Skip deb package signing on PR builds; use rm -f for man-db auto-update removal#845
Merged
Conversation
…te removal Secrets (GPG_KEY, GPG_PW) aren't available on PRs from forks, causing the GPG import step to fail with "no valid OpenPGP data found". Guard the import on master only and skip debsign when no GPG ID is provided so PRs still validate the deb build. The man-db auto-update file no longer exists on current GitHub runner images, so the unconditional rm fails the build. Use -f so the step is idempotent across runner image versions.
Member
Author
|
@ibauersachs All the non-amd64 builds are failing with Has some cert expired on your private repo? |
Member
Author
Actually there's an earlier error like so I'm wondering if maybe your repo has dependencies on old versions or something? |
Member
Uh, no? It's Let's Encrypt cert and seems valid in browers. I would assume that the ca-certificates package is missing or outdated on the runners / docker images and thus fails to chain to the current ca root. |
Member
The only packages that should be in my repo are libjitsi and libjitsi-lgpl-dependencies. This looks more like an apt failure with a complicated dependency chain. I saw these before. I would suggest to simply disable the .deb builds for Jitsi Desktop. I cannot imagine that they still work anywhere with all the breaking changes in newer ffmpeg versions. |
The sbuild chroot is created from a minimal debootstrap base, which does not include ca-certificates. apt inside the chroot therefore has no trust store and cannot verify the Let's Encrypt cert on nexus.ingo.ch when fetching the jitsi-desktop-unstable repo, failing with "No system certificates available". Bake ca-certificates into the chroot via mk-sbuild --debootstrap-include, and bump the chroot cache key so existing CA-less chroots are not reused.
The jitsi-desktop-unstable apt repo at nexus.ingo.ch is missing noble/plucky dists, and cross-arch sbuild runs fail to resolve aptitude's deps. Skip the whole deb matrix until both are sorted; the dependent release job will skip automatically.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is the same as #844, but not off a forked repo.
Secrets (GPG_KEY, GPG_PW) aren't available on PRs from forks, causing the GPG import step to fail with "no valid OpenPGP data found". Guard the import on master only and skip debsign when no GPG ID is provided so PRs still validate the deb build.
The man-db auto-update file no longer exists on current GitHub runner images, so the unconditional rm fails the build. Use -f so the step is idempotent across runner image versions.