Merge branch 'deb-with-gbp' into 'main'

Create debian packages with gbp

See merge request mail/exim-encrypt-dlfunc!8

.gitlab-ci.yml

@@ -1,147 +1,167 @@
+---
+include:
+  - remote: 'https://git.scc.kit.edu/KIT-CERT/publish/-/raw/main/gitlab-ci/ssh-config.yml'
+  - remote: 'https://git.scc.kit.edu/KIT-CERT/publish/-/raw/main/gitlab-ci/build_image.yml'
+  - remote: 'https://git.scc.kit.edu/KIT-CERT/publish/-/raw/main/gitlab-ci/gbp-pkg.yml'
+
 stages:
-    - build
+  - build_image
-    - debian-package
+  - build_pkg
-    - prepare
+
-    - release
+variables:
+  BUILD_CONTEXT: ci_container
+  BUILD_FILE: Dockerfile
+  IMAGE_NAME: pkg_build-exim-encrypt-dlfunc/bullseye
+  TARGET_REPOSITORY: "bullseye"
+
 
 .image-buster:
-    image: '${CONTAINER_REGISTRY_NAME}/exim-encrypt-dlfunc-build-buster'
+  variables:
+    IMAGE_NAME: pkg_build-exim-encrypt-dlfunc/buster
+    BUILD_FILE: Dockerfile.buster
+    TARGET_REPOSITORY: "buster"
 
-.image-bullseye:
+.image-jammy:
-    image: '${CONTAINER_REGISTRY_NAME}/exim-encrypt-dlfunc-build-bullseye'
+  variables:
+    IMAGE_NAME: pkg_build-exim-encrypt-dlfunc/jammy
+    TARGET_REPOSITORY: "jammy"
+    BUILD_FILE: Dockerfile.jammy
 
 .image-focal:
-    image: '${CONTAINER_REGISTRY_NAME}/exim-encrypt-dlfunc-build-focal'
+  variables:
+    IMAGE_NAME: pkg_build-exim-encrypt-dlfunc/focal
+    TARGET_REPOSITORY: "focal"
+    BUILD_FILE: Dockerfile.focal
 
-.code-coverage:
+build_pkg_image_buster:
-    stage: build
+  extends:
-    script:
+    - .image-buster
-        - "export PATH=/usr/local/sbin:/usr/local/bin:${PATH}"
+    - build_pkg_image
-        - meson build -Db_coverage=true
-        - cd build
-        - ninja
-        - ninja test
-        - ninja coverage-xml
-        - grep -Eo 'line-rate="[^"]+"' meson-logs/coverage.xml | head -n 1 |
-            grep -Eo '[0-9.]+' | awk '{ printf "coverage\x3a %.2f%% of statements\n", $1 * 100 }'
-        - ninja coverage-html
-        - mv meson-logs/coveragereport ../coverage
-    artifacts:
-        paths:
-            - coverage/
-        reports:
-            cobertura: build/meson-logs/coverage.xml
 
-.build:
+build_pkg_image_jammy:
-    stage: build
+  extends:
-    script:
+    - .image-jammy
-        - which meson
+    - build_pkg_image
-        - meson build
-        - cd build
-        - ninja
-        - ninja test
-    artifacts:
-        paths:
-            - build/src/libexim-encrypt-dlfunc.so
-            - build/src/libexim-encrypt-dlfunc-genkeys
-            - build/src/libexim-encrypt-dlfunc-decrypt-secretbox
-            - build/src/libexim-encrypt-dlfunc-decrypt-sealedbox
 
