Use monotonic Mesa upstream versioning

.gitea/workflows/build.yml

@@ -106,6 +106,10 @@ jobs:
         run: |
           chmod +x scripts/generate-apt-repo.sh
           ./scripts/generate-apt-repo.sh
+      - name: Verify generated apt repository
+        run: |
+          chmod +x scripts/verify-apt-repo.sh
+          ./scripts/verify-apt-repo.sh
       - name: Upload deb package to Gitea release
         run: |
           . dist/package-info.env
@@ -187,3 +191,7 @@ jobs:
           fi
         env:
           GITEA_SHA: ${{ gitea.sha }}
+      - name: Verify published apt endpoint
+        run: |
+          chmod +x scripts/verify-apt-repo.sh
+          ./scripts/verify-apt-repo.sh --remote

README.md

@@ -10,6 +10,7 @@ System-Mesa genutzt werden kann.
 - Installationspfad: `/opt/mesa-git`
 - Wrapper: `/usr/bin/mesa-git-env`
 - Ausgabe: `mesa-git_<version>_amd64.deb`
+- Versionsschema: `<mesa-version>+r<mesa-commit-count>.<mesa-sha>-<debian-revision>`
 
 ## Build-Profil
 
@@ -75,10 +76,32 @@ Releases werden als normale Releases angelegt, nicht als Pre-Releases.
 Der Workflow veröffentlicht zusätzlich einen einfachen Debian-Repo-Baum auf
 dem Branch `apt`.
 
-Die Einbindung ist dann über die Raw-URL des Branches möglich, zum Beispiel:
+Wichtig: APT braucht anonym erreichbare HTTP-Dateien wie `dists/stable/Release`
+und `pool/...deb`. Ein funktionierendes `git ls-remote` reicht dafür nicht aus.
+
+Auf dieser Gitea-Instanz war die bisher dokumentierte Raw-URL für anonyme
+HTTP-Clients nicht erreichbar und lieferte `404`. Genau daran scheitert dann
+`apt update` auf Ubuntu, obwohl der `apt`-Branch in Git existiert.
+
+Deshalb gilt:
+
+- nutze für Clients nur eine wirklich öffentlich erreichbare statische HTTP-URL
+- setze diese Basis-URL in `config/mesa-opt.conf` als `APT_PUBLIC_BASE_URL`
+- der Workflow prüft dann nach dem Publish, ob `Release`, `Packages` und das
+  referenzierte `.deb` anonym abrufbar sind
+
+Beispiel für die Konfiguration:
+
+```bash
+APT_SUITE="stable"
+APT_COMPONENT="main"
+APT_PUBLIC_BASE_URL="https://packages.example.tld/mesa-repo"
+```
+
+Die Einbindung auf dem Client sieht dann so aus:
 
 ```text
-deb [trusted=yes] https://git.mp-mueller.de/magges/mesa-repo/raw/branch/apt stable main
+deb [trusted=yes] https://packages.example.tld/mesa-repo stable main
 ```
 
 Danach:
@@ -92,6 +115,8 @@ Hinweis:
 
 - das Repo ist aktuell unsigniert
 - für APT wird deshalb hier `trusted=yes` verwendet
+- `scripts/verify-apt-repo.sh --remote` prüft, ob die öffentliche URL wirklich
+  APT-tauglich ist
 - wenn du willst, kann ich als nächsten Schritt auch noch Release-Signierung mit GPG einbauen
 
 ## Wichtige Dateien
@@ -100,6 +125,7 @@ Hinweis:
 - `scripts/build-mesa-opt.sh`: Build und Paketierung
 - `scripts/generate-release-notes.sh`: automatische Release-Notes aus Mesa-Commits
 - `scripts/generate-apt-repo.sh`: erzeugt den APT-Repo-Baum
+- `scripts/verify-apt-repo.sh`: prüft Repo-Struktur und optional den öffentlichen APT-Endpunkt
 - `.gitea/workflows/build.yml`: Gitea-Workflow
 
 ## Benutzung

config/mesa-opt.conf

@@ -2,6 +2,11 @@ PACKAGE_NAME="mesa-git"
 PACKAGE_VERSION_PREFIX=""
 PACKAGE_RELEASE="1"
 PACKAGE_ARCH="amd64"
+APT_SUITE="stable"
+APT_COMPONENT="main"
+# Public static HTTP base URL for the generated apt tree, without trailing slash.
+# Leave empty if the repo is only generated locally or published elsewhere.
+APT_PUBLIC_BASE_URL=""
 
