Allow downloading all certificates of a UserID, so that users are able
to get to old ones and those used in parallel as well.

Signed-off-by: David Runge <dvzrv@archlinux.org>

David Runge authored 5 months ago and Christian Hesse committed 5 months ago

Add `build` target to .PHONY targets so that it is actually run when
only calling `make wkd`.

Fixes: #258


Signed-off-by: David Runge <dvzrv@archlinux.org>

David Runge authored 5 months ago and Christian Hesse committed 5 months ago

As sequoia-sq >= 0.38 breaks our use-case of exporting a keyring to a
WKD directory structure, we switch to the simpler `wkd-exporter`.

In addition to all `archlinux.org` User IDs, we now also export all
`master-key.archlinux.org` User IDs.

The `wkd-exporter` tool omits the creation of the `.well-known`
directory, as the dedicated `openpgp` directory in it is the relevant
bit. Therefore we adjust (the use of) `WKD_BUILD_DIR` accordingly.

Signed-off-by: David Runge <dvzrv@archlinux.org>

As sq 0.33.0 moved the `sq wkd` command to `sq network wkd` we have to
adapt the Makefile to be able to create the WKD output directory.

Signed-off-by: David Runge <dvzrv@archlinux.org>

This allows creating a tag and accompanying GitLab release by running
```shell
make release RELEASE=<VERSION>
```

This will automatically rebuild artifacts, check if `glab` is setup
using an auth token, create a signed git tag, push it and afterwards
create an accompanying GitLab release, with signed assets attached.

Fixes archlinux/archlinux-keyring#231



Signed-off-by: David Runge <dvzrv@archlinux.org>

Leonidas Spyropoulos authored 2 years ago and David Runge committed 2 years ago

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

Michel Lind authored 2 years ago and Christian Hesse committed 2 years ago

On Debian/Ubuntu the default shell is dash, and builds are done with
SHELL overridden to dash. Since archlinux-keyring now has Bash-isms in
the install and uninstall targets (for {} expansion), and rewriting it
to drop this is inconvenient (because we'll have to repeat the path
prefixes), hardcode the use of Bash instead.

Use /bin/bash to be compatible with distros that have not finished the
/bin -> /usr/bin migration yet.

Signed-off-by: Michel Alexandre Salim <michel@michel-slm.name>

Makefile:
Force symlinking of systemd unit for activation. If the service is
already installed and activated (symlinked) on the target system, a
non-forced symlink would fail otherwise.

Makefile:
Change the Makefile to build WKD dirs based on a given WKD_FQDN and add
them to WKD_BUILD_DIR.

wkd_sync/archlinux-keyring-wkd-sync.service.in:
Replace use of explicit script location (i.e. /usr/bin) with
SCRIPT_TARGET_DIR placeholder.

Makefile:
Create WKD sync service file from input file, replacing the
SCRIPT_TARGET_DIR placeholder with $SCRIPT_TARGET_DIR.

Makefile:
Change Makefile to allow installation of keyring data, systemd units and
scripts more configurable.
This allows user provided overrides via KEYRING_TARGET_DIR,
SCRIPT_TARGET_DIR, SYSTEMD_SYSTEM_UNIT_DIR.
Instead of relying on wildcards, rely on specifically named files, as
this can be reused also in the uninstall target without issue and
provides a clearer overview of what will be installed/uninstalled.
Specifically only make use of DESTDIR in the install and uninstall
targets, which allows easier overrides.
Extend uninstall target to also remove WKD sync related script and
systemd units.

Michel Lind authored 2 years ago and Christian Hesse committed 2 years ago

These are non-executables, they should be installed 644 rather than 755.

Signed-off-by: Michel Alexandre Salim <michel@michel-slm.name>

Makefile:
Extend install target to also install the WKD update script and the
systemd service and timer.
Vendor enable the systemd timer.

Declare the whole keyring data as well as the code as input dependency
for the build target. This way we can properly depend on the build
target for installation without forcing rebuilding on every invocation.

A rebuild will be triggered if either the keyring or the source code
creating the build output changes.

The directories are added to the source dependencies on purpose to
guarantee that changes like deleted files will result in a rebuild.

The mtime of the build directory is force updated on every run to allow
make to track the output artifacts mtime compared against the
dependencies.

David Runge authored 3 years ago and Levente Polyak committed 3 years ago

Makefile:
Fail coverage report below 100% test coverage.

David Runge authored 3 years ago and Levente Polyak committed 3 years ago

pyproject.toml:
Set specific source for `toolscoverage.paths` (as we only provide one
module).
Set `tools.coverage.run.relative_files` to true (although it is still
bug riddled and does not seem to work as advertized in regards to xml
output: https://github.com/nedbat/coveragepy/issues/963,
https://github.com/nedbat/coveragepy/issues/1147).
Set `tool.coverage.xml.output`, so we don't have to provide it on the
commandline.

Makefile:
Do not provide an output file to the coverage xml call, as we do that in
configuration now.

David Runge authored 3 years ago and Levente Polyak committed 3 years ago

Makefile:
Run pytest via coverage in `make test` to also generate a coverage
report.

This allows an easy to use cli which invokes the export function to get
the keyring and uses the ownertrust and revoke functions to write all
artifacts into a target directory.

This helps to structure the layout of the repository better by having
one root folder that contains the actual decomposed keyring structure.

David Runge authored 3 years ago and Levente Polyak committed 3 years ago

Makefile:
Remove soon unneeded targets for dist and upload.
Add lint and build targets.
Simplify the installation and uninstallation target.