Add a 'db-import-keyring' program

It is a bit similar in spirit to the old 'any-to-ours' program.

When db-import-pkg imports archlinux32-keyring, it is only released to
core-i686, but we need it to be available on all architectures.
Currently, this is a manual process.

So, add db-import-keyring which imports *only* the -keyring packages, and
releases them to [libre] on each architecture.

4 files changed, 125 insertions, 0 deletions

diff --git a/db-import-keyring b/db-import-keyring
new file mode 100644
index 0000000..28903ab
--- /dev/null
+++ b/db-import-keyring
@@ -0,0 +1,98 @@
+#!/bin/bash
+# Imports to [libre] specific packages from upstream Arch repos.
+#
+# License: GPLv3
+
+set -euE -o pipefail
+shopt -s extglob globstar nullglob
+source "$(librelib messages)"
+setup_traps
+
+# usage: expac_file <file.db> <expac_args>
+#
+# Uses the ${WORKDIR} global
+expac_file() {
+	local dbfile=$1
+	local args=("${@:2}")
+
+	local reponame=${dbfile##*/}
+	reponame=${reponame%%.*}
+
+	mkdir -p -- "${WORKDIR}/expac/root"
+	cat >"${WORKDIR}/expac/pacman.conf" <<-EOT
+	[options]
+	RootDir = ${WORKDIR}/expac/root
+	DBPath = ${WORKDIR}/expac/root
+
+	[${reponame}]
+	Server = file://$(realpath --no-symlinks -- "${dbfile%/*}")
+	EOT
+
+	fakeroot pacman --config="${WORKDIR}/expac/pacman.conf" -Syy >/dev/null
+	# expac exits with non-zero on emtpy databases, so ignore errors
+	expac --config="${WORKDIR}/expac/pacman.conf" --sync "${args[@]}" || true
+}
+
+# usage: get_repo_rsync_dir <upstream> <tag>
+get_repo_rsync_dir() {
+	if ! grep -q ARCHMIRROR -- "/etc/dbscripts/config.local.$1"; then
+		msg "db-import-keyring.conf: Doesn't look like an upstream: %s" "$1" >&2
+		exit $EXIT_NOTCONFIGURED
+	fi
+	(
+		source "/etc/dbscripts/config.local.$1" >&2
+		printf '%s\n' "${ARCHMIRROR}/$(repo=${2%-*} arch=${2##*-} envsubst '$repo $arch' <<<"$ARCHPATH")"
+	)
+}
+
+main() {
+	if [[ $# -ne 0 ]]; then
+		msg 'usage: %s' "${0##*/}"
+		exit $EXIT_INVALIDARGUMENT
+	fi
+
+	local config_dir
+	config_dir="$(dirname "$(readlink -e "$0")")"
+	source "${config_dir}/config" # for FTP_BASE
+	source "${config_dir}/db-import-keyring.conf" # for KEYRINGS
+
+	WORKDIR=$(mktemp -dt "${0##*/}.XXXXXXXXXX")
+	readonly WORKDIR
+	trap "rm -rf -- ${WORKDIR@Q}" EXIT
+
+	##############################################################
+
+	local fromspec upstream tag pkgname repo repo_rsync_dir from_pkgver to_pkgver filename
+	for fromspec in "${KEYRINGS[@]}"; do
+		msg "Processing %s" "$fromspec"
+		IFS=/ read -r upstream tag pkgname <<<"$fromspec"
+		repo_rsync_dir=$(get_repo_rsync_dir "$upstream" "$tag")
+		repo=${tag%-*}
+
+		# Download the upstream database
+		msg2 'Downloading %s' "${repo_rsync_dir}/${repo}.db"
+		mkdir -p -- "${WORKDIR}/dbs/${upstream}"
+		rsync --no-motd -mrtLH --no-p "${repo_rsync_dir}/${repo}.db" "${WORKDIR}/dbs/${upstream}/${tag}.db"
+
+		# Compare it against the libre database
+		from_pkgver=$(expac_file "${WORKDIR}/dbs/${upstream}/${tag}.db" '%v' "$pkgname")
+		to_pkgver=$(expac_file "${FTP_BASE}/libre/os/x86_64/libre.db" '%v' "$pkgname")
+
+		# And download a new keyring if necessary
+		if [[ "$from_pkgver" == "$to_pkgver" ]]; then
+			msg2 "Up to date: %s == %s" "$from_pkgver" "$to_pkgver"
+		else
+			msg2 "Updating: %s != %s" "$from_pkgver" "$to_pkgver"
+			filename=$(expac_file "${WORKDIR}/dbs/${upstream}/${tag}.db" '%f' "$pkgname")
+			mkdir -p -- "${WORKDIR}/staging/libre/"
+			rsync --no-motd -mrtLH --no-p "${repo_rsync_dir}/${filename}" "${WORKDIR}/staging/libre/"
+		fi
+	done
+
+	##############################################################
+
+	msg "Running db-update..."
+	STAGING=${WORKDIR}/staging db-update
+}
+
+main "$@"
diff --git a/db-import-keyring.conf b/db-import-keyring.conf
new file mode 100644
index 0000000..8e78ff8
--- /dev/null
+++ b/db-import-keyring.conf
@@ -0,0 +1,7 @@
+#!/hint/bash
+
+KEYRINGS=(
+	# Format is "UPSTREAM/TAG/PKGNAME"
+	archlinux32/core-i686/archlinux32-keyring
+	archlinuxarm/core-armv7h/archlinuxarm-keyring
+)
diff --git a/systemd/db-import-keyring.service b/systemd/db-import-keyring.service
new file mode 100644
index 0000000..96ec7bd
--- /dev/null
+++ b/systemd/db-import-keyring.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=db-import-keyring
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=oneshot
+User=repo
+ExecStart=/usr/bin/db-import-keyring
+
+PrivateTmp=true
diff --git a/systemd/db-import-keyring.timer b/systemd/db-import-keyring.timer
new file mode 100644
index 0000000..3818733
--- /dev/null
+++ b/systemd/db-import-keyring.timer
@@ -0,0 +1,9 @@
+[Unit]
+Description=Daily db-import-keyring
+
+[Timer]
+OnCalendar=daily
+Persistent=true
+
+[Install]
+WantedBy=timers.target