name: Build Packages # Builds the seven Slackware .txz packages defined under packages/ # (podman, conmon, crun, netavark, aardvark-dns, passt, fuse-overlayfs) # inside a Slackware container, verifies + consolidates their checksums, and # uploads the result as a workflow artifact. # # Intentionally does NOT commit any built binary back to the repository — # packages/**, *.txz, dist/ are all git-ignored (see .gitignore). Artifacts # only ever leave this workflow via the "Upload build artifacts" step below # (retained by GitHub Actions, not the repo) or, for tagged releases, via # release.yml attaching them to a GitHub Release. # # See docs/ARCHITECTURE.md section 5 (Paketmanagement). on: push: branches: [main] paths: - "packages/**" - "versions.env" - "scripts/**" - ".github/workflows/build-packages.yml" pull_request: paths: - "packages/**" - "versions.env" - "scripts/**" - ".github/workflows/build-packages.yml" workflow_dispatch: inputs: packages: description: > Space-separated package names to build (default: all seven). Example: "podman conmon" required: false default: "" workflow_call: outputs: artifact-name: description: "Name of the uploaded dist/ artifact" value: ${{ jobs.build.outputs.artifact-name }} # Pin the Slackware build image by tag here. vbatts/slackware is a # long-standing, widely used Slackware Docker image; swap this (and ideally # pin by digest) if the project standardizes on a different/self-hosted # base image. See scripts/ci/setup-slackware-buildenv.sh for how missing # build dependencies are bootstrapped on top of whatever this image ships. # # vbatts/slackware:15.0 ships tar but NOT git (needed by actions/checkout), # nor any of the shared libraries git's HTTPS transport needs. The # "Install git" step below uses slackpkg (already present and pre- # configured with a mirror in this image) rather than hand-picking package # files: git's HTTPS support pulls in nghttp2/brotli/cyrus-sasl, and # hand-pinning those separately from the base 15.0 release directory (as # an earlier version of this step did) silently drifted out of sync with # the newer, patched curl that scripts/ci/setup-slackware-buildenv.sh # installs later in the same container — same library, two different # builds, resulting in a symbol lookup error at runtime. Letting slackpkg # resolve everything from the same prioritized repo set (patches over # main, see /etc/slackpkg/slackpkg.conf's PRIORITY) keeps every package on # this image on a mutually consistent version set. # # actions/checkout and actions/upload-artifact are both Node-based actions # — Gitea Actions execs their JS bundle with the "node" binary found # inside the job's own container, it does not inject a runtime of its # own. Slackware has no nodejs package at all (checked: not in any of the # main/extra/pasture/testing repos), so the "Install git" step also # installs a pinned, checksum-verified Node.js release directly from # nodejs.org — the same style already used for Go/Rust in # scripts/ci/setup-slackware-buildenv.sh. env: SLACKWARE_IMAGE: "vbatts/slackware:15.0" NODE_VERSION: "20.20.2" NODE_SHA256: "df770b2a6f130ed8627c9782c988fda9669fa23898329a61a871e32f965e007d" jobs: build: name: Build .txz packages runs-on: ubuntu-latest container: image: ${{ env.SLACKWARE_IMAGE }} outputs: artifact-name: ${{ steps.artifact-name.outputs.value }} steps: - name: Install git and Node.js (needed before actions/checkout can run) run: | set -eu command -v tar > /dev/null || (echo "!! base image is missing tar — see SLACKWARE_IMAGE in this workflow" && exit 1) # CHECKGPG is turned off: slackpkg's default GPG-key bootstrap # fetches Slackware's signing key from www.slackware.com, which # is not reachable from every CI network (observed to hang on # this project's self-hosted Gitea Actions runner). CHECKMD5 # (on by default) still verifies every package against the # mirror's own CHECKSUMS.md5 as a transit-integrity check. sed -i 's/^CHECKGPG=on/CHECKGPG=off/' /etc/slackpkg/slackpkg.conf slackpkg -batch=on -default_answer=y update # git and curl's HTTPS transport need nghttp2/brotli/cyrus-sasl at # runtime, but slackpkg does not resolve shared-library # dependencies (Slackware packages carry no such metadata) — list # them explicitly so they come from the same slackpkg pass (and # therefore the same mutually-consistent build) as git itself. slackpkg -batch=on -default_answer=y install \ git ca-certificates nghttp2 brotli cyrus-sasl # ca-certificates ships individual certs under # /usr/share/ca-certificates/ — this builds the combined bundle # git (and later, curl) need to actually trust HTTPS remotes. update-ca-certificates echo "GIT_SSL_CAINFO=/etc/ssl/certs/ca-certificates.crt" >> "$GITHUB_ENV" echo "CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt" >> "$GITHUB_ENV" git --version # curl isn't installed until scripts/ci/setup-slackware-buildenv.sh # runs, later — use wget (present in the base image) here instead. # wget does not consult the system CA bundle on its own (unlike # curl/git, which respect CURL_CA_BUNDLE/GIT_SSL_CAINFO), so pass # it explicitly via --ca-certificate. node_tarball="node-v${NODE_VERSION}-linux-x64.tar.xz" wget -q --tries=3 --ca-certificate=/etc/ssl/certs/ca-certificates.crt \ -O "/tmp/$node_tarball" "https://nodejs.org/dist/v${NODE_VERSION}/$node_tarball" echo "${NODE_SHA256} /tmp/$node_tarball" | sha256sum -c - mkdir -p /usr/local/lib/nodejs tar -xf "/tmp/$node_tarball" -C /usr/local/lib/nodejs echo "/usr/local/lib/nodejs/node-v${NODE_VERSION}-linux-x64/bin" >> "$GITHUB_PATH" "/usr/local/lib/nodejs/node-v${NODE_VERSION}-linux-x64/bin/node" --version - uses: actions/checkout@v4 - name: Set up Slackware build environment run: scripts/ci/setup-slackware-buildenv.sh - name: Build packages run: scripts/build-packages.sh ${{ github.event.inputs.packages }} - name: Verify and consolidate checksums run: scripts/checksums.sh - name: Compute artifact name id: artifact-name run: echo "value=podman-packages-${{ github.sha }}" >> "$GITHUB_OUTPUT" - name: Upload build artifacts uses: actions/upload-artifact@v4 with: name: ${{ steps.artifact-name.outputs.value }} path: | dist/*.txz dist/*.sha256 dist/*.md5 dist/CHECKSUMS.sha256 dist/CHECKSUMS.md5 if-no-files-found: error retention-days: 14