{"id":24649777,"url":"https://github.com/archlinux/releng","last_synced_at":"2026-04-24T20:31:34.644Z","repository":{"id":41392059,"uuid":"284008348","full_name":"archlinux/releng","owner":"archlinux","description":"Arch Linux release engineering (read-only mirror)","archived":false,"fork":false,"pushed_at":"2023-03-01T09:48:54.000Z","size":50,"stargazers_count":6,"open_issues_count":0,"forks_count":8,"subscribers_count":1,"default_branch":"master","last_synced_at":"2026-04-04T12:36:56.098Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://gitlab.archlinux.org/archlinux/releng","language":"Shell","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/archlinux.png","metadata":{"files":{"readme":"README.rst","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2020-07-31T10:27:29.000Z","updated_at":"2026-03-16T10:27:52.000Z","dependencies_parsed_at":"2025-06-28T06:06:37.503Z","dependency_job_id":"81791e28-6148-4769-b7b8-f4abaf9096bb","html_url":"https://github.com/archlinux/releng","commit_stats":null,"previous_names":[],"tags_count":20,"template":false,"template_full_name":null,"purl":"pkg:github/archlinux/releng","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/archlinux%2Freleng","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/archlinux%2Freleng/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/archlinux%2Freleng/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/archlinux%2Freleng/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/archlinux","download_url":"https://codeload.github.com/archlinux/releng/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/archlinux%2Freleng/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32239467,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-24T13:21:15.438Z","status":"ssl_error","status_checked_at":"2026-04-24T13:21:15.005Z","response_time":64,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-01-25T17:20:34.384Z","updated_at":"2026-04-24T20:31:34.628Z","avatar_url":"https://github.com/archlinux.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"======\nreleng\n======\n\nThis repository is used to create release artifacts for Arch Linux.\n\nArtifacts\n=========\n\nReleases of this repository provide artifacts, that are in either of the following two categories: *build artifacts* and\n*promotion artifacts*. For `archweb \u003chttps://github.com/archlinux/archweb/\u003e`_ only releases with *both* artifact types\nare considered.\n\nBuild Artifacts\n---------------\n\nThese artifacts are the output of the build script in this repository (e.g. by running `make` as root, locally). It\ngathers artifacts by:\n\n- running ``mkarchiso`` (`archiso \u003chttps://gitlab.archlinux.org/archlinux/archiso\u003e`_) using the `releng profile\n  \u003chttps://gitlab.archlinux.org/archlinux/archiso/-/tree/master/configs/releng\u003e`_ in all available build modes\n  (``bootstrap``, ``iso``, ``netboot``)\n- copying relevant binaries from the `ipxe package \u003chttps://archlinux.org/packages/community/x86_64/ipxe/\u003e`_\n- creating a codesigned iPXE target script (see `#9 \u003chttps://gitlab.archlinux.org/archlinux/releng/-/issues/9\u003e`_)\n- creating zsync files for large artifacts\n- creating checksums\n\nThe artifacts are assembled in a directory structure, that reflects the artifact type (``bootstrap``, ``ipxe``, ``iso``,\n``netboot``) per-release (i.e. ``\u003ctype\u003e/\u003ctype\u003e-\u003cversion\u003e``).\n\nPromotion Artifacts\n-------------------\n\nThese artifacts are added to a release by a developer, after it has been created to \"promote\" the release to become one\nthat is used on the mirrors. Promotion artifacts encompass:\n\n- detached PGP signatures for the ``iso`` and ``bootstrap`` build artifacts (see `#1\n  \u003chttps://gitlab.archlinux.org/archlinux/releng/-/issues/1\u003e`_)\n- base64-encoded torrent files for the ``iso`` and ``bootstrap`` build artifacts (which include the detached PGP\n  signatures) (see `#5 \u003chttps://gitlab.archlinux.org/archlinux/releng/-/issues/5\u003e`_)\n- a JSON file with required metadata for the release (see `#3\n  \u003chttps://gitlab.archlinux.org/archlinux/releng/-/issues/3\u003e`_)\n\nCode Signing\n============\n\n``mkarchiso`` (`archiso \u003chttps://gitlab.archlinux.org/archlinux/archiso\u003e`_) offers the export of server-side artifacts,\nthat allow for `iPXE \u003chttps://ipxe.org\u003e`_ to use them. The artifacts can optionally be codesigned which can establish a\ntrust path between a client and the server-side files.\n\nHow to establish a code signing authority is explained in the `iPXE upstream documentation \u003chttps://ipxe.org/crypto\u003e`_.\nThe server-side artifacts are signed using a codesigning certificate and key pair. The codesigning certificate is then\nembedded in the iPXE binary and is used during boot to validate the codesigning signature when downloading the file.\n\nAdditionally, CA certificates are embedded in the iPXE binary to validate the TLS connection over which the data is\ntransmitted.\n\n.. code:: sh\n\n           iPXE binary                                   Server\n   xxxxxxxxxxxxxxxxxxxxxxxxxxx               xxxxxxxxxxxxxxxxxxxxxxxxxxxx\n   x       CA cert(s)        x    =====\u003e     x Transport Layer Security x\n   xxxxxxxxxxxxxxxxxxxxxxxxxxx               xxxxxxxxxxxxxxxxxxxxxxxxxxxx\n   x Codesigning Certificate x    =====\u003e     x   Codesigning Signature  x\n   xxxxxxxxxxxxxxxxxxxxxxxxxxx               xxxxxxxxxxxxxxxxxxxxxxxxxxxx\n\nCreate a new Code Signing Key Pair\n----------------------------------\n\n1. Create a new code signing key pair using ``codesigning/create_codesigning_key_pair.sh``.\n2. Embed the codesigning certificate in the binaries generated by `the ipxe\n   package \u003chttps://archlinux.org/packages/community/x86_64/ipxe/\u003e`_ and release a new version of the package.\n3. Add the codesigning certificate and key as `variables of type File\n   \u003chttps://docs.gitlab.com/ee/ci/variables/#project-cicd-variables\u003e`_ to this repository\n   (``SECRET_CODESIGNING_CERT_FILE`` and ``SECRET_CODESIGNING_KEY_FILE``, respectively), so that they can be accessed\n   during build.\n4. Build a new release with the respective artifacts being signed with the new codesigning key and make sure that the\n   release contains the iPXE binaries from the updated package (embedding the new codesigning certificate)\n5. Once all official releases using the previous codesigning key pair have been removed, the previous codesigning\n   certificate can be removed from the ipxe package.\n\nLicense\n=======\n\nReleng is licensed under the terms of the **GPL-3.0-or-later** (see `LICENSE \u003cLICENSE\u003e`_).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Farchlinux%2Freleng","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Farchlinux%2Freleng","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Farchlinux%2Freleng/lists"}