Skip to content

Commit 7244db9

Browse files
authored
Merge pull request #120 from Infisical/feature/upload-packages-to-s3
feature(distribution): upload packages to s3
2 parents 7362eec + de47570 commit 7244db9

File tree

6 files changed

+981
-8
lines changed

6 files changed

+981
-8
lines changed

.github/workflows/release_build_infisical_cli.yml

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,15 @@ jobs:
124124
AUR_KEY: ${{ secrets.AUR_KEY }}
125125
GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
126126
- uses: actions/setup-python@v4
127+
with:
128+
python-version: "3.12"
127129
- run: pip install --upgrade cloudsmith-cli
130+
- name: Install mkrepo and dependencies
131+
run: pip install mkrepo univers boto3
132+
- name: Install AWS CLI
133+
run: pip install awscli
134+
- name: Install rpm-sign
135+
run: sudo apt-get install -y rpm
128136
- uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252
129137
with:
130138
ruby-version: "3.3" # Not needed with a .ruby-version, .tool-versions or mise.toml
@@ -136,16 +144,23 @@ jobs:
136144
env:
137145
GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }}
138146
GPG_SIGNING_KEY_PASSPHRASE: ${{ secrets.GPG_SIGNING_KEY_PASSPHRASE }}
139-
- name: Publish to CloudSmith
147+
- name: Configure APK Signing Key
148+
run: |
149+
echo -n "$APK_PRIVATE_KEY" | base64 --decode > /tmp/infisical-apk.rsa
150+
chmod 600 /tmp/infisical-apk.rsa
151+
env:
152+
APK_PRIVATE_KEY: ${{ secrets.APK_PRIVATE_KEY }}
153+
- name: Publish packages to repositories
140154
run: sh upload_to_cloudsmith.sh
141155
env:
142156
CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}
143157
INFISICAL_CLI_S3_BUCKET: ${{ secrets.INFISICAL_CLI_S3_BUCKET }}
144158
INFISICAL_CLI_REPO_SIGNING_KEY_ID: ${{ secrets.INFISICAL_CLI_REPO_SIGNING_KEY_ID }}
145159
AWS_ACCESS_KEY_ID: ${{ secrets.INFISICAL_CLI_REPO_AWS_ACCESS_KEY_ID }}
146160
AWS_SECRET_ACCESS_KEY: ${{ secrets.INFISICAL_CLI_REPO_AWS_SECRET_ACCESS_KEY }}
161+
APK_PRIVATE_KEY_PATH: /tmp/infisical-apk.rsa
147162
- name: Invalidate Cloudfront cache
148-
run: aws cloudfront create-invalidation --distribution-id $CLOUDFRONT_DISTRIBUTION_ID --paths '/deb/dists/stable/*'
163+
run: aws cloudfront create-invalidation --distribution-id $CLOUDFRONT_DISTRIBUTION_ID --paths '/rpm/Packages/*' '/rpm/repodata/*' '/deb/dists/stable/*' '/apk/stable/main/*'
149164
env:
150165
AWS_ACCESS_KEY_ID: ${{ secrets.INFISICAL_CLI_REPO_AWS_ACCESS_KEY_ID }}
151166
AWS_SECRET_ACCESS_KEY: ${{ secrets.INFISICAL_CLI_REPO_AWS_SECRET_ACCESS_KEY }}

