bb719e7c807c13febbb584c37f7b73a6f24743c5
A fresh chroot download failed with mmdebstrap unable to copy the keyrings: its unshare-mode hooks run under an identity that cannot read the invoking user's private directories, so the 0700 cache directory the module created broke the trusted.gpg.d setup hook with 'Permission denied' (builds reusing an already-cached tarball never hit the path). Create the cache 0755 and chmod the keyrings 0644 instead. The planting guard does not weaken: cached keyrings are trusted as-is, and validate_keyring_dir keeps refusing directories that are not owned by the current user or are writable by group or others — read access for the bootstrap tool is not a planting vector. Legacy 0700 cache directories are validated as before, then widened.
pkh
pkh is a packaging helper for Debian/Ubuntu packages.
Usage and features
Basic concepts
pkh aims at wrapping the different debian tools and workflows
(git, git-ubuntu, pull-debian-sources, pull-lp-sources, pull-ppa-sources,
dch, dpkg-buildpackage, sbuild, dpkg-source, quilt, ...) into one tool, that
would have the same interface for everything, while being smarter at integrating all workflows.
Thus, pkh uses similar options for all subcommands (with very few command-specific options):
Options:
-s, --series <series> Target package distribution series
-d, --dist <dist> Target package distribution (debian, ubuntu)
-v, --version <version> Target package version
-a, --arch <arch> Target architecture (amd64, arm64, riscv64, ...)
-p, --pocket <pocket> Target distribution pocket (updates, security, proposed, ...)
--ppa <ppa> Do the action in/for a specific PPA
Commands and workflows include:
Commands:
pull Pull a source package from the archive or git
chlog Auto-generate changelog entry, editing it, committing it afterwards
build Build the source package (into a .dsc)
deb Build the source package into binary package (.deb)
put Upload the built source package to a PPA
help Print this message or the help of the given subcommand(s)
Examples
A typical workflow to patch an Ubuntu package hello on the development release could be:
# Obtain the package source
git ubuntu clone hello
cd hello
# Apply the patch to the package
...
dpkg-source --commit
# Increment version number
dch
# Test that the patch builds
git ubuntu export-orig
dpkg-buildpackage -S -I -i -nc -d
sbuild --dist resolute --arch amd64 ../hello_xxx.dsc
# Upload the package to a ppa
dput ppa:user/hello_xxx ../hello_xxx_source.changes
# Commit the changes to git
git add debian/patches/xxx.patch
git commit -m "Applied patch xxx"
git add debian/changelog
git commit -m "changelog"
git checkout -b xxx
git push xxx user-fork
That is a lot of different tools and operations. With pkh, the same workflow:
# Obtain the package source (and orig tarball)
pkh pull hello # needs -d ubuntu if you are not running Ubuntu
# Apply the patch to the package
...
pkh commit -m "Applied patch xxx"
pkh chlog
# Test that the package builds
pkh build
pkh deb
# Upload the package to a ppa
pkh put --ppa user/hello_xxx
# Push previously commited changes
git push xxx user-fork
Roadmap: features needed for 1.0
Basically, wrapping the basic debian workflows. Missing features:
pkh pull- Obtain package sources from git
- Obtain package sources from the archive (fallback)
- Obtain package source from PPA (--ppa)
- Obtain a specific version of the package
- Fetch the correct git branch for series on Ubuntu
- Try to fetch the correct git branch for series on Debian, or fallback to the archive
pkh chlog- Auto-generate changelog entry
- Extra flags: backport, non-maintainer upload, no change rebuild, ...
- Commit changelog entry
pkh build- Build the source package
pkh deb- Build the binary package
- Build for a specific architecture
- Three build modes:
- Build locally (discouraged)
- Build using unshare chroot, with binary emulation (default)
- Cross-compilation
- Async build
pkh status- Show build status
pkh put- Upload the source package to a PPA (native SFTP, no
dputdependency) - Upload the source package to the archive
- Upload the source package to a PPA (native SFTP, no
pkh commit- Commit the changes to git
pkh lint- Lint the package
pkh test- Run autopkgtest
- Provide options: local (discouraged), chroot, VM?, ppa
- Async test
Nice-to-have features
- 'pkh pull'
- Cache the Sources.gz files, to improve speed
- Work in an already downloaded package, to git pull and re-fetch orig tar gz
- 'pkh context'
- Select, add, remove, list contexts
- Context-scoped command execution
- Context-scoped deb and test commands
- Per-architecture contexts
- Per-series contexts
- ssh contexts
- docker, lxc contexts?
- context push, context pop: context stack
Languages
Rust
99.9%
Go Template
0.1%