-.debian-package:
+build_pkg_image_focal:
-    stage: debian-package
+  extends:
-    script:
+    - .image-focal
-        - mkdir ~/.gnupg; chown root:root ~/.gnupg; chmod 700 ~/.gnupg
+    - build_pkg_image
-        - eval $(gpg-agent --batch --sh --disable-scdaemon)
-        - echo "pinentry-mode loopback" > ~/.gnupg/gpg.conf
-        - echo "allow-loopback-pinentry" > ~/.gnupg/gpg-agent.conf
-        - gpg-connect-agent /bye
-        - echo $DEBIAN_SIGNING_KEY_ASC | base64 -d | gpg --batch --import --always-trust --yes
-        - echo "1DC7C2770DC111723D505DD61614D5CDEE1555A7:6:" | gpg --import-ownertrust
-        - dpkg-buildpackage --sign-key=1DC7C2770DC111723D505DD61614D5CDEE1555A7
-        - mv -t . ../*.deb ../*.dsc ../*.tar.gz ../*.changes ../*.buildinfo
-    artifacts:
-        paths:
-            - ./*.deb
-            - ./*.dsc
-            - ./*.tar.gz
-            - ./*.changes
-            - ./*.buildinfo
 
-code-coverage:
+pkg_buster:
-    extends:
+  extends:
-        - .image-bullseye
+    - .image-buster
-        - .code-coverage
+    - gbp_pkg
-    needs: [ ]
 
-build:bullseye:
+pkg_focal:
-    extends:
+  extends:
-        - .image-bullseye
+    - .image-focal
-        - .build
+    - gbp_pkg
-        - .code-coverage
-    needs: [ ]
 
-build:focal:
+pkg_jammy:
-    extends:
+  extends:
-        - .image-focal
+    - .image-jammy
-        - .build
+    - gbp_pkg
-    needs: [ ]
 