 UPSTREAM_GIT_URL="https://gitlab.freedesktop.org/mesa/mesa.git"
 UPSTREAM_GIT_REF="main"

scripts/build-mesa-opt.sh

@@ -83,9 +83,9 @@ detect_upstream_version() {
 
 GIT_SHA=$(git -C "${SRC_DIR}" rev-parse --short=12 HEAD)
 GIT_SHA_FULL=$(git -C "${SRC_DIR}" rev-parse HEAD)
+UPSTREAM_COMMIT_COUNT=$(git -C "${SRC_DIR}" rev-list --count HEAD)
 UPSTREAM_VERSION="${PACKAGE_VERSION_PREFIX:-$(detect_upstream_version "${SRC_DIR}")}"
-UPSTREAM_SERIES="$(printf '%s' "${UPSTREAM_VERSION}" | sed -E 's/^([0-9]+\.[0-9]+).*/\1/')"
-PACKAGE_VERSION="${UPSTREAM_SERIES}+git${GIT_SHA}-${PACKAGE_RELEASE}"
+PACKAGE_VERSION="${UPSTREAM_VERSION}+r${UPSTREAM_COMMIT_COUNT}.${GIT_SHA}-${PACKAGE_RELEASE}"
 OUTPUT_DEB="${DIST_DIR}/${PACKAGE_NAME}_${PACKAGE_VERSION}_${PACKAGE_ARCH}.deb"
 
 meson setup "${BUILD_DIR}" "${SRC_DIR}" \
@@ -156,6 +156,11 @@ cat > "${DIST_DIR}/package-info.env" <<EOF
 PACKAGE_NAME=${PACKAGE_NAME}
 PACKAGE_VERSION=${PACKAGE_VERSION}
 PACKAGE_FILE=$(basename "${OUTPUT_DEB}")
+PACKAGE_ARCH=${PACKAGE_ARCH}
+UPSTREAM_COMMIT_COUNT=${UPSTREAM_COMMIT_COUNT}
+APT_SUITE=${APT_SUITE:-stable}
+APT_COMPONENT=${APT_COMPONENT:-main}
+APT_PUBLIC_BASE_URL=${APT_PUBLIC_BASE_URL:-}
 UPSTREAM_GIT_URL=${UPSTREAM_GIT_URL}
 UPSTREAM_GIT_REF=${UPSTREAM_REF}
 UPSTREAM_GIT_SHA=${GIT_SHA_FULL}

scripts/generate-apt-repo.sh

@@ -4,10 +4,16 @@ set -euo pipefail
 
 SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 ROOT_DIR=$(cd -- "${SCRIPT_DIR}/.." && pwd)
+CONFIG_FILE="${ROOT_DIR}/config/mesa-opt.conf"
 DIST_DIR="${ROOT_DIR}/dist"
 APT_DIR="${DIST_DIR}/aptrepo"
 DIST_ENV="${DIST_DIR}/package-info.env"
 
+if [[ -f "${CONFIG_FILE}" ]]; then
+  # shellcheck disable=SC1090
+  source "${CONFIG_FILE}"
+fi
+
 if [[ ! -f "${DIST_ENV}" ]]; then
   echo "missing dist metadata: ${DIST_ENV}" >&2
   exit 1
@@ -87,3 +93,11 @@ append_checksum_block() {
 append_checksum_block "MD5Sum" md5sum
 append_checksum_block "SHA256" sha256sum
 append_checksum_block "SHA512" sha512sum
+
+if [[ -n "${APT_PUBLIC_BASE_URL:-}" ]]; then
+  printf 'deb [trusted=yes] %s %s %s\n' \
+    "${APT_PUBLIC_BASE_URL%/}" \
+    "${APT_SUITE}" \
+    "${APT_COMPONENT}" \
+    > "${APT_DIR}/${PACKAGE_NAME}-${APT_SUITE}.list"
+fi

scripts/generate-release-notes.sh

@@ -51,13 +51,14 @@ import sys
 releases = json.loads(sys.argv[1])
 current_tag = sys.argv[2]
 package_name = sys.argv[3]
-pattern = re.compile(rf"^{re.escape(package_name)}-.*\+git([0-9a-f]{{12}})-")
+tag_prefix = f"{package_name}-"
+pattern = re.compile(r"([0-9a-f]{7,40})-\d+$")
 
 for release in releases:
     tag = release.get("tag_name", "")
-    if tag == current_tag:
+    if tag == current_tag or not tag.startswith(tag_prefix):
         continue
-    match = pattern.match(tag)
+    match = pattern.search(tag)
     if match:
         print(match.group(1))
         print(release.get("target_commitish", ""))

