Signed xbps release pipeline #29

New Issue

2026-11-05T17:00:48Z

xavierk commented

2026-11-05 17:00:48 +00:00

Parent

Spec: Voculinux — Void Linux (glibc) Wayland/niri port of Vocalinux

What to build

Releasing Voculinux becomes a tag push. A dedicated workflow runs on the existing version-tag form (the tag must match the version source of truth), builds the packages with the Void source tooling inside the pinned Void glibc container, indexes and signs the repository and each package, and attaches packages, signatures, and the complete signed x86_64 repository data to the release, because the repository URL serves the newest release's downloads. Signing uses the single RSA 4096 repository key supplied only as a CI secret; when the secret is absent the workflow fails and publishes nothing. The README gains the repository registration lines, the key fingerprint, the install command, and Void's third-party-repository caveat. The post-release template version and checksum bump is documented as a normal pull request, never a bot commit to the main branch. Because creating a real key and pushing a real tag are human acts, this ticket proves signing locally in the container with a throwaway key; it does not itself cut a release.

Acceptance criteria

Offline policy tests pin the workflow shape: tag-to-version gate, pinned container, build, index, sign, full signed repository data attached, and hard failure when the signing secret is unset.
A local podman run of the build-and-sign path with a throwaway key produces repository data that verifies against that key's fingerprint in a clean container.
README installation instructions register the repository, show the fingerprint to pin, install the package, and carry the third-party-repository caveat.
No workflow step builds or uploads any asset by hand, publishes anything unsigned, or commits directly to the main branch; the template-bump pull-request step is documented in the release process.
Only glibc x86_64 repository data is produced; no musl or other-architecture data appears.

Blocked by

## Parent [Spec: Voculinux — Void Linux (glibc) Wayland/niri port of Vocalinux](https://git.bongbetic.com/xavierk/voculinux/issues/16) ## What to build Releasing Voculinux becomes a tag push. A dedicated workflow runs on the existing version-tag form (the tag must match the version source of truth), builds the packages with the Void source tooling inside the pinned Void glibc container, indexes and signs the repository and each package, and attaches packages, signatures, and the complete signed x86_64 repository data to the release, because the repository URL serves the newest release's downloads. Signing uses the single RSA 4096 repository key supplied only as a CI secret; when the secret is absent the workflow fails and publishes nothing. The README gains the repository registration lines, the key fingerprint, the install command, and Void's third-party-repository caveat. The post-release template version and checksum bump is documented as a normal pull request, never a bot commit to the main branch. Because creating a real key and pushing a real tag are human acts, this ticket proves signing locally in the container with a throwaway key; it does not itself cut a release. ## Acceptance criteria - [ ] Offline policy tests pin the workflow shape: tag-to-version gate, pinned container, build, index, sign, full signed repository data attached, and hard failure when the signing secret is unset. - [ ] A local podman run of the build-and-sign path with a throwaway key produces repository data that verifies against that key's fingerprint in a clean container. - [ ] README installation instructions register the repository, show the fingerprint to pin, install the package, and carry the third-party-repository caveat. - [ ] No workflow step builds or uploads any asset by hand, publishes anything unsigned, or commits directly to the main branch; the template-bump pull-request step is documented in the release process. - [ ] Only glibc x86_64 repository data is produced; no musl or other-architecture data appears. ## Blocked by - [Void app template for voculinux](https://git.bongbetic.com/xavierk/voculinux/issues/27) - [Void package smoke gate](https://git.bongbetic.com/xavierk/voculinux/issues/28)

xavierk added the ready-for-agent label 2026-11-05 17:00:48 +00:00

xavierk commented

2026-11-06 04:16:01 +00:00

Merged in integration/spec16 1dd3986383 pushed to fork/integration/spec16 (https://github.com/soubarnak/vocalinux/tree/integration/spec16), review PASS, gates flake8 E9,F63,F7,F82 + black --check + isort --check + mypy src/ clean, pytest 37 passed, npm jest 11 suites/92 tests + lint 0 errors + tsc clean + build OK

Merged in integration/spec16 1dd398638312a3b6e27793d856662e60df73f252 pushed to fork/integration/spec16 (https://github.com/soubarnak/vocalinux/tree/integration/spec16), review PASS, gates flake8 E9,F63,F7,F82 + black --check + isort --check + mypy src/ clean, pytest 37 passed, npm jest 11 suites/92 tests + lint 0 errors + tsc clean + build OK

xavierk closed this issue

2026-11-06 04:16:01 +00:00

xavierk referenced this issue from a commit

2026-11-06 11:06:39 +00:00

Improve installation scripts with better platform detection, dependency management, and error handling (#29)

xavierk referenced this issue from a commit

2026-11-06 11:06:41 +00:00

fix(web): honest fork-status notes on install paths, soften xbps claim

xavierk referenced this issue from a commit

2026-11-06 11:06:41 +00:00

feat(void): add signed xbps repository pipeline

xavierk referenced this issue from a commit