chore(aur): improve AUR SSH key handling logic

* Improve SSH key handling with support for raw, escaped, and base64-encoded keys
* Add validation for AUR_SSH_KEY to ensure it's a valid private key
* Update SSH command options for better security and reliability

.gitea/workflows/release.yml

@@ -92,61 +92,89 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-  pkg-arch:
+  pkg-aur:
     needs: release
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
 
-      - name: Build Arch package
+      - name: Publish to AUR
+        env:
+          AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }}
         run: |
+          set -euo pipefail
+
           VERSION="${{ github.event.inputs.tag || github.ref_name }}"
           PKGVER="${VERSION#v}"
+          AUR_KEY_PATH="$HOME/.ssh/aur"
+          AUR_KNOWN_HOSTS="$HOME/.ssh/known_hosts"
 
-          # Source tarball — prefix=unitdore/ matches `cd "$pkgname"` in PKGBUILD
-          git archive --format=tar.gz --prefix=unitdore/ HEAD \
-            > pkg/arch/unitdore-${PKGVER}.tar.gz
-          SHA=$(sha256sum pkg/arch/unitdore-${PKGVER}.tar.gz | cut -d' ' -f1)
+          # Setup SSH for AUR
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
 
-          # Patch PKGBUILD for local build
-          sed -i \
-            -e "s/^pkgver=.*/pkgver=${PKGVER}/" \
-            -e "s/^sha256sums=.*/sha256sums=('${SHA}')/" \
-            -e "s|source=.*|source=(\"unitdore-\${pkgver}.tar.gz\")|" \
-            pkg/arch/PKGBUILD
+          if [ -z "${AUR_SSH_KEY:-}" ]; then
+            echo "AUR_SSH_KEY is empty"
+            exit 1
+          fi
 
-          mkdir -p pkg/arch/out
-          docker run --rm \
-            -v "$PWD/pkg/arch:/build" \
-            -v "$PWD/pkg/arch/out:/out" \
-            -w /build \
-            archlinux:latest \
-            bash -c "
-              pacman -Syu --noconfirm base-devel go &&
-              useradd -m builder &&
-              chown -R builder:builder /build &&
-              runuser -u builder -- makepkg --noconfirm --noprogressbar &&
-              cp /build/*.pkg.tar.zst /out/
-            "
+          # Support raw multiline keys, escaped \\n secrets, or base64-encoded keys.
+          CLEAN_AUR_SSH_KEY="$(printf '%s' "$AUR_SSH_KEY" | tr -d '\r')"
+          if printf '%s' "$CLEAN_AUR_SSH_KEY" | grep -q "^-----BEGIN .*PRIVATE KEY-----$"; then
+            printf '%s\n' "$CLEAN_AUR_SSH_KEY" > "$AUR_KEY_PATH"
+          elif printf '%s' "$CLEAN_AUR_SSH_KEY" | grep -q '\\n'; then
+            printf '%b\n' "$CLEAN_AUR_SSH_KEY" > "$AUR_KEY_PATH"
+          else
+            if printf '%s' "$CLEAN_AUR_SSH_KEY" | tr -d '[:space:]' | base64 --decode > "$AUR_KEY_PATH" 2>/dev/null; then
+              :
+            else
+              printf '%s\n' "$CLEAN_AUR_SSH_KEY" > "$AUR_KEY_PATH"
+            fi
+          fi
+          chmod 600 "$AUR_KEY_PATH"
 
