wip: build for multiple os versions

ci/Jenkinsfile

@@ -1,40 +1,81 @@
-// vim: set sw=4 ts=4 sts=4 et :
-
 pipeline {
-    agent {
-        kubernetes {
-            yamlFile 'ci/podTemplate.yaml'
-            defaultContainer 'build'
+    agent none
+
+    stages {
+        stage('RPM') {
+            matrix {
+                axes {
+                    axis {
+                        name 'FEDORA'
+                        values '39', '40'
                     }
                 }
 
                 stages {
+                    stage('Build RPM') {
+                        agent {
+                            kubernetes {
+                                yamlFile 'ci/podTemplate.yaml'
+                                yamlMergeStrategy merge()
+                                defaultContainer 'fedora'
+                                containerTemplate {
+                                    name 'fedora'
+                                    image "registry.fedoraproject.org/fedora:${FEDORA}"
+                                }
+                            }
+                        }
+                        environment {
+                            GNUPGHOME = "${env.WORKSPACE_TMP}/gnupg"
+                        }
+                        stages {
+                            stage('Prepare') {
+                                steps {
+                                    sh '. ci/prepare.sh'
+                                }
+                            }
+
                             stage('Build') {
                                 steps {
-                sh 'make rpm'
-            }
-        }
-
-        stage('Publish') {
-            when {
-                branch 'main'
-            }
-            steps {
-                withCredentials([usernamePassword(
-                    credentialsId: 'jenkins-packages',
-                    usernameVariable: 'GITEA_USERNAME',
-                    passwordVariable: 'GITEA_PASSWORD',
-                )]) {
-                    sh 'make publish'
+                                    sh '. ci/build.sh'
+                                    script {
+                                        if (env.BRANCH_NAME == 'master') {
+                                            withCredentials([
+                                                file(
+                                                    credentialsId: 'rpm-gpg-key',
+                                                    variable: 'RPM_GPG_PRIVATE_KEY',
+                                                ),
+                                                file(
+                                                    credentialsId: 'rpm-gpg-key-passphrase',
+                                                    variable: 'RPM_GPG_KEY_PASSPHRASE',
+                                                ),
+                                            ]) {
+                                                sh '. ci/sign-rpms.sh'
                                             }
                                         }
                                     }
                                 }
-
                                 post {
                                     success {
                                         archiveArtifacts '*.rpm'
                                     }
                                 }
+                            }
+
+                            stage('Publish') {
+                                when {
+                                    branch 'master'
+                                }
+                                steps {
+                                    sshagent(['jenkins-repohost']) {
+                                        sh '. ci/publish.sh'
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
 
     }
+}

ci/build.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+make rpm

ci/podTemplate.yaml

@@ -1,7 +1,16 @@
 spec:
   containers:
-  - name: build
-    image: git.pyrocufflink.net/containerimages/build/selinux:main
-    imagePullPolicy: Always
-    securityPolicy:
-      runAsNonRoot: true
+  - name: fedora
+    command:
+    - cat
+    stdin: true
+    tty: true
+    volumeMounts:
+    - mountPath: /etc/ssh/ssh_known_hosts
+      name: ssh-known-hosts
+      subPath: ssh_known_hosts
+  hostUsers: false
+  volumes:
+  - name: ssh-known-hosts
+    configMap:
+      name: ssh-known-hosts

ci/prepare.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+dnf install -y \
+	--setopt install_weak_deps=0 \
+	make \
+	openssh-clients \
+	openssl-devel \
+	rpm-build \
+	rpm-sign \
+	rsync \
+    selinux-policy-devel \
+	tar \
+    xz \
+	--
+
+install -m u=rwx,go= -d "${GNUPGHOME}"
+cat > "${GNUPGHOME}"/gpg-agent.conf <<EOF
+allow-loopback-pinentry
+EOF

ci/publish.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+
+ARCH="$(uname -m)"
+REPO_HOST=jenkins@files.pyrocufflink.blue
+REPO_PATH=/srv/www/repohost/repos/dch/fedora/$(rpm --eval %fedora)
+
+ssh-add -l
+ssh-add -L
+
+case "${ARCH}" in
+x86_64)
+    # only include the SRPM once
+    include='*.rpm'
+    ;;
+*)
+    include="*.${ARCH}.rpm"
+    ;;
+esac
+
+rsync -rtiO \
+    --chmod=ugo=rwX \
+    --include "${include}" \
+    --exclude '*' \
+    ./ \
+    "${REPO_HOST}:${REPO_PATH}/"