Introduction

Any commit on github results in generation of files required for RPM/Debian builds on Open Build Service. These files are automatically generated on github on updates through the following action scripts. These files are then pushed to sourceforge.net mirrors by the same action scripts.

IndiMail

1. indimail-mta
2. indimail-virtualdomains
3. libqmail
4. ezmlm-idx
5. tinydnssec

mpdev

1. mpdev - For maintaining listening preferences for Music Player Daemon
2. pistiop - For stop/start of satellite MPD players

These files are named package-obs.tar.gz. Each file also has its gpg signature in package-obs.sig, signed by Manvendra Bhangui software@indimail.org. See the section on verifying uploads at the bottom. The package-obs.tar.gz usually has the following content

1. package1.version.tar.gz, package2.version.tar.gz, ... - Source archive file for package1, package2, ..., packagen
2. debian.tar.gz - For debian builds on OBS
3. package.spec - RPM Spec file
4. package-rpmlintrc - rpmlint configuration file for OBS
5. package.changes - ChangeLog for package
6. package-permissions.[easy|secure|paranoid] - These are needed for openSUSE and SUSE Enterprise Linux and are present when your package installs setuid executables.
7. PKGBUILD - For Arch Linux builds
8. archpkgnum.install - Install time scripts used by Arch Linux packaging. Here num can be missing or be a number depending on number of split packages in a Arch Linux package.

This files are pulled by OBS to start a build. The pull happens whenever the source service is triggered or when the source service is changed.

Example

Here indimail-obs.tar.gz has one source archive indimail-3.4.tar.gz, indicating that this will build indimail version 3.4. For indimail-access-obs.tar.gz, the archive has two source archives - courier-imap-5.1.2.tar.gz and fetchmail-6.4.16.tar.gz

$ tar tvf indimail-obs.tar.gz 
-rw-r--r-- runner/docker  9866 2021-03-26 19:04 debian.tar.gz
-rw-r--r-- runner/docker 2210480 2021-03-26 19:04 indimail-3.4.tar.gz
-rw-r--r-- runner/docker     595 2021-03-26 19:04 indimail-Debian_10.dsc
-rw-r--r-- runner/docker     595 2021-03-26 19:04 indimail-Debian_9.0.dsc
-rw-r--r-- runner/docker    1290 2021-03-26 19:04 indimail-permissions.easy
-rw-r--r-- runner/docker    1555 2021-03-26 19:04 indimail-permissions.paranoid
-rw-r--r-- runner/docker    3698 2021-03-26 19:04 indimail-permissions.secure
-rw-r--r-- runner/docker     393 2021-03-26 19:04 indimail-rpmlintrc
-rw-r--r-- runner/docker     600 2021-03-26 19:04 indimail-xUbuntu_18.04.dsc
-rw-r--r-- runner/docker    1078 2021-03-26 19:04 indimail.changes
-rw-r--r-- runner/docker     586 2021-03-26 19:04 indimail.dsc
-rw-r--r-- runner/docker   70939 2021-03-26 19:04 indimail.spec

$ tar tvf indimail-access-obs.tar.gz
-rw-r--r-- runner/docker 8222105 2021-03-29 22:35 courier-imap-5.1.2.tar.gz
-rw-r--r-- runner/docker    7129 2021-03-29 22:36 debian.tar.gz
-rw-r--r-- runner/docker 2579303 2021-03-29 22:36 fetchmail-6.4.16.tar.gz
-rw-r--r-- runner/docker     627 2021-03-29 22:36 indimail-access-permissions.easy
-rw-r--r-- runner/docker    1625 2021-03-29 22:36 indimail-access-permissions.paranoid
-rw-r--r-- runner/docker    3110 2021-03-29 22:36 indimail-access-permissions.secure
-rw-r--r-- runner/docker    1094 2021-03-29 22:36 indimail-access-rpmlintrc
-rw-r--r-- runner/docker     497 2021-03-29 22:36 indimail-access.changes
-rw-r--r-- runner/docker     575 2021-03-29 22:36 indimail-access.dsc
-rw-r--r-- runner/docker   30623 2021-03-29 22:36 indimail-access.spec

Build Mechanism

The way things happen is like this

1. New code committed to github causes github action scripts to run.
2. These action scripts create source tar archive and all necessary files for binary builds, to be pushed to the github directory on sourceforge.net
3. Every package on OBS repository has a source service configured to pull these files when triggered by a token.
4. As soon as the sources are pulled, the process to build the binaries starts. After a successful build, these binaries are available for installation using YUM/DNF/apt-get here

NOTE: The builds on OBS are triggered manually as of now. This is because the sourceforge.net mirrors take few minutes to synchronize all their mirrors with the latest archive pushed from github.

Verifying Uploads

Each archive is signed by gpg with public key=0x3265bc69e4b2907f You can also import the key using either one of the two below files

• indimail-pubkey.asc
• indimail-pubkey.gpg

Importing gpg keys

Import gpg keys for indimail.org using gpg --import option

$ gpg --import software@indimail.org-pubkey.asc
or
$ gpg --import software@indimail.org-pubkey.gpg

Verifying archives

Verify using gpg --verify option

$ gpg --verify indimail-mta-obs.sig indimail-mta-obs.tar.gz
gpg: Signature made Monday 19 April 2021 05:56:21 PM IST
gpg:                using RSA key D0109589C53F52A4B038C0843265BC69E4B2907F
gpg:                issuer "software@indimail.org"
gpg: Good signature from "indimail admin <software@indimail.org>" [ultimate]