-build:buster:
+#.code-coverage:
-    extends:
+#    stage: build
-        - .build
+#    script:
-        - .image-buster
+#        - "export PATH=/usr/local/sbin:/usr/local/bin:${PATH}"
-    needs: [ ]
+#        - meson build -Db_coverage=true
-
+#        - cd build
-debian-package:bullseye:
+#        - ninja
-    extends:
+#        - ninja test
-        - .image-bullseye
+#        - ninja coverage-xml
-        - .debian-package
+#        - grep -Eo 'line-rate="[^"]+"' meson-logs/coverage.xml | head -n 1 |
-    dependencies:
+#            grep -Eo '[0-9.]+' | awk '{ printf "coverage\x3a %.2f%% of statements\n", $1 * 100 }'
-        - build:bullseye
+#        - ninja coverage-html
-    needs: [ "build:bullseye" ]
+#        - mv meson-logs/coveragereport ../coverage
-
+#    artifacts:
-debian-package:focal:
+#        paths:
-    extends:
+#            - coverage/
-        - .image-focal
+#        reports:
-        - .debian-package
+#            cobertura: build/meson-logs/coverage.xml
-    dependencies:
+#
-        - build:focal
+#.build:
-    needs: [ "build:focal" ]
+#    stage: build
-
+#    script:
-debian-package:buster:
+#        - which meson
-    extends:
+#        - meson build
-        - .image-buster
+#        - cd build
-        - .debian-package
+#        - ninja
-    dependencies:
+#        - ninja test
-        - build:buster
+#    artifacts:
-    needs: [ "build:buster" ]
+#        paths:
-
+#            - build/src/libexim-encrypt-dlfunc.so
-prepare_job:
+#            - build/src/libexim-encrypt-dlfunc-genkeys
-  stage: prepare                                              # This stage must run before the release stage
+#            - build/src/libexim-encrypt-dlfunc-decrypt-secretbox
-  rules:
+#            - build/src/libexim-encrypt-dlfunc-decrypt-sealedbox
-    - if: $CI_COMMIT_TAG
+#
-      when: never                                             # Do not run this job when a tag is created manually
+#.debian-package:
-#    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH             # Run this job when commits are pushed or merged to the default branch
+#    stage: debian-package
-  script:
+#    script:
-    - echo "TAG=v$(cat VERSION)" >> variables.env             # and append to the variables.env file
+#        - mkdir ~/.gnupg; chown root:root ~/.gnupg; chmod 700 ~/.gnupg
-  artifacts:
+#        - eval $(gpg-agent --batch --sh --disable-scdaemon)
-    reports:
+#        - echo "pinentry-mode loopback" > ~/.gnupg/gpg.conf
-      dotenv: variables.env                                   # Use artifacts:reports:dotenv to expose the variables to other jobs
+#        - echo "allow-loopback-pinentry" > ~/.gnupg/gpg-agent.conf
-
+#        - gpg-connect-agent /bye
-release_job:
+#        - echo $DEBIAN_SIGNING_KEY_ASC | base64 -d | gpg --batch --import --always-trust --yes
-  stage: release
+#        - echo "1DC7C2770DC111723D505DD61614D5CDEE1555A7:6:" | gpg --import-ownertrust
-  image: registry.gitlab.com/gitlab-org/release-cli:latest
+#        - dpkg-buildpackage --sign-key=1DC7C2770DC111723D505DD61614D5CDEE1555A7
-  needs:
+#        - mv -t . ../*.deb ../*.dsc ../*.tar.gz ../*.changes ../*.buildinfo
-    - job: prepare_job
+#    artifacts:
-      artifacts: true
+#        paths:
-  rules:
+#            - ./*.deb
-    - if: $CI_COMMIT_TAG
+#            - ./*.dsc
-      when: never
+#            - ./*.tar.gz
-#    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+#            - ./*.changes
-  script:
+#            - ./*.buildinfo
-    - echo "running release_job for $TAG"
+#
-  release:
+#code-coverage:
-    name: 'Release $CI_COMMIT_TAG'
+#    extends:
-    description: 'Created using the release-cli'
+#        - .image-bullseye
-    tag_name: '$CI_COMMIT_TAG'
+#        - .code-coverage
-    ref: '$CI_COMMIT_TAG'
+#    needs: [ ]
+#
+#build:bullseye:
+#    extends:
+#        - .image-bullseye
+#        - .build
+#        - .code-coverage
+#    needs: [ ]
+#
+#build:focal:
+#    extends:
+#        - .image-focal
+#        - .build
+#    needs: [ ]
+#
+#build:buster:
+#    extends:
+#        - .build
+#        - .image-buster
+#    needs: [ ]
+#
+#debian-package:bullseye:
+#    extends:
+#        - .image-bullseye
+#        - .debian-package
+#    dependencies:
+#        - build:bullseye
+#    needs: [ "build:bullseye" ]
+#
+#debian-package:focal:
+#    extends:
+#        - .image-focal
+#        - .debian-package
+#    dependencies:
+#        - build:focal
+#    needs: [ "build:focal" ]
+#
+#debian-package:buster:
+#    extends:
+#        - .image-buster
+#        - .debian-package
+#    dependencies:
+#        - build:buster
+#    needs: [ "build:buster" ]

ci_container/Dockerfile

@@ -18,18 +18,17 @@ RUN apt-get update; \
         openssl \
         pkg-config \
         python3-pip \
-        libxml2-utils; \
+        libxml2-utils \
-    DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install --no-install-recommends -y \
         debhelper \
         debsigs \
         devscripts \
         dh-make \
         git-buildpackage \
         gpgv1 \
-        meson; \
+        meson \
-    DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install --no-install-recommends -y \
         less \
         mc \
+        rsync \
         openssh-client \
         vim; \
     DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get clean; \

