[GHA] Rework how secrets are used inside Dockerfiles.

diff --git a/.github/docker/debian/bookworm/amd64/Dockerfile b/.github/docker/debian/bookworm/amd64/Dockerfile
index b5008301487433b71af786f28f7fd2c1b0f04cc5..844d9494a4bc10e88f511679a6d60be7e5eba245 100644 (file)
--- a/.github/docker/debian/bookworm/amd64/Dockerfile
+++ b/.github/docker/debian/bookworm/amd64/Dockerfile
@@ -51,19 +51,10 @@ deb [signed-by=${GPG_KEY}] https://${REPO_DOMAIN}/repo/deb/debian-unstable ${COD
 deb-src [signed-by=${GPG_KEY}] https://${REPO_DOMAIN}/repo/deb/debian-unstable ${CODENAME} main
 EOF
 
-RUN --mount=type=secret,id=REPO_PASSWORD \
-  printf "machine ${REPO_DOMAIN} " > ~/.netrc && \
-  printf "login ${REPO_USERNAME} " >> ~/.netrc && \
-  printf "password " >> ~/.netrc && \
-  cat /run/secrets/REPO_PASSWORD >> ~/.netrc && \
-  cp -f ~/.netrc /etc/apt/auth.conf
-
 RUN git config --global --add safe.directory '*' \
     && git config --global user.name "${MAINTAINER_NAME}" \
     && git config --global user.email "${MAINTAINER_EMAIL}"
 
-RUN curl --netrc -o ${GPG_KEY} https://${REPO_DOMAIN}/repo/deb/debian-unstable/signalwire-freeswitch-repo.gpg
-
 # Bootstrap and Build
 COPY . ${DATA_DIR}
 WORKDIR ${DATA_DIR}
@@ -72,9 +63,25 @@ RUN echo "export VERSION=$(cat ./build/next-release.txt | tr -d '\n')" | tee -a
 RUN . ~/.env && ./debian/util.sh prep-create-orig -n -V${VERSION}-${BUILD_NUMBER}-${GIT_SHA} -x
 RUN . ~/.env && ./debian/util.sh prep-create-dsc ${CODENAME}
 
-RUN apt-get -q update && \
-    mk-build-deps --install --remove debian/control --tool "apt-get -y --no-install-recommends" && \
-    apt-get -y -f install
+RUN --mount=type=secret,id=REPO_PASSWORD \
+    printf "machine ${REPO_DOMAIN} "  > /etc/apt/auth.conf && \
+    printf "login ${REPO_USERNAME} " >> /etc/apt/auth.conf && \
+    printf "password "               >> /etc/apt/auth.conf && \
+    cat /run/secrets/REPO_PASSWORD   >> /etc/apt/auth.conf && \
+    curl \
+        --fail \
+        --netrc-file /etc/apt/auth.conf \
+        --output ${GPG_KEY} \
+        --silent \
+        https://${REPO_DOMAIN}/repo/deb/debian-unstable/signalwire-freeswitch-repo.gpg && \
+    file ${GPG_KEY} && \
+    apt-get --quiet update && \
+    mk-build-deps \
+        --install \
+        --remove debian/control \
+        --tool "apt-get --yes --no-install-recommends" && \
+    apt-get --yes --fix-broken install && \
+    rm -f /etc/apt/auth.conf
 
 ENV DEB_BUILD_OPTIONS="parallel=1"
 RUN . ~/.env && dch -b -M -v "${VERSION}-${BUILD_NUMBER}-${GIT_SHA}~${CODENAME}" \

diff --git a/.github/docker/debian/bookworm/arm32v7/Dockerfile b/.github/docker/debian/bookworm/arm32v7/Dockerfile
index 43b4778b3e836e48e167498479d9d5be74880b4a..164e60235628811896349ea7ca36f631996315f5 100644 (file)
--- a/.github/docker/debian/bookworm/arm32v7/Dockerfile
+++ b/.github/docker/debian/bookworm/arm32v7/Dockerfile
@@ -51,19 +51,10 @@ deb [signed-by=${GPG_KEY}] https://${REPO_DOMAIN}/repo/deb/rpi/debian-dev ${CODE
 deb-src [signed-by=${GPG_KEY}] https://${REPO_DOMAIN}/repo/deb/rpi/debian-dev ${CODENAME} main
 EOF
 
