rsyslog/rsyslog
1
0
Fork 0
mirror of https://github.com/rsyslog/rsyslog.git synced 2026-08-24 19:24:14 +02:00
Code Issues Packages Projects Releases Wiki Activity
rsyslog/.github/DEBIAN_DAILY_STABLE.md
Rainer Gerhards bda383e37e packaging: add native ARM daily builds 
Why:
Daily stable archives need native ARM packages alongside x86 packages.

Impact:
All current daily package workflows build, publish, and install-test ARM.

Before:
The package archives contained only amd64 or x86_64 binaries.

After:
Archives contain native arm64 or aarch64 binaries with signed metadata.

Technical Overview:
Add native GitHub ARM runners to every current daily package matrix.
Publish both architectures in one serialized repository update.
Keep immutable snapshots separated by architecture.
Filter APT indexes by architecture and advertise both architectures.
Make EL Mock validation accept the requested RPM architecture.
Verify each published package in a matching native distro container.

With the help of AI-Agents: Codex
2026-07-30 16:17:14 +02:00

4.8 KiB
Raw Blame History

Debian daily stable package archive

The debian daily stable workflow builds current rsyslog main for Debian 13 (trixie) on amd64 and arm64. Package construction does not run for pull requests; the repository's workflow lint and security checks still validate workflow changes without consuming a full Debian package-build runner. Manual dispatch remains available for bootstrap and recovery. Scheduled publishing remains disabled until the DigitalOcean archive is provisioned.

The workflow owns package construction, APT metadata generation, signing, upload ordering, and post-publication installation verification. The verification job uses the public CDN from a clean Debian 13 container, installs the exact published version, and smoke-tests the installed binary and default configuration. DigitalOcean Spaces is passive S3-compatible storage behind its CDN; no package-building service runs there.

If a scheduled run fails or is cancelled, the workflow creates or updates the [debian-daily-stable] package archive failure issue with the run URL and each job result. Manual bootstrap runs report failures through their Actions run without opening this daily-operations issue.

Archive layout and retention

The initial repository URL ends in:

/apt/daily-stable/debian/13

This leaves room for later channels, Debian and Ubuntu versions, and RPM-based distributions. Debian packages and source artifacts use immutable paths below pool/. Every run also records its manifest, checksums, build information, and build log below:

snapshots/YYYY-MM-DD/PACKAGE_VERSION/amd64/
snapshots/YYYY-MM-DD/PACKAGE_VERSION/arm64/

Signed APT indexes are published under both binary-amd64/ and binary-arm64/. Each package is built and installed on a native runner of the matching architecture.

The APT indexes retain every published package version. The Space must not have a lifecycle rule that removes package-pool, by-hash, or snapshot objects before five years. Retention starts with the first successful publication; the workflow does not synthesize historical builds.

Only the small current Packages.xz and Sources.xz indexes are downloaded before a publication. They are merged with the new build, so daily Actions traffic does not grow with the full archive size. Immutable objects are uploaded first, signed mutable metadata last, and InRelease last of all.

DigitalOcean setup contract

Create one public-read Standard Spaces bucket with object versioning enabled. Give the workflow a bucket-scoped read/write Spaces key; do not give it a DigitalOcean account API token. Enable the Spaces CDN and route the final package hostname to it. The workflows set DigitalOcean's object metadata max-age override in addition to HTTP Cache-Control: 60 seconds for mutable repository metadata and one year for immutable package and snapshot objects. After first enabling that override, purge previously cached repository metadata once in the DigitalOcean control panel so old one-hour cache entries do not delay the first verification run.

Configure these GitHub repository variables:

  • DEBIAN_DAILY_STABLE_ENABLED: set to true only after a manual publication and installation test succeeds.
  • DEBIAN_DAILY_STABLE_SPACE_BUCKET: Space name.
  • DEBIAN_DAILY_STABLE_SPACE_ENDPOINT: regional S3 endpoint, for example https://fra1.digitaloceanspaces.com.
  • DEBIAN_DAILY_STABLE_SPACE_REGION: matching region, for example fra1.
  • DEBIAN_DAILY_STABLE_REPO_URL: public URL including /apt/daily-stable/debian/13.
  • DEBIAN_DAILY_STABLE_GPG_FINGERPRINT: full fingerprint of the archive signing key.

All daily-package schedule switches are repository variables. A scheduled workflow fails preflight, and therefore reports a failure issue, if its switch is missing or is not exactly true or false.

Create a protected debian-daily-stable GitHub Environment and add:

  • DEBIAN_DAILY_STABLE_SPACE_ACCESS_KEY
  • DEBIAN_DAILY_STABLE_SPACE_SECRET_KEY
  • DEBIAN_DAILY_STABLE_GPG_PRIVATE_KEY
  • DEBIAN_DAILY_STABLE_GPG_PASSPHRASE

The passphrase may be empty only if the archive key was intentionally created without one. Keep stable-release publishing in a separate environment when it is added later.

Activation

Before enabling the schedule:

  1. Run the workflow manually with publication disabled and review its package artifact.
  2. Provision the Space, CDN, DNS, signing key, variables, and secrets.
  3. Run it manually with publication enabled.
  4. Confirm that signed metadata verification, clean Debian 13 package installation, and installed-configuration smoke test all pass.
  5. Set DEBIAN_DAILY_STABLE_ENABLED to true.

There is deliberately no five-year GitHub Actions artifact retention. The short-lived Actions artifact transfers one build between jobs; DigitalOcean Spaces is the durable archive.