wip: build for multiple os versions

ci/Jenkinsfile

@@ -1,40 +1,86 @@
-// vim: set sw=4 ts=4 sts=4 et :
-
 pipeline {
-    agent {
+    agent none
-        kubernetes {
-            yamlFile 'ci/podTemplate.yaml'
-            defaultContainer 'build'
-        }
-    }
 
     stages {
-        stage('Build') {
+        stage('RPM') {
-            steps {
+            matrix {
-                sh 'make rpm'
+                axes {
-            }
+                    axis {
-        }
+                        name 'ARCH'
+                        values 'amd64', 'arm64'
+                    }
+                    axis {
+                        name 'FEDORA'
+                        values '39', '40'
+                    }
+                }
 
-        stage('Publish') {
+                stages {
-            when {
+                    stage('Build RPM') {
-                branch 'main'
+                        agent {
-            }
+                            kubernetes {
-            steps {
+                                yamlFile 'ci/podTemplate.yaml'
-                withCredentials([usernamePassword(
+                                yamlMergeStrategy merge()
-                    credentialsId: 'jenkins-packages',
+                                defaultContainer 'fedora'
-                    usernameVariable: 'GITEA_USERNAME',
+                                nodeSelector "kubernetes.io/arch=${ARCH}"
-                    passwordVariable: 'GITEA_PASSWORD',
+                                containerTemplate {
-                )]) {
+                                    name 'fedora'
-                    sh 'make publish'
+                                    image "registry.fedoraproject.org/fedora:${FEDORA}"
+                                }
+                            }
+                        }
+                        environment {
+                            GNUPGHOME = "${env.WORKSPACE_TMP}/gnupg"
+                        }
+                        stages {
+                            stage('Prepare') {
+                                steps {
+                                    sh '. ci/prepare.sh'
+                                }
+                            }
+
+                            stage('Build') {
+                                steps {
+                                    sh '. ci/build.sh'
+                                    script {
+                                        if (env.BRANCH_NAME == 'master') {
+                                            withCredentials([
+                                                file(
+                                                    credentialsId: 'rpm-gpg-key',
+                                                    variable: 'RPM_GPG_PRIVATE_KEY',
+                                                ),
+                                                file(
+                                                    credentialsId: 'rpm-gpg-key-passphrase',
+                                                    variable: 'RPM_GPG_KEY_PASSPHRASE',
+                                                ),
+                                            ]) {
+                                                sh '. ci/sign-rpms.sh'
+                                            }
+                                        }
+                                    }
+                                }
+                                post {
+                                    success {
+                                        archiveArtifacts '*.rpm'
+                                    }
+                                }
+                            }
+
+                            stage('Publish') {
+                                when {
+                                    branch 'master'
+                                }
+                                steps {
+                                    sshagent(['jenkins-repohost']) {
+                                        sh '. ci/publish.sh'
+                                    }
+                                }
+                            }
+                        }
+                    }
                 }
             }
         }
-    }
 
-    post {
-        success {
-            archiveArtifacts '*.rpm'
-        }
     }
-
 }

ci/build.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+make

ci/podTemplate.yaml

@@ -1,7 +1,16 @@
 spec:
   containers:
-  - name: build
+  - name: fedora
-    image: git.pyrocufflink.net/containerimages/build/selinux:main
+    command:
-    imagePullPolicy: Always
+    - cat
-    securityPolicy:
+    stdin: true
-      runAsNonRoot: true
+    tty: true
+    volumeMounts:
+    - mountPath: /etc/ssh/ssh_known_hosts
+      name: ssh-known-hosts
+      subPath: ssh_known_hosts
+  hostUsers: false
+  volumes:
+  - name: ssh-known-hosts
+    configMap:
+      name: ssh-known-hosts

ci/prepare.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+dnf install -y \
+	--setopt install_weak_deps=0 \
+	make \
+	openssh-clients \
+	openssl-devel \
+	rpm-build \
+	rpm-sign \
+	rsync \
+    selinux-policy-devel \
+	tar \
+    xz \
+	--
+
+install -m u=rwx,go= -d "${GNUPGHOME}"
+cat > "${GNUPGHOME}"/gpg-agent.conf <<EOF
+allow-loopback-pinentry
+EOF

ci/publish.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+
+ARCH="$(uname -m)"
+REPO_HOST=jenkins@files.pyrocufflink.blue
+REPO_PATH=/srv/www/repohost/repos/dch/fedora/$(rpm --eval %fedora)
+
+ssh-add -l
+ssh-add -L
+
+case "${ARCH}" in
+x86_64)
+    # only include the SRPM once
+    include='*.rpm'
+    ;;
+*)
+    include="*.${ARCH}.rpm"
+    ;;
+esac
+
+rsync -rtiO \
+    --chmod=ugo=rwX \
+    --include "${include}" \
+    --exclude '*' \
+    ./ \
+    "${REPO_HOST}:${REPO_PATH}/"