ci_container/Dockerfile.buster

@@ -0,0 +1,40 @@
+FROM debian:latest
+
+LABEL org.opencontainers.image.created=${BUILDTIMESTAMP} \
+      org.opencontainers.image.authors="Heiko Reese <reese@kit.edu>" \
+      org.opencontainers.image.title="exim build container" \
+      org.opencontainers.image.description="A buld environment for exim-encrypt-dlfunc" \
+      org.opencontainers.image.source="https://git.scc.kit.edu/mail/exim-encrypt-dlfunc/" \
+      org.opencontainers.image.licenses="Apache-2.0"
+
+RUN apt-get update; \
+    DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install --no-install-recommends -y \
+        build-essential \
+        exim4-daemon-heavy \
+        exim4-dev \
+        gcovr \
+        git \
+        libsodium-dev \
+        openssl \
+        pkg-config \
+        python3-pip \
+        libxml2-utils \
+        debhelper \
+        debsigs \
+        devscripts \
+        dh-make \
+        git-buildpackage \
+        gpgv1 \
+        meson \
+        less \
+        mc \
+        rsync \
+        openssh-client \
+        vim; \
+    DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get clean; \
+    rm -rf /var/lib/apt/lists/*;
+
+RUN pip3 install --upgrade meson ninja; \
+    rm -rf ~/.cache/pip/*;
+
+WORKDIR /mnt/

ci_container/Dockerfile.focal

@@ -0,0 +1,41 @@
+FROM docker.io/library/ubuntu:focal
+
+LABEL org.opencontainers.image.created=${BUILDTIMESTAMP} \
+      org.opencontainers.image.authors="Heiko Reese <reese@kit.edu>" \
+      org.opencontainers.image.title="exim build container" \
+      org.opencontainers.image.description="A buld environment for exim-encrypt-dlfunc" \
+      org.opencontainers.image.source="https://git.scc.kit.edu/mail/exim-encrypt-dlfunc/" \
+      org.opencontainers.image.licenses="Apache-2.0"
+
+
+RUN apt-get update; \
+    DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install --no-install-recommends -y \
+        build-essential \
+        exim4-daemon-heavy \
+        exim4-dev \
+        gcovr \
+        git \
+        libsodium-dev \
+        openssl \
+        pkg-config \
+        python3-pip \
+        libxml2-utils \
+        debhelper \
+        debsigs \
+        devscripts \
+        dh-make \
+        git-buildpackage \
+        gpgv1 \
+        meson \
+        less \
+        mc \
+		rsync \
+        openssh-client \
+        vim; \
+    DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get clean; \
+    rm -rf /var/lib/apt/lists/*;
+
+RUN pip3 install --upgrade meson ninja; \
+    rm -rf ~/.cache/pip/*;
+
+WORKDIR /mnt/

ci_container/Dockerfile.jammy

@@ -0,0 +1,41 @@
+FROM docker.io/library/ubuntu:jammy
+
+LABEL org.opencontainers.image.created=${BUILDTIMESTAMP} \
+      org.opencontainers.image.authors="Heiko Reese <reese@kit.edu>" \
+      org.opencontainers.image.title="exim build container" \
+      org.opencontainers.image.description="A buld environment for exim-encrypt-dlfunc" \
+      org.opencontainers.image.source="https://git.scc.kit.edu/mail/exim-encrypt-dlfunc/" \
+      org.opencontainers.image.licenses="Apache-2.0"
+
+
+RUN apt-get update; \
+    DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install --no-install-recommends -y \
+        build-essential \
+        exim4-daemon-heavy \
+        exim4-dev \
+        gcovr \
+        git \
+        libsodium-dev \
+        openssl \
+        pkg-config \
+        python3-pip \
+        libxml2-utils \
+        debhelper \
+        debsigs \
+        devscripts \
+        dh-make \
+        git-buildpackage \
+        gpgv1 \
+        meson \
+        less \
+        mc \
+		rsync \
+        openssh-client \
+        vim; \
+    DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get clean; \
+    rm -rf /var/lib/apt/lists/*;
+
+RUN pip3 install --upgrade meson ninja; \
+    rm -rf ~/.cache/pip/*;
+
+WORKDIR /mnt/

debian/rules

@@ -17,7 +17,6 @@ export DEB_BUILD_MAINT_OPTIONS = hardening=+all
 %:
 	dh $@
 
-
 # dh_make generated override targets
 # This is example for Cmake (See https://bugs.debian.org/641051 )
 #override_dh_auto_configure: