitdir}/bb-auth.service +%{_datadir}/dbus-1/services/org.bb.auth.service +%{_datadir}/bb-auth/ + +%changelog +* Thu Sep 10 2026 branrgx - 0.2.1-1 +- Initial Fedora COPR package diff --git a/docs/FEDORA_COPR.md b/docs/FEDORA_COPR.md new file mode 100644 index 0000000..ff07b67 --- /dev/null +++ b/docs/FEDORA_COPR.md @@ -0,0 +1,62 @@ +# Fedora releases and COPR + +`bb-auth.spec` downloads `v%{version}` from GitHub. Keep `VERSION`, the +spec's `Version`, and the release tag synchronized (for example `0.2.1`, +`0.2.1`, `v0.2.1`). Commit changes before creating the tag. Do not move +published tags. For a packaging-only rebuild, increment `Release`. + +## COPR setup + +Create the `bb-auth` project with the `fedora-44-x86_64` chroot, then add +an SCM package named `bb-auth`: + +- Type: Git +- Clone URL: `https://github.com/branrgx/bb-auth.git` +- Committish: `main` (the tag event overrides this for release builds) +- Spec file: `bb-auth.spec` +- Subdirectory: empty +- SRPM build method: **make srpm** (uses `.copr/Makefile`) +- Enable automatic rebuilds for webhook handling. + +In COPR Settings → Integrations, copy the **GitHub** webhook URL and append +`bb-auth/` so version-only tags select the package: + +```text +https://copr.fedorainfracloud.org/webhooks/github///bb-auth/ +``` + +In GitHub Settings → Secrets and variables → Actions, create the repository +secret `COPR_WEBHOOK_URL` with that URL. Do not register the URL under GitHub +Webhooks: that would trigger builds before validation. This workflow uses the +GitHub webhook endpoint, not the custom webhook endpoint. + +## Publish + +Merge the packaging and workflow changes after CI passes. Update `VERSION` +and `Version` in the spec together, commit, then create a GitHub release with +the matching `vX.Y.Z` tag. Both workflows must exist in that tagged commit. + +`.github/workflows/fedora.yml` builds, tests, and installs an RPM in Fedora 44 +on pushes to `main` and pull requests. It also exposes `workflow_call` so the +release workflow can reuse the same validation. + +`.github/workflows/copr-release.yml` runs when a release is published. It first +calls `fedora.yml`, which downloads the release tag archive and checks that it +matches the checkout before building/testing/installing the RPM. Only after +validation succeeds does the release workflow send a tag-creation event to +COPR. Prereleases are validated but do not trigger COPR. A failed validation +prevents the webhook job from running. The release is validated independently +of previous `main` runs, so COPR receives the tag that actually passed. + +COPR checks out the tag, reads its spec, and downloads the versioned archive +to build the SRPM. A successful webhook request only means the request was +accepted; check the resulting build in COPR. If you add supported Fedora +versions, extend the validation job to cover them before publishing there. + +The RPM configures `/usr/libexec/gcr-prompter` and installs the user unit in +`/usr/lib/systemd/user`, independently of Fedora's `/usr/lib64` library path. +Container validation does not test interactive authentication in a desktop +session; check polkit, keyring, and pinentry on Fedora before announcing support. + +References: [COPR SCM and webhooks](https://docs.copr.fedorainfracloud.org/user_documentation.html), +[GitHub release events](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#release).