chore(aur): improve AUR SSH key handling logic

chore(aur): enhance AUR SSH setup for key handling
* Improve SSH key handling with support for raw, escaped, and base64-encoded keys * Add validation for AUR_SSH_KEY to ensure it's a valid private key * Update SSH command options for better security and reliability
2026-04-08 17:19:13 +02:00 · 2026-04-08 17:02:10 +02:00 · 2026-04-08 16:39:06 +02:00 · 2026-04-08 15:41:35 +02:00 · 2026-04-08 15:29:21 +02:00 · 2026-04-08 15:23:10 +02:00
7 changed files with 443 additions and 3 deletions
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -91,3 +91,199 @@ jobs:
          done
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  pkg-aur:
+    needs: release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Publish to AUR
+        env:
+          AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }}
+        run: |
+          set -euo pipefail
+
+          VERSION="${{ github.event.inputs.tag || github.ref_name }}"
+          PKGVER="${VERSION#v}"
+          AUR_KEY_PATH="$HOME/.ssh/aur"
+          AUR_KNOWN_HOSTS="$HOME/.ssh/known_hosts"
+
+          # Setup SSH for AUR
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+
+          if [ -z "${AUR_SSH_KEY:-}" ]; then
+            echo "AUR_SSH_KEY is empty"
+            exit 1
+          fi
+
+          # Support raw multiline keys, escaped \\n secrets, or base64-encoded keys.
+          CLEAN_AUR_SSH_KEY="$(printf '%s' "$AUR_SSH_KEY" | tr -d '\r')"
+          if printf '%s' "$CLEAN_AUR_SSH_KEY" | grep -q "^-----BEGIN .*PRIVATE KEY-----$"; then
+            printf '%s\n' "$CLEAN_AUR_SSH_KEY" > "$AUR_KEY_PATH"
+          elif printf '%s' "$CLEAN_AUR_SSH_KEY" | grep -q '\\n'; then
+            printf '%b\n' "$CLEAN_AUR_SSH_KEY" > "$AUR_KEY_PATH"
+          else
+            if printf '%s' "$CLEAN_AUR_SSH_KEY" | tr -d '[:space:]' | base64 --decode > "$AUR_KEY_PATH" 2>/dev/null; then
+              :
+            else
+              printf '%s\n' "$CLEAN_AUR_SSH_KEY" > "$AUR_KEY_PATH"
+            fi
+          fi
+          chmod 600 "$AUR_KEY_PATH"
+
+          if ! ssh-keygen -y -f "$AUR_KEY_PATH" >/dev/null 2>&1; then
+            echo "AUR_SSH_KEY is not a valid private key."
+            echo "Store it as a raw private key, an escaped private key with \\n, or a base64-encoded private key."
+            exit 1
+          fi
+
+          ssh-keyscan -t rsa,ed25519 aur.archlinux.org >> "$AUR_KNOWN_HOSTS"
+          chmod 644 "$AUR_KNOWN_HOSTS"
+
+          # Clone AUR repo
+          GIT_SSH_COMMAND="ssh -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$AUR_KNOWN_HOSTS -i $AUR_KEY_PATH" \
+            git clone ssh://aur@aur.archlinux.org/unitdore.git aur-repo
+
+          # Compute SHA256 of the release tarball (same URL the PKGBUILD will download)
+          SHA=$(curl -fsSL "https://git.warky.dev/wdevs/unitdore/archive/v${PKGVER}.zip" | sha256sum | cut -d' ' -f1)
+
+          # Update PKGBUILD — keep remote source URL, only bump version and checksum
+          sed -e "s/^pkgver=.*/pkgver=${PKGVER}/" \
+              -e "s/^pkgrel=.*/pkgrel=1/" \
+              -e "s/^sha256sums=.*/sha256sums=('${SHA}')/" \
+              pkg/arch/PKGBUILD > aur-repo/PKGBUILD
+
+          # Generate .SRCINFO inside an Arch container (docker cp avoids DinD volume mount issues)
+          CID=$(docker run -d archlinux:latest sleep infinity)
+          docker cp aur-repo/PKGBUILD $CID:/build/PKGBUILD || (docker exec $CID mkdir -p /build && docker cp aur-repo/PKGBUILD $CID:/build/PKGBUILD)
+          docker exec $CID bash -c "
+            pacman -Sy --noconfirm base-devel &&
+            useradd -m builder &&
+            chown -R builder:builder /build &&
+            runuser -u builder -- bash -c 'cd /build && makepkg --printsrcinfo > .SRCINFO'
+          "
+          docker cp $CID:/build/.SRCINFO aur-repo/.SRCINFO
+          docker rm -f $CID
+
+          # Commit and push to AUR master
+          cd aur-repo
+          git config user.email "hein@warky.dev"
+          git config user.name "Hein"
+          git add PKGBUILD .SRCINFO
+          git commit -m "Update to v${PKGVER}"
+          GIT_SSH_COMMAND="ssh -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$AUR_KNOWN_HOSTS -i $AUR_KEY_PATH" \
+            git push origin HEAD:master
+
+  pkg-deb:
+    needs: release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Build Debian packages
+        run: |
+          VERSION="${{ github.event.inputs.tag || github.ref_name }}"
+          PKGVER="${VERSION#v}"
+
+          for GOARCH in amd64 arm64; do
+            GOOS=linux GOARCH=$GOARCH go build \
+              -trimpath \
+              -ldflags "-X main.version=${PKGVER}" \
+              -o unitdore .