-RUN --mount=type=secret,id=REPO_PASSWORD \
-  printf "machine ${REPO_DOMAIN} " > ~/.netrc && \
-  printf "login ${REPO_USERNAME} " >> ~/.netrc && \
-  printf "password " >> ~/.netrc && \
-  cat /run/secrets/REPO_PASSWORD >> ~/.netrc && \
-  cp -f ~/.netrc /etc/apt/auth.conf
-
 RUN git config --global --add safe.directory '*' \
     && git config --global user.name "${MAINTAINER_NAME}" \
     && git config --global user.email "${MAINTAINER_EMAIL}"
 
-RUN curl --netrc -o ${GPG_KEY} https://${REPO_DOMAIN}/repo/deb/rpi/debian-dev/signalwire-freeswitch-repo.gpg
-
 # Bootstrap and Build
 COPY . ${DATA_DIR}
 WORKDIR ${DATA_DIR}
@@ -72,9 +63,25 @@ RUN echo "export VERSION=$(cat ./build/next-release.txt | tr -d '\n')" | tee -a
 RUN . ~/.env && ./debian/util.sh prep-create-orig -n -V${VERSION}-${BUILD_NUMBER}-${GIT_SHA} -x
 RUN . ~/.env && ./debian/util.sh prep-create-dsc -a armhf ${CODENAME}
 
-RUN apt-get -q update && \
-    mk-build-deps --install --remove debian/control --tool "apt-get -y --no-install-recommends" && \
-    apt-get -y -f install
+RUN --mount=type=secret,id=REPO_PASSWORD \
+    printf "machine ${REPO_DOMAIN} "  > /etc/apt/auth.conf && \
+    printf "login ${REPO_USERNAME} " >> /etc/apt/auth.conf && \
+    printf "password "               >> /etc/apt/auth.conf && \
+    cat /run/secrets/REPO_PASSWORD   >> /etc/apt/auth.conf && \
+    curl \
+        --fail \
+        --netrc-file /etc/apt/auth.conf \
+        --output ${GPG_KEY} \
+        --silent \
+        https://${REPO_DOMAIN}/repo/deb/rpi/debian-dev/signalwire-freeswitch-repo.gpg && \
+    file ${GPG_KEY} && \
+    apt-get --quiet update && \
+    mk-build-deps \
+        --install \
+        --remove debian/control \
+        --tool "apt-get --yes --no-install-recommends" && \
+    apt-get --yes --fix-broken install && \
+    rm -f /etc/apt/auth.conf
 
 ENV DEB_BUILD_OPTIONS="parallel=1"
 RUN . ~/.env && dch -b -M -v "${VERSION}-${BUILD_NUMBER}-${GIT_SHA}~${CODENAME}" \

diff --git a/.github/docker/debian/bookworm/arm64v8/Dockerfile b/.github/docker/debian/bookworm/arm64v8/Dockerfile
index 50c24957f179828e25deeea89506ae639814268e..0e30f8504e6b9549ab416c08b93fb1d1273f9e0d 100644 (file)
--- a/.github/docker/debian/bookworm/arm64v8/Dockerfile
+++ b/.github/docker/debian/bookworm/arm64v8/Dockerfile
@@ -51,19 +51,10 @@ deb [signed-by=${GPG_KEY}] https://${REPO_DOMAIN}/repo/deb/debian-unstable ${COD
 deb-src [signed-by=${GPG_KEY}] https://${REPO_DOMAIN}/repo/deb/debian-unstable ${CODENAME} main
 EOF
 
