feat(packaging): nfpm-based deb + rpm build infrastructure (spec §3-7, ADR 0007)

Implement the packaging configuration, staging script, maintainer scripts, and container test harness for building native deb and rpm packages. Core files: - packaging/nfpm.yaml: single source of truth for both formats - packaging/stage.sh: builds staged tree (venv, wrapper, helpers, units, polkit, sysusers, tmpfiles) - packaging/fenris.conf: placeholder-commented default configuration - packaging/postinst.sh, prerm.sh, postrm.sh: POSIX-compatible deb maintainer scripts - packaging/rpm/post.sh, preun.sh, postun.sh: RPM scriptlets - packaging/sysusers.d/fenris.conf, tmpfiles.d/fenris.conf: systemd fragments - packaging/fenris.repo: dnf consumer setup - packaging/keys/fenris-packaging.asc: public key placeholder Build targets added to Makefile: stage, package-deb, package-rpm, package, release, clean. Container test harness in tests/test_packaging.py covering dormant install, migration guard, upgrade semantics, and removal semantics across the compatibility matrix (Debian 12, Ubuntu 22.04/24.04, Fedora 40). Dormant CI workflow at .gitea/workflows/release.yml. All 289 existing tests pass without regression. Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
2026-09-03 02:36:08 +05:30
parent b005049733
commit babc8eeeb1
18 changed files with 1050 additions and 1 deletions
@@ -0,0 +1,59 @@
+#!/bin/sh
+# postinst — install and upgrade paths (spec §7).
+#
+# dpkg calls: postinst configure [most-recently-configured-version]
+#   fresh install: $1 = "configure"
+#   upgrade:       $1 = "configure"  (old version as $2 when available)
+#
+# rpm calls: %post $1 = 1 (fresh install) / 2 (upgrade)
+#   (handled by packaging/rpm/post.sh)
+#
+# Install:  sysusers, tmpfiles, daemon-reload — nothing else (dormant).
+# Upgrade:  snapshot, migration, daemon-reload, conditional timer restart.
+set -eu
+
+STORE_DIR="/var/lib/fenris"
+STORE_DB="${STORE_DIR}/observations.db"
+STORE_BAK="${STORE_DIR}/observations.db.bak"
+VENV_PYTHON="/opt/fenris/bin/python3"
+
+case "${1:-}" in
+    configure)
+        if [ -n "${2:-}" ]; then
+            # Upgrade — $2 is the old version
+            # Snapshot observation store (one generation)
+            if [ -f "${STORE_DB}" ]; then
+                cp "${STORE_DB}" "${STORE_BAK}" 2>/dev/null || true
+            fi
+
+            # Forward-only schema migration
+            if [ -x "${VENV_PYTHON}" ] && [ -f "${STORE_DB}" ]; then
+                "${VENV_PYTHON}" -c "
+from fenris.store import migrate_to_latest
+from pathlib import Path
+n = migrate_to_latest(Path('${STORE_DB}'))
+print(f'Fenris migration: {n} step(s) applied') if n else None
+" 2>&1 || echo "Fenris: migration skipped (store not yet initialized)"
+            fi
+
+            # Restart collect timer only if unit contents changed AND it is active
+            for unit in fenris-collect.timer fenris-collect.service; do
+                if systemctl is-active --quiet "${unit}" 2>/dev/null; then
+                    TMPFILE="$(mktemp)"
+                    systemctl cat "${unit}" > "${TMPFILE}" 2>/dev/null || true
+                    UNIT_PATH="/usr/lib/systemd/system/${unit}"
+                    if ! diff -q "${TMPFILE}" "${UNIT_PATH}" > /dev/null 2>&1; then
+                        systemctl restart "${unit}" 2>/dev/null || true
+                    fi
+                    rm -f "${TMPFILE}"
+                fi
+            done
+        fi
+        # Always run on both fresh install and upgrade
+        systemd-sysusers  || true
+        systemd-tmpfiles --create  || true
+        systemctl daemon-reload  || true
+        ;;
+    abort-upgrade|abort-install|disappear)
+        ;;
+esac