From 7161fe2fb68975c130171f30367bc39fddce3dda Mon Sep 17 00:00:00 2001 From: Roman Kivalin Date: Sun, 12 Apr 2026 21:27:15 +0200 Subject: [PATCH] Fix release workflow and drop aws-lc-rs dependency - Use ring backend for instant-acme instead of aws-lc-rs (fixes Arch build linker errors, also reduces binary from 9MB to 6.6MB) - Remove redundant mv in deb packaging (dpkg-deb already outputs the correct filename) Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/release.yaml | 62 ++++++++++++++++++---------- Cargo.lock | 75 +++------------------------------- Cargo.toml | 2 +- 3 files changed, 47 insertions(+), 92 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index ab040c3..bd2ecc7 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -62,35 +62,54 @@ jobs: needs: build runs-on: ubuntu-latest container: archlinux:base-devel - strategy: - matrix: - include: - - arch: x86_64 - artifact: amd64 steps: - uses: actions/checkout@v6 - - name: Install dependencies - run: | - pacman -Syu --noconfirm rust + - name: Download binary + uses: actions/download-artifact@v8 + with: + name: certforge-amd64 - name: Build package run: | - # makepkg can't run as root, create a build user + pacman -Syu --noconfirm + + VERSION=${GITHUB_REF_NAME#v} + + # Create a fake PKGBUILD that packages the pre-built binary + cat >PKGBUILD <<'PKGEOF' + # Maintainer: Roman Kivalin + pkgname=certforge + pkgver=VERSION_PLACEHOLDER + pkgrel=1 + pkgdesc='ACME certificate manager with DANE and systemd integration' + arch=('x86_64') + url='https://github.com/rkivalin/certforge' + license=('MIT') + depends=('systemd-libs') + source=("certforge-amd64.tar.gz" + "certforge.service" + "certforge.timer" + "config.toml") + sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP') + + package() { + install -Dm755 "$srcdir/certforge" "$pkgdir/usr/bin/certforge" + install -Dm644 "$srcdir/certforge.service" "$pkgdir/usr/lib/systemd/system/certforge.service" + install -Dm644 "$srcdir/certforge.timer" "$pkgdir/usr/lib/systemd/system/certforge.timer" + install -Dm644 "$srcdir/config.toml" "$pkgdir/etc/certforge/config.toml" + install -dm750 "$pkgdir/etc/certforge/certs" + install -dm700 "$pkgdir/var/lib/certforge" + } + PKGEOF + sed -i "s/VERSION_PLACEHOLDER/$VERSION/" PKGBUILD + + # Place source files where makepkg expects them + cp examples/certforge.service examples/certforge.timer examples/config.toml . + useradd -m builder chown -R builder:builder . - # Adjust PKGBUILD source to use local files - cd /tmp - VERSION=${GITHUB_REF_NAME#v} - mkdir -p "certforge-$VERSION" - cp -a "$GITHUB_WORKSPACE"/* "certforge-$VERSION/" - tar czf "certforge-$VERSION.tar.gz" "certforge-$VERSION" - cp "$GITHUB_WORKSPACE/PKGBUILD" . - sed -i "s|pkgver=.*|pkgver=$VERSION|" PKGBUILD - sed -i "s|source=.*|source=(\"certforge-$VERSION.tar.gz\")|" PKGBUILD - chown -R builder:builder /tmp/certforge-* /tmp/PKGBUILD - su builder -c 'makepkg -s --noconfirm --skipinteg' - cp /tmp/*.pkg.tar.zst "$GITHUB_WORKSPACE/" + su builder -c 'makepkg --noconfirm --skipinteg' - name: Upload artifact uses: actions/upload-artifact@v7 @@ -147,7 +166,6 @@ jobs: echo "/etc/certforge/config.toml" >"$PKG/DEBIAN/conffiles" dpkg-deb --build --root-owner-group "$PKG" - mv "${PKG}.deb" "certforge_${VERSION}-1_${{ matrix.arch }}.deb" - name: Upload artifact uses: actions/upload-artifact@v7 diff --git a/Cargo.lock b/Cargo.lock index 2b0999e..4a52931 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -286,29 +286,6 @@ version = "1.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8" -[[package]] -name = "aws-lc-rs" -version = "1.16.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a054912289d18629dc78375ba2c3726a3afe3ff71b4edba9dedfca0e3446d1fc" -dependencies = [ - "aws-lc-sys", - "untrusted 0.7.1", - "zeroize", -] - -[[package]] -name = "aws-lc-sys" -version = "0.39.