scripts/setup/README.md

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# Repository Setup Scripts
2+
3+
This folder contains setup scripts that end-users run to configure their systems to install the Infisical CLI from our package repositories.
4+
5+
## Scripts
6+
7+
| Script | Target System | Description |
8+
|--------|---------------|-------------|
9+
| `setup.deb.sh` | Debian/Ubuntu | Configures APT repository for `.deb` packages |
10+
| `setup.rpm.sh` | RHEL/Fedora/CentOS/SUSE | Configures YUM/DNF/Zypper repository for `.rpm` packages |
11+
| `setup.apk.sh` | Alpine Linux | Configures APK repository for `.apk` packages |
12+
13+
## How They're Used
14+
15+
These scripts are hosted on our S3 artifacts bucket and users download and run them to set up the repository:
16+
17+
```bash
18+
# Debian/Ubuntu
19+
curl -1sLf 'https://artifacts-cli.infisical.com/setup.deb.sh' | sudo bash
20+
21+
# RHEL/Fedora/CentOS
22+
curl -1sLf 'https://artifacts-cli.infisical.com/setup.rpm.sh' | sudo bash
23+
24+
# Alpine Linux
25+
wget -qO- 'https://artifacts-cli.infisical.com/setup.apk.sh' | sudo sh
26+
```
27+
28+
After running the setup script, users can install the CLI using their native package manager:
29+
30+
```bash
31+
# Debian/Ubuntu
32+
sudo apt-get update && sudo apt-get install infisical
33+
34+
# RHEL/Fedora
35+
sudo yum install infisical # or dnf/zypper
36+
37+
# Alpine
38+
sudo apk add infisical
39+
```
40+
41+
## What Each Script Does
42+
43+
1. **Imports GPG/RSA signing keys** - Downloads and installs the public key used to verify package signatures
44+
2. **Configures the repository** - Adds the Infisical repository to the system's package manager
45+
3. **Updates package cache** - Refreshes the package list so the CLI can be installed
46+
47+
## Deployment
48+
49+
These scripts are uploaded to S3 during the release process. They are served from:
50+
- `https://artifacts-cli.infisical.com/setup.deb.sh`
51+
- `https://artifacts-cli.infisical.com/setup.rpm.sh`
52+
- `https://artifacts-cli.infisical.com/setup.apk.sh`

