github-starred/vikunja
2
0
Fork 0
mirror of https://github.com/go-vikunja/vikunja.git synced 2026-08-22 12:12:18 -05:00
Code Issues 690 Packages Projects Releases 13 Wiki Activity

[PR #2611] [MERGED] feat: add OS package repository publishing #8401

New Issue
Closed
opened 2026-04-20 18:11:48 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-20 18:11:48 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/go-vikunja/vikunja/pull/2611
Author: @tink-bot
Created: 4/12/2026
Status: ✅ Merged
Merged: 4/12/2026
Merged by: @kolaente

Base: main ← Head: feat-os-package-repos

📝 Commits (3)

  • a8288a5 feat: add Mage targets for OS package repository metadata
  • b0a7204 feat(ci): add publish-repos job for OS package repository metadata
  • 306604f refactor: update reprepro-dist-conf for multi-arch with stable and unstable suites

📊 Changes

3 files changed (+374 additions, -11 deletions)

View changed files

📝 .github/workflows/release.yml (+101 -2)
📝 build/reprepro-dist-conf (+12 -5)
📝 magefile.go (+261 -4)

📄 Description

Add proper repository metadata generation so users can install Vikunja via native package managers (apt install vikunja, dnf install vikunja, apk add vikunja, pacman -S vikunja) by adding dl.vikunja.io as a package source.

What this adds:

  • Four new Mage targets (release:repo-apt, release:repo-rpm, release:repo-apk, release:repo-pacman) that generate signed repository metadata using standard tools (dpkg-scanpackages, createrepo_c, apk index, repo-add)
  • A publish-repos CI job that runs after os-package and desktop jobs on tagged releases, generates metadata for all four formats across all architectures, and uploads to R2 under /repos/
  • Updated reprepro-dist-conf for multi-arch (amd64, arm64, armhf) with stable codename

Package files are not re-uploaded — the dl.vikunja.io Worker redirects package requests under /repos/ to existing artifact locations.

Setup required before first use

1. GPG signing (APT, RPM, Pacman)

The existing RELEASE_GPG_SIGN_KEY and RELEASE_GPG_PASSPHRASE secrets are reused. The GPG key ID 7D061A4AA61436B40713D42EFF054DACD908493A is hardcoded in the workflow for the --default-key and public key export steps. No new secrets needed for GPG.

2. APK signing key (Alpine)

Alpine uses RSA keys, not GPG. Two things are needed:

Generate the key pair (one-time):

openssl genrsa -out vikunja-apk.rsa 4096
openssl rsa -in vikunja-apk.rsa -pubout -out vikunja-apk.rsa.pub

Add the private key as a GitHub secret:

  • Secret name: APK_SIGNING_KEY
  • Value: contents of vikunja-apk.rsa

Upload the public key to R2:

  • Path: /repos/apk/vikunja-apk.rsa.pub
  • Contents: vikunja-apk.rsa.pub

This public key is what Alpine users download to verify packages.

3. Existing secrets used

The job reuses these existing secrets (no changes needed):

  • RELEASE_GPG_SIGN_KEY — GPG private key (armor-encoded)
  • RELEASE_GPG_PASSPHRASE — GPG key passphrase
  • S3_ACCESS_KEY, S3_SECRET_KEY, S3_ENDPOINT, S3_BUCKET, S3_REGION — R2 upload credentials

4. Worker redirect

The dl.vikunja.io Cloudflare Worker must redirect package file requests under /repos/ to existing artifact locations:

  • Server packages: /repos/*/vikunja-<ver>-<arch>.<ext> → /vikunja/<version>/<filename>
  • Desktop packages: /repos/*/Vikunja Desktop-<ver>.<ext> → /desktop/<version>/<filename>

