Skip to content

fix: dynamic series detection and debsign #117

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rtibbles merged 1 commit into from
Mar 4, 2026
Merged

fix: dynamic series detection and debsign #117

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion .github/workflows/build_debian.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,11 @@ jobs:
steps:
- name: checkout codebase
uses: actions/checkout@v4
- name: Set changelog distribution to runner series
run: |
SERIES=$(. /etc/os-release && echo "$VERSION_CODENAME")
sed -i "1s/) [a-z]*;/) ${SERIES};/" debian/changelog
echo "Targeting series: ${SERIES}"
- name: Install build and upload dependencies
run: make install-upload-deps
- name: Install Kolibri
Expand All @@ -68,6 +73,8 @@ jobs:
if: steps.check_source.outputs.already_uploaded != 'true'
run: |
echo -n "${{ secrets.GPG_SIGNING_KEY }}" | base64 --decode | gpg --import --no-tty --batch --yes
echo "allow-loopback-pinentry" >> ~/.gnupg/gpg-agent.conf
gpgconf --kill gpg-agent
- name: Sign and upload package
if: steps.check_source.outputs.already_uploaded != 'true'
env:
Expand Down Expand Up @@ -119,7 +126,7 @@ jobs:
LP_CREDENTIALS: ${{ secrets.LP_CREDENTIALS }}
run: |
echo "$LP_CREDENTIALS" > /tmp/lp-creds.txt
- name: Copy from jammy to supported series
- name: Copy to other supported series
env:
LP_CREDENTIALS_FILE: /tmp/lp-creds.txt
run: |
Expand Down
10 changes: 10 additions & 0 deletions .github/workflows/installtest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,17 @@ jobs:
build:
name: Build kolibri-server .deb package
runs-on: ubuntu-latest
outputs:
ppa_series: ${{ steps.detect_series.outputs.PPA_SERIES }}
steps:
- name: Checkout codebase
uses: actions/checkout@v4
- name: Detect runner series
id: detect_series
run: |
SERIES=$(. /etc/os-release && echo "$VERSION_CODENAME")
echo "PPA_SERIES=${SERIES}" >> "$GITHUB_OUTPUT"
echo "Detected series: ${SERIES}"
- name: Install build dependencies
run: make install-build-deps
- name: Install Kolibri
Expand Down Expand Up @@ -47,6 +55,8 @@ jobs:
ln -s /usr/share/zoneinfo/America/New_York /etc/localtime
dpkg-reconfigure -f noninteractive tzdata
- name: Setup Kolibri PPA
env:
PPA_SERIES: ${{ needs.build.outputs.ppa_series }}
run: ./test/setup_ppa.sh
- name: Configure debconf selections
run: |
Expand Down
7 changes: 5 additions & 2 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,10 +53,13 @@ dist: error-pages orig
dpkg-buildpackage -S -us -uc
mv ../kolibri-server_$(VERSION)* dist/
@echo "Package built successfully!"
# build and sign (signing uses environment GPG_PASSPHRASE and KEYID)
# build and sign (signing uses environment GPG_KEY_ID and GPG_PASSPHRASE)
sign-and-upload: dist
@echo "Signing and uploading package..."
debsign -p"gpg --batch --yes --pinentry-mode loopback --passphrase $(GPG_PASSPHRASE)" dist/*.changes
@printf '%s' "$$GPG_PASSPHRASE" > /tmp/.gpg-passphrase
debsign -p"gpg --batch --pinentry-mode loopback --passphrase-file /tmp/.gpg-passphrase" \
-k"$$GPG_KEY_ID" dist/*.changes
@rm -f /tmp/.gpg-passphrase
Copy link
Member

@bjester bjester Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If debsign fails, this never occurs.

@echo "Uploading to PPA..."
dput --unchecked ppa:learningequality/kolibri-proposed dist/*.changes
@echo "Upload completed successfully!"
Expand Down
11 changes: 10 additions & 1 deletion test/setup_ppa.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,18 @@ set -e
SUDO=""
[ "$(id -u)" != "0" ] && SUDO="sudo"

# Detect Ubuntu series for PPA source line
# On Ubuntu: use the OS codename. On non-Ubuntu (e.g. Debian): require PPA_SERIES env var.
. /etc/os-release
if [ "$ID" = "ubuntu" ]; then
SERIES="$VERSION_CODENAME"
else
SERIES="${PPA_SERIES:?PPA_SERIES must be set for non-Ubuntu systems (e.g. PPA_SERIES=noble)}"
fi

gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys DC5BAA93F9E4AE4F0411F97C74F88ADB3194DD81
gpg --output /tmp/learningequality-kolibri.gpg --export DC5BAA93F9E4AE4F0411F97C74F88ADB3194DD81
$SUDO mv /tmp/learningequality-kolibri.gpg /usr/share/keyrings/learningequality-kolibri.gpg

echo "deb [signed-by=/usr/share/keyrings/learningequality-kolibri.gpg] http://ppa.launchpad.net/learningequality/kolibri/ubuntu jammy main" \
echo "deb [signed-by=/usr/share/keyrings/learningequality-kolibri.gpg] http://ppa.launchpad.net/learningequality/kolibri/ubuntu $SERIES main" \
| $SUDO tee /etc/apt/sources.list.d/learningequality-ubuntu-kolibri.list > /dev/null
Loading