.github/workflows/build-PKGBUILDs-aarch64.yml

@@ -0,0 +1,152 @@
+name: Build Arch Repository
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [ main ]
+
+env:
+  REPO_NAME: qcom
+  BUILD_DIR: build
+  REPO_DIR: repo
+
+jobs:
+  build-packages:
+    name: Build Package (${{ matrix.package }})
+    runs-on: ubuntu-22.04-arm
+    container: danhunsaker/archlinuxarm
+    env: 
+      BUILD_ALARM_SH: 'sudo su - alarm -c'
+    strategy:
+      matrix:
+        package: [
+            'q6voiced',
+            'soc-qcom-sdm845',
+            'persistent-mac',
+            'linux-firmware',
+            'qbootctl',
+            'bootmac',
+            'alsa-ucm-oneplus',
+            'device-oneplus-fajita',
+            'device-lenovo-q706f',
+            'mkbootimg',
+            'linux-firmware-lenovo-sm8250',
+            'linux-sdm845',
+            'linux-sm8250',
+            'sensors/iio-sensor-proxy',
+            'sensors/hexagonrpcd',
+            'sensors/libssc',
+            'tinyalsa-git'
+        ]
+
+    steps:
+
+    - name: Install dependencies
+      run: | 
+        curl -L -o /etc/pacman.conf https://github.com/silime/ArchlinuxARM-qcom-aarch64/raw/main/pacman.conf
+        pacman-key --init && pacman-key --populate archlinuxarm
+        pacman-key --recv-keys F60FD4C6D426DAB6
+        pacman-key --lsign F60FD4C6D426DAB6
+        pacman -Syyu --noconfirm  --ask=4 arch-install-scripts cloud-guest-utils sudo binutils fakeroot base-devel git bc distcc ccache meson libqmi protobuf-c glib2
+        useradd -m alarm
+        passwd -d alarm
+        usermod -aG wheel alarm
+        echo 'alarm ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
+        mkdir /home/alarm/ -p
+        chown alarm /home/alarm/
+        
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    - name: Build package
+      working-directory: ${{ github.workspace }}/${{ matrix.package }}
+      run: |
+        # 构建参数配置
+        export MAKEPKG_CONF="/etc/makepkg.conf"
+        echo 'BUILDENV=(!distcc color !ccache check !sign)' | sudo tee -a $MAKEPKG_CONF
+        # 清理并构建
+        sudo chown alarm:alarm ./
+        echo RELEASE=$(echo ${{ matrix.package }} | sed 's/\//_/g')
+        echo RELEASE=$(echo ${{ matrix.package }} | sed 's/\//_/g') >> $GITHUB_ENV
+
+        cp ./* /home/alarm/
+        ${{ env.BUILD_ALARM_SH }} '(makepkg --cleanbuild --syncdeps --noconfirm)'
+
+    - name: Upload artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: ${{ env.RELEASE }}-pkg 
+        path: |
+          /home/alarm/*.pkg.tar.*
+
+  create-repository:
+    name: Create Repository
+    runs-on: ubuntu-22.04-arm
+    needs: build-packages
+    container: danhunsaker/archlinuxarm
+    env: 
+      BUILD_ALARM_SH: 'sudo su - alarm -c'
+
+    steps:
+    - name: Download all artifacts
+      uses: actions/download-artifact@v4
+      with:
+        path: ${{ env.BUILD_DIR }}
+
+    - name: Setup repository directory
+      run: |
+        mkdir -p ${{ env.REPO_DIR }}
+        pacman -Syyu --noconfirm  --ask=4 arch-install-scripts cloud-guest-utils sudo binutils fakeroot base-devel git bc distcc
+        useradd -m alarm
+        passwd -d alarm
+        usermod -aG wheel alarm
+        echo 'alarm ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
+        mkdir /home/alarm/ -p
+        chown alarm /home/alarm/
+        find ./ -mindepth 2 -name '*.pkg.tar.*' -exec cp {} ${{ env.REPO_DIR }} \;
+    - name: Setup GPG
+      run: |
+        # Import the GPG private key
+        ${{ env.BUILD_ALARM_SH }} 'echo "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --import --passphrase "${{ secrets.GPG_PASSPHRASE }}" --pinentry-mode loopback'
+        # Configure the GPG agent to use the passphrase
+        ${{ env.BUILD_ALARM_SH }} 'echo "default-cache-ttl 18000" > ~/.gnupg/gpg-agent.conf'
+        ${{ env.BUILD_ALARM_SH }} 'echo "max-cache-ttl 18000" >> ~/.gnupg/gpg-agent.conf'
+        ${{ env.BUILD_ALARM_SH }} 'gpgconf --reload gpg-agent'
+    - name: Sign package
+      run: |
+        cp ${{ env.REPO_DIR }}/* /home/alarm/ -r
+        chown -R alarm:alarm /home/alarm/*
+        ${{ env.BUILD_ALARM_SH }} '
+        for pkg in /home/alarm/*.pkg.tar.*; do
+          [[ -f "$pkg" ]] || continue
+          echo "Signing $pkg ..."
+          gpg --batch --yes --pinentry-mode loopback \
+            --passphrase ${{ secrets.GPG_PASSPHRASE }}\
+            --detach-sign --no-armor "$pkg"
+        done'
+    - name: Generate repository database
+      run: |
+        ${{ env.BUILD_ALARM_SH }} 'repo-add -s -v -n ${{ env.REPO_NAME }}.db.tar.xz *.pkg.tar.xz'
+
+    - name: Upload repository
+      uses: actions/upload-artifact@v4
+      with:
+        name: ${{ env.REPO_NAME }}
+        path: /home/alarm/*
+
+    - name: Set variables
+      run: |
+        echo RELEASE=$(date +%Y\/%m\/%d) >> $GITHUB_ENV
+      shell: bash
+
+    - name: create release
+      uses: softprops/action-gh-release@v2
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        body: ${{ env.RELEASE }}
+        tag_name: ${{ env.RELEASE }}
+        draft: false
+        prerelease: false
+        files: |
+          /home/alarm/*