scripts/verify-apt-repo.sh

@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+ROOT_DIR=$(cd -- "${SCRIPT_DIR}/.." && pwd)
+CONFIG_FILE="${ROOT_DIR}/config/mesa-opt.conf"
+DIST_DIR="${ROOT_DIR}/dist"
+APT_DIR="${DIST_DIR}/aptrepo"
+DIST_ENV="${DIST_DIR}/package-info.env"
+CHECK_REMOTE=0
+
+usage() {
+  cat <<'EOF'
+Usage: verify-apt-repo.sh [--remote]
+
+Checks that the generated apt repository is internally consistent.
+With --remote, also verifies that the configured public HTTP base URL serves
+the Release file, Packages index, and referenced package anonymously.
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --remote)
+      CHECK_REMOTE=1
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "unknown argument: $1" >&2
+      usage >&2
+      exit 1
+      ;;
+  esac
+done
+
+if [[ -f "${CONFIG_FILE}" ]]; then
+  # shellcheck disable=SC1090
+  source "${CONFIG_FILE}"
+fi
+
+if [[ ! -f "${DIST_ENV}" ]]; then
+  echo "missing dist metadata: ${DIST_ENV}" >&2
+  exit 1
+fi
+
+# shellcheck disable=SC1090
+source "${DIST_ENV}"
+
+APT_SUITE="${APT_SUITE:-stable}"
+APT_COMPONENT="${APT_COMPONENT:-main}"
+APT_ARCH="${APT_ARCH:-${PACKAGE_ARCH:-amd64}}"
+PACKAGES_FILE="${APT_DIR}/dists/${APT_SUITE}/${APT_COMPONENT}/binary-${APT_ARCH}/Packages"
+RELEASE_FILE="${APT_DIR}/dists/${APT_SUITE}/Release"
+
+require_cmd() {
+  local cmd
+  for cmd in "$@"; do
+    command -v "${cmd}" >/dev/null 2>&1 || {
+      echo "missing command: ${cmd}" >&2
+      exit 1
+    }
+  done
+}
+
+require_cmd awk curl grep gzip
+
+[[ -f "${RELEASE_FILE}" ]] || {
+  echo "missing Release file: ${RELEASE_FILE}" >&2
+  exit 1
+}
+
+[[ -f "${PACKAGES_FILE}" ]] || {
+  echo "missing Packages file: ${PACKAGES_FILE}" >&2
+  exit 1
+}
+
+[[ -f "${PACKAGES_FILE}.gz" ]] || {
+  echo "missing Packages.gz file: ${PACKAGES_FILE}.gz" >&2
+  exit 1
+}
+
+PACKAGE_RELATIVE_PATH="$(awk -F': ' '$1=="Filename" { print $2; exit }' "${PACKAGES_FILE}")"
+[[ -n "${PACKAGE_RELATIVE_PATH}" ]] || {
+  echo "missing Filename entry in ${PACKAGES_FILE}" >&2
+  exit 1
+}
+
+[[ -f "${APT_DIR}/${PACKAGE_RELATIVE_PATH}" ]] || {
+  echo "referenced package is missing: ${APT_DIR}/${PACKAGE_RELATIVE_PATH}" >&2
+  exit 1
+}
+
+grep -q " ${APT_COMPONENT}/binary-${APT_ARCH}/Packages\$" "${RELEASE_FILE}" || {
+  echo "Release file does not reference Packages index" >&2
+  exit 1
+}
+
+grep -q " ${APT_COMPONENT}/binary-${APT_ARCH}/Packages.gz\$" "${RELEASE_FILE}" || {
+  echo "Release file does not reference Packages.gz index" >&2
+  exit 1
+}
+
+gzip -t "${PACKAGES_FILE}.gz"
+echo "local apt repository structure looks valid"
+
+if [[ "${CHECK_REMOTE}" -eq 0 ]]; then
+  exit 0
+fi
+
+if [[ -z "${APT_PUBLIC_BASE_URL:-}" ]]; then
+  echo "APT_PUBLIC_BASE_URL is empty; skipping remote verification"
+  exit 0
+fi
+
+BASE_URL="${APT_PUBLIC_BASE_URL%/}"
+RELEASE_URL="${BASE_URL}/dists/${APT_SUITE}/Release"
+PACKAGES_URL="${BASE_URL}/dists/${APT_SUITE}/${APT_COMPONENT}/binary-${APT_ARCH}/Packages"
+PACKAGE_URL="${BASE_URL}/${PACKAGE_RELATIVE_PATH}"
+
+curl -fsSL "${RELEASE_URL}" >/dev/null
+curl -fsSL "${PACKAGES_URL}" >/dev/null
+curl -fsSLI "${PACKAGE_URL}" >/dev/null
+
+echo "remote apt repository is reachable anonymously via ${BASE_URL}"