-RUN --mount=type=secret,id=REPO_PASSWORD \
-  printf "machine ${REPO_DOMAIN} " > ~/.netrc && \
-  printf "login ${REPO_USERNAME} " >> ~/.netrc && \
-  printf "password " >> ~/.netrc && \
-  cat /run/secrets/REPO_PASSWORD >> ~/.netrc && \
-  cp -f ~/.netrc /etc/apt/auth.conf
-
 RUN git config --global --add safe.directory '*' \
     && git config --global user.name "${MAINTAINER_NAME}" \
     && git config --global user.email "${MAINTAINER_EMAIL}"
 
-RUN curl --netrc -o ${GPG_KEY} https://${REPO_DOMAIN}/repo/deb/debian-unstable/signalwire-freeswitch-repo.gpg
-
 # Bootstrap and Build
 COPY . ${DATA_DIR}
 WORKDIR ${DATA_DIR}
@@ -72,9 +63,25 @@ RUN echo "export VERSION=$(cat ./build/next-release.txt | tr -d '\n')" | tee -a
 RUN . ~/.env && ./debian/util.sh prep-create-orig -n -V${VERSION}-${BUILD_NUMBER}-${GIT_SHA} -x
 RUN . ~/.env && ./debian/util.sh prep-create-dsc -a arm64 ${CODENAME}
 
-RUN apt-get -q update && \
-    mk-build-deps --install --remove debian/control --tool "apt-get -y --no-install-recommends" && \
-    apt-get -y -f install
+RUN --mount=type=secret,id=REPO_PASSWORD \
+    printf "machine ${REPO_DOMAIN} "  > /etc/apt/auth.conf && \
+    printf "login ${REPO_USERNAME} " >> /etc/apt/auth.conf && \
+    printf "password "               >> /etc/apt/auth.conf && \
+    cat /run/secrets/REPO_PASSWORD   >> /etc/apt/auth.conf && \
+    curl \
+        --fail \
+        --netrc-file /etc/apt/auth.conf \
+        --output ${GPG_KEY} \
+        --silent \
+        https://${REPO_DOMAIN}/repo/deb/debian-unstable/signalwire-freeswitch-repo.gpg && \
+    file ${GPG_KEY} && \
+    apt-get --quiet update && \
+    mk-build-deps \
+        --install \
+        --remove debian/control \
+        --tool "apt-get --yes --no-install-recommends" && \
+    apt-get --yes --fix-broken install && \
+    rm -f /etc/apt/auth.conf
 
 ENV DEB_BUILD_OPTIONS="parallel=1"
 RUN . ~/.env && dch -b -M -v "${VERSION}-${BUILD_NUMBER}-${GIT_SHA}~${CODENAME}" \

diff --git a/.github/docker/debian/bullseye/amd64/Dockerfile b/.github/docker/debian/bullseye/amd64/Dockerfile
index aefbd382242d127a939a4f7f19d6cb7ca4de69fb..e4557f1ed66cbf41f1b0d9e19f81702fe82e02a7 100644 (file)
--- a/.github/docker/debian/bullseye/amd64/Dockerfile
+++ b/.github/docker/debian/bullseye/amd64/Dockerfile
@@ -51,19 +51,10 @@ deb [signed-by=${GPG_KEY}] https://${REPO_DOMAIN}/repo/deb/debian-unstable ${COD
 deb-src [signed-by=${GPG_KEY}] https://${REPO_DOMAIN}/repo/deb/debian-unstable ${CODENAME} main
 EOF
 
-RUN --mount=type=secret,id=REPO_PASSWORD \
-  printf "machine ${REPO_DOMAIN} " > ~/.netrc && \
-  printf "login ${REPO_USERNAME} " >> ~/.netrc && \
-  printf "password " >> ~/.netrc && \
-  cat /run/secrets/REPO_PASSWORD >> ~/.netrc && \
-  cp -f ~/.netrc /etc/apt/auth.conf
-
 RUN git config --global --add safe.directory '*' \
     && git config --global user.name "${MAINTAINER_NAME}" \
     && git config --global user.email "${MAINTAINER_EMAIL}"
 
