Skip to content

Commit bf0bfd2

Browse files
rjzakrjzak
committed
ci: build linux arm64 for release
Signed-off-by: Richard Zak <[email protected]>
1 parent c8063e3 commit bf0bfd2

File tree

1 file changed

+99
-3
lines changed

1 file changed

+99
-3
lines changed

‎.github/workflows/release.yml‎

Lines changed: 99 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ permissions:
1212
id-token: write
1313

1414
jobs:
15-
linux:
15+
linux_x86:
1616
if: startsWith(github.ref, 'refs/tags/') && github.event_name == 'push'
1717
runs-on: ubuntu-latest
1818
steps:
@@ -36,6 +36,7 @@ jobs:
3636
- name: Setup Rust toolchain
3737
run: |
3838
rustup target install x86_64-unknown-linux-musl
39+
sudo apt-get update
3940
sudo apt-get install -y musl musl-dev musl-tools dpkg-dev liblzma-dev
4041
cargo install cargo-deb cargo-auditable cargo-audit
4142
- id: version
@@ -105,6 +106,79 @@ jobs:
105106
if-no-files-found: error
106107
retention-days: 5
107108

109+
linux_arm:
110+
if: startsWith(github.ref, 'refs/tags/') && github.event_name == 'push'
111+
runs-on: ubuntu-24.04-arm
112+
steps:
113+
- name: Harden Runner
114+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
115+
with:
116+
egress-policy: audit
117+
allowed-endpoints: >
118+
azure.archive.ubuntu.com:80
119+
cdn.fwupd.org:443
120+
crates.io:443
121+
esm.ubuntu.com:443
122+
github.com:443
123+
index.crates.io:443
124+
motd.ubuntu.com:443
125+
ppa.launchpadcontent.net:443
126+
static.crates.io:443
127+
static.rust-lang.org:443
128+
129+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
130+
- name: Setup Rust toolchain
131+
run: |
132+
rustup target install aarch64-unknown-linux-musl
133+
sudo apt-get update
134+
sudo apt-get install -y musl musl-dev musl-tools dpkg-dev liblzma-dev
135+
cargo install cargo-deb cargo-auditable cargo-audit
136+
- id: version
137+
run: echo "version=$(cargo metadata --format-version=1 --no-deps | jq '.packages[] | select(.name == "malwaredb") | .version' --raw-output)" >>$GITHUB_OUTPUT
138+
- name: Install dependencies
139+
run: sudo apt-get install -y libmagic-dev
140+
- name: Install GUI dependencies
141+
run: sudo apt-get install -y libxcb-shape0-dev libxcb-xfixes0-dev libx11-dev libxkbcommon-dev libfontconfig-dev libxext-dev libxft-dev libxinerama-dev libxcursor-dev libxrender-dev libxfixes-dev
142+
- name: Build client
143+
run: cargo auditable build --workspace --bin mdb_client --target aarch64-unknown-linux-musl --release
144+
- name: Package client
145+
run: |
146+
cd client
147+
cargo auditable deb --target aarch64-unknown-linux-musl
148+
- name: Build server
149+
run: cargo auditable build --features=admin,admin-gui,sqlite,vt --bin mdb_server --release
150+
- name: Package server
151+
run: cargo deb --locked --cargo-build 'auditable build' --target aarch64-unknown-linux-gnu
152+
- run: mv target/release/mdb_server target/release/mdb_server_linux_gnu_arm64
153+
- name: Upload mdb_server
154+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
155+
with:
156+
name: mdb_server_linux_gnu_arm64
157+
path: target/release/mdb_server_linux_gnu_arm64
158+
if-no-files-found: error
159+
retention-days: 5
160+
- name: Upload mdb_server deb
161+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
162+
with:
163+
name: "malwaredb_${{ steps.version.outputs.version }}-1_arm64.deb"
164+
path: "target/aarch64-unknown-linux-gnu/debian/malwaredb_${{ steps.version.outputs.version }}-1_arm64.deb"
165+
if-no-files-found: error
166+
retention-days: 5
167+
- run: mv target/aarch64-unknown-linux-musl/release/mdb_client target/aarch64-unknown-linux-musl/release/mdb_client_linux_musl_arm64
168+
- name: Upload mdb_client
169+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
170+
with:
171+
name: mdb_client_linux_musl_arm64
172+
path: target/aarch64-unknown-linux-musl/release/mdb_client_linux_musl_arm64
173+
retention-days: 5
174+
- name: Upload mdb_client deb
175+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
176+
with:
177+
name: "malwaredb-client_${{ steps.version.outputs.version }}-1_arm64.deb"
178+
path: "target/aarch64-unknown-linux-musl/debian/malwaredb-client_${{ steps.version.outputs.version }}-1_arm64.deb"
179+
if-no-files-found: error
180+
retention-days: 5
181+
108182
macos:
109183
if: startsWith(github.ref, 'refs/tags/') && github.event_name == 'push'
110184
runs-on: macos-14
@@ -239,7 +313,7 @@ jobs:
239313

