feat: deb-ci gate, chroot and PyPI import scripts, package template #1

Merged

navigator merged 8 commits from feat/gate into main 2026-09-30 02:51:22 -03:00

Conversation 0 Commits 8 Files changed 12 +545 -13

navigator commented 2026-09-30 02:15:43 -03:00

Owner

Copy link

The shared gate for every package repository in deb/: source package from the committed tree and pristine-tar, sbuild in a clean trixie chroot (unshare, no root, no Docker), lintian with errors and warnings fatal, autopkgtest against trixie, and an identical second build. Also the chroot script, a PyPI importer that checks the sdist against the published sha256, and the template files. Details in the commit messages and README.

Verified by hand on keel-deb-runner with pyzbar 0.1.9-3~bpo13+keel1: lintian pass, autopkgtest pass (31 passed), identical rebuild.

Tracker: deb/tracker#1, deb/tracker#2.

The shared gate for every package repository in `deb/`: source package from the committed tree and pristine-tar, sbuild in a clean trixie chroot (unshare, no root, no Docker), lintian with errors and warnings fatal, autopkgtest against trixie, and an identical second build. Also the chroot script, a PyPI importer that checks the sdist against the published sha256, and the template files. Details in the commit messages and README. Verified by hand on keel-deb-runner with pyzbar 0.1.9-3~bpo13+keel1: lintian pass, autopkgtest pass (31 passed), identical rebuild. Tracker: deb/tracker#1, deb/tracker#2.

navigator added 2 commits 2026-09-30 02:15:43 -03:00

feat: deb-ci gate, chroot and PyPI import scripts, package template ... fc3fe754ac

deb-ci builds the source package from the committed tree and the
pristine-tar tarball, runs sbuild in a clean trixie chroot (unshare
backend, no root, no Docker), lintian with errors and warnings fatal,
autopkgtest against trixie, and a second build whose .deb files must be
identical. The autopkgtest release is fixed to trixie because sbuild's
%r would follow the changelog (unstable) and test against sid.

deb-ci-chroot writes the chroot tarball atomically from trixie,
trixie-updates and trixie-security. deb-import-pypi accepts only the
sdist and checks it against the sha256 PyPI publishes before gbp
import-orig.

Verified on keel-deb-runner with pyzbar 0.1.9-3~bpo13+keel1: build,
lintian, autopkgtest (31 passed) and an identical rebuild.

ci: shellcheck the scripts on keel-deb-runner 74e23040a0

navigator added 1 commit 2026-09-30 02:27:56 -03:00

fix: gate on the real trixie chroot and on the verdicts, build HEAD untouched ... 3d16d9642e

Review findings on the first version:

- sbuild 0.89 ignores a chroot tarball older than 7 days and bootstraps
  one from the changelog distribution (unstable), so after a week every
  build would have run in sid without a word. Auto-creation and the age
  limit are now off and the tarball is passed by absolute path; deb-ci
  refuses to run without it and prints its age. autopkgtest gets the same
  tarball explicitly.
- git archive applied upstream export-subst and export-ignore, which
  breaks dpkg-source for setuptools-scm projects. HEAD is now checked out
  in a private clone whose info/attributes disables every attribute that
  can change bytes; the changelog is read from that clone, so uncommitted
  edits no longer leak in.
- Lintian and autopkgtest verdicts are read from the build log: lintian
  must be pass or info, autopkgtest pass whenever the package declares
  tests. A skipped lintian no longer passes.
- The sbuild configuration path is resolved through symlinks and must be
  readable; settings a runner's own configuration could inject (extra
  repositories and packages, build environment) are reset.
- The workflows check out GITHUB_SHA and verify it.
- deb-import-pypi maps PEP 440 pre-releases to ~ versions, refuses
  epochs, accepts .tgz and sets up local upstream/pristine-tar branches.
- Traps exit on INT and TERM, --out is resolved before cd, the chroot
  script honours the architecture and XDG_CACHE_HOME, exit code 1 is
  documented.
- The README states what the identical rebuild does and does not prove,
  how a new upstream version reaches CI, and the runner's exposure to
  pull request code.

navigator added 1 commit 2026-09-30 02:28:51 -03:00

ci: selftest the gate on python-ordered-set 4.1.0-1 from Salsa 27d9c2e9a9

navigator added 1 commit 2026-09-30 02:37:52 -03:00

fix: close the remaining review findings ... cea7d21de3

- Autopkgtest counts as passed only with at least one PASS line and no
  SKIP, FLAKY or FAIL: sbuild reports pass for autopkgtest exit 2, which
  includes every test skipped because the unshare backend cannot provide
  isolation-container or isolation-machine.
- DEB_BUILD_OPTIONS and DEB_BUILD_PROFILES are unset, and the sbuild
  settings a runner configuration could change (profiles, dpkg-buildpackage
  options, lintian and autopkgtest commands, apt update and upgrade,
  external commands) are reset.
- Tags are fetched into the private clone, for repositories that build
  the orig tarball from an upstream tag instead of pristine-tar.
- An unreadable changelog exits 3; tests are detected by
  debian/tests/control.
- The chroot age is enforced: a warning after 8 days, a refusal after 31.
- deb-import-pypi maps versions with packaging.version: dev before alpha
  (~~dev), post-releases as +post, and refuses what PEP 440 does not parse
  or what carries an epoch or a local label.

navigator added 1 commit 2026-09-30 02:45:02 -03:00

fix: accept superficial-only autopkgtests, keep upstream release spelling ... 31401e8e7b

- autopkgtest exits 8, which sbuild records as "no tests", when only
  superficial tests passed, as with the import test autodep8 generates
  for Testsuite: autopkgtest-pkg-python. The gate failed every such
  package. It now accepts "no tests" as long as the per-test lines show
  a PASS and nothing skipped, flaky or failed; those lines are read from
  the autopkgtest part of the log only, so build-time test output cannot
  be mistaken for them.
- deb-import-pypi keeps upstream's spelling of the release numbers
  (2021.01.15, 1.01), so the orig tarball and the upstream tag match what
  uscan and Debian use, and refuses any version with both a post and a
  dev part.

navigator added 1 commit 2026-09-30 02:45:25 -03:00

docs: README states the autopkgtest verdicts the gate accepts a3004c13f3

navigator added 1 commit 2026-09-30 02:46:06 -03:00

fix: deb-import-pypi, an apostrophe closed the quoted Python program 4f529f89ca

navigator merged commit ae5b120eb6 into main 2026-09-30 02:51:22 -03:00

navigator referenced this pull request from a commit 2026-09-30 02:51:24 -03:00

Merge pull request 'feat: deb-ci gate, chroot and PyPI import scripts, package template' (#1) from feat/gate into main

navigator referenced this pull request from deb/tracker 2026-09-30 03:16:21 -03:00

Debian packaging of the Odoo 18 + OCA Python libraries #2

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

deb/ci!1

No description provided.