first commit

2026-09-29 13:37:57 +02:00
commit 093e6a7c14
@@ -0,0 +1,35 @@
+#!/bin/sh
+set -eu
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo "Run as root" >&2
+    exit 1
+fi
+
+BUILDER_USER="${1:-builder}"
+BUILDER_GROUP="$BUILDER_USER"
+
+ASSUME_ALWAYS_YES=yes pkg bootstrap -f
+pkg update
+pkg install -y git rust python3 pkgconf cmake gmake perl5 rsync
+
+if ! pw groupshow "$BUILDER_GROUP" >/dev/null 2>&1; then
+    pw groupadd "$BUILDER_GROUP"
+fi
+if ! pw usershow "$BUILDER_USER" >/dev/null 2>&1; then
+    pw useradd "$BUILDER_USER" -g "$BUILDER_GROUP" -m -s /bin/sh -c "RustProxy package builder"
+fi
+
+install -d -o "$BUILDER_USER" -g "$BUILDER_GROUP" -m 0755 /usr/local/rustproxy-build
+install -d -o "$BUILDER_USER" -g "$BUILDER_GROUP" -m 0700 /usr/local/rustproxy-build/keys
+
+echo "FreeBSD builder dependencies installed."
+echo "Builder account: $BUILDER_USER"
+echo "Add its SSH public key to /home/$BUILDER_USER/.ssh/authorized_keys."
+echo "Then log in as $BUILDER_USER and create the repository signing key."
+rust_version="$(rustc --version | awk '{print $2}')"
+if [ "$(pkg version -t "$rust_version" 1.88)" = "<" ]; then
+    echo "RustProxy requires Rust >= 1.88, found $rust_version" >&2
+    exit 1
+fi
+echo "Rust version OK: $rust_version"
@@ -0,0 +1,108 @@
+#!/bin/sh
+set -eu
+
+ROOT="${1:-$(pwd)}"
+APP_DIR="$ROOT/app"
+PLUGIN_SOURCE="$ROOT/opnsense-plugin/www/rustproxy"
+DIST_DIR="$ROOT/dist"
+CACHE_DIR="${RUSTPROXY_BUILD_CACHE:-$HOME/.cache/rustproxy-opnsense}"
+PLUGINS_DIR="$CACHE_DIR/opnsense-plugins"
+OPNSENSE_PLUGINS_REF="${OPNSENSE_PLUGINS_REF:-stable/26.7}"
+OPNSENSE_ABI="${OPNSENSE_ABI:-26.7}"
+SOURCE_REVISION="${SOURCE_REVISION:-0}"
+SOURCE_COMMIT="${RUSTPROXY_SOURCE_COMMIT:-unknown}"
+SOURCE_URL="${RUSTPROXY_SOURCE_URL:-https://git.linuxiarz.pl/gru/RustProxy}"
+SOURCE_REF="${RUSTPROXY_SOURCE_REF:-HEAD}"
+RUN_TESTS="${RUN_TESTS:-1}"
+
+if [ "$(uname -s)" != "FreeBSD" ]; then
+    echo "This release builder must run on FreeBSD." >&2
+    exit 1
+fi
+case "$(uname -m)" in
+    amd64|x86_64) ;;
+    *) echo "Only amd64/x86_64 is supported by this pipeline." >&2; exit 1 ;;
+esac
+
+for tool in cargo git make pkg rsync; do
+    command -v "$tool" >/dev/null 2>&1 || { echo "Missing tool: $tool" >&2; exit 1; }
+done
+
+rust_version="$(rustc --version | awk '{print $2}')"
+echo "Using rustc $rust_version on $(freebsd-version -ku | tr '\n' ' ')"
+
+app_version="$(awk -F '"' '/^version = "/ {print $2; exit}' "$APP_DIR/Cargo.toml")"
+if [ -z "$app_version" ]; then
+    echo "Cannot read app version from Cargo.toml" >&2
+    exit 1
+fi
+
+mkdir -p "$CACHE_DIR"
+if [ ! -d "$PLUGINS_DIR/.git" ]; then