-RUN curl --netrc -o ${GPG_KEY} https://${REPO_DOMAIN}/repo/deb/debian-unstable/signalwire-freeswitch-repo.gpg
-
 # Bootstrap and Build
 COPY . ${DATA_DIR}
 WORKDIR ${DATA_DIR}
@@ -72,9 +63,25 @@ RUN echo "export VERSION=$(cat ./build/next-release.txt | tr -d '\n')" | tee -a
 RUN . ~/.env && ./debian/util.sh prep-create-orig -n -V${VERSION}-${BUILD_NUMBER}-${GIT_SHA} -x
 RUN . ~/.env && ./debian/util.sh prep-create-dsc ${CODENAME}
 
-RUN apt-get -q update && \
-    mk-build-deps --install --remove debian/control --tool "apt-get -y --no-install-recommends" && \
-    apt-get -y -f install
+RUN --mount=type=secret,id=REPO_PASSWORD \
+    printf "machine ${REPO_DOMAIN} "  > /etc/apt/auth.conf && \
+    printf "login ${REPO_USERNAME} " >> /etc/apt/auth.conf && \
+    printf "password "               >> /etc/apt/auth.conf && \
+    cat /run/secrets/REPO_PASSWORD   >> /etc/apt/auth.conf && \
+    curl \
+        --fail \
+        --netrc-file /etc/apt/auth.conf \
+        --output ${GPG_KEY} \
+        --silent \
+        https://${REPO_DOMAIN}/repo/deb/debian-unstable/signalwire-freeswitch-repo.gpg && \
+    file ${GPG_KEY} && \
+    apt-get --quiet update && \
+    mk-build-deps \
+        --install \
+        --remove debian/control \
+        --tool "apt-get --yes --no-install-recommends" && \
+    apt-get --yes --fix-broken install && \
+    rm -f /etc/apt/auth.conf
 
 ENV DEB_BUILD_OPTIONS="parallel=1"
 RUN . ~/.env && dch -b -M -v "${VERSION}-${BUILD_NUMBER}-${GIT_SHA}~${CODENAME}" \

diff --git a/.github/docker/debian/bullseye/arm32v7/Dockerfile b/.github/docker/debian/bullseye/arm32v7/Dockerfile
index b3a6f00c36074c9237813958b3c5aa8bdeb715ac..03eb59b40f8e5385d5bff271ab845aed549e5038 100644 (file)
--- a/.github/docker/debian/bullseye/arm32v7/Dockerfile
+++ b/.github/docker/debian/bullseye/arm32v7/Dockerfile
@@ -51,19 +51,10 @@ deb [signed-by=${GPG_KEY}] https://${REPO_DOMAIN}/repo/deb/rpi/debian-dev ${CODE
 deb-src [signed-by=${GPG_KEY}] https://${REPO_DOMAIN}/repo/deb/rpi/debian-dev ${CODENAME} main
 EOF
 
-RUN --mount=type=secret,id=REPO_PASSWORD \
-  printf "machine ${REPO_DOMAIN} " > ~/.netrc && \
-  printf "login ${REPO_USERNAME} " >> ~/.netrc && \
-  printf "password " >> ~/.netrc && \
-  cat /run/secrets/REPO_PASSWORD >> ~/.netrc && \
-  cp -f ~/.netrc /etc/apt/auth.conf
-
 RUN git config --global --add safe.directory '*' \
     && git config --global user.name "${MAINTAINER_NAME}" \
     && git config --global user.email "${MAINTAINER_EMAIL}"
 