+
+            PKGDIR="unitdore_${PKGVER}_${GOARCH}"
+            mkdir -p "${PKGDIR}/DEBIAN"
+            mkdir -p "${PKGDIR}/usr/bin"
+            mkdir -p "${PKGDIR}/usr/share/man/man1"
+            mkdir -p "${PKGDIR}/etc/unitdore"
+
+            install -m755 unitdore "${PKGDIR}/usr/bin/unitdore"
+            install -m644 docs/unitdore.1 "${PKGDIR}/usr/share/man/man1/unitdore.1"
+
+            sed -e "s/VERSION/${PKGVER}/" \
+                -e "s/ARCH/${GOARCH}/" \
+                pkg/debian/control > "${PKGDIR}/DEBIAN/control"
+
+            dpkg-deb --build --root-owner-group "${PKGDIR}"
+            echo "Built ${PKGDIR}.deb"
+          done
+
+      - name: Upload to release
+        run: |
+          TAG="${{ github.event.inputs.tag || github.ref_name }}"
+          RELEASE=$(curl -s "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}" \
+            -H "Authorization: token ${GITHUB_TOKEN}")
+          UPLOAD_URL=$(echo "$RELEASE" | grep -o '"upload_url":"[^"]*"' | cut -d'"' -f4)
+          for f in *.deb; do
+            FNAME=$(basename "$f")
+            echo "Uploading $FNAME..."
+            curl -s -X POST "${UPLOAD_URL}?name=${FNAME}" \
+              -H "Authorization: token ${GITHUB_TOKEN}" \
+              -H "Content-Type: application/octet-stream" \
+              --data-binary "@${f}" > /dev/null
+          done
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  pkg-rpm:
+    needs: release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Build RPM
+        run: |
+          VERSION="${{ github.event.inputs.tag || github.ref_name }}"
+          PKGVER="${VERSION#v}"
+
+          # Source tarball — prefix=unitdore-VERSION/ matches RPM %autosetup convention
+          git archive --format=tar.gz --prefix=unitdore-${PKGVER}/ HEAD \
+            > unitdore-${PKGVER}.tar.gz
+
+          # Patch spec version
+          sed -i "s/^Version:.*/Version:        ${PKGVER}/" pkg/centos/unitdore.spec
+
+          mkdir -p pkg/centos/out
+          docker run --rm \
+            -v "$PWD:/workspace" \
+            -v "$PWD/pkg/centos/out:/out" \
+            -w /workspace \
+            rockylinux:9 \
+            bash -c "
+              dnf install -y rpm-build git curl &&
+              GO_VER=\$(grep '^go ' /workspace/go.mod | awk '{print \$2}') &&
+              curl -fsSL https://go.dev/dl/go\${GO_VER}.linux-amd64.tar.gz | tar -C /usr/local -xz &&
+              export PATH=\$PATH:/usr/local/go/bin &&
+              mkdir -p ~/rpmbuild/{BUILD,BUILDROOT,RPMS,SOURCES,SPECS,SRPMS} &&
+              cp unitdore-${PKGVER}.tar.gz ~/rpmbuild/SOURCES/ &&
+              cp pkg/centos/unitdore.spec ~/rpmbuild/SPECS/ &&
+              rpmbuild --nodeps -ba ~/rpmbuild/SPECS/unitdore.spec &&
+              find ~/rpmbuild/RPMS -name '*.rpm' -exec cp {} /out/ \;
+            "
+
+      - name: Upload to release
+        run: |
+          TAG="${{ github.event.inputs.tag || github.ref_name }}"
+          RELEASE=$(curl -s "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}" \
+            -H "Authorization: token ${GITHUB_TOKEN}")
+          UPLOAD_URL=$(echo "$RELEASE" | grep -o '"upload_url":"[^"]*"' | cut -d'"' -f4)
+          for f in pkg/centos/out/*.rpm; do
+            FNAME=$(basename "$f")
+            echo "Uploading $FNAME..."
