152 lines
5.6 KiB
Bash
Executable File
152 lines
5.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
OUT="$ROOT/packages"
|
|
IMAGE="${POSTFIXADMIN_RS_DEB_IMAGE:-debian:12-slim}"
|
|
TOOLCHAIN="$(sed -n 's/^channel[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p' "$ROOT/rust-toolchain.toml" | head -n1)"
|
|
|
|
command -v docker >/dev/null 2>&1 || { echo "error: docker is required" >&2; exit 1; }
|
|
[ -n "$TOOLCHAIN" ] || { echo "error: cannot read Rust toolchain" >&2; exit 1; }
|
|
mkdir -p "$OUT"
|
|
|
|
printf 'Building Debian package with %s / Rust %s\n' "$IMAGE" "$TOOLCHAIN"
|
|
printf 'Output: %s\n' "$OUT"
|
|
|
|
docker run --rm \
|
|
-e DEBIAN_FRONTEND=noninteractive \
|
|
-e RUSTUP_HOME=/opt/rustup \
|
|
-e CARGO_HOME=/opt/cargo \
|
|
-e POSTFIXADMIN_RS_TOOLCHAIN="$TOOLCHAIN" \
|
|
-v "$ROOT:/src:ro" \
|
|
-v "$OUT:/packages" \
|
|
-v postfixadmin-rs-cargo-registry:/opt/cargo/registry \
|
|
-v postfixadmin-rs-cargo-git:/opt/cargo/git \
|
|
-v postfixadmin-rs-rustup:/opt/rustup \
|
|
"$IMAGE" bash -euxo pipefail -c '
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends ca-certificates curl build-essential pkg-config libssl-dev dpkg-dev python3
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
if [ ! -x /opt/cargo/bin/rustup ]; then
|
|
curl --proto "=https" --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path --profile minimal
|
|
fi
|
|
export PATH="/opt/cargo/bin:$PATH"
|
|
rustup toolchain install "$POSTFIXADMIN_RS_TOOLCHAIN" --profile minimal
|
|
rustup default "$POSTFIXADMIN_RS_TOOLCHAIN"
|
|
rustup component add rustfmt clippy --toolchain "$POSTFIXADMIN_RS_TOOLCHAIN"
|
|
|
|
rm -rf /work/postfixadmin-rs /work/pkg
|
|
mkdir -p /work/postfixadmin-rs
|
|
cp -a /src/. /work/postfixadmin-rs/
|
|
cd /work/postfixadmin-rs
|
|
|
|
python3 ./scripts/validate-release-static.py
|
|
cargo generate-lockfile
|
|
cargo fmt --all
|
|
cargo fmt --all -- --check
|
|
cargo test
|
|
cargo clippy --all-targets -- -D warnings
|
|
cargo build --release
|
|
|
|
VERSION="$(sed -n "s/^version[[:space:]]*=[[:space:]]*\"\([^\"]*\)\".*/\1/p" Cargo.toml | head -n1)"
|
|
DEB_VERSION="${VERSION/-dev/~dev}"
|
|
ARCH="$(dpkg --print-architecture)"
|
|
PKG=/work/pkg
|
|
|
|
install -d "$PKG/DEBIAN" "$PKG/usr/bin" "$PKG/etc/postfixadmin-rs" "$PKG/etc/default" "$PKG/lib/systemd/system" "$PKG/usr/share/doc/postfixadmin-rs"
|
|
install -m 0755 target/release/postfixadmin-rs "$PKG/usr/bin/postfixadmin-rs"
|
|
install -m 0640 config.example.toml "$PKG/etc/postfixadmin-rs/config.toml"
|
|
install -m 0644 packaging/postfixadmin-rs.default "$PKG/etc/default/postfixadmin-rs"
|
|
install -m 0644 packaging/postfixadmin-rs.service "$PKG/lib/systemd/system/postfixadmin-rs.service"
|
|
install -m 0644 README.md SECURITY.md COMPATIBILITY.md PORT-PARITY.md "$PKG/usr/share/doc/postfixadmin-rs/"
|
|
|
|
cat > "$PKG/DEBIAN/control" <<CONTROL
|
|
Package: postfixadmin-rs
|
|
Version: $DEB_VERSION
|
|
Section: admin
|
|
Priority: optional
|
|
Architecture: $ARCH
|
|
Maintainer: local build <root@localhost>
|
|
Depends: adduser, libc6 (>= 2.36), libgcc-s1, libssl3, ca-certificates
|
|
Description: Rust web administration panel for Postfix virtual mail data
|
|
PostfixAdmin-RS is a Rust administration panel compatible with PostfixAdmin
|
|
database layouts. This is a development package built locally.