-RUN curl --netrc -o ${GPG_KEY} https://${REPO_DOMAIN}/repo/deb/rpi/debian-dev/signalwire-freeswitch-repo.gpg
-
 # Bootstrap and Build
 COPY . ${DATA_DIR}
 WORKDIR ${DATA_DIR}
@@ -72,9 +63,25 @@ RUN echo "export VERSION=$(cat ./build/next-release.txt | tr -d '\n')" | tee -a
 RUN . ~/.env && ./debian/util.sh prep-create-orig -n -V${VERSION}-${BUILD_NUMBER}-${GIT_SHA} -x
 RUN . ~/.env && ./debian/util.sh prep-create-dsc -a armhf ${CODENAME}
 
-RUN apt-get -q update && \
-    mk-build-deps --install --remove debian/control --tool "apt-get -y --no-install-recommends" && \
-    apt-get -y -f install
+RUN --mount=type=secret,id=REPO_PASSWORD \
+    printf "machine ${REPO_DOMAIN} "  > /etc/apt/auth.conf && \
+    printf "login ${REPO_USERNAME} " >> /etc/apt/auth.conf && \
+    printf "password "               >> /etc/apt/auth.conf && \
+    cat /run/secrets/REPO_PASSWORD   >> /etc/apt/auth.conf && \
+    curl \
+        --fail \
+        --netrc-file /etc/apt/auth.conf \
+        --output ${GPG_KEY} \
+        --silent \
+        https://${REPO_DOMAIN}/repo/deb/rpi/debian-dev/signalwire-freeswitch-repo.gpg && \
+    file ${GPG_KEY} && \
+    apt-get --quiet update && \
+    mk-build-deps \
+        --install \
+        --remove debian/control \
+        --tool "apt-get --yes --no-install-recommends" && \
+    apt-get --yes --fix-broken install && \
+    rm -f /etc/apt/auth.conf
 
 ENV DEB_BUILD_OPTIONS="parallel=1"
 RUN . ~/.env && dch -b -M -v "${VERSION}-${BUILD_NUMBER}-${GIT_SHA}~${CODENAME}" \

diff --git a/.github/docker/debian/bullseye/arm64v8/Dockerfile b/.github/docker/debian/bullseye/arm64v8/Dockerfile
index dfa899540ef6ffd82bd183d2d7698eb970d4022a..ca216a82d7e4c9c03401188daa4e3ec01650ed52 100644 (file)
--- a/.github/docker/debian/bullseye/arm64v8/Dockerfile
+++ b/.github/docker/debian/bullseye/arm64v8/Dockerfile
@@ -51,19 +51,10 @@ deb [signed-by=${GPG_KEY}] https://${REPO_DOMAIN}/repo/deb/debian-unstable ${COD
 deb-src [signed-by=${GPG_KEY}] https://${REPO_DOMAIN}/repo/deb/debian-unstable ${CODENAME} main
 EOF
 
-RUN --mount=type=secret,id=REPO_PASSWORD \
-  printf "machine ${REPO_DOMAIN} " > ~/.netrc && \
-  printf "login ${REPO_USERNAME} " >> ~/.netrc && \
-  printf "password " >> ~/.netrc && \
-  cat /run/secrets/REPO_PASSWORD >> ~/.netrc && \
-  cp -f ~/.netrc /etc/apt/auth.conf
-
 RUN git config --global --add safe.directory '*' \
     && git config --global user.name "${MAINTAINER_NAME}" \
     && git config --global user.email "${MAINTAINER_EMAIL}"
 
-RUN curl --netrc -o ${GPG_KEY} https://${REPO_DOMAIN}/repo/deb/debian-unstable/signalwire-freeswitch-repo.gpg
-
 # Bootstrap and Build
 COPY . ${DATA_DIR}
 WORKDIR ${DATA_DIR}
@@ -72,9 +63,25 @@ RUN echo "export VERSION=$(cat ./build/next-release.txt | tr -d '\n')" | tee -a
 RUN . ~/.env && ./debian/util.sh prep-create-orig -n -V${VERSION}-${BUILD_NUMBER}-${GIT_SHA} -x
 RUN . ~/.env && ./debian/util.sh prep-create-dsc -a arm64 ${CODENAME}
 