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/go-vikunja/vikunja/pull/2611 **Author:** [@tink-bot](https://github.com/tink-bot) **Created:** 4/12/2026 **Status:** ✅ Merged **Merged:** 4/12/2026 **Merged by:** [@kolaente](https://github.com/kolaente) **Base:** `main` ← **Head:** `feat-os-package-repos` --- ### 📝 Commits (3) - [`a8288a5`](https://github.com/go-vikunja/vikunja/commit/a8288a546f57861de8196336df0dc2dbd7b5ceb3) feat: add Mage targets for OS package repository metadata - [`b0a7204`](https://github.com/go-vikunja/vikunja/commit/b0a7204e577b6e15a459ff7bdcb9526afd5a6f3b) feat(ci): add publish-repos job for OS package repository metadata - [`306604f`](https://github.com/go-vikunja/vikunja/commit/306604f15149655b3708e2f4a9258cbcc937d294) refactor: update reprepro-dist-conf for multi-arch with stable and unstable suites ### 📊 Changes **3 files changed** (+374 additions, -11 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/release.yml` (+101 -2) 📝 `build/reprepro-dist-conf` (+12 -5) 📝 `magefile.go` (+261 -4) </details> ### 📄 Description Add proper repository metadata generation so users can install Vikunja via native package managers (`apt install vikunja`, `dnf install vikunja`, `apk add vikunja`, `pacman -S vikunja`) by adding dl.vikunja.io as a package source. **What this adds:** - Four new Mage targets (`release:repo-apt`, `release:repo-rpm`, `release:repo-apk`, `release:repo-pacman`) that generate signed repository metadata using standard tools (dpkg-scanpackages, createrepo_c, apk index, repo-add) - A `publish-repos` CI job that runs after `os-package` and `desktop` jobs on tagged releases, generates metadata for all four formats across all architectures, and uploads to R2 under `/repos/` - Updated `reprepro-dist-conf` for multi-arch (amd64, arm64, armhf) with `stable` codename Package files are not re-uploaded — the dl.vikunja.io Worker redirects package requests under `/repos/` to existing artifact locations. ## Setup required before first use ### 1. GPG signing (APT, RPM, Pacman) The existing `RELEASE_GPG_SIGN_KEY` and `RELEASE_GPG_PASSPHRASE` secrets are reused. The GPG key ID `7D061A4AA61436B40713D42EFF054DACD908493A` is hardcoded in the workflow for the `--default-key` and public key export steps. No new secrets needed for GPG. ### 2. APK signing key (Alpine) Alpine uses RSA keys, not GPG. Two things are needed: **Generate the key pair (one-time):** ```bash openssl genrsa -out vikunja-apk.rsa 4096 openssl rsa -in vikunja-apk.rsa -pubout -out vikunja-apk.rsa.pub ``` **Add the private key as a GitHub secret:** - Secret name: `APK_SIGNING_KEY` - Value: contents of `vikunja-apk.rsa` **Upload the public key to R2:** - Path: `/repos/apk/vikunja-apk.rsa.pub` - Contents: `vikunja-apk.rsa.pub` This public key is what Alpine users download to verify packages. ### 3. Existing secrets used The job reuses these existing secrets (no changes needed): - `RELEASE_GPG_SIGN_KEY` — GPG private key (armor-encoded) - `RELEASE_GPG_PASSPHRASE` — GPG key passphrase - `S3_ACCESS_KEY`, `S3_SECRET_KEY`, `S3_ENDPOINT`, `S3_BUCKET`, `S3_REGION` — R2 upload credentials ### 4. Worker redirect The dl.vikunja.io Cloudflare Worker must redirect package file requests under `/repos/` to existing artifact locations: - Server packages: `/repos/*/vikunja-<ver>-<arch>.<ext>` → `/vikunja/<version>/<filename>` - Desktop packages: `/repos/*/Vikunja Desktop-<ver>.<ext>` → `/desktop/<version>/<filename>` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-20 18:11:48 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
area/attachments
area/auth
area/avatars
area/backup-restore
area/caldav
area/calendar-view
area/comments
area/config
area/database
area/desktop
area/docker
area/email
area/favorites
area/filters
area/frontend
area/gantt
area/i18n
area/import-export
area/internal-code
area/kanban
area/labels
area/list-view
area/mobile
area/notifications
area/permissions
area/projects
area/pwa
area/recurring-tasks
area/reminders
area/search
area/shortcuts
area/subtasks
area/sync
area/table-view
area/task-editor
area/task-metadata
area/task-relations
area/teams
area/theming
area/time-tracking
area/typesense
area/views
area/webhooks
bug
changes requested
concern/accessibility
concern/performance
concern/regression
concern/ux
confirmed
db/mysql
dependencies
enhancement
good first issue
help wanted
integration/inbound
integration/outbound
kind/bug
kind/feature
needs reproduction
pull-request
Mirrored from GitHub Pull Request
 pull-request
Mirrored from GitHub Pull Request
 pull-request
Mirrored from GitHub Pull Request
 question
security
support
upstream issue
waiting for reply
wontfix
No labels pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vikunja#8401