|
|
CONTROL
|
|
|
|
cat > "$PKG/DEBIAN/conffiles" <<CONFFILES
|
|
/etc/postfixadmin-rs/config.toml
|
|
/etc/default/postfixadmin-rs
|
|
CONFFILES
|
|
|
|
cat > "$PKG/DEBIAN/postinst" <<'POSTINST'
|
|
#!/bin/sh
|
|
set -e
|
|
|
|
# Dedicated unprivileged runtime identity. Preserve an existing account if present.
|
|
if ! getent group postfixadmin >/dev/null 2>&1; then
|
|
addgroup --system postfixadmin >/dev/null
|
|
fi
|
|
if ! getent passwd postfixadmin >/dev/null 2>&1; then
|
|
adduser --system \
|
|
--ingroup postfixadmin \
|
|
--home /var/lib/postfixadmin-rs \
|
|
--no-create-home \
|
|
--disabled-login \
|
|
--shell /usr/sbin/nologin \
|
|
postfixadmin >/dev/null
|
|
fi
|
|
|
|
# Runtime/state directory is writable by the service account.
|
|
install -d -o postfixadmin -g postfixadmin -m 0750 /var/lib/postfixadmin-rs
|
|
|
|
# Configuration stays root-owned: the service can read secrets but cannot edit them.
|
|
install -d -o root -g postfixadmin -m 0750 /etc/postfixadmin-rs
|
|
if [ -f /etc/postfixadmin-rs/config.toml ]; then
|
|
chown root:postfixadmin /etc/postfixadmin-rs/config.toml
|
|
chmod 0640 /etc/postfixadmin-rs/config.toml
|
|
fi
|
|
if [ -f /etc/default/postfixadmin-rs ]; then
|
|
chown root:postfixadmin /etc/default/postfixadmin-rs
|
|
chmod 0640 /etc/default/postfixadmin-rs
|
|
fi
|
|
|
|
if command -v systemctl >/dev/null 2>&1; then
|
|
systemctl daemon-reload || true
|
|
fi
|
|
printf "%s\\n" "PostfixAdmin-RS installed. Configure /etc/postfixadmin-rs/config.toml, then run: systemctl enable --now postfixadmin-rs"
|
|
exit 0
|
|
POSTINST
|
|
chmod 0755 "$PKG/DEBIAN/postinst"
|
|
|
|
cat > "$PKG/DEBIAN/prerm" <<'PRERM'
|
|
#!/bin/sh
|
|
set -e
|
|
if [ "${1:-}" = remove ] && command -v systemctl >/dev/null 2>&1; then
|
|
systemctl stop postfixadmin-rs.service >/dev/null 2>&1 || true
|
|
fi
|
|
exit 0
|
|
PRERM
|
|
chmod 0755 "$PKG/DEBIAN/prerm"
|
|
|
|
cat > "$PKG/DEBIAN/postrm" <<'POSTRM'
|
|
#!/bin/sh
|
|
set -e
|
|
if command -v systemctl >/dev/null 2>&1; then
|
|
systemctl daemon-reload >/dev/null 2>&1 || true
|
|
fi
|
|
exit 0
|
|
POSTRM
|
|
chmod 0755 "$PKG/DEBIAN/postrm"
|
|
|
|
grep -qx "User=postfixadmin" "$PKG/lib/systemd/system/postfixadmin-rs.service"
|
|
grep -qx "Group=postfixadmin" "$PKG/lib/systemd/system/postfixadmin-rs.service"
|
|
test -f "$PKG/etc/postfixadmin-rs/config.toml"
|
|
|
|
dpkg-deb --root-owner-group --build "$PKG" "/packages/postfixadmin-rs_${DEB_VERSION}_${ARCH}.deb"
|
|
sha256sum "/packages/postfixadmin-rs_${DEB_VERSION}_${ARCH}.deb" > "/packages/postfixadmin-rs_${DEB_VERSION}_${ARCH}.deb.sha256"
|
|
'
|
|
|
|
printf '\nPackages created:\n'
|
|
find "$OUT" -maxdepth 1 -type f -name 'postfixadmin-rs_*.deb*' -printf ' %f\n' | sort
|