-RUN apt-get -q update && \
-    mk-build-deps --install --remove debian/control --tool "apt-get -y --no-install-recommends" && \
-    apt-get -y -f install
+RUN --mount=type=secret,id=REPO_PASSWORD \
+    printf "machine ${REPO_DOMAIN} "  > /etc/apt/auth.conf && \
+    printf "login ${REPO_USERNAME} " >> /etc/apt/auth.conf && \
+    printf "password "               >> /etc/apt/auth.conf && \
+    cat /run/secrets/REPO_PASSWORD   >> /etc/apt/auth.conf && \
+    curl \
+        --fail \
+        --netrc-file /etc/apt/auth.conf \
+        --output ${GPG_KEY} \
+        --silent \
+        https://${REPO_DOMAIN}/repo/deb/debian-unstable/signalwire-freeswitch-repo.gpg && \
+    file ${GPG_KEY} && \
+    apt-get --quiet update && \
+    mk-build-deps \
+        --install \
+        --remove debian/control \
+        --tool "apt-get --yes --no-install-recommends" && \
+    apt-get --yes --fix-broken install && \
+    rm -f /etc/apt/auth.conf
 
 ENV DEB_BUILD_OPTIONS="parallel=1"
 RUN . ~/.env && dch -b -M -v "${VERSION}-${BUILD_NUMBER}-${GIT_SHA}~${CODENAME}" \

diff --git a/.github/docker/debian/buster/amd64/Dockerfile b/.github/docker/debian/buster/amd64/Dockerfile
index 119a18076e8731e9faecaa4c43e1042ddbbdb656..a0da4dbe7cc4306c097368e4314f9d38143402ba 100644 (file)
--- a/.github/docker/debian/buster/amd64/Dockerfile
+++ b/.github/docker/debian/buster/amd64/Dockerfile
@@ -51,19 +51,10 @@ deb [signed-by=${GPG_KEY}] https://${REPO_DOMAIN}/repo/deb/debian-unstable ${COD
 deb-src [signed-by=${GPG_KEY}] https://${REPO_DOMAIN}/repo/deb/debian-unstable ${CODENAME} main
 EOF
 
-RUN --mount=type=secret,id=REPO_PASSWORD \
-  printf "machine ${REPO_DOMAIN} " > ~/.netrc && \
-  printf "login ${REPO_USERNAME} " >> ~/.netrc && \
-  printf "password " >> ~/.netrc && \
-  cat /run/secrets/REPO_PASSWORD >> ~/.netrc && \
-  cp -f ~/.netrc /etc/apt/auth.conf
-
 RUN git config --global --add safe.directory '*' \
     && git config --global user.name "${MAINTAINER_NAME}" \
     && git config --global user.email "${MAINTAINER_EMAIL}"
 
-RUN curl --netrc -o ${GPG_KEY} https://${REPO_DOMAIN}/repo/deb/debian-unstable/signalwire-freeswitch-repo.gpg
-
 # Bootstrap and Build
 COPY . ${DATA_DIR}
 WORKDIR ${DATA_DIR}
@@ -73,9 +64,25 @@ RUN echo "export VERSION=$(cat ./build/next-release.txt | tr -d '\n')" | tee -a
 RUN . ~/.env && ./debian/util.sh prep-create-orig -n -V${VERSION}-${BUILD_NUMBER}-${GIT_SHA} -x
 RUN . ~/.env && ./debian/util.sh prep-create-dsc ${CODENAME}
 
