ReactorcoremeltdownandClaude Opus 5.5
00409379cc
Verified on Debian 13 arm64 with Cinnamon: the .deb installs, the tray registers and renders its menu, and pull and push sync end to end. - Packages ship 0755 directories whatever the builder's umask, name the native changelog changelog.gz, and override lintian for the static binary and the 0640 server config; prerm uses deb-systemd-invoke. - The tray item is titled KeepOrg for StatusNotifierItem hosts. - Event log lines omit empty fields. - -reset-admin help no longer says to stop the server. Client 0.6.1 (Linux, macOS, Windows, BSD), server 0.12.1. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
123 lines
4.5 KiB
Bash
Executable File
123 lines
4.5 KiB
Bash
Executable File
#!/bin/sh
|
|
# Build one Debian package.
|
|
# build-deb.sh <client|server> <version> <arch> <output.deb>
|
|
set -eu
|
|
|
|
kind=$1
|
|
version=$2
|
|
arch=$3
|
|
out=$4
|
|
|
|
root=$(cd "$(dirname "$0")/.." && pwd)
|
|
stage=$root/build/deb-$kind-$arch
|
|
rm -rf "$stage"
|
|
|
|
case $kind in
|
|
client)
|
|
pkg=keeporg
|
|
binary=keeporg
|
|
mkdir -p "$stage/usr/bin" "$stage/usr/lib/systemd/user" \
|
|
"$stage/usr/share/applications" "$stage/usr/share/icons"
|
|
install -m 0755 "$root/build/linux-$arch/keeporg" "$stage/usr/bin/keeporg"
|
|
install -m 0644 "$root/packaging/systemd/keeporg.service" \
|
|
"$stage/usr/lib/systemd/user/keeporg.service"
|
|
# The tray application: a menu entry, and the icon it and the tray use.
|
|
install -m 0644 "$root/packaging/linux/keeporg.desktop" \
|
|
"$stage/usr/share/applications/keeporg.desktop"
|
|
cp -R "$root/build/icons/hicolor" "$stage/usr/share/icons/hicolor"
|
|
rm -f "$stage/usr/share/icons/hicolor/.stamp"
|
|
find "$stage/usr/share/icons" -type d -exec chmod 0755 {} + -o -type f -exec chmod 0644 {} +
|
|
;;
|
|
server)
|
|
pkg=keeporgd
|
|
binary=keeporgd
|
|
mkdir -p "$stage/usr/bin" "$stage/usr/lib/systemd/system" "$stage/etc/keeporg"
|
|
install -m 0755 "$root/build/linux-$arch/keeporgd" "$stage/usr/bin/keeporgd"
|
|
install -m 0644 "$root/packaging/systemd/keeporgd.service" \
|
|
"$stage/usr/lib/systemd/system/keeporgd.service"
|
|
"$root/build/linux-$arch/keeporgd" -write-config "$stage/etc/keeporg/server.json" >/dev/null
|
|
chmod 0640 "$stage/etc/keeporg/server.json"
|
|
;;
|
|
*)
|
|
echo "build-deb.sh: unknown package kind $kind" >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
|
|
mkdir -p "$stage/DEBIAN" "$stage/usr/share/doc/$pkg"
|
|
sed -e "s/@VERSION@/$version/" -e "s/@ARCH@/$arch/" \
|
|
"$root/packaging/deb/$kind/control.in" > "$stage/DEBIAN/control"
|
|
install -m 0644 "$root/packaging/deb/copyright" "$stage/usr/share/doc/$pkg/copyright"
|
|
# A version without a Debian revision is a native package, whose changelog
|
|
# Debian policy names changelog.gz rather than changelog.Debian.gz.
|
|
case $version in
|
|
*-*) changelog=changelog.Debian.gz ;;
|
|
*) changelog=changelog.gz ;;
|
|
esac
|
|
gzip -9nc "$root/packaging/deb/$kind/changelog" > "$stage/usr/share/doc/$pkg/$changelog"
|
|
chmod 0644 "$stage/usr/share/doc/$pkg/$changelog"
|
|
# Go links statically on purpose: one binary, no libc dependency.
|
|
mkdir -p "$stage/usr/share/lintian/overrides"
|
|
printf '%s: statically-linked-binary [usr/bin/%s]\n' "$pkg" "$binary" \
|
|
> "$stage/usr/share/lintian/overrides/$pkg"
|
|
if [ "$kind" = server ]; then
|
|
# The config may carry the OIDC client secret, so it is not world-readable.
|
|
echo "$pkg: non-standard-file-perm 0640 != 0644 [etc/keeporg/server.json]" \
|
|
>> "$stage/usr/share/lintian/overrides/$pkg"
|
|
fi
|
|
chmod 0644 "$stage/usr/share/lintian/overrides/$pkg"
|
|
|
|
if [ "$kind" = server ]; then
|
|
cat > "$stage/DEBIAN/conffiles" <<'CONF'
|
|
/etc/keeporg/server.json
|
|
CONF
|
|
cat > "$stage/DEBIAN/postinst" <<'POST'
|
|
#!/bin/sh
|
|
set -e
|
|
if [ "$1" = configure ]; then
|
|
if ! getent passwd keeporg >/dev/null; then
|
|
adduser --system --group --home /var/lib/keeporg \
|
|
--gecos "KeepOrg synchronization server" keeporg
|
|
fi
|
|
install -d -o keeporg -g keeporg -m 0700 /var/lib/keeporg
|
|
chgrp keeporg /etc/keeporg /etc/keeporg/server.json || true
|
|
chmod 0750 /etc/keeporg || true
|
|
chmod 0640 /etc/keeporg/server.json || true
|
|
# The service cannot write /etc (ProtectSystem=strict), and without its
|
|
# master key the server does not start, so the key is made here, once.
|
|
# It is never replaced: a new key opens nothing that is already stored.
|
|
if [ ! -e /etc/keeporg/master.key ]; then
|
|
(umask 077 && head -c 32 /dev/urandom | base64 > /etc/keeporg/master.key)
|
|
chgrp keeporg /etc/keeporg/master.key
|
|
chmod 0640 /etc/keeporg/master.key
|
|
fi
|
|
if [ -d /run/systemd/system ]; then
|
|
systemctl daemon-reload || true
|
|
echo "keeporgd: edit /etc/keeporg/server.json, then" \
|
|
"systemctl enable --now keeporgd" >&2
|
|
echo "keeporgd: the master key is /etc/keeporg/master.key; everything" \
|
|
"the server stores is encrypted under it. Back it up separately" \
|
|
"from the database: losing it loses the data" >&2
|
|
fi
|
|
fi
|
|
exit 0
|
|
POST
|
|
cat > "$stage/DEBIAN/prerm" <<'PRERM'
|
|
#!/bin/sh
|
|
set -e
|
|
if [ "$1" = remove ] && [ -d /run/systemd/system ]; then
|
|
deb-systemd-invoke stop keeporgd.service || true
|
|
fi
|
|
exit 0
|
|
PRERM
|
|
chmod 0755 "$stage/DEBIAN/postinst" "$stage/DEBIAN/prerm"
|
|
fi
|
|
|
|
# Whatever the builder's umask, packaged directories are 0755; postinst
|
|
# tightens /etc/keeporg itself.
|
|
find "$stage" -type d -exec chmod 0755 {} +
|
|
|
|
mkdir -p "$(dirname "$out")"
|
|
fakeroot dpkg-deb --root-owner-group --build "$stage" "$out" >/dev/null
|
|
printf 'built %s (%s %s %s)\n' "$out" "$binary" "$version" "$arch"
|