feature(distribution): upload packages to s3 by victorvhs017 · Pull Request #120 · Infisical/cli

victorvhs017 · 2026-02-02T23:04:26Z

Description 📣

Adds S3-based package repository support for APK (Alpine) and RPM packages, alongside existing Cloudsmith uploads. Includes setup scripts for end users and updates the CI/CD workflow to upload and sign packages.

Changes Made

1. Enhanced Package Upload Script (`upload_to_cloudsmith.sh`)

APK packages: Uploads to S3, generates and signs APKINDEX.tar.gz for x86_64 and aarch64
RPM packages: Signs RPMs with GPG and uploads to S3, regenerates repository metadata using mkrepo
DEB packages: Already supported via deb-s3 (no changes)
Maintains backward compatibility: continues uploading to Cloudsmith during transition

2. New Setup Scripts

scripts/setup.apk.sh: Alpine repository setup script
- Imports RSA public key
- Configures APK repository
- Supports x86_64 and aarch64 architectures
scripts/setup.rpm.sh: RPM repository setup script
- Detects OS distribution (RHEL, CentOS, Fedora, SUSE, etc.)
- Imports GPG keys
- Configures YUM/DNF/Zypper repositories

3. GitHub Workflow Updates (`.github/workflows/release_build_infisical_cli.yml`)

Installs required tools: mkrepo, boto3, awscli, rpm (for RPM signing)
Configures APK signing key from base64-encoded secret
Adds environment variables for S3 access and signing
Expands CloudFront cache invalidation to include RPM and APK paths

Pre-Merge Checklist

GitHub Secrets Required

APK_PRIVATE_KEY (NEW)
- Base64-encoded RSA private key for APK package signing
- Generate with: openssl genrsa -out infisical.rsa 4096
- Encode with: base64 -w 0 infisical.rsa
- Store the base64 string as the secret

S3 Bucket Setup Required

Configure the S3 bucket with the following structure and assets:

Directory Structure - DONE

s3://infisical-cli-artifacts-repo/
├── apk/
│   └── stable/
│       └── main/
│           ├── x86_64/
│           └── aarch64/
├── rpm/
│   ├── Packages/
│   └── repodata/
└── deb/
    └── (existing structure)

Public Keys to Upload
- APK Public Key: Upload the RSA public key to s3://infisical-cli-artifacts-repo/apk/infisical.rsa.pub
  - Extract from private key (the APK_PRIVATE_KEY added as secret in GitHub): openssl rsa -in infisical.rsa -pubout -out infisical.rsa.pub

Note: This PR maintains dual upload (Cloudsmith + S3) during the transition period. Once S3 repositories are validated, Cloudsmith uploads can be removed in a future PR.

Type ✨

Tests

I tested the scripts locally with dummy data.
I also tested in the AWS dev environment, and the workflow for the APK worked

I couldn't test the RPM upload locally because the rpm-sign command is linux only

I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

- Added functionality to upload APK packages to S3 and generate APKINDEX. - Implemented architecture-specific handling for APK files. - Introduced RPM package signing and upload to S3 with metadata regeneration. - Updated GitHub Actions workflow to install necessary dependencies for APK and RPM handling. - Created setup scripts for both APK and RPM repositories to streamline installation.

- Added error handling for directory change in upload_to_cloudsmith.sh. - Enhanced architecture validation in setup.apk.sh with clearer messaging. - Updated setup.rpm.sh to improve temporary file handling and added checks for DNF version. - Streamlined repository setup process in setup.rpm.sh by ensuring proper cleanup and error handling.

- Changed function name from detect_arch to validate_arch in setup.apk.sh to improve code readability and maintainability.

greptile-apps · 2026-02-02T23:08:21Z

Greptile Overview

Greptile Summary

Adds S3-based package repository infrastructure for APK and RPM packages alongside existing Cloudsmith uploads. This PR implements a dual-upload strategy during the transition period.

Major Changes:

Enhanced upload_to_cloudsmith.sh with S3 upload logic for APK and RPM packages, including Docker-based APKINDEX generation and mkrepo for RPM metadata
Added new user-facing setup scripts (setup.apk.sh and setup.rpm.sh) for repository configuration
Updated GitHub workflow to install dependencies (mkrepo, boto3, awscli, rpm) and configure APK signing keys
Expanded CloudFront cache invalidation to include new package paths

Key Observations:

The implementation follows secure practices with proper validation of environment variables and signing key paths
Docker container for APK signing uses read-only volume mounts for private keys
Scripts handle architecture detection and multiple package managers appropriately
S3 syncs preserve old package versions (intentional per previous thread discussion)

Issues Found:

The setup.rpm.sh script pipes curl output directly to Python for pip installation without checksum verification, creating a remote code execution vector if bootstrap.pypa.io is compromised
AWS CLI commands could expose internal bucket structure in CI logs (minor information disclosure)
README.md still references old Cloudsmith URLs for Alpine/RPM setup scripts and may need updating

Confidence Score: 4/5

This PR is safe to merge with minimal security risk given the dual-upload approach and tested validation logic
Score reflects well-structured implementation with proper validation and security controls, offset by one critical RCE vulnerability in setup.rpm.sh that affects end users (not CI) and minor information disclosure issues in logging
scripts/setup.rpm.sh requires attention for the curl-to-python piping vulnerability. Other files are well-implemented

Important Files Changed

Filename	Overview
upload_to_cloudsmith.sh	Added S3 upload support for APK and RPM packages with signing, includes Docker-based APKINDEX generation and mkrepo for RPM metadata
.github/workflows/release_build_infisical_cli.yml	Added dependencies (mkrepo, boto3, awscli, rpm), APK signing key setup, and expanded CloudFront cache invalidation
scripts/setup.apk.sh	New Alpine repository setup script with architecture detection, RSA key import, and repository configuration
scripts/setup.rpm.sh	New RPM repository setup script with OS detection, GPG key import, and multi-package-manager support (DNF/YUM/Zypper)

greptile-apps

_{4 files reviewed, 8 comments}

_{Edit Code Review Agent Settings | Greptile}

scripts/setup/setup.apk.sh

scripts/setup/setup.rpm.sh

upload_to_cloudsmith.sh

… detection - Implemented a validation function for required S3 environment variables in upload_to_cloudsmith.sh, ensuring necessary credentials are set before proceeding with uploads. - Updated the architecture validation function in setup.apk.sh to enhance clarity and messaging, renaming it from validate_arch to detect_arch.

victorvhs017 · 2026-02-03T00:05:51Z

@greptileai re-review and update the summary

greptile-apps

_{2 files reviewed, 7 comments}

_{Edit Code Review Agent Settings | Greptile}

upload_to_cloudsmith.sh

.github/workflows/release_build_infisical_cli.yml

upload_to_cloudsmith.sh

.github/workflows/release_build_infisical_cli.yml

greptile-apps · 2026-02-03T00:10:00Z

Additional Comments (1)

upload_to_cloudsmith.sh
Missing CloudFront cache invalidation for /apk/stable/main/* in this workflow step. The workflow file (.github/workflows/release_build_infisical_cli.yml:163) includes it, but verify $CLOUDFRONT_DISTRIBUTION_ID is properly configured.

- Implemented checks to ensure the APK private key exists before proceeding with APK processing. - Added validation for the RPM signing key ID to ensure it is configured before uploading RPM packages.

… RPM uploads - Added a check to ensure the INFISICAL_CLI_REPO_SIGNING_KEY_ID is set before uploading APK packages. - Removed redundant validation for RPM signing key ID, consolidating the check for both APK and RPM uploads.

victorvhs017 · 2026-02-03T00:32:25Z

@greptileai re-review and update the summary

greptile-apps

_{4 files reviewed, 4 comments}

_{Edit Code Review Agent Settings | Greptile}

scripts/setup/setup.apk.sh

upload_to_cloudsmith.sh

greptile-apps · 2026-02-03T00:36:02Z

Additional Comments (2)

README.md
Alpine installation instructions still reference the old Cloudsmith URL instead of the new S3-based repository. Update to match the new infrastructure:

_Alpine:_

```bash
curl -1sLf 'https://artifacts-cli.infisical.com/scripts/setup.apk.sh' | sudo sh
sudo apk add infisical

README.md
RPM installation instructions still reference the old Cloudsmith URL instead of the new S3-based repository. Update to use the new setup script:

_RHEL/CentOS:_

```bash
curl -1sLf 'https://artifacts-cli.infisical.com/scripts/setup.rpm.sh' | sudo -E bash
sudo yum install infisical

victorvhs017 · 2026-02-03T00:41:24Z

Additional Comments (2)
README.md Alpine installation instructions still reference the old Cloudsmith URL instead of the new S3-based repository. Update to match the new infrastructure:
_Alpine:_

```bash
curl -1sLf 'https://artifacts-cli.infisical.com/scripts/setup.apk.sh' | sudo sh
sudo apk add infisical
README.md RPM installation instructions still reference the old Cloudsmith URL instead of the new S3-based repository. Update to use the new setup script:
_RHEL/CentOS:_

```bash
curl -1sLf 'https://artifacts-cli.infisical.com/scripts/setup.rpm.sh' | sudo -E bash
sudo yum install infisical

These are fine, we're testing the S3 flow first, and we'll upload to both places.