build_repo.sh

@@ -0,0 +1,161 @@
+#!/bin/sh
+# 构建、签名并创建SELinux软件包仓库的脚本
+# 使用方法：./build_repo.sh [-g] [-h] [GPG密码] [仓库名称]
+
+set -e # 遇到错误立即退出
+
+# 初始化全局变量
+REPO_DIR="./repo"       # 仓库存储目录
+PKGEXT=".pkg.tar.zst"   # 包后缀
+GPG_PASSPHRASE=""       # GPG密码
+REPO_NAME=""            # 仓库名称
+
+# 切换到脚本所在目录
+cd "$(dirname -- "$0")" || exit $?
+
+# 检查root权限
+if [ "$(id -u)" = 0 ]; then
+    echo >&2 "错误：请勿使用root权限运行本脚本"
+    exit 1
+fi
+
+# 显示帮助信息
+show_help() {
+    echo "Usage: $0 [OPTIONS] GPG_PASSPHRASE REPO_NAME"
+    echo "选项:"
+    echo "  -g    总是升级git包"
+    echo "  -h    显示帮助信息"
+    echo
+    echo "示例:"
+    echo "  $0 -g mypassword myrepo"
+    exit 0
+}
+
+# 参数解析
+UPGRADE_GIT_PACKAGE=false
+while getopts ":gh" OPT; do
+    case "$OPT" in
+        h) show_help ;;
+        g) UPGRADE_GIT_PACKAGE=true ;;
+        \?) echo >&2 "无效选项: -$OPTARG"; exit 1 ;;
+    esac
+done
+shift $((OPTIND-1))
+
+# 验证必需参数
+if [ $# -ne 2 ]; then
+    echo >&2 "错误：需要提供GPG密码和仓库名称"
+    show_help
+fi
+GPG_PASSPHRASE=$1
+REPO_NAME=$2
+
+# 创建仓库目录
+mkdir -p "$REPO_DIR"
+
+# 包构建顺序列表
+PACKAGE_LIST=(
+    "q6voiced"
+    "soc-qcom-sdm845" 
+    "persistent-mac"
+    "linux-firmware"
+    "qbootctl"
+    "bootmac"
+    "alsa-ucm-oneplus"
+    "device-oneplus-fajita"
+    "device-lenovo-q706f"
+    "mkbootimg"
+    "linux-firmware-lenovo-sm8250"
+    "linux-sdm845"
+    "linux-sm8250"
+    "sensors/iio-sensor-proxy"
+    "sensors/hexagonrpcd"
+    "sensors/libssc"
+)
+
+# 检查包是否需要构建（复用原脚本逻辑）
+# needs_install() {
+#     # [原脚本中的needs_install函数实现]
+#     # 此处保留原有版本检查逻辑
+# }
+
+# 增强版构建函数
+build_package() {
+    local pkg_dir=$1
+    echo "▌正在构建 $pkg_dir..."
+
+    # 清理构建环境
+    rm -rf "${pkg_dir}/src" "${pkg_dir}/pkg"
+    find "${pkg_dir}" -maxdepth 1 -name "*.pkg.tar.*" -delete
+
+    # 特殊包处理示例
+    # case "$pkg_dir" in
+    #     "linux-sdm845"|"linux-sm8250")
+    #         export KERNEL_CONFIG="selinux_defconfig" ;;
+    # esac
+
+    # 执行构建
+    (cd "$pkg_dir" && makepkg -s -C --noconfirm) || {
+        echo >&2 "构建 $pkg_dir 失败"
+        exit 3
+    }
+}
+
+# GPG签名函数
+sign_package() {
+    local pkg_path=$1
+    echo "▌正在签名 ${pkg_path##*/}..."
+
+    gpg --detach-sign --no-armor \
+        --batch --yes \
+        --passphrase "$GPG_PASSPHRASE" \
+        --pinentry-mode loopback \
+        "$pkg_path" || {
+        echo >&2 "签名 $pkg_path 失败"
+        exit 4
+    }
+}
+
+# 添加到仓库
+add_to_repo() {
+    local pkg_file=$1
+    echo "▌添加包到仓库: ${pkg_file##*/}"
+
+    cp -f "$pkg_file" "$REPO_DIR/"
+    cp -f "${pkg_file}.sig" "$REPO_DIR/"
+
+    repo-add -s -v "$REPO_DIR/$REPO_NAME.db.tar.gz" \
+        "$REPO_DIR/${pkg_file##*/}" || {
+        echo >&2 "添加包到仓库失败"
+        exit 5
+    }
+}
+
+# 主构建流程
+for pkg in "${PACKAGE_LIST[@]}"; do
+    # 检查包目录是否存在
+    if [ ! -d "$pkg" ]; then
+        echo >&2 "错误：包目录 $pkg 不存在"
+        exit 2
+    fi
+
+    # 版本检查
+    # if ! needs_install "$pkg"; then
+    #     echo "▌跳过已安装的包: $pkg"
+    #     continue
+    # fi
+
+    # 构建流程
+    build_package "$pkg"
+
+    # 处理生成的包文件
+    for pkg_file in "$pkg"/*$PKGEXT; do
+        [ -f "$pkg_file" ] || continue
+
+        sign_package "$pkg_file"
+        add_to_repo "$pkg_file"
+    done
+done
+
+echo "✔ 所有操作已完成！"
+echo "仓库路径: $(pwd)/$REPO_DIR"

