Ship the tool as a .deb, an .rpm and a pacman package

A tarball has to be upgraded by hand and nothing on the machine knows it is
there. Every release now also carries three package formats for both
architectures, so the tool is installed and upgraded the way everything else
on the system is.

The nfpms block puts the binary in /usr/bin, because the package manager owns
it, and README, LICENSE and the example config under /usr/share/doc. It
provides the command name and conflicts with anything else shipping it, so a
second copy is a conflict rather than a silent overwrite.

GoReleaser cannot read tool.json, so the package description is a copy of the
tagline. `make manifest` now also runs the kit's check-nfpm.py, which fails
when the two disagree, and CI runs it on every push.

`install.repo_url` points at the family package repository, which is what the
README's one-time setup is derived from: the one-liner, and next to it the
commands it stands for. The release job tells tui-tools/pkgs that new
packages exist, so the repository rebuilds on release rather than on its
weekly run; the step is inert until PKGS_DISPATCH_TOKEN is set.

Author: edimarlnx

.github/workflows/ci.yml

@@ -129,6 +129,23 @@ jobs:
             --spec=draft2020 -c ajv-formats \
             -s /tmp/tool.schema.json -d tool.json
 
+      # GoReleaser cannot read tool.json, so the package description in
+      # .goreleaser.yaml is a copy of the manifest's tagline. This is what
+      # stops the copy from drifting, and it checks the rest of the package
+      # metadata the family fixed by convention along with it.
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: go.mod
+          check-latest: true
+
+      - name: package metadata matches the manifest
+        run: |
+          python3 -m pip install --quiet --disable-pip-version-check pyyaml
+          go mod download github.com/tui-tools/tui-kit
+          kit=$(go list -m -f '{{.Dir}}' github.com/tui-tools/tui-kit)
+          python3 "$kit/tools/check-nfpm.py" --manifest tool.json \
+            --config .goreleaser.yaml
+
   release:
     name: release
     if: startsWith(github.ref, 'refs/tags/v')
@@ -138,6 +155,10 @@ jobs:
       contents: write
     env:
       SITE_DISPATCH_TOKEN: ${{ secrets.SITE_DISPATCH_TOKEN }}
+      # The package repository builder. PKGS_DISPATCH_TOKEN is the one to
+      # set; SITE_DISPATCH_TOKEN is accepted as a fallback so a single
+      # organization token can drive both rebuilds.
+      PKGS_DISPATCH_TOKEN: ${{ secrets.PKGS_DISPATCH_TOKEN || secrets.SITE_DISPATCH_TOKEN }}
     steps:
       - uses: actions/checkout@v7
         with:
@@ -169,3 +190,17 @@ jobs:
           gh api repos/tui-tools/tui-tools.github.io/dispatches \
             -f event_type=tool-released \
             -f 'client_payload[tool]=tui-firewall'
+
+      # Tell the package repository builder that new .deb/.rpm/pacman files
+      # exist, so pkgs.tui.tools picks them up now rather than on its weekly
+      # run. Inert until PKGS_DISPATCH_TOKEN exists: a fine-grained PAT with
+      # "Contents: read and write" on tui-tools/pkgs.
+      - name: notify the package repository
+        if: env.PKGS_DISPATCH_TOKEN != ''
+        env:
+          GH_TOKEN: ${{ env.PKGS_DISPATCH_TOKEN }}
+        run: |
+          gh api repos/tui-tools/pkgs/dispatches \
+            -f event_type=tool-released \
+            -f 'client_payload[tool]=tui-firewall' \
+            -f "client_payload[version]=${GITHUB_REF_NAME#v}"

