fix: dynamic series detection and debsign#117
Merged
Conversation
- setup_ppa.sh: detect Ubuntu series from /etc/os-release instead of hardcoding jammy; require PPA_SERIES env var for non-Ubuntu systems - build_debian.yml: patch debian/changelog distribution to match the runner's OS at build time so copy-to-series finds the uploaded package; configure allow-loopback-pinentry for GPG signing - installtest.yml: build job outputs detected series, test jobs pass it to setup_ppa.sh via PPA_SERIES for Debian containers - Makefile sign-and-upload: use --passphrase-file instead of inline --passphrase (avoids shell quoting issues); use $GPG_KEY_ID with -k flag (was set but never used); use shell expansion ($$) not Make expansion ($()) for env vars Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
bjester
reviewed
Mar 4, 2026
| @printf '%s' "$$GPG_PASSPHRASE" > /tmp/.gpg-passphrase | ||
| debsign -p"gpg --batch --pinentry-mode loopback --passphrase-file /tmp/.gpg-passphrase" \ | ||
| -k"$$GPG_KEY_ID" dist/*.changes | ||
| @rm -f /tmp/.gpg-passphrase |
Member
There was a problem hiding this comment.
If debsign fails, this never occurs.
This was referenced Mar 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
jammyeverywhere with auto-detection from/etc/os-release. Whenubuntu-latestmoves to 26.04, everything transitions seamlessly.--passphrase-fileand-k $GPG_KEY_IDinstead of broken-p"gpg --passphrase $(MAKE_VAR)"approach that mangled arguments.noble(runner OS) but they were uploaded tojammy(changelog). Now the changelog distribution is patched to match the runner at build time.Changes
test/setup_ppa.shPPA_SERIESenv var for DebianMakefilesign-and-upload:--passphrase-file,-k $$GPG_KEY_ID, shell ($$) not Make ($()) expansionbuild_debian.ymlallow-loopback-pinentryinstalltest.ymlPPA_SERIESTest plan
setup_ppa.shtested on Ubuntu container (auto-detectsnoble)setup_ppa.shtested on Debian container withPPA_SERIES=noblesetup_ppa.shtested on Debian container withoutPPA_SERIES(errors with helpful message)jammy→nobleon line 1 only)debsignwith--passphrase-filetested end-to-end with passphrase-protected keybuild_debian.ymlsucceeds on next release (requires secrets)🤖 Generated with Claude Code