-RUN apt-get -q update && \
-    mk-build-deps --install --remove debian/control --tool "apt-get -y --no-install-recommends" && \
-    apt-get -y -f install
+RUN --mount=type=secret,id=REPO_PASSWORD \
+    printf "machine ${REPO_DOMAIN} "  > /etc/apt/auth.conf && \
+    printf "login ${REPO_USERNAME} " >> /etc/apt/auth.conf && \
+    printf "password "               >> /etc/apt/auth.conf && \
+    cat /run/secrets/REPO_PASSWORD   >> /etc/apt/auth.conf && \
+    curl \
+        --fail \
+        --netrc-file /etc/apt/auth.conf \
+        --output ${GPG_KEY} \
+        --silent \
+        https://${REPO_DOMAIN}/repo/deb/debian-unstable/signalwire-freeswitch-repo.gpg && \
+    file ${GPG_KEY} && \
+    apt-get --quiet update && \
+    mk-build-deps \
+        --install \
+        --remove debian/control \
+        --tool "apt-get --yes --no-install-recommends" && \
+    apt-get --yes --fix-broken install && \
+    rm -f /etc/apt/auth.conf
 
 ENV DEB_BUILD_OPTIONS="parallel=1"
 RUN . ~/.env && dch -b -M -v "${VERSION}-${BUILD_NUMBER}-${GIT_SHA}~${CODENAME}" \

diff --git a/.github/docker/debian/buster/arm32v7/Dockerfile b/.github/docker/debian/buster/arm32v7/Dockerfile
index 2113f55bd8d083898a246041e144e399a7254335..c283d9c6ce238c8381397e525a1aed915a5c123c 100644 (file)
--- a/.github/docker/debian/buster/arm32v7/Dockerfile
+++ b/.github/docker/debian/buster/arm32v7/Dockerfile
@@ -51,19 +51,10 @@ deb [signed-by=${GPG_KEY}] https://${REPO_DOMAIN}/repo/deb/rpi/debian-dev ${CODE
 deb-src [signed-by=${GPG_KEY}] https://${REPO_DOMAIN}/repo/deb/rpi/debian-dev ${CODENAME} main
 EOF
 
-RUN --mount=type=secret,id=REPO_PASSWORD \
-  printf "machine ${REPO_DOMAIN} " > ~/.netrc && \
-  printf "login ${REPO_USERNAME} " >> ~/.netrc && \
-  printf "password " >> ~/.netrc && \
-  cat /run/secrets/REPO_PASSWORD >> ~/.netrc && \
-  cp -f ~/.netrc /etc/apt/auth.conf
-
 RUN git config --global --add safe.directory '*' \
     && git config --global user.name "${MAINTAINER_NAME}" \
     && git config --global user.email "${MAINTAINER_EMAIL}"
 
-RUN curl --netrc -o ${GPG_KEY} https://${REPO_DOMAIN}/repo/deb/rpi/debian-dev/signalwire-freeswitch-repo.gpg
-
 # Bootstrap and Build
 COPY . ${DATA_DIR}
 WORKDIR ${DATA_DIR}
@@ -72,9 +63,25 @@ RUN echo "export VERSION=$(cat ./build/next-release.txt | tr -d '\n')" | tee -a
 RUN . ~/.env && ./debian/util.sh prep-create-orig -n -V${VERSION}-${BUILD_NUMBER}-${GIT_SHA} -x
 RUN . ~/.env && ./debian/util.sh prep-create-dsc -a armhf ${CODENAME}
 
-RUN apt-get -q update && \
-    mk-build-deps --install --remove debian/control --tool "apt-get -y --no-install-recommends" && \
-    apt-get -y -f install
+RUN --mount=type=secret,id=REPO_PASSWORD \
+    printf "machine ${REPO_DOMAIN} "  > /etc/apt/auth.conf && \
+    printf "login ${REPO_USERNAME} " >> /etc/apt/auth.conf && \
+    printf "password "               >> /etc/apt/auth.conf && \
+    cat /run/secrets/REPO_PASSWORD   >> /etc/apt/auth.conf && \
+    curl \
+        --fail \
+        --netrc-file /etc/apt/auth.conf \
+        --output ${GPG_KEY} \
+        --silent \
+        https://${REPO_DOMAIN}/repo/deb/rpi/debian-dev/signalwire-freeswitch-repo.gpg && \
+    file ${GPG_KEY} && \
+    apt-get --quiet update && \
+    mk-build-deps \
+        --install \
+        --remove debian/control \
+        --tool "apt-get --yes --no-install-recommends" && \
+    apt-get --yes --fix-broken install && \
+    rm -f /etc/apt/auth.conf
 