.goreleaser.yaml

@@ -45,6 +45,57 @@ archives:
       - README.md
       - examples/config.toml
 
+# The distribution packages. Three formats times two architectures is six
+# files per release, and they are what pkgs.tui.tools indexes into the apt,
+# dnf and pacman repositories: a tool is then installed and upgraded the way
+# everything else on the machine is.
+#
+# GoReleaser cannot read tool.json, so `description` below is a copy of the
+# manifest's tagline. tui-kit/tools/check-nfpm.py asserts the two are
+# identical, and `make manifest` runs it, so the copy cannot drift.
+nfpms:
+  - id: tui-firewall
+    ids:
+      - tui-firewall
+    package_name: tui-firewall
+    formats:
+      - deb
+      - rpm
+      - archlinux
+    # Each ecosystem's own naming, so the files look native where they land:
+    # tui-firewall_0.1.0_amd64.deb, tui-firewall-0.1.0.x86_64.rpm,
+    # tui-firewall-0.1.0-1-x86_64.pkg.tar.zst.
+    file_name_template: "{{ .ConventionalFileName }}"
+    vendor: tui-tools
+    homepage: https://tui.tools/tools/tui-firewall/
+    maintainer: tui-tools <maintainers@tui.tools>
+    description: "ufw and firewalld, with every change previewed before it runs"
+    license: MIT
+    # The binary belongs in the distribution's own path, not /usr/local: it
+    # arrives through the package manager, so the package manager owns it.
+    bindir: /usr/bin
+    section: utils
+    priority: optional
+    contents:
+      - src: README.md
+        dst: /usr/share/doc/tui-firewall/README.md
+      - src: LICENSE
+        dst: /usr/share/doc/tui-firewall/LICENSE
+      - src: examples/config.toml
+        dst: /usr/share/doc/tui-firewall/config.toml
+    # The package owns the binary name, so anything else shipping the same
+    # command — an AUR -bin build, a hand-rolled local package — is a
+    # conflict rather than a silent overwrite.
+    provides:
+      - tui-firewall
+    conflicts:
+      - tui-firewall-bin
+    rpm:
+      group: Applications/System
+    archlinux:
+      pkgbase: tui-firewall
+      packager: tui-tools <maintainers@tui.tools>
+
 checksum:
   name_template: checksums.txt
 

Makefile

@@ -98,6 +98,8 @@ manifest:
 	@npx --yes -p ajv-cli@5 -p ajv-formats@3 ajv validate \
 		--spec=draft2020 -c ajv-formats \
 		-s /tmp/tui-tool.schema.json -d tool.json
+	@python3 $(KIT)/tools/check-nfpm.py --manifest tool.json \
+		--config .goreleaser.yaml
 
 ## clean: remove build output.
 clean:

README.md

@@ -26,7 +26,7 @@ firewalld.
 ### Any distribution, static binary
 
 ```sh
-curl -fsSL https://github.com/tui-tools/tui-firewall/releases/download/v0.1.0/tui-firewall_0.1.0_linux_amd64.tar.gz | tar -xz tui-firewall
+curl -fsSL https://github.com/tui-tools/tui-firewall/releases/download/v0.2.0/tui-firewall_0.2.0_linux_amd64.tar.gz | tar -xz tui-firewall
 sudo install -m0755 tui-firewall /usr/local/bin/tui-firewall
 ```
 
@@ -51,11 +51,34 @@ turns them on.
 Needs the tui-tools repository, which is a [one-time
 setup](https://tui-tools.github.io/install/).
 
+The one-liner detects the distribution and adds the repository and its signing
+key:
+
+```sh
+curl -fsSL https://pkgs.tui.tools/install.sh | sh
+```
+
+Piping a script into a shell is not this family's style, so here is the same
+setup by hand — read it, or read the script first with `curl -fsSL
+https://pkgs.tui.tools/install.sh -o install.sh`:
+
+```sh
+curl -fsSL -o /tmp/tui-tools.asc https://pkgs.tui.tools/pubkey.asc
+sudo pacman-key --add /tmp/tui-tools.asc
+sudo pacman-key --lsign-key \
+  "$(gpg --show-keys --with-colons /tmp/tui-tools.asc | awk -F: '/^fpr:/{print $10; exit}')"
+printf '[tui-tools]\nServer = https://pkgs.tui.tools/arch/$arch\n' \
+  | sudo tee -a /etc/pacman.conf
+sudo pacman -Sy
+```
+
+Then, and for every other tool in the family:
+
 ```sh
 sudo pacman -S tui-firewall
 ```
 
-Add the tui-tools repository to pacman.conf first.
+Upgrades then arrive with the rest of your system updates.
 
 ### Arch Linux (AUR) — coming soon
 
@@ -70,22 +93,63 @@ The -bin package installs the released static binary.
 Needs the tui-tools repository, which is a [one-time
 setup](https://tui-tools.github.io/install/).
 
+The one-liner detects the distribution and adds the repository and its signing
+key:
+
+```sh
+curl -fsSL https://pkgs.tui.tools/install.sh | sh
+```
+
+Piping a script into a shell is not this family's style, so here is the same
+setup by hand — read it, or read the script first with `curl -fsSL
+https://pkgs.tui.tools/install.sh -o install.sh`:
+
+```sh
+sudo install -d -m 0755 /etc/apt/keyrings
+curl -fsSL https://pkgs.tui.tools/pubkey.asc \
+  | sudo gpg --dearmor -o /etc/apt/keyrings/tui-tools.gpg
+echo "deb [signed-by=/etc/apt/keyrings/tui-tools.gpg] https://pkgs.tui.tools/deb stable main" \
+  | sudo tee /etc/apt/sources.list.d/tui-tools.list
+sudo apt update
+```
+
+Then, and for every other tool in the family:
+
 ```sh
 sudo apt install tui-firewall
 ```
 
-Add the tui-tools apt repository and its keyring first.
+Upgrades then arrive with the rest of your system updates.
 