+            curl -s -X POST "${UPLOAD_URL}?name=${FNAME}" \
+              -H "Authorization: token ${GITHUB_TOKEN}" \
+              -H "Content-Type: application/octet-stream" \
+              --data-binary "@${f}" > /dev/null
+          done
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
--- a/6
+++ b/6
@@ -12,16 +12,18 @@ all: build
 build:
 	go build $(LDFLAGS) -o $(BINARY) .

-## install: install binary and create config dir
+## install: install binary, man page, and create config dir
 install: build
 	install -Dm755 $(BINARY) $(INSTALL_DIR)/$(BINARY)
+	install -Dm644 docs/unitdore.1 /usr/share/man/man1/unitdore.1
 	mkdir -p $(CONFIG_DIR)
 	@echo "Installed to $(INSTALL_DIR)/$(BINARY)"
 	@echo "Config dir: $(CONFIG_DIR)"

-## uninstall: remove binary
+## uninstall: remove binary and man page
 uninstall:
 	rm -f $(INSTALL_DIR)/$(BINARY)
+	rm -f /usr/share/man/man1/unitdore.1
 	@echo "Removed $(INSTALL_DIR)/$(BINARY)"

 ## test: run all unit tests
--- a/docs/unitdore.1
+++ b/docs/unitdore.1
@@ -0,0 +1,143 @@
+.TH UNITDORE 1 "2026-04-08" "0.1.0" "User Commands"
+.SH NAME
+unitdore \- manage container units via systemd
+.SH SYNOPSIS
+.B unitdore
+[\fB\-\-config\fR \fIpath\fR]
+\fIcommand\fR
+[\fIarguments\fR]
+.SH DESCRIPTION
+.B unitdore
+bridges your container runtime (Podman, Docker) and systemd.
+It discovers running containers, stores them in a config file, and generates
+and manages systemd \fI.service\fR units for each one.
+.SH OPTIONS
+.TP
+.BR \-\-config " " \fIpath\fR
+Path to the units config file. Default: \fI/etc/unitdore/units.yaml\fR
+.SH COMMANDS
+.TP
+.B syncup
+Query all available runtimes for running containers and add any new ones to
+the config. Reconciles existing entries: if a configured unit's container no
+longer exists it is marked disabled with a reason.
+.TP
+.B install
+Generate \fI.service\fR files for all enabled units and write them to the
+appropriate systemd directory. Use \fB\-\-dry\-run\fR to preview without writing.
+.TP
+.B uninstall \fIname\fR
+Disable, stop, and remove the service file for a specific unit.
+.TP
+.B startall
+Run \fBsystemctl enable \-\-now\fR for all enabled, installed units in startup
+order.
+.TP
+.B stopall
+Run \fBsystemctl disable \-\-now\fR for all installed units in reverse startup
+order.
+.TP
+.B start \fIname\fR
+Start a specific unit by name (\fBsystemctl start\fR).
+.TP
+.B stop \fIname\fR
+Stop a specific unit by name (\fBsystemctl stop\fR).
+.TP
+.B update \fIname\fR
+Update a unit's config and recreate its service file.
+.RS
+.TP
+.BR \-\-order " " \fIn\fR
+Set the startup order.
+.TP
+.B \-\-enable
+Enable the unit.
+.TP
+.B \-\-disable
+Disable the unit.
+.RE
+.TP
+.B status
+Print a summary table of all managed units showing runtime, user, enabled
+state, installed state, systemd active state, and disabled reason.
+.TP
+.B list
+Print a table of all tracked units including the path to each service file.
+.TP
+.B edit
+Open the units config file in \fB$EDITOR\fR. Falls back to \fBnvim\fR,
+\fBnano\fR, \fBvi\fR in that order.
