packaging: validate genuine source RPM metadata
Some checks failed
CI / Source-only, license, shell and secret policy (push) Has been cancelled
CI / Build and full tests (clang) (push) Has been cancelled
CI / Build and full tests (gcc) (push) Has been cancelled
CI / Strict warnings (clang) (push) Has been cancelled
CI / Strict warnings (gcc) (push) Has been cancelled
CI / ASan, LSan and UBSan (push) Has been cancelled
CI / GCC static analyzer (push) Has been cancelled
CI / Reproducible audited source archive (push) Has been cancelled
CI / Debian/Ubuntu source-built package (push) Has been cancelled
CI / openSUSE Tumbleweed x86_64 RPM gate (push) Has been cancelled
CI / Fedora noarch GUI RPM and SRPM gate (push) Has been cancelled
CI / Linux x86_64 notice-bearing CLI tar.xz gate (push) Has been cancelled
CI / Source-only GUI portable ZIP gate (push) Has been cancelled
CI / Windows and macOS release gates (push) Has been cancelled
CI / Windows x86_64 package and smoke test (push) Has been cancelled
CI / macOS native DMG and installed-image test (push) Has been cancelled

This commit is contained in:
Cristian Cezar Moisés 2026-08-31 22:12:31 -03:00
commit 33eb90454d
4 changed files with 71 additions and 5 deletions

View file

@ -469,6 +469,12 @@ jobs:
test "$(rpm -qp --qf '%{ARCH}' "$gui_rpm")" = noarch
rpm -qp --requires "$gui_rpm" | grep -Fx "zupt >= $version"
test "$(rpm -qp --qf '%{NAME}' "$gui_srpm")" = zupt-gui
test "$(rpm -qp --qf '%{VERSION}-%{RELEASE}' "$gui_srpm")" = "$version-1"
test "$(rpm -qp --qf '%{SOURCEPACKAGE}' "$gui_srpm")" = 1
test "$(rpm -qp --qf '%{SOURCERPM}' "$gui_srpm")" = '(none)'
test "$(rpm -qpl "$gui_srpm" | wc -l)" -eq 2
rpm -qpl "$gui_srpm" | grep -Fx "zupt-gui-$version.tar.gz"
rpm -qpl "$gui_srpm" | grep -Fx zupt-gui.spec
- name: Build the matching Fedora CLI RPM
run: |
version=$(sed -n 's/^#define ZUPT_VERSION_STRING "\([^"]*\)".*/\1/p' include/zupt.h)

View file

@ -389,11 +389,17 @@ jobs:
[[ $(rpm -qp --qf '%{VERSION}' "$rpm_file") == "$VERSION" ]]
[[ $(rpm -qp --qf '%{RELEASE}' "$rpm_file") == 0 ]]
[[ $(rpm -qp --qf '%{ARCH}' "$rpm_file") == x86_64 ]]
[[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$rpm_file") == '(none)' ]]
[[ $(rpm -qp --qf '%{SOURCERPM}' "$rpm_file") == "$srpm_name" ]]
srpm=$asset_dir/$srpm_name
[[ $(rpm -qp --qf '%{NAME}' "$srpm") == zupt ]]
[[ $(rpm -qp --qf '%{VERSION}' "$srpm") == "$VERSION" ]]
[[ $(rpm -qp --qf '%{RELEASE}' "$srpm") == 0 ]]
[[ $(rpm -qp --qf '%{ARCH}' "$srpm") == src ]]
[[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$srpm") == 1 ]]
[[ $(rpm -qp --qf '%{SOURCERPM}' "$srpm") == '(none)' ]]
[[ $(rpm -qpl "$srpm" | wc -l) -eq 2 ]]
rpm -qpl "$srpm" | grep -Fx "zupt-$VERSION.tar.gz"
rpm -qpl "$srpm" | grep -Fx zupt.spec
gui_deb=$asset_dir/$gui_deb_name
dpkg-deb --info "$gui_deb" >/dev/null
@ -406,12 +412,18 @@ jobs:
[[ $(rpm -qp --qf '%{VERSION}' "$gui_rpm") == "$VERSION" ]]
[[ $(rpm -qp --qf '%{RELEASE}' "$gui_rpm") == 1 ]]
[[ $(rpm -qp --qf '%{ARCH}' "$gui_rpm") == noarch ]]
[[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$gui_rpm") == '(none)' ]]
[[ $(rpm -qp --qf '%{SOURCERPM}' "$gui_rpm") == "$gui_srpm_name" ]]
rpm -qp --requires "$gui_rpm" | grep -Fx "zupt >= $VERSION"
gui_srpm=$asset_dir/$gui_srpm_name
[[ $(rpm -qp --qf '%{NAME}' "$gui_srpm") == zupt-gui ]]
[[ $(rpm -qp --qf '%{VERSION}' "$gui_srpm") == "$VERSION" ]]
[[ $(rpm -qp --qf '%{RELEASE}' "$gui_srpm") == 1 ]]
[[ $(rpm -qp --qf '%{ARCH}' "$gui_srpm") == src ]]
[[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$gui_srpm") == 1 ]]
[[ $(rpm -qp --qf '%{SOURCERPM}' "$gui_srpm") == '(none)' ]]
[[ $(rpm -qpl "$gui_srpm" | wc -l) -eq 2 ]]
rpm -qpl "$gui_srpm" | grep -Fx "zupt-gui-$VERSION.tar.gz"
rpm -qpl "$gui_srpm" | grep -Fx zupt-gui.spec
linux_tar=$asset_dir/$linux_tar_name
python3 - "$linux_tar" "zupt-$VERSION-linux-x86_64" <<'PY'