Repository navigation
Packaging: CPack TGZ/DEB/RPM with systemd service; CI assembly, verification, and release publishing - #511
Merged
Conversation
…n suite - Portable tarball with top-level wire-sysio/ (extract to /opt); versioned artifact via new package-tgz target - DEB/RPM install under /usr; base (runtime) + dev (headers/libs/testing) package pair for both formats - Packaged systemd unit (tools/packaging/systemd), tmpfiles.d state dirs, logrotate policy (5x1G copytruncate) for /var/log/wire/sysio - Debconf prompts (register / enable+start) with yes/yes noninteractive defaults; RPM scriptlets enable --now on fresh install; removal never deletes chain state or logs - Convert install() destinations to relative GNUInstallDirs paths; classify every install rule into base/dev components; drop broken plugin static-lib installs and the legacy spring_testing dev maintainer scripts - tools/packaging/tests: S1-S6 verification suite incl. systemd-in-container runtime service gate (self-bootstrapping test images) - docs/release-layout.md: release artifact file trees Change-Id: I2eb3ece33236621e326042b00b68817e36f9fff3
…flow - linux_amd64_build: cpack -G DEB smoke on all platforms; ubuntu24 assembles the full package set (base+dev deb/rpm + portable tgz) into a single wire-sysio-packages-amd64 artifact; new verify-packages job runs the packaging suite (S1-S6, incl. the systemd-in-container service-start gate) and gates all-passing; per-platform package artifact uploads removed - release workflow reactivated from noop/: on release publish it locates the tag build, guards tag/version consistency, re-verifies the artifacts, attaches the packages plus sha256 checksums to the release, and refreshes the wire-sysio-experimental-binaries ghcr image; actions SHA-pinned - tools/tweak-deb.sh -> tools/packaging/scripts/deb-postprocess.sh (git mv; callers updated: build workflow, tools/reproducible.Dockerfile) - dev-component testing-tree installs marked OPTIONAL so contracts-OFF CI builds package cleanly - BUILD.md: document the release flow Change-Id: Ic2f0ee003a32316d938b2937e9bf5603919a6513
Change-Id: I7eb0facdfc41777a4256c796a649c520c9bcd2d4
- docs/release-workflow.md: overview with mermaid activity and sequence diagrams - release.yaml: workflow_dispatch with a tag input, since release-published events always execute the default branch's workflow file and the verify/ attach path must be testable before this branch merges Change-Id: Ia5ef2d01775bdc265cd06257ba87bba07dc14595
GNU tar's --delete/--update cannot edit the pax-format control archives CPack emits (tar: Skipping to next header), which broke the Build packages CI step on every leg. Unpack, apply the same Installed-Size/libc6 tweaks, and repack with deterministic GNU-format metadata. Change-Id: I1a10d7a163e583f48062725ebbdff54a852e593b
…istry
The opp-bundles publish flow now ships the generated Solana Rust crate to
the CodeArtifact cargo registry (wire-pkg / wire-pkg-rust-private,
provisioned by wire-infra ArtifactManagementStack) alongside the existing
npm publishes, with the same invocation the workflow already uses:
`generate-opp-bundles.sh --publish`.
- protobuf-bundler: CARGO_PUBLISHABLE_TARGETS (solana) + publishCargoCrate
in handlePublish — `cargo publish --registry wire --allow-dirty
--no-verify` from the generated crate dir, duplicate-version tolerated so
npm/cargo publish skew self-heals on the next synchronized version.
- Generated Cargo.toml now carries license (LicenseRef-Wire-Proprietary),
repository, and `publish = ["wire"]` so the crate can never land on
crates.io by accident.
- generate-opp-bundles.sh: when --publish, verifies cargo >= 1.74 and the
AWS CLI are available, mints the CodeArtifact token from ambient AWS
credentials, and exports CARGO_REGISTRIES_WIRE_{INDEX,TOKEN,
CREDENTIAL_PROVIDER} for the bundler. Validate mode stays credential-free.
- opp-bundles.yaml: id-token: write + aws-actions/configure-aws-credentials
(pinned, v6.2.2) assuming wire-pkg-cargo-publisher, gated to
push/workflow_dispatch; the publish step invocation is unchanged.
First publish completed: wire-opp-solana-models v1.0.35 is live in
wire-pkg-rust-private (synchronized with the npm bundle version).
Co-Authored-By: Claude Fable 5 <[email protected]>
Change-Id: I6919d03b9ce88540934b6cd3b79abf84b4ac39f0
Consumers (wire-solana et al) read the crate anonymously via https://public.crates.pkgs.wire-dev.com — no AWS credentials required. Publishing is unchanged: the GitHub OIDC publisher role authenticates against the native CodeArtifact endpoint. Co-Authored-By: Claude Fable 5 <[email protected]> Change-Id: Ibcd739e40800154d7b3a30069aab9880deaaf919
Contributor
Author
|
@heifner @huangminghuang - I have to merge this in order to resolve #517 - I'll have a part 2 to this PR |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
wire-sysio/, extract to/opt), and/usr-prefixed system packages in two variants for both formats:wire-sysio(runtime) +wire-sysio-dev(headers/libs/testing, depends on exact base version).-e -p sysioretained), tmpfiles.d state dirs (/etc/wire/sysio,/var/lib/wire/sysio/data,/var/log/wire/sysio), logrotate policy (5x1G, copytruncate). DEB asks via debconf (register? enable+start?; noninteractive defaults yes/yes); RPM registers+enables+starts on fresh install. Removal/purge never deletes chain state or logs.tools/packaging/tests/(S1-S6): tarball layout, payload/control checks, containerized installs (ubuntu 24.04 + fedora), install-manifest regression, static lint, and a systemd-in-container runtime gate proving the service enables, starts, and stays up (self-bootstrapping test images).wire-sysio-packages-amd64artifact; newverify-packagesjob runs the suite on every build and gatesall-passing. Per-platform package artifacts removed.noop/: on release publish — locate the successful tag build, guard tag↔artifact version consistency, re-verify artifacts, attach packages + sha256 checksums, refresh the ghcrwire-sysio-experimental-binariesimage.docs/release-layout.md(artifact file trees) + BUILD.md packaging/release-flow sections.Verification evidence (local)
All gates green against real artifacts: S1-S5 plus S6 on both DEB (ubuntu 24.04) and RPM (fedora) systemd containers — nodeop live-producing blocks signed by
sysiowithin seconds ofapt install/dnf install.actionlint: zero new findings.Reviewer notes
verify-packagesuntil the companion appbase PR lands:libraries/appbaseneeds a 4-line install-destination fix (CMAKE_INSTALL_FULL_*→ relative) that cannot ship from this repo; a pristine appbase reintroduces/usr/localpaths into the dev rpm, which the fedora install gate correctly rejects. Draft until the appbase change merges and the gitlink bumps.v*-rc*pre-release.CMakeLists.txtVERSION_*(release workflow fails fast on tag/version mismatch).Companion PR
verify-packagesto go green (relative install destinations); thelibraries/appbasegitlink bump lands here once it merges.