rsyslog/rsyslog
1
0
Fork 0
mirror of https://github.com/rsyslog/rsyslog.git synced 2026-08-24 19:24:14 +02:00
Code Issues Packages Projects Releases Wiki Activity
rsyslog/.github/ALPINE_DAILY_STABLE.md
Rainer Gerhards bda383e37e packaging: add native ARM daily builds 
Why:
Daily stable archives need native ARM packages alongside x86 packages.

Impact:
All current daily package workflows build, publish, and install-test ARM.

Before:
The package archives contained only amd64 or x86_64 binaries.

After:
Archives contain native arm64 or aarch64 binaries with signed metadata.

Technical Overview:
Add native GitHub ARM runners to every current daily package matrix.
Publish both architectures in one serialized repository update.
Keep immutable snapshots separated by architecture.
Filter APT indexes by architecture and advertise both architectures.
Make EL Mock validation accept the requested RPM architecture.
Verify each published package in a matching native distro container.

With the help of AI-Agents: Codex
2026-07-30 16:17:14 +02:00

3.7 KiB
Raw Blame History

Alpine daily stable package archive

The alpine 3.24 daily stable workflow builds current rsyslog main for Alpine Linux 3.24 on x86_64 and aarch64. It starts with Alpine's official 3.24-stable main/rsyslog APKBUILD and replaces only the upstream source and daily version. This preserves Alpine's configure choices, dependencies, subpackage split, OpenRC integration, and default configuration. The only current policy addition is autoconf-archive, required by AX macros used by current upstream but not by Alpine's released 8.2604 source package.

Package construction does not run for pull requests. Manual dispatch remains available for bootstrap and recovery. The schedule is inactive until a manual publication and clean Alpine installation test pass.

Archive layout and retention

The repository URL ends in:

/apk/daily-stable/alpine/3.24

The architecture repositories are below that path:

x86_64/APKINDEX.tar.gz
x86_64/*.apk
aarch64/APKINDEX.tar.gz
aarch64/*.apk

Every publication also records its manifest, checksums, prepared APKBUILD, and build log below:

snapshots/YYYY-MM-DD/PACKAGE_VERSION/x86_64/
snapshots/YYYY-MM-DD/PACKAGE_VERSION/aarch64/

Each APK is built and installed on a native runner of the matching architecture.

APK files and snapshots are immutable and retained for at least five years. The workflow merges the previous signed index with each new package set so older daily versions remain installable. Only the small mutable APK index and public signing key request a 60-second metadata cache override. DigitalOcean's CDN currently enforces a one-hour minimum TTL, so consumers can see a newly published index up to one hour later. The ordered APK version contains the UTC date and GitHub run/attempt serial; the manifest records the exact rsyslog source commit.

Signing

Alpine repositories use an RSA signing key, independently of the OpenPGP key used by APT and RPM repositories. The protected debian-daily-stable GitHub Environment is reused as the security boundary for the shared package archive. Despite its legacy name, it is not limited to Debian packages.

Add this environment secret:

  • ALPINE_DAILY_STABLE_RSA_PRIVATE_KEY: PEM-encoded RSA private key used by abuild to sign APK packages and their APKINDEX.

Add this repository variable:

  • ALPINE324_DAILY_STABLE_ENABLED: true only after the first end-to-end publication succeeds.

The scheduled workflow fails preflight if this switch is missing or is not exactly true or false, so a configuration error cannot appear successful.

Add these variables to the debian-daily-stable environment:

  • ALPINE324_DAILY_STABLE_REPO_URL: public CDN URL ending in /apk/daily-stable/alpine/3.24.
  • ALPINE324_DAILY_STABLE_ORIGIN_REPO_URL: public Spaces origin URL ending in /apk/daily-stable/alpine/3.24.
  • ALPINE_DAILY_STABLE_RSA_PUBLIC_KEY_SHA256: SHA-256 of the PEM public key.

The existing shared Space bucket, endpoint, region, access key, and secret key remain unchanged. A DigitalOcean account API token is not required.

End-to-end activation

  1. Generate and store the Alpine RSA key and its public-key SHA-256.
  2. Run the workflow manually with publication disabled and inspect the APK artifacts.
  3. Run it manually with publication enabled.
  4. Confirm that the CDN key and index are reachable and that a clean native alpine:3.24 containers for both architectures trust the public origin key, install the exact daily rsyslog version, and pass rsyslogd -N1. Exact-version validation uses the origin because the CDN's minimum TTL can exceed CI runtime.
  5. Set ALPINE324_DAILY_STABLE_ENABLED=true.

The scheduled workflow opens or updates an issue if its build, publication, or installation verification fails.