Repository navigation
feat(apt): build the ivicli Debian packages and install them with apt before a release - #290
Merged
Merged
Conversation
… before a release
ShortArrow
marked this pull request as ready for review
October 19, 2026 23:34
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ADR 0052 §2–§4: ivi-cli builds its Debian packages, checks that apt installs them, and attaches them to each stable release, where the registry in ShortArrow/pkg will index them. Depends on ShortArrow/pkg#1, which names
shortarrow-archive-keyring.The package
packaging/apt/build-deb.shpacks the self-contained single-file publish, so the package needs no .NET runtime. The binary goes under/usr/lib/ivicli, and/usr/bin/ivicliis a symlink to it.Dependslists the native libraries the runtime loads, as ADR 0052 §2 gives them, and the registry's keyring package, so a rotated key reaches every machine that has ivicli. The script refuses a version containing-, because Debian would sort0.4.1-beta.1after0.4.1.That keyring package exists only in the registry. Until the registry is live, a
.debtaken from a release does not install on its own; the CHANGELOG entry says so.The install test
packaging/apt/install-test.shsigns a throwaway repository with a key generated for the run, next to a stand-inshortarrow-archive-keyringthat carries that key. It then installs both withapt-get install --no-install-recommendsin freshdebian:bookwormandubuntu:24.04containers and checksivicli --version. A runtime library missing fromDependsshows up as a binary that does not start. A library that is loaded only on first use, such as OpenSSL, is not exercised.Pull requests run it on amd64 and arm64 when the packaging,
src/, the version, the SDK pin or these workflows change. Inrelease.yml, the newdebjob runs it before anything is published:pack,docker, the NativeAOT manifest andreleaseall wait for it, and the.debfiles join the release assets andSHA256SUMS. A pre-release tag builds no package.How it was checked
In this PR's CI, both architectures installed the package in both containers, and
ivicli --versionreported0.4.1. Run locally, the test failed when it was given a version the package does not have. Locally,build-deb.shalso stopped on a pre-release version. The release job itself runs only on a tag. It uses the same two scripts on the artifacts thepublishjob already uploads.