-      - name: Upload to release
-        run: |
-          TAG="${{ github.event.inputs.tag || github.ref_name }}"
-          RELEASE=$(curl -s "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}" \
-            -H "Authorization: token ${GITHUB_TOKEN}")
-          UPLOAD_URL=$(echo "$RELEASE" | grep -o '"upload_url":"[^"]*"' | cut -d'"' -f4)
-          for f in pkg/arch/out/*.pkg.tar.zst; do
-            FNAME=$(basename "$f")
-            echo "Uploading $FNAME..."
-            curl -s -X POST "${UPLOAD_URL}?name=${FNAME}" \
-              -H "Authorization: token ${GITHUB_TOKEN}" \
-              -H "Content-Type: application/octet-stream" \
-              --data-binary "@${f}" > /dev/null
-          done
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          if ! ssh-keygen -y -f "$AUR_KEY_PATH" >/dev/null 2>&1; then
+            echo "AUR_SSH_KEY is not a valid private key."
+            echo "Store it as a raw private key, an escaped private key with \\n, or a base64-encoded private key."
+            exit 1
+          fi
+
+          ssh-keyscan -t rsa,ed25519 aur.archlinux.org >> "$AUR_KNOWN_HOSTS"
+          chmod 644 "$AUR_KNOWN_HOSTS"
+
+          # Clone AUR repo
+          GIT_SSH_COMMAND="ssh -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$AUR_KNOWN_HOSTS -i $AUR_KEY_PATH" \
+            git clone ssh://aur@aur.archlinux.org/unitdore.git aur-repo
+
+          # Compute SHA256 of the release tarball (same URL the PKGBUILD will download)
+          SHA=$(curl -fsSL "https://git.warky.dev/wdevs/unitdore/archive/v${PKGVER}.zip" | sha256sum | cut -d' ' -f1)
+
+          # Update PKGBUILD — keep remote source URL, only bump version and checksum
+          sed -e "s/^pkgver=.*/pkgver=${PKGVER}/" \
+              -e "s/^pkgrel=.*/pkgrel=1/" \
+              -e "s/^sha256sums=.*/sha256sums=('${SHA}')/" \
+              pkg/arch/PKGBUILD > aur-repo/PKGBUILD
+
+          # Generate .SRCINFO inside an Arch container (docker cp avoids DinD volume mount issues)
+          CID=$(docker run -d archlinux:latest sleep infinity)
+          docker cp aur-repo/PKGBUILD $CID:/build/PKGBUILD || (docker exec $CID mkdir -p /build && docker cp aur-repo/PKGBUILD $CID:/build/PKGBUILD)
+          docker exec $CID bash -c "
+            pacman -Sy --noconfirm base-devel &&
+            useradd -m builder &&
+            chown -R builder:builder /build &&
+            runuser -u builder -- bash -c 'cd /build && makepkg --printsrcinfo > .SRCINFO'
+          "
+          docker cp $CID:/build/.SRCINFO aur-repo/.SRCINFO
+          docker rm -f $CID
+
+          # Commit and push to AUR master
+          cd aur-repo
+          git config user.email "hein@warky.dev"
+          git config user.name "Hein"
+          git add PKGBUILD .SRCINFO
+          git commit -m "Update to v${PKGVER}"
+          GIT_SSH_COMMAND="ssh -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$AUR_KNOWN_HOSTS -i $AUR_KEY_PATH" \
+            git push origin HEAD:master
 
   pkg-deb:
     needs: release
@@ -232,11 +260,14 @@ jobs:
             -w /workspace \
             rockylinux:9 \
             bash -c "
-              dnf install -y rpm-build golang git &&
+              dnf install -y rpm-build git curl &&
+              GO_VER=\$(grep '^go ' /workspace/go.mod | awk '{print \$2}') &&
+              curl -fsSL https://go.dev/dl/go\${GO_VER}.linux-amd64.tar.gz | tar -C /usr/local -xz &&
+              export PATH=\$PATH:/usr/local/go/bin &&
               mkdir -p ~/rpmbuild/{BUILD,BUILDROOT,RPMS,SOURCES,SPECS,SRPMS} &&
               cp unitdore-${PKGVER}.tar.gz ~/rpmbuild/SOURCES/ &&
               cp pkg/centos/unitdore.spec ~/rpmbuild/SPECS/ &&
-              rpmbuild -ba ~/rpmbuild/SPECS/unitdore.spec &&
+              rpmbuild --nodeps -ba ~/rpmbuild/SPECS/unitdore.spec &&
               find ~/rpmbuild/RPMS -name '*.rpm' -exec cp {} /out/ \;
             "
 

go.mod

@@ -1,6 +1,6 @@
 module github.com/warkanum/unitdore
 
-go 1.26.1
+go 1.23.0
 
 require (
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect

pkg/arch/PKGBUILD

@@ -4,7 +4,7 @@ pkgver=0.1.0
 pkgrel=1
 pkgdesc="A door you open and close for container units — manage containers via systemd"
 arch=('x86_64' 'aarch64')
-url="https://warky.dev"
+url="https://git.warky.dev/wdevs/unitdore"
 license=('MIT')
 depends=('systemd')
 optdepends=(
@@ -13,11 +13,11 @@ optdepends=(
 )
 makedepends=('go')
 backup=('etc/unitdore/units.yaml')
-source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz")
+source=("$pkgname-$pkgver.zip::$url/archive/v$pkgver.zip")
 sha256sums=('SKIP')
 
 build() {
-    cd "$pkgname"
+    cd "$pkgname-v$pkgver"
     export CGO_ENABLED=0
     go build \
         -trimpath \
@@ -26,12 +26,12 @@ build() {
 }
 
 check() {
-    cd "$pkgname"
+    cd "$pkgname-v$pkgver"
     go test ./...
 }
 
 package() {
-    cd "$pkgname"
+    cd "$pkgname-v$pkgver"
 
     # Binary
     install -Dm755 "$pkgname" "$pkgdir/usr/bin/$pkgname"

pkg/centos/unitdore.spec

@@ -4,10 +4,10 @@ Release:        1%{?dist}
 Summary:        Manage container units via systemd
 
 License:        MIT
-URL:            https://warky.dev
+URL:            https://git.warky.dev/wdevs/unitdore
 Source0:        %{name}-%{version}.tar.gz
 
-BuildRequires:  golang >= 1.21
+BuildRequires:  golang >= 1.23
 Requires:       systemd
 
 %description