chromium/.SRCINFO

@@ -0,0 +1,68 @@
+pkgbase = chromium
+	pkgdesc = A web browser built for speed, simplicity, and security
+	pkgver = 133.0.6943.126
+	pkgrel = 2
+	url = https://www.chromium.org/Home
+	arch = x86_64
+	license = BSD-3-Clause
+	makedepends = python
+	makedepends = gn
+	makedepends = ninja
+	makedepends = clang
+	makedepends = lld
+	makedepends = gperf
+	makedepends = nodejs
+	makedepends = pipewire
+	makedepends = rust
+	makedepends = rust-bindgen
+	makedepends = qt5-base
+	makedepends = qt6-base
+	makedepends = java-runtime-headless
+	makedepends = git
+	depends = gtk3
+	depends = nss
+	depends = alsa-lib
+	depends = xdg-utils
+	depends = libxss
+	depends = libcups
+	depends = libgcrypt
+	depends = ttf-liberation
+	depends = systemd
+	depends = dbus
+	depends = libpulse
+	depends = pciutils
+	depends = libva
+	depends = libffi
+	depends = desktop-file-utils
+	depends = hicolor-icon-theme
+	depends = fontconfig
+	depends = brotli
+	depends = libjpeg-turbo
+	depends = flac
+	depends = libxml2
+	depends = libwebp
+	depends = minizip
+	depends = opus
+	depends = harfbuzz
+	depends = libxslt
+	depends = libpng
+	depends = freetype2
+	optdepends = pipewire: WebRTC desktop sharing under Wayland
+	optdepends = kdialog: support for native dialogs in Plasma
+	optdepends = gtk4: for --gtk-version=4 (GTK4 IME might work better on Wayland)
+	optdepends = org.freedesktop.secrets: password storage backend on GNOME / Xfce
+	optdepends = kwallet: support for storing passwords in KWallet on Plasma
+	optdepends = upower: Battery Status API support
+	options = !lto
+	source = https://commondatastorage.googleapis.com/chromium-browser-official/chromium-133.0.6943.126.tar.xz
+	source = https://github.com/foutrelis/chromium-launcher/archive/v8/chromium-launcher-8.tar.gz
+	source = compiler-rt-adjust-paths.patch
+	source = increase-fortify-level.patch
+	source = use-oauth2-client-switches-as-default.patch
+	sha256sums = bb99b5d8a4ec2374f58d3b6c694bffde91af1b80db5c46783166dd51beada024
+	sha256sums = 213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a
+	sha256sums = b3de01b7df227478687d7517f61a777450dca765756002c80c4915f271e2d961
+	sha256sums = d634d2ce1fc63da7ac41f432b1e84c59b7cceabf19d510848a7cff40c8025342
+	sha256sums = 6de648d449159dd579e42db304aca0a36243f2ac1538f8d030473afbbc8ff475
+
+pkgname = chromium