Operations Release Process - CyberMind-FR/secubox-deb GitHub Wiki
What it is for. How a SecuBox release is cut (tag v3.0.0-alpha.N), which workflows run, which files end up on the GitHub release, and how to check a download.
Pushing a tag v* starts three things in parallel:
| Workflow | File | Produces |
|---|---|---|
| Release | release.yml |
orchestrates package build, system images, live USB, APT publication, release notes, SHA256SUMS
|
| Build SecuBox .deb packages | build-packages.yml |
the .deb files (arm64 and amd64), published into the release and the repository |
| Build Installer ISO | build-installer-iso.yml |
the headless installer (amd64), compressed ISO and USB image |
A tag containing alpha, beta or rc is published as a pre-release. release.yml can also be started by hand (workflow_dispatch) with the version, whether to build images, whether to publish to the APT repository, and the Debian suite (trixie by default).
Release notes are written from a shell heredoc in
release.yml: never put a backtick in that file, the shell would run it.
| Asset | Description |
|---|---|
System images (secubox-<profile>-<board>-<suite>.img.gz) |
MOCHAbin, Raspberry Pi 400 and VM x64; the profile of each board comes from its config.mk (lite for the ESPRESSObin, isp and full elsewhere). ESPRESSObin images are not part of scheduled releases but can be built on demand. |
| Live USB | x64 (GRUB, UEFI and BIOS), Raspberry Pi 400 (kiosk by default) and MOCHAbin (U-Boot); boot entries: Live with persistence, Kiosk, Console TUI, Bridge, Install to disk, To RAM |
| Installer |
secubox-installer-amd64-<suite>.iso.gz and .img.gz: boots, then installs on the first disk with no screen or keyboard. It erases that disk.
|
| Scripts |
create-qemu-arm64-vm.sh, create-vbox-vm.sh
|
| Checksums |
SHA256SUMS and SHA256SUMS.gpg
|
The raw .img files are not published, only compressed ones.
GitHub refuses any release asset of 2 GiB or more. The live-USB workflow therefore:
- compresses any remaining raw
.imgwith gzip; -
splits any file still above about 2 GB into parts of 1900 MB named
<file>.part00,<file>.part01, ... (the Raspberry Pi image is the usual case).
Reassemble, then decompress and flash:
cat secubox-<image>.img.gz.part* > secubox-<image>.img.gz
gunzip -c secubox-<image>.img.gz | sudo dd of=/dev/sdX bs=4M status=progress
syncReplace /dev/sdX with the right device (lsblk to find it); dd erases it.
SHA256SUMS lists every published file by bare name, parts included, so it works next to the downloaded files. It is clear-signed as SHA256SUMS.gpg with the repository key [email protected].
gpg --verify SHA256SUMS.gpg
sha256sum -c SHA256SUMSCheck the sums before reassembling or flashing. sha256sum -c reports missing files; ignore the ones you did not download (--ignore-missing).
The release jobs ship whatever the upstream jobs produced: one failed board does not cancel the others, and a retry deletes the assets it re-uploads. Typical causes seen: a profile refused by the gate (scripts/verify-profile.sh, see Profils), an artifact that vanished (BlobNotFound on the publish job), or a runner out of disk space. Re-run the failed jobs; when the tag itself must move, delete the partial release with its tag and push the tag again.
- all expected assets present, and
SHA256SUMSmatches; - the installer boots in a VM and installs on a blank disk;
- the APT repository serves the new versions (Operations-APT-Repository).
Operations-APT-Repository · Operations-Runbook · Live-USB · Installation · Profils · Trixie · Operations-Release-Process-FR