[bpapaspyros]

What and why

A package depending on another of ours cannot be built by the release or edge workflows: the builder knows no published package, so the build stops at the first such dependency. The builder can now read the archive (ARCHIVE_URL in duatic_devtools' build_pkg.sh), and this passes it.

• reusable_release_build.yml:
  • with the organization variable ARCHIVE_URL set, it fetches the archive's key from it and uses it only when its one primary key's fingerprint is ARCHIVE_KEY_FINGERPRINT;
  • it gives the builder the archive, the key and archive_channels, a new input defaulting to stable.
  • Without ARCHIVE_URL, the build runs as before.
• reusable_edge_build.yml builds with archive_channels: edge stable, so a dependency without a build of main comes from its release.
• README: the build section and the inputs table.

Testing

• The fingerprint check, run locally on throwaway keys: the matching key passes. A different key, a keyring holding two keys and an unreadable file are refused. A subkey's fingerprint is not taken for the primary's.
• This has not run on GitHub yet.
• Tests updated, or not applicable
• Docs updated, or not applicable
• This changes or removes something existing (if so, title needs ! and means the next release is a major version bump)

Notes

• Needs the duatic_devtools release carrying ARCHIVE_URL in the builder. Until then the builder ignores it, and a build with such a dependency fails as it does today.
• Takes effect once the organization variables ARCHIVE_URL and ARCHIVE_KEY_FINGERPRINT are set.