owen
981587e83d
urapt is a self-hostable APT repository server with a companion CLI for pushing and managing Debian .deb packages. Server (urapt-server): - REST API + APT endpoint, SQLite storage (pure-Go modernc driver, no CGO) - .deb files stored content-addressed on disk, reference-counted for dedup - Server-managed RSA-4096 OpenPGP signing key (ProtonMail/go-crypto) - APT indices (Release/InRelease/Packages[.gz/.xz]) generated on demand from the DB, cached in memory, signed with the server key - Full APT model: repositories -> distributions -> components -> architectures - Bearer-token auth for REST; HTTP Basic auth for private-repo APT reads - First registrant becomes admin; repo-scoped permissions (read/write/read-write/admin) plus owner and server-admin roles - Multipart package push with control-field extraction, list/show/delete, pool serving, blob ref-count cleanup - Audit log CLI (urapt): - register/login/logout/whoami, token management - repo/distro/component/arch CRUD, member management - push/pull/ls/show/rm for packages - apt-config helper that emits apt setup commands (key, sources.list, auth.conf for private repos) Packaging & docs: - Dockerfile (multi-stage distroless), docker-compose.yml, sample config - README quick start, architecture overview, config reference, security notes - PLAN.md design blueprint, CHANGELOG.md, GPL-3.0 LICENSE - GitHub Actions CI (test, lint, cross-build for linux/darwin amd64/arm64) - Makefile release target producing static binaries + tarballs + checksums Tests cover the data-access layer, auth/permission checks, APT index generation, .deb parsing, GPG signing, the REST API, and the typed API client. Verified end-to-end on a Raspberry Pi (arm64) pushing and installing a real package.
54 lines
1.7 KiB
Go
54 lines
1.7 KiB
Go
package store
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
"urapt/shared/models"
|
|
)
|
|
|
|
// SaveGPGKey inserts a GPG key row.
|
|
func (s *Store) SaveGPGKey(ctx context.Context, fingerprint, userID, pubArmored, privArmored string, isDefault bool) (*models.GPGKey, error) {
|
|
id := newID()
|
|
now := s.now()
|
|
_, err := s.exec(ctx, `INSERT INTO gpg_keys (id, fingerprint, user_id, public_key_armored, private_key_armored, is_default, created_at)
|
|
VALUES (?, ?, ?, ?, ?, ?, ?)`,
|
|
id, fingerprint, userID, pubArmored, privArmored, boolToInt(isDefault), now)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("insert gpg key: %w", err)
|
|
}
|
|
return &models.GPGKey{
|
|
ID: id, Fingerprint: fingerprint, UserID: userID,
|
|
PublicKeyArmored: pubArmored, IsDefault: isDefault, CreatedAt: now,
|
|
}, nil
|
|
}
|
|
|
|
// GetDefaultGPGKey returns the default signing key, or ErrNotFound if none.
|
|
func (s *Store) GetDefaultGPGKey(ctx context.Context) (*models.GPGKey, error) {
|
|
row := s.db.QueryRowContext(ctx,
|
|
`SELECT id, fingerprint, user_id, public_key_armored, private_key_armored, is_default, created_at
|
|
FROM gpg_keys WHERE is_default = 1 LIMIT 1`)
|
|
k := &models.GPGKey{}
|
|
var isDefault int
|
|
err := row.Scan(&k.ID, &k.Fingerprint, &k.UserID, &k.PublicKeyArmored, &k.PrivateKeyArmored, &isDefault, &k.CreatedAt)
|
|
if isErrNoRows(err) {
|
|
return nil, ErrNotFound
|
|
}
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
k.IsDefault = isDefault == 1
|
|
return k, nil
|
|
}
|
|
|
|
// GetGPGKeyPublic returns just the armored public key of the default key.
|
|
func (s *Store) GetGPGKeyPublic(ctx context.Context) (string, error) {
|
|
row := s.db.QueryRowContext(ctx, `SELECT public_key_armored FROM gpg_keys WHERE is_default = 1 LIMIT 1`)
|
|
var pub string
|
|
err := row.Scan(&pub)
|
|
if isErrNoRows(err) {
|
|
return "", ErrNotFound
|
|
}
|
|
return pub, err
|
|
}
|