Package repositories for rpm and debian packages

This directory contains scripts and definitions for setting up YUM and apt repositories for Linux users to install dragonfly packages.

The repositories are served as static websites. The generate-site workflow is used to set up and deploy the sites using scripts and definitions included here.

The workflow does the following tasks:

• Download the latest 5 releases from dragonfly releases page, specifically deb and rpm assets
  • for deb files, only the latest package is downloaded and present (see note below)
• Set up a directory structure separating deb and rpm files into version specific paths
• Sign the packages (see note on GPG)
• Deploy the assets prepared, along with the public GPG key and repo definitions for apt and rpm tooling

Using the YUM repository

Add the repository using:

sudo dnf config-manager addrepo --from-repofile=https://packages.dragonflydb.io/dragonfly.repo

Then install dragonfly as usual, or a specific version:

sudo dnf -y install dragonfly-0:v1.33.1-1.fc30.x86_64

Using the APT repository

First download the public GPG key to an appropriate location:

sudo curl -Lo /usr/share/keyrings/dragonfly-keyring.public https://packages.dragonflydb.io/pgp-key.public

Then add the sources file:

sudo curl -Lo /etc/apt/sources.list.d/dragonfly.sources https://packages.dragonflydb.io/dragonfly.sources

Finally install dragonfly using apt

sudo apt update && sudo apt install dragonfly

Versions in APT repository

Unlike the yum repo, the apt repo only has the latest version. The reason for this is the tool, reprepro supplied by debian to build repositories only supports multiple versions in version 5.4 onwards, and the github runner using ubuntu-latest does not have this version.

Another option would be to use the components feature of apt repositories in the sources file we ask users to install, but then the versions would need to be hardcoded in the sources file and the user would have to update the file with each new release which makes for a bad user experience. As of now users wanting older packages should download them directly.

Signing packages

The packages are signed using the GPG key imported from the secret GPG_PRIVATE_KEY in this repository.

The corresponding public key is served with site assets, so the apt/yum/dnf based tooling can consume the public key to verify package integrity.

TODO

• debian packages signing (not required? release file is signed)
• debian repo metadata setup
• tests asserting that packages are installable?