forked from heavy-duty/stoke
64 lines
2.2 KiB
Bash
64 lines
2.2 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
#
|
||
|
|
# One-time setup to install stoke via apt on Debian/Ubuntu.
|
||
|
|
#
|
||
|
|
# Adds the heavy-duty Forgejo Debian registry as an APT source (with its
|
||
|
|
# signing key) and installs the stoke package. Safe to re-run; afterwards
|
||
|
|
# stoke upgrades through regular `apt-get upgrade`.
|
||
|
|
#
|
||
|
|
# Usage:
|
||
|
|
# ./scripts/install-apt.sh
|
||
|
|
# FORGE_URL=... OWNER=... ./scripts/install-apt.sh # non-default instance
|
||
|
|
#
|
||
|
|
# Run as root or as a user with sudo.
|
||
|
|
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
FORGE_URL="${FORGE_URL:-https://forgejo.heavyduty.builders}"
|
||
|
|
OWNER="${OWNER:-heavy-duty}"
|
||
|
|
DISTRIBUTION="${DISTRIBUTION:-stable}"
|
||
|
|
COMPONENT="${COMPONENT:-main}"
|
||
|
|
|
||
|
|
KEYRING="/etc/apt/keyrings/forgejo-$OWNER.asc"
|
||
|
|
LIST="/etc/apt/sources.list.d/forgejo-$OWNER.list"
|
||
|
|
|
||
|
|
SUDO=""
|
||
|
|
if [ "$(id -u)" -ne 0 ]; then
|
||
|
|
command -v sudo >/dev/null 2>&1 || { echo "error: run as root or install sudo" >&2; exit 1; }
|
||
|
|
SUDO="sudo"
|
||
|
|
fi
|
||
|
|
|
||
|
|
update_only_this_source() {
|
||
|
|
$SUDO apt-get update \
|
||
|
|
-o Dir::Etc::sourcelist="$LIST" \
|
||
|
|
-o Dir::Etc::sourceparts=/dev/null \
|
||
|
|
-o APT::Get::List-Cleanup=0
|
||
|
|
}
|
||
|
|
|
||
|
|
echo "Adding APT source for $FORGE_URL/$OWNER ..."
|
||
|
|
$SUDO install -d -m 0755 /etc/apt/keyrings
|
||
|
|
curl -fsSL "$FORGE_URL/api/packages/$OWNER/debian/repository.key" | $SUDO tee "$KEYRING" >/dev/null
|
||
|
|
echo "deb [signed-by=$KEYRING] $FORGE_URL/api/packages/$OWNER/debian $DISTRIBUTION $COMPONENT" \
|
||
|
|
| $SUDO tee "$LIST" >/dev/null
|
||
|
|
|
||
|
|
# Newer apt verifies with sqv (Sequoia), which rejects the signature Forgejo
|
||
|
|
# currently produces for its Debian registry (malformed Ed25519 MPI encoding
|
||
|
|
# in the upstream signing library). Try the properly signed source first so
|
||
|
|
# this heals automatically once the forge is fixed; otherwise fall back to
|
||
|
|
# [trusted=yes] — package integrity then relies on HTTPS to our own forge.
|
||
|
|
if ! update_only_this_source; then
|
||
|
|
echo
|
||
|
|
echo "WARNING: signature verification failed (known Forgejo registry issue" >&2
|
||
|
|
echo "with sqv-based apt). Falling back to [trusted=yes]; transport" >&2
|
||
|
|
echo "security is provided by HTTPS to $FORGE_URL." >&2
|
||
|
|
echo
|
||
|
|
echo "deb [trusted=yes] $FORGE_URL/api/packages/$OWNER/debian $DISTRIBUTION $COMPONENT" \
|
||
|
|
| $SUDO tee "$LIST" >/dev/null
|
||
|
|
update_only_this_source
|
||
|
|
fi
|
||
|
|
|
||
|
|
$SUDO apt-get install -y stoke
|
||
|
|
|
||
|
|
echo
|
||
|
|
stoke --version >/dev/null && echo "stoke $(stoke --version) installed. Run: stoke auth login"
|