… upload_to_cloudsmith.sh - Moved the validation check for INFISICAL_CLI_REPO_SIGNING_KEY_ID to the beginning of the script to ensure it is set before any uploads occur. - Removed redundant validation code from the APK upload section, streamlining the script.

victorvhs017 · 2026-02-03T00:45:01Z

@greptileai re-review and update the summary

greptile-apps

_{4 files reviewed, 5 comments}

_{Edit Code Review Agent Settings | Greptile}

upload_to_cloudsmith.sh

scripts/setup/setup.rpm.sh

scripts/setup/setup.apk.sh

upload_to_cloudsmith.sh

… logic - Changed the validation for S3 environment variables to exit on error instead of warning, ensuring the script halts if required variables are missing. - Removed the S3_ENABLED flag, simplifying the upload logic for APK and RPM packages by directly checking for the presence of files. - Enhanced clarity in the RPM upload section by consolidating the upload and metadata regeneration steps.

…ux distributions - Introduced `setup.deb.sh`, `setup.rpm.sh`, and `setup.apk.sh` scripts to facilitate the installation of the Infisical CLI on Debian/Ubuntu, RHEL/Fedora/CentOS/SUSE, and Alpine Linux respectively. - Created a comprehensive `README.md` to document the usage and functionality of the setup scripts, including instructions for configuring package repositories and installing the CLI. - Each script includes error handling, architecture detection, and repository configuration to streamline the installation process for end-users.

Victor Santos added 3 commits February 2, 2026 18:26

refactor: rename architecture detection function for clarity

f5c0162

- Changed function name from detect_arch to validate_arch in setup.apk.sh to improve code readability and maintainability.

greptile-apps bot reviewed Feb 2, 2026

View reviewed changes

victorvhs017 requested a review from varonix0 February 3, 2026 00:06

greptile-apps bot reviewed Feb 3, 2026

View reviewed changes

Victor Santos added 2 commits February 2, 2026 21:29

feat: add validation for APK private key and RPM signing key ID

693e37b

- Implemented checks to ensure the APK private key exists before proceeding with APK processing. - Added validation for the RPM signing key ID to ensure it is configured before uploading RPM packages.

greptile-apps bot reviewed Feb 3, 2026

View reviewed changes

scripts/setup/setup.apk.sh Show resolved Hide resolved

upload_to_cloudsmith.sh Outdated Show resolved Hide resolved

greptile-apps bot reviewed Feb 3, 2026

View reviewed changes

upload_to_cloudsmith.sh Show resolved Hide resolved

upload_to_cloudsmith.sh Show resolved Hide resolved

upload_to_cloudsmith.sh Outdated Show resolved Hide resolved

upload_to_cloudsmith.sh Outdated Show resolved Hide resolved

scripts/setup/setup.rpm.sh Show resolved Hide resolved

varonix0 requested changes Feb 5, 2026

View reviewed changes

scripts/setup/setup.apk.sh Show resolved Hide resolved

upload_to_cloudsmith.sh Outdated Show resolved Hide resolved

upload_to_cloudsmith.sh Outdated Show resolved Hide resolved

victorvhs017 requested a review from varonix0 February 9, 2026 14:07

Victor Santos and others added 3 commits February 9, 2026 13:43

Update relay.go

dc25514

Update relay.go

de47570

varonix0 approved these changes Feb 11, 2026

View reviewed changes

victorvhs017 merged commit 7244db9 into main Feb 11, 2026
4 checks passed

Conversation

victorvhs017 commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description 📣

Changes Made

1. Enhanced Package Upload Script (upload_to_cloudsmith.sh)

2. New Setup Scripts

3. GitHub Workflow Updates (.github/workflows/release_build_infisical_cli.yml)

Pre-Merge Checklist

GitHub Secrets Required

S3 Bucket Setup Required

Type ✨

Tests

Uh oh!

greptile-apps bot commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Overview

Greptile Summary

Confidence Score: 4/5

Important Files Changed

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

victorvhs017 commented Feb 3, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

greptile-apps bot commented Feb 3, 2026

Uh oh!

victorvhs017 commented Feb 3, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

greptile-apps bot commented Feb 3, 2026

Uh oh!

victorvhs017 commented Feb 3, 2026

Uh oh!

victorvhs017 commented Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

victorvhs017 commented Feb 2, 2026 •

edited

Loading

1. Enhanced Package Upload Script (`upload_to_cloudsmith.sh`)

3. GitHub Workflow Updates (`.github/workflows/release_build_infisical_cli.yml`)

greptile-apps bot commented Feb 2, 2026 •

edited

Loading

victorvhs017 commented Feb 3, 2026 •

edited

Loading