scripts/setup/setup.apk.sh

Lines changed: 199 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,199 @@
1+
#!/bin/sh
2+
#
3+
# Infisical CLI Alpine Repository Setup Script
4+
# The core commands execute start from the "MAIN" section below.
5+
#
6+
7+
set -e
8+
9+
# Environment variables that can be set
10+
PKG_URL="${PKG_URL:-https://artifacts-cli.infisical.com}"
11+
PACKAGE_NAME="${PACKAGE_NAME:-infisical}"
12+
RSA_KEY_URL="${RSA_KEY_URL:-${PKG_URL}/apk/infisical.rsa.pub}"
13+
14+
# Colors (basic POSIX-compatible)
15+
RED='\033[0;31m'
16+
GREEN='\033[0;32m'
17+
BOLD='\033[1m'
18+
NC='\033[0m' # No Color
19+
20+
echo_status() {
21+
local status=$1
22+
local message=$2
23+
if [ "$status" = "OK" ]; then
24+
printf "${GREEN}[ OK ]${NC} %s\n" "$message"
25+
elif [ "$status" = "FAIL" ]; then
26+
printf "${RED}[ FAIL ]${NC} %s\n" "$message"
27+
elif [ "$status" = "RUN" ]; then
28+
printf "[ .. ] %s\r" "$message"
29+
fi
30+
}
31+
32+
die() {
33+
echo
34+
printf "${RED}${BOLD}Error:${NC} %s\n" "$1"
35+
echo
36+
printf "${BOLD}For assistance, please visit:${NC}\n"
37+
echo " https://github.com/Infisical/infisical"
38+
echo
39+
exit 1
40+
}
41+
42+
check_tool() {
43+
local tool=$1
44+
echo_status "RUN" "Checking for required tool '$tool'..."
45+
if command -v "$tool" > /dev/null 2>&1; then
46+
echo_status "OK" "Checking for required tool '$tool'"
47+
return 0
48+
else
49+
echo_status "FAIL" "Checking for required tool '$tool'"
50+
die "$tool is not installed, but is required by this script."
51+
fi
52+
}
53+
54+
detect_arch() {
55+
echo_status "RUN" "Detecting system architecture..."
56+
local raw_arch=$(uname -m)
57+
case "$raw_arch" in
58+
x86_64|amd64)
59+
arch="x86_64"
60+
;;
61+
aarch64|arm64)
62+
arch="aarch64"
63+
;;
64+
*)
65+
echo_status "FAIL" "Detecting system architecture"
66+
die "Unsupported architecture: $raw_arch. Supported: x86_64, aarch64"
67+
;;
68+
esac
69+
echo_status "OK" "Architecture detected: $arch"
70+
}
71+
72+
import_rsa_key() {
73+
echo_status "RUN" "Importing '${PACKAGE_NAME}' repository RSA key..."
74+
75+
# Create keys directory if it doesn't exist
76+
mkdir -p /etc/apk/keys
77+
78+
# Download and install RSA public key
79+
if wget -q -O "/etc/apk/keys/${PACKAGE_NAME}.rsa.pub" "${RSA_KEY_URL}"; then
80+
chmod 644 "/etc/apk/keys/${PACKAGE_NAME}.rsa.pub"
81+
echo_status "OK" "Importing '${PACKAGE_NAME}' repository RSA key"
82+
else
83+
echo_status "FAIL" "Importing '${PACKAGE_NAME}' repository RSA key"
84+
die "Could not download RSA key from ${RSA_KEY_URL}"
85+
fi
86+
}
87+
88+
setup_repository() {
89+
local repo_file="/etc/apk/repositories"
90+
local repo_url="${PKG_URL}/apk/stable/main/${arch}"
91+
92+
echo_status "RUN" "Adding '${PACKAGE_NAME}' repository..."
93+
94+
# Check if repository already exists
95+
if grep -q "${repo_url}" "${repo_file}" 2>/dev/null; then
96+
echo_status "OK" "Repository already configured"
97+
return 0
98+
fi
99+
100+
# Add repository
101+
echo "${repo_url}" >> "${repo_file}"
102+
echo_status "OK" "Adding '${PACKAGE_NAME}' repository"
103+
}
104+
105+
update_apk() {
106+
echo_status "RUN" "Updating Alpine repository cache..."
107+
if apk update > /dev/null 2>&1; then
108+
echo_status "OK" "Updating Alpine repository cache"
109+
else
110+
echo_status "FAIL" "Updating Alpine repository cache"
111+
die "Failed to update APK cache. Please check your network connection."
112+
fi
113+
}
114+
115+
usage() {
116+
cat << EOF
117+
Usage: $0 [options]
118+
119+
Options:
120+
-h, --help Display this help message
121+
-r, --remove Remove the repository configuration
122+
123+
Environment variables:
124+
PKG_URL Base URL for packages (default: https://artifacts-cli.infisical.com)
125+
PACKAGE_NAME Package name (default: infisical)
126+
127+
EOF
128+
exit 0
129+
}
130+
131+
remove_repository() {
132+
echo "Removing ${PACKAGE_NAME} repository configuration..."
133+
134+
# Remove from repositories file
135+
if [ -f /etc/apk/repositories ]; then
136+
sed -i "\|${PKG_URL}/apk|d" /etc/apk/repositories
137+
echo_status "OK" "Removed repository from /etc/apk/repositories"
138+
fi
139+
140+
# Remove RSA key
141+
if [ -f "/etc/apk/keys/${PACKAGE_NAME}.rsa.pub" ]; then
142+
rm -f "/etc/apk/keys/${PACKAGE_NAME}.rsa.pub"
143+
echo_status "OK" "Removed RSA key"
144+
fi
145+
146+
# Update cache
147+
apk update > /dev/null 2>&1
148+
149+
echo
150+
echo "Repository removed successfully."
151+
exit 0
152+
}
153+
154+
#
155+
# MAIN
156+
#
157+
158+
# Parse arguments
159+
while [ $# -gt 0 ]; do
160+
case "$1" in
161+
-h|--help)
162+
usage
163+
;;
164+
-r|--remove)
165+
remove_repository
166+
;;
167+
*)
168+
echo "Unknown option: $1"
169+
usage
170+
;;
171+
esac
172+
shift
173+
done
174+
175+
echo
176+
echo "Executing the setup script for the '${PACKAGE_NAME}' repository..."
177+
echo
178+
179+
# Check for root privileges
180+
if [ "$(id -u)" -ne 0 ]; then
181+
die "This script must be run as root (e.g., using sudo)"
182+
fi
183+
184+
# Check requirements
185+
check_tool "wget"
186+
187+
# Setup
188+
detect_arch
189+
import_rsa_key
190+
setup_repository
191+
update_apk
192+
193+
echo
194+
printf "${GREEN}${BOLD}Success!${NC} The repository has been installed successfully.\n"
195+
echo
196+
echo "You can now install ${PACKAGE_NAME} with:"
197+
echo
198+
printf " ${BOLD}apk add ${PACKAGE_NAME}${NC}\n"
199+
echo

0 commit comments

Comments
 (0)