240314
release:
241315
if: startsWith(github.ref, 'refs/tags/') && github.event_name == 'push'
242-
needs: [ windows, macos, linux ]
316+
needs: [ windows, macos, linux_x86, linux_arm ]
243317
runs-on: ubuntu-latest
244318
permissions:
245319
id-token: write
@@ -284,15 +358,27 @@ jobs:
284358
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
285359
with:
286360
name: mdb_server_linux_musl_x86_64
361+
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
362+
with:
363+
name: mdb_server_linux_gnu_arm64
287364
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
288365
with:
289366
name: "malwaredb_${{ steps.version.outputs.version }}-1_amd64.deb"
367+
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
368+
with:
369+
name: "malwaredb_${{ steps.version.outputs.version }}-1_arm64.deb"
290370
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
291371
with:
292372
name: mdb_client_linux_musl_x86_64
373+
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
374+
with:
375+
name: mdb_client_linux_musl_arm64
293376
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
294377
with:
295378
name: "malwaredb-client_${{ steps.version.outputs.version }}-1_amd64.deb"
379+
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
380+
with:
381+
name: "malwaredb-client_${{ steps.version.outputs.version }}-1_arm64.deb"
296382
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
297383
with:
298384
name: sbom.xml
@@ -309,7 +395,7 @@ jobs:
309395
run: |
310396
mkdir ~/.minisign/
311397
echo "${{ secrets.MINISIGN_KEY }}" > ~/.minisign/minisign.key
312-
echo | ./minisign -Sm mdb_* malwaredb* sbom.*
398+
echo | ./minisign -t "MalwareDB ${{ steps.version.outputs.version }}" -Sm mdb_* malwaredb* sbom.*
313399
echo | ./minisign -R
314400
- uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631 # v2.2.2
315401
with:
@@ -333,10 +419,18 @@ jobs:
333419
mdb_server_linux_musl_x86_64.minisig
334420
mdb_client_linux_musl_x86_64
335421
mdb_client_linux_musl_x86_64.minisig
422+
mdb_server_linux_gnu_arm64
423+
mdb_server_linux_gnu_arm64.minisig
424+
mdb_client_linux_musl_arm64
425+
mdb_client_linux_musl_arm64.minisig
336426
malwaredb_${{ steps.version.outputs.version }}-1_amd64.deb
337427
malwaredb_${{ steps.version.outputs.version }}-1_amd64.deb.minisig
338428
malwaredb-client_${{ steps.version.outputs.version }}-1_amd64.deb
339429
malwaredb-client_${{ steps.version.outputs.version }}-1_amd64.deb.minisig
430+
malwaredb_${{ steps.version.outputs.version }}-1_arm64.deb
431+
malwaredb_${{ steps.version.outputs.version }}-1_arm64.deb.minisig
432+
malwaredb-client_${{ steps.version.outputs.version }}-1_arm64.deb
433+
malwaredb-client_${{ steps.version.outputs.version }}-1_arm64.deb.minisig
340434
sbom.xml
341435
sbom.xml.minisig
342436
sbom.json
@@ -355,5 +449,7 @@ jobs:
355449
mdb_client_arm64.exe
356450
mdb_server_linux_musl_x86_64
357451
mdb_client_linux_musl_x86_64
452+
mdb_server_linux_gnu_arm64
453+
mdb_client_linux_musl_arm64
358454
sbom.xml
359455
sbom.json

0 commit comments

Comments
 (0)