 ### Fedora and RHEL — coming soon
 
 Needs the tui-tools repository, which is a [one-time
 setup](https://tui-tools.github.io/install/).
 
+The one-liner detects the distribution and adds the repository and its signing
+key:
+
+```sh
+curl -fsSL https://pkgs.tui.tools/install.sh | sh
+```
+
+Piping a script into a shell is not this family's style, so here is the same
+setup by hand — read it, or read the script first with `curl -fsSL
+https://pkgs.tui.tools/install.sh -o install.sh`:
+
+```sh
+sudo rpm --import https://pkgs.tui.tools/pubkey.asc
+sudo curl -fsSL -o /etc/yum.repos.d/tui-tools.repo https://pkgs.tui.tools/rpm/tui-tools.repo
+sudo dnf makecache
+```
+
+Then, and for every other tool in the family:
+
 ```sh
 sudo dnf install tui-firewall
 ```
 
-Add the tui-tools.repo file first.
+Upgrades then arrive with the rest of your system updates.
 
 ### openSUSE — coming soon
 
@@ -96,7 +160,7 @@ setup](https://tui-tools.github.io/install/).
 sudo zypper install tui-firewall
 ```
 
-Add the tui-tools repository first.
+The rpm repository is shared with dnf; zypper support is not tested yet.
 
 ### Verify a download
 

go.mod

@@ -6,7 +6,7 @@ require (
 	github.com/charmbracelet/bubbles v1.0.0
 	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/charmbracelet/lipgloss v1.1.0
-	github.com/tui-tools/tui-kit v0.2.3
+	github.com/tui-tools/tui-kit v0.2.4
 )
 
 require (

go.sum

@@ -38,8 +38,8 @@ github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc
 github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
-github.com/tui-tools/tui-kit v0.2.3 h1:wzL2AdfAvO2Bdk/k7OrvG48NwgxFqYXHX9yYDTZWHv0=
-github.com/tui-tools/tui-kit v0.2.3/go.mod h1:Vpg1NcQ5ktylMvXTzsixdHjLUNxhntR3ZYSOYaQ7/FQ=
+github.com/tui-tools/tui-kit v0.2.4 h1:/d2mdFSO0yMwPeV8LVjbOxZ6nBAkVryzXO/CHN25umw=
+github.com/tui-tools/tui-kit v0.2.4/go.mod h1:Vpg1NcQ5ktylMvXTzsixdHjLUNxhntR3ZYSOYaQ7/FQ=
 github.com/xo/terminfo v1.0.0 h1:2ZpYzqWzyyytjk3TP6aJVDhkMAkc99/1xKQdA3TDTBY=
 github.com/xo/terminfo v1.0.0/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI=

tool.json

@@ -156,14 +156,15 @@
     }
   ],
   "install": {
+    "repo_url": "https://pkgs.tui.tools",
     "pacman": {
       "available": false,
       "package": "tui-firewall",
       "repo": "tui-tools",
       "requires_repo_setup": true,
       "command": "sudo pacman -S tui-firewall",
       "url": "https://pkgs.tui.tools/arch",
-      "note": "Add the tui-tools repository to pacman.conf first."
+      "note": "Upgrades then arrive with the rest of your system updates."
     },
     "aur": {
       "available": false,
@@ -180,7 +181,7 @@
       "requires_repo_setup": true,
       "command": "sudo apt install tui-firewall",
       "url": "https://pkgs.tui.tools/deb",
-      "note": "Add the tui-tools apt repository and its keyring first."
+      "note": "Upgrades then arrive with the rest of your system updates."
     },
     "dnf": {
       "available": false,
@@ -189,7 +190,7 @@
       "requires_repo_setup": true,
       "command": "sudo dnf install tui-firewall",
       "url": "https://pkgs.tui.tools/rpm",
-      "note": "Add the tui-tools.repo file first."
+      "note": "Upgrades then arrive with the rest of your system updates."
     },
     "zypper": {
       "available": false,
@@ -198,7 +199,7 @@
       "requires_repo_setup": true,
       "command": "sudo zypper install tui-firewall",
       "url": "https://pkgs.tui.tools/rpm",
-      "note": "Add the tui-tools repository first."
+      "note": "The rpm repository is shared with dnf; zypper support is not tested yet."
     },
     "binary": {
       "available": true,