+.SH CONFIG FILE
+.B Location:
+\fI/etc/unitdore/units.yaml\fR
+.PP
+.nf
+prefix: ""         # prepended to all service names, e.g. "prod-"
+suffix: ""         # appended to all service names, e.g. "-svc"
+service_user: ""   # User= in [Service]; defaults to current OS user
+
+units:
+  - name: nginx
+    runtime: podman       # podman | docker
+    user: ""              # empty = system unit; set for rootless user unit
+    command: ""           # optional: override ExecStart
+    order: 1              # startup order (lower = earlier)
+    delay: 0s             # delay after previous order group
+    enabled: true
+    disabled_reason: ""   # auto-set by syncup reconciliation
+.fi
+.SH GENERATED SERVICE FILES
+System units are written to \fI/etc/systemd/system/\fR and user units to
+\fI~/.config/systemd/user/\fR.
+Service names follow the pattern:
+.PP
+.RS
+\fBunitdore-\fR[\fIprefix\fR]\fIname\fR[\fIsuffix\fR]\fB.service\fR
+.RE
+.SH EXAMPLES
+Discover containers and install their service files:
+.PP
+.RS
+.nf
+sudo unitdore syncup
+sudo unitdore install
+sudo unitdore startall
+.fi
+.RE
+.PP
+Preview generated service files without writing:
+.PP
+.RS
+sudo unitdore install \-\-dry\-run
+.RE
+.PP
+Start a single container unit:
+.PP
+.RS
+sudo unitdore start nginx
+.RE
+.PP
+Change startup order and re\-apply service file:
+.PP
+.RS
+sudo unitdore update nginx \-\-order 2
+.RE
+.SH FILES
+.TP
+.I /etc/unitdore/units.yaml
+Default configuration file.
+.TP
+.I /etc/systemd/system/unitdore-*.service
+Generated system unit files.
+.TP
+.I ~/.config/systemd/user/unitdore-*.service
+Generated rootless user unit files.
+.SH REQUIREMENTS
+systemd; Podman and/or Docker (only installed runtimes are used).
+Root is required for system units; the relevant user for rootless units.
+.SH SEE ALSO
+.BR systemctl (1),
+.BR podman (1),
+.BR docker (1)
+.SH AUTHORS
+Hein (Warky Devs) \(em https://warky.dev
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/warkanum/unitdore

-go 1.26.1
+go 1.23.0

 require (
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
--- a/pkg/arch/PKGBUILD
+++ b/pkg/arch/PKGBUILD
@@ -0,0 +1,44 @@
+# Maintainer: Hein (Warky Devs) <hein@warky.dev>
+pkgname=unitdore
+pkgver=0.1.0
+pkgrel=1
+pkgdesc="A door you open and close for container units — manage containers via systemd"
+arch=('x86_64' 'aarch64')
+url="https://git.warky.dev/wdevs/unitdore"
+license=('MIT')
+depends=('systemd')
+optdepends=(
+    'podman: Podman container runtime support'
+    'docker: Docker container runtime support'
+)
+makedepends=('go')
+backup=('etc/unitdore/units.yaml')
+source=("$pkgname-$pkgver.zip::$url/archive/v$pkgver.zip")
+sha256sums=('SKIP')
+
+build() {
+    cd "$pkgname-v$pkgver"
+    export CGO_ENABLED=0
+    go build \
+        -trimpath \
+        -ldflags "-X main.version=$pkgver" \
+        -o "$pkgname" .
+}
+
+check() {
+    cd "$pkgname-v$pkgver"
+    go test ./...
+}
+
+package() {
+    cd "$pkgname-v$pkgver"
+
+    # Binary
+    install -Dm755 "$pkgname" "$pkgdir/usr/bin/$pkgname"
+
+    # Man page
+    install -Dm644 docs/unitdore.1 "$pkgdir/usr/share/man/man1/unitdore.1"
+
+    # Default config dir
+    install -dm755 "$pkgdir/etc/unitdore"
+}
--- a/pkg/centos/unitdore.spec
+++ b/pkg/centos/unitdore.spec
@@ -0,0 +1,45 @@
+Name:           unitdore
+Version:        0.1.0
+Release:        1%{?dist}
+Summary:        Manage container units via systemd
+
+License:        MIT
+URL:            https://git.warky.dev/wdevs/unitdore
+Source0:        %{name}-%{version}.tar.gz
+
+BuildRequires:  golang >= 1.23
+Requires:       systemd
+
+%description
+Unitdore bridges your container runtime (Podman, Docker) and systemd.