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "83a25cf98105baa966497416dbd42565ce3a8cf8dbfd59803ec9ad46f3126399" -dependencies = [ - "cc", - "cmake", - "dunce", - "fs_extra", -] - [[package]] name = "base64" version = "0.22.1" @@ -362,8 +339,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "43c5703da9466b66a946814e1adf53ea2c90f10063b86290cc9eb67ce3478a20" dependencies = [ "find-msvc-tools", - "jobserver", - "libc", "shlex", ] @@ -453,15 +428,6 @@ version = "1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9" -[[package]] -name = "cmake" -version = "0.1.58" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678" -dependencies = [ - "cc", -] - [[package]] name = "colorchoice" version = "1.0.5" @@ -598,12 +564,6 @@ dependencies = [ "syn", ] -[[package]] -name = "dunce" -version = "1.0.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813" - [[package]] name = "endi" version = "1.1.1" @@ -719,12 +679,6 @@ dependencies = [ "percent-encoding", ] -[[package]] -name = "fs_extra" -version = "1.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c" - [[package]] name = "futures-channel" version = "0.3.32" @@ -1183,7 +1137,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9f05ad37c421b962354c358d347d4a6130151df9407978372d3ad7f0c8f71a64" dependencies = [ "async-trait", - "aws-lc-rs", "base64", "bytes", "http", @@ -1194,6 +1147,7 @@ dependencies = [ "hyper-rustls", "hyper-util", "rcgen 0.14.7", + "ring", "rustls", "rustls-pki-types", "serde", @@ -1269,16 +1223,6 @@ dependencies = [ "syn", ] -[[package]] -name = "jobserver" -version = "0.1.34" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33" -dependencies = [ - "getrandom 0.3.4", - "libc", -] - [[package]] name = "js-sys" version = "0.3.95" @@ -1668,8 +1612,8 @@ version = "0.14.7" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "10b99e0098aa4082912d4c649628623db6aba77335e4f4569ff5083a6448b32e" dependencies = [ - "aws-lc-rs", "pem", + "ring", "rustls-pki-types", "time", "x509-parser 0.18.1", @@ -1703,7 +1647,7 @@ dependencies = [ "cfg-if", "getrandom 0.2.17", "libc", - "untrusted 0.9.0", + "untrusted", "windows-sys 0.52.0", ] @@ -1744,8 +1688,8 @@ version = "0.23.37" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "758025cb5fccfd3bc2fd74708fd4682be41d99e5dff73c377c0646c6012c73a4" dependencies = [ - "aws-lc-rs", "once_cell", + "ring", "rustls-pki-types", "rustls-webpki", "subtle", @@ -1806,10 +1750,9 @@ version = "0.103.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "20a6af516fea4b20eccceaf166e8aa666ac996208e8a644ce3ef5aa783bc7cd4" dependencies = [ - "aws-lc-rs", "ring", "rustls-pki-types", - "untrusted 0.9.0", + "untrusted", ] [[package]] @@ -2383,12 +2326,6 @@ version = "0.2.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853" -[[package]] -name = "untrusted" -version = "0.7.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a" - [[package]] name = "untrusted" version = "0.9.0" @@ -2859,12 +2796,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d43b0f71ce057da06bc0851b23ee24f3f86190b07203dd8f567d0b706a185202" dependencies = [ "asn1-rs 0.7.1", - "aws-lc-rs", "data-encoding", "der-parser 10.0.0", "lazy_static", "nom", "oid-registry 0.8.1", + "ring", "rusticata-macros", "thiserror 2.0.18", "time", diff --git a/Cargo.toml b/Cargo.toml index f235927..c8aabb0 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -11,7 +11,7 @@ panic = "abort" # no unwinding machinery — smaller binary, simpler code [dependencies] # ACME -instant-acme = "0.8" +instant-acme = { version = "0.8", default-features = false, features = ["hyper-rustls", "ring"] } # DNS hickory-proto = { version = "0.25", features = ["dnssec-ring"] }