+    git clone https://github.com/opnsense/plugins.git "$PLUGINS_DIR"
+fi
+git -C "$PLUGINS_DIR" fetch --prune origin "$OPNSENSE_PLUGINS_REF"
+git -C "$PLUGINS_DIR" checkout -f -B rustproxy-build FETCH_HEAD
+git -C "$PLUGINS_DIR" clean -ffd
+
+cd "$APP_DIR"
+if [ "$RUN_TESTS" = "1" ]; then
+    cargo test --locked --release
+fi
+cargo build --locked --release
+
+plugin_dir="$PLUGINS_DIR/www/rustproxy"
+rm -rf "$plugin_dir"
+cp -R "$PLUGIN_SOURCE" "$plugin_dir"
+mkdir -p "$plugin_dir/src/sbin"
+install -m 0555 "$APP_DIR/target/release/rust-proxy" "$plugin_dir/src/sbin/rust-proxy"
+
+cd "$plugin_dir"
+make PLUGIN_VERSION="$app_version" PLUGIN_REVISION="$SOURCE_REVISION" PLUGIN_ABI="$OPNSENSE_ABI" package
+
+package_file="$(find "$plugin_dir/work/pkg" -maxdepth 1 -type f -name 'os-rustproxy-*.pkg' | sort | tail -n 1)"
+if [ -z "$package_file" ] || [ ! -f "$package_file" ]; then
+    echo "Package was not produced." >&2
+    exit 1
+fi
+
+repo_dir="$DIST_DIR/repository/$OPNSENSE_ABI/amd64"
+rm -rf "$DIST_DIR"
+mkdir -p "$repo_dir"
+cp "$package_file" "$repo_dir/"
+
+if [ -n "${PKG_REPO_SIGN_KEY:-}" ]; then
+    if [ ! -r "$PKG_REPO_SIGN_KEY" ]; then
+        echo "Repository signing key is not readable: $PKG_REPO_SIGN_KEY" >&2
+        exit 1
+    fi
+    pkg repo "$repo_dir" "$PKG_REPO_SIGN_KEY"
+else
+    echo "WARNING: creating unsigned development repository" >&2
+    pkg repo "$repo_dir"
+fi
+
+if [ -n "${PKG_REPO_PUBLIC_KEY:-}" ]; then
+    if [ ! -r "$PKG_REPO_PUBLIC_KEY" ]; then
+        echo "Repository public key is not readable: $PKG_REPO_PUBLIC_KEY" >&2
+        exit 1
+    fi
+    cp "$PKG_REPO_PUBLIC_KEY" "$DIST_DIR/rustproxy-repo.pub"
+fi
+
+cat > "$DIST_DIR/BUILD-INFO.txt" <<INFO
+app_version=$app_version
+plugin_revision=$SOURCE_REVISION
+source_url=$SOURCE_URL
+source_ref=$SOURCE_REF
+source_commit=$SOURCE_COMMIT
+opnsense_plugins_ref=$OPNSENSE_PLUGINS_REF
+opnsense_abi=$OPNSENSE_ABI
+freebsd_kernel=$(freebsd-version -k)
+freebsd_userland=$(freebsd-version -u)
+rustc=$rust_version
+package=$(basename "$package_file")
+INFO
+
+sha256 "$repo_dir/$(basename "$package_file")" > "$DIST_DIR/SHA256"
+echo "Release artifacts created in $DIST_DIR"
@@ -0,0 +1,21 @@
+#!/bin/sh
+set -eu
+
+KEY_DIR="${1:-/usr/local/rustproxy-build/keys}"
+KEY="$KEY_DIR/rustproxy-repo.key"
+PUB="$KEY_DIR/rustproxy-repo.pub"
+
+umask 077
+mkdir -p "$KEY_DIR"
+if [ -e "$KEY" ] || [ -e "$PUB" ]; then
+    echo "Key already exists in $KEY_DIR" >&2
+    exit 1
+fi
+
+openssl genrsa -out "$KEY" 2048
+chmod 0400 "$KEY"
+openssl rsa -in "$KEY" -out "$PUB" -pubout
+chmod 0444 "$PUB"
+
+echo "Private key: $KEY"
+echo "Public key:  $PUB"