+It discovers running containers, stores them in a config file, and generates
+and manages systemd .service units for each one.
+
+%prep
+%autosetup
+
+%build
+export CGO_ENABLED=0
+go build \
+    -trimpath \
+    -ldflags "-X main.version=%{version}" \
+    -o %{name} .
+
+%install
+# Binary
+install -Dm755 %{name} %{buildroot}%{_bindir}/%{name}
+
+# Man page
+install -Dm644 docs/unitdore.1 %{buildroot}%{_mandir}/man1/unitdore.1
+
+# Config dir
+install -dm755 %{buildroot}%{_sysconfdir}/unitdore
+
+%files
+%{_bindir}/%{name}
+%{_mandir}/man1/unitdore.1*
+%dir %{_sysconfdir}/unitdore
+
+%changelog
+* Tue Apr 08 2026 Hein (Warky Devs) <hein@warky.dev> - 0.1.0-1
+- Initial package
--- a/pkg/debian/control
+++ b/pkg/debian/control
@@ -0,0 +1,10 @@
+Package: unitdore
+Version: VERSION
+Architecture: ARCH
+Maintainer: Hein (Warky Devs) <hein@warky.dev>
+Depends: systemd
+Recommends: podman | docker.io
+Description: A door you open and close for container units
+ Unitdore bridges your container runtime (Podman, Docker) and systemd.
+ It discovers running containers, stores them in a config file, and generates
+ and manages systemd .service units for each one.
Author	SHA1	Message	Date
Hein	77b86dc3fc	chore(aur): improve AUR SSH key handling logic Some checks failed Release / test (push) Successful in -30m41s Details Release / pkg-deb (push) Successful in -30m32s Details Release / release (push) Successful in -30m33s Details Release / pkg-rpm (push) Failing after -30m32s Details Release / pkg-aur (push) Successful in -30m34s Details	2026-04-08 17:19:13 +02:00
Hein	0999303cd3	chore(aur): enhance AUR SSH setup for key handling * Improve SSH key handling with support for raw, escaped, and base64-encoded keys * Add validation for AUR_SSH_KEY to ensure it's a valid private key * Update SSH command options for better security and reliability	2026-04-08 17:02:10 +02:00
Hein	384c4592d1	chore(release): remove key content diagnostics from AUR SSH setup	2026-04-08 16:39:06 +02:00
Hein	815bdfed80	chore(release): enhance AUR SSH setup for key handling * Improve SSH key setup by auto-detecting key format * Add diagnostics for key validation and size	2026-04-08 15:41:35 +02:00
Hein	243da39fe3	chore(release): update AUR SSH setup to use base64 decoding	2026-04-08 15:29:21 +02:00
Hein	0a1e768dfe	chore(release): remove Arch package build steps from workflow	2026-04-08 15:23:10 +02:00
Hein	e66f869752	chore(release): update source archive format and URLs Some checks failed Release / test (push) Successful in -30m28s Details Release / release (push) Successful in -29m36s Details Release / pkg-aur (push) Failing after -31m0s Details Release / pkg-arch (push) Failing after -30m36s Details Release / pkg-deb (push) Successful in -30m6s Details Release / pkg-rpm (push) Failing after -30m27s Details * Change source archive from tar.gz to zip for Arch packaging * Update URLs in PKGBUILD and spec files to point to the correct repository	2026-04-08 15:09:33 +02:00
Hein	2c0f51422e	chore(release): update Go version and build requirements * Change Go version to 1.23.0 in go.mod * Update golang build requirement to >= 1.23 in unitdore.spec * Adjust packaging commands for Arch and RPM	2026-04-08 14:51:57 +02:00
Hein	0b34b182a9	feat(release): add packaging support for Arch, Debian, and RPM Some checks failed Release / test (push) Successful in -30m44s Details Release / release (push) Successful in -30m36s Details Release / pkg-arch (push) Failing after -30m14s Details Release / pkg-deb (push) Successful in -30m4s Details Release / pkg-rpm (push) Failing after -28m19s Details * Implement Arch package build process in release workflow * Add Debian and RPM packaging specifications * Include man page installation in Makefile * Create unitdore man page for documentation	2026-04-08 14:28:09 +02:00