ci: Build/sign RPMs for multiple Fedora versions

* Use `matrix` to generate pipelines for multiple Fedora versions
* Sign RPM packages using the Jenkins GPG key
* Publish RPM files to *dch* repository on *files.pyrocufflink.blue*
  instead of Gitea (the latter cannot handle multiple releases of the
  same package)

ci/Jenkinsfile

@@ -1,40 +1,81 @@
-// vim: set sw=4 ts=4 sts=4 et :
-
 pipeline {
-    agent {
-        kubernetes {
-            yamlFile 'ci/podTemplate.yaml'
-            defaultContainer 'build'
-        }
-    }
+    agent none
 
     stages {
-        stage('Build') {
-            steps {
-                sh 'make rpm'
-            }
-        }
+        stage('RPM') {
+            matrix {
+                axes {
+                    axis {
+                        name 'FEDORA'
+                        values '39', '40'
+                    }
+                }
 
-        stage('Publish') {
-            when {
-                branch 'main'
-            }
-            steps {
-                withCredentials([usernamePassword(
-                    credentialsId: 'jenkins-packages',
-                    usernameVariable: 'GITEA_USERNAME',
-                    passwordVariable: 'GITEA_PASSWORD',
-                )]) {
-                    sh 'make publish'
+                stages {
+                    stage('Build RPM') {
+                        agent {
+                            kubernetes {
+                                yamlFile 'ci/podTemplate.yaml'
+                                yamlMergeStrategy merge()
+                                defaultContainer 'fedora'
+                                containerTemplate {
+                                    name 'fedora'
+                                    image "registry.fedoraproject.org/fedora:${FEDORA}"
+                                }
+                            }
+                        }
+                        environment {
+                            GNUPGHOME = "${env.WORKSPACE_TMP}/gnupg"
+                        }
+                        stages {
+                            stage('Prepare') {
+                                steps {
+                                    sh '. ci/prepare.sh'
+                                }
+                            }
+
+                            stage('Build') {
+                                steps {
+                                    sh '. ci/build.sh'
+                                    script {
+                                        if (env.BRANCH_NAME == 'main') {
+                                            withCredentials([
+                                                file(
+                                                    credentialsId: 'rpm-gpg-key',
+                                                    variable: 'RPM_GPG_PRIVATE_KEY',
+                                                ),
+                                                file(
+                                                    credentialsId: 'rpm-gpg-key-passphrase',
+                                                    variable: 'RPM_GPG_KEY_PASSPHRASE',
+                                                ),
+                                            ]) {
+                                                sh '. ci/sign-rpms.sh'
+                                            }
+                                        }
+                                    }
+                                }
+                                post {
+                                    success {
+                                        archiveArtifacts '*.rpm'
+                                    }
+                                }
+                            }
+
+                            stage('Publish') {
+                                when {
+                                    branch 'main'
+                                }
+                                steps {
+                                    sshagent(['jenkins-repohost']) {
+                                        sh '. ci/publish.sh'
+                                    }
+                                }
+                            }
+                        }
+                    }
                 }
             }
         }
-    }
 
-    post {
-        success {
-            archiveArtifacts '*.rpm'
-        }
     }
-
 }

ci/build.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+make rpm

ci/podTemplate.yaml

@@ -1,7 +1,16 @@
 spec:
   containers:
-  - name: build
-    image: git.pyrocufflink.net/containerimages/build/selinux:main
-    imagePullPolicy: Always
-    securityPolicy:
-      runAsNonRoot: true
+  - name: fedora
+    command:
+    - cat
+    stdin: true
+    tty: true
+    volumeMounts:
+    - mountPath: /etc/ssh/ssh_known_hosts
+      name: ssh-known-hosts
+      subPath: ssh_known_hosts
+  hostUsers: false
+  volumes:
+  - name: ssh-known-hosts
+    configMap:
+      name: ssh-known-hosts

ci/prepare.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+dnf install -y \
+	--setopt install_weak_deps=0 \
+	make \
+	openssh-clients \
+	openssl-devel \
+	rpm-build \
+	rpm-sign \
+	rsync \
+    selinux-policy-devel \
+	tar \
+    xz \
+	--
+
+install -m u=rwx,go= -d "${GNUPGHOME}"
+cat > "${GNUPGHOME}"/gpg-agent.conf <<EOF
+allow-loopback-pinentry
+EOF

ci/publish.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+
+ARCH="$(uname -m)"
+REPO_HOST=jenkins@files.pyrocufflink.blue
+REPO_PATH=/srv/www/repohost/repos/dch/fedora/$(rpm --eval %fedora)
+
+ssh-add -l
+ssh-add -L
+
+case "${ARCH}" in
+x86_64)
+    # only include the SRPM once
+    include='*.rpm'
+    ;;
+*)
+    include="*.${ARCH}.rpm"
+    ;;
+esac
+
+rsync -rtiO \
+    --chmod=ugo=rwX \
+    --include "${include}" \
+    --exclude '*' \
+    ./ \
+    "${REPO_HOST}:${REPO_PATH}/"

ci/sign-rpms.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+
+gpg2 --pinentry-mode loopback --passphrase-fd 0 \
+    --import "${RPM_GPG_PRIVATE_KEY}" \
+    < "${RPM_GPG_KEY_PASSPHRASE}"
+
+rpmsign --addsign \
+    -D '_gpg_name jenkins@pyrocufflink.net' \
+    -D '_gpg_sign_cmd_extra_args --pinentry-mode loopback --passphrase-fd 3' \
+    *.rpm \
+    3< "${RPM_GPG_KEY_PASSPHRASE}"
+