release: .deb, .rpm and build provenance attestations; Nix flake #1

Merged

backmeupplz merged 4 commits from packaging-release-assets into main

2026-10-18 18:27:37 +00:00

backmeupplz commented

2026-10-18 17:31:15 +00:00

(Migrated from github.com)

First step of putting plain on package managers (agentboard #140). This is the part that needs no new accounts, repos or keys; the channels that do (Homebrew tap, npm plain-evm, apt/dnf repo at pkg.getplain.org, AUR, crates.io) are tracked separately because they need Nikita's logins and approvals first.

Release workflow

The release job now also builds plain_<version>_amd64.deb and plain-<version>-1.x86_64.rpm from the Linux tarball with nfpm (Docker image pinned by digest, since it may receive the signing key). The .rpm is signed when the optional PACKAGES_GPG_PRIVATE_KEY secret exists and unsigned otherwise, so releases never wait on it.
SHA256SUMS covers every asset; the installer's plain-$target.tar.gz$ lookup is unchanged.
Build provenance attestations for every file (actions/attest, pinned): gh attestation verify <file> -R backmeupplz/plain, and mise verifies them automatically.

packaging/nfpm.yaml: /usr/bin/plain plus the license; libc6 (>= 2.34), libgcc-s1 / glibc >= 2.34, so too-old distros refuse cleanly instead of installing a binary that can't start.

flake.nix / flake.lock: nix run github:backmeupplz/plain -- test builds from source (cargoLock.lockFile, no hash to maintain; tests off because the fixture downloads solc).

Docs: glibc floor corrected to 2.34 (RHEL 9 and Amazon Linux 2023 work), plus mise, Nix, .deb/.rpm and attestation verification.

Tested locally

actionlint 1.7.12: clean.
The workflow's .deb/.rpm step, extracted verbatim, run against the v0.3.0 tarballs with and without a throwaway signing key.
.deb: installs and runs on ubuntu 22.04, 24.04, debian 12, 13; debian 11 refuses on libc6 (>= 2.34).
Signed .rpm: rpm -K "digests signatures OK" and runs on fedora 44, rocky 9, amazonlinux 2023; unsigned build gives "digests OK".
Nix: see the PR comment for the container build result.

Not provable before a tag: the attestation step and the published release itself run only on a real v* tag.

First step of putting plain on package managers (agentboard #140). This is the part that needs no new accounts, repos or keys; the channels that do (Homebrew tap, npm `plain-evm`, apt/dnf repo at pkg.getplain.org, AUR, crates.io) are tracked separately because they need Nikita's logins and approvals first. **Release workflow** - The `release` job now also builds `plain_<version>_amd64.deb` and `plain-<version>-1.x86_64.rpm` from the Linux tarball with nfpm (Docker image pinned by digest, since it may receive the signing key). The .rpm is signed when the optional `PACKAGES_GPG_PRIVATE_KEY` secret exists and unsigned otherwise, so releases never wait on it. - `SHA256SUMS` covers every asset; the installer's ` plain-$target.tar.gz$` lookup is unchanged. - Build provenance attestations for every file (`actions/attest`, pinned): `gh attestation verify <file> -R backmeupplz/plain`, and mise verifies them automatically. **packaging/nfpm.yaml**: `/usr/bin/plain` plus the license; `libc6 (>= 2.34), libgcc-s1` / `glibc >= 2.34`, so too-old distros refuse cleanly instead of installing a binary that can't start. **flake.nix / flake.lock**: `nix run github:backmeupplz/plain -- test` builds from source (`cargoLock.lockFile`, no hash to maintain; tests off because the fixture downloads solc). **Docs**: glibc floor corrected to 2.34 (RHEL 9 and Amazon Linux 2023 work), plus mise, Nix, .deb/.rpm and attestation verification. **Tested locally** - actionlint 1.7.12: clean. - The workflow's .deb/.rpm step, extracted verbatim, run against the v0.3.0 tarballs with and without a throwaway signing key. - .deb: installs and runs on ubuntu 22.04, 24.04, debian 12, 13; debian 11 refuses on `libc6 (>= 2.34)`. - Signed .rpm: `rpm -K` "digests signatures OK" and runs on fedora 44, rocky 9, amazonlinux 2023; unsigned build gives "digests OK". - Nix: see the PR comment for the container build result. Not provable before a tag: the attestation step and the published release itself run only on a real `v*` tag.

backmeupplz commented

2026-10-18 17:33:54 +00:00

(Migrated from github.com)

Nix check (nixos/nix container, Linux arm64 host, so aarch64-linux was added to systems in a test copy only): nix build builds plain from source with the pinned nixos-unstable, ./result/bin/plain --version → plain 0.3.1; nix flake check → all checks passed.

Nix check (nixos/nix container, Linux arm64 host, so `aarch64-linux` was added to `systems` in a test copy only): `nix build` builds plain from source with the pinned nixos-unstable, `./result/bin/plain --version` → `plain 0.3.1`; `nix flake check` → all checks passed.