 ENV DEB_BUILD_OPTIONS="parallel=1"
 RUN . ~/.env && dch -b -M -v "${VERSION}-${BUILD_NUMBER}-${GIT_SHA}~${CODENAME}" \

diff --git a/.github/docker/debian/buster/arm64v8/Dockerfile b/.github/docker/debian/buster/arm64v8/Dockerfile
index 150a77fec2e483608ce05f52f8d6183238342c85..ac1f77959fdc83a3eb3098503f253b3613e645a1 100644 (file)
--- a/.github/docker/debian/buster/arm64v8/Dockerfile
+++ b/.github/docker/debian/buster/arm64v8/Dockerfile
@@ -51,19 +51,10 @@ deb [signed-by=${GPG_KEY}] https://${REPO_DOMAIN}/repo/deb/debian-unstable ${COD
 deb-src [signed-by=${GPG_KEY}] https://${REPO_DOMAIN}/repo/deb/debian-unstable ${CODENAME} main
 EOF
 
-RUN --mount=type=secret,id=REPO_PASSWORD \
-  printf "machine ${REPO_DOMAIN} " > ~/.netrc && \
-  printf "login ${REPO_USERNAME} " >> ~/.netrc && \
-  printf "password " >> ~/.netrc && \
-  cat /run/secrets/REPO_PASSWORD >> ~/.netrc && \
-  cp -f ~/.netrc /etc/apt/auth.conf
-
 RUN git config --global --add safe.directory '*' \
     && git config --global user.name "${MAINTAINER_NAME}" \
     && git config --global user.email "${MAINTAINER_EMAIL}"
 
-RUN curl --netrc -o ${GPG_KEY} https://${REPO_DOMAIN}/repo/deb/debian-unstable/signalwire-freeswitch-repo.gpg
-
 # Bootstrap and Build
 COPY . ${DATA_DIR}
 WORKDIR ${DATA_DIR}
@@ -72,9 +63,25 @@ RUN echo "export VERSION=$(cat ./build/next-release.txt | tr -d '\n')" | tee -a
 RUN . ~/.env && ./debian/util.sh prep-create-orig -n -V${VERSION}-${BUILD_NUMBER}-${GIT_SHA} -x
 RUN . ~/.env && ./debian/util.sh prep-create-dsc -a arm64 ${CODENAME}
 
-RUN apt-get -q update && \
-    mk-build-deps --install --remove debian/control --tool "apt-get -y --no-install-recommends" && \
-    apt-get -y -f install
+RUN --mount=type=secret,id=REPO_PASSWORD \
+    printf "machine ${REPO_DOMAIN} "  > /etc/apt/auth.conf && \
+    printf "login ${REPO_USERNAME} " >> /etc/apt/auth.conf && \
+    printf "password "               >> /etc/apt/auth.conf && \
+    cat /run/secrets/REPO_PASSWORD   >> /etc/apt/auth.conf && \
+    curl \
+        --fail \
+        --netrc-file /etc/apt/auth.conf \
+        --output ${GPG_KEY} \
+        --silent \
+        https://${REPO_DOMAIN}/repo/deb/debian-unstable/signalwire-freeswitch-repo.gpg && \
+    file ${GPG_KEY} && \
+    apt-get --quiet update && \
+    mk-build-deps \
+        --install \
+        --remove debian/control \
+        --tool "apt-get --yes --no-install-recommends" && \
+    apt-get --yes --fix-broken install && \
+    rm -f /etc/apt/auth.conf
 
 ENV DEB_BUILD_OPTIONS="parallel=1"
 RUN . ~/.env && dch -b -M -v "${VERSION}-${BUILD_NUMBER}-${GIT_SHA}~${CODENAME}" \