[ci] Refactor RPM nfpm configs for reuse

.github/packaging/Dockerfile → .github/packaging/Dockerfile.rpm

@@ -15,10 +15,12 @@ ARG TARGETARCH
 
 # Install build dependencies
 # - gcc: required for cgo (CGO_ENABLED=1 in scripts/constants.sh)
+# - gettext: envsubst for nfpm config template expansion
 # - gnupg2: GPG signing of RPM packages
 # - git: version detection in build scripts
 RUN dnf install -y \
         gcc \
+        gettext \
         gnupg2 \
         git \
     && dnf clean all

.github/packaging/Taskfile.yml

@@ -50,56 +50,63 @@ tasks:
       GO_VERSION: '{{.PACKAGING_GO_VERSION}}'
       DOCKER_IMAGE: '{{.PACKAGING_DOCKER_IMAGE}}'
       CONTEXT_DIR: '{{.REPO_ROOT}}/.github/packaging'
+      DOCKERFILE: Dockerfile.rpm
     cmds:
       - cmd: '{{.REPO_ROOT}}/.github/packaging/scripts/build-builder-image.sh'
 
   build-avalanchego-rpm:
     desc: Builds RPM for avalanchego
     vars:
-      RPM_ARCH: '{{.RPM_ARCH | default .PACKAGING_HOST_ARCH}}'
+      PACKAGE_ARCH: '{{.PACKAGE_ARCH | default .PACKAGING_HOST_ARCH}}'
       RPM_TAG: '{{.PACKAGING_TAG}}'
+    env:
+      GPG_KEY_PASSPHRASE: '{{.GPG_KEY_PASSPHRASE}}'
     deps: [build-builder-docker-image]
     cmds:
       - cmd: mkdir -p {{.PACKAGING_OUTPUT_DIR}}
       - cmd: >-
           docker run --rm
           -v {{.REPO_ROOT}}:/build
           -v {{.PACKAGING_OUTPUT_DIR}}:/output
-          {{if .RPM_GPG_KEY_FILE}}-v {{.RPM_GPG_KEY_FILE}}:{{.RPM_GPG_KEY_FILE}}:ro{{end}}
+          {{if .GPG_KEY_FILE}}-v {{.GPG_KEY_FILE}}:{{.GPG_KEY_FILE}}:ro{{end}}
+          -e PKG_FORMAT=RPM
           -e PACKAGE=avalanchego
           -e VERSION={{trimPrefix "v" .RPM_TAG}}
           -e TAG={{.RPM_TAG}}
-          -e RPM_ARCH={{.RPM_ARCH}}
+          -e PACKAGE_ARCH={{.PACKAGE_ARCH}}
           -e OUTPUT_DIR=/output
           -e AVALANCHEGO_COMMIT={{.PACKAGING_GIT_COMMIT}}
-          {{if .RPM_GPG_KEY_FILE}}-e RPM_GPG_KEY_FILE={{.RPM_GPG_KEY_FILE}}{{end}}
-          {{if .NFPM_RPM_PASSPHRASE}}-e NFPM_RPM_PASSPHRASE={{.NFPM_RPM_PASSPHRASE}}{{end}}
+          {{if .GPG_KEY_FILE}}-e GPG_KEY_FILE={{.GPG_KEY_FILE}}{{end}}
+          {{if .GPG_KEY_PASSPHRASE}}-e GPG_KEY_PASSPHRASE{{end}}
           {{.PACKAGING_DOCKER_IMAGE}}
-          .github/packaging/scripts/build-rpm.sh
+          .github/packaging/scripts/build-package.sh
 
   build-subnet-evm-rpm:
     desc: Builds RPM for subnet-evm
     vars:
-      RPM_ARCH: '{{.RPM_ARCH | default .PACKAGING_HOST_ARCH}}'
+      PACKAGE_ARCH: '{{.PACKAGE_ARCH | default .PACKAGING_HOST_ARCH}}'
       RPM_TAG: '{{.PACKAGING_TAG}}'
+    env:
+      GPG_KEY_PASSPHRASE: '{{.GPG_KEY_PASSPHRASE}}'
     deps: [build-builder-docker-image]
     cmds:
       - cmd: mkdir -p {{.PACKAGING_OUTPUT_DIR}}
       - cmd: >-
           docker run --rm
           -v {{.REPO_ROOT}}:/build
           -v {{.PACKAGING_OUTPUT_DIR}}:/output
-          {{if .RPM_GPG_KEY_FILE}}-v {{.RPM_GPG_KEY_FILE}}:{{.RPM_GPG_KEY_FILE}}:ro{{end}}
+          {{if .GPG_KEY_FILE}}-v {{.GPG_KEY_FILE}}:{{.GPG_KEY_FILE}}:ro{{end}}
+          -e PKG_FORMAT=RPM
           -e PACKAGE=subnet-evm
           -e VERSION={{trimPrefix "v" .RPM_TAG}}
           -e TAG={{.RPM_TAG}}
-          -e RPM_ARCH={{.RPM_ARCH}}
+          -e PACKAGE_ARCH={{.PACKAGE_ARCH}}
           -e OUTPUT_DIR=/output
           -e AVALANCHEGO_COMMIT={{.PACKAGING_GIT_COMMIT}}
-          {{if .RPM_GPG_KEY_FILE}}-e RPM_GPG_KEY_FILE={{.RPM_GPG_KEY_FILE}}{{end}}
-          {{if .NFPM_RPM_PASSPHRASE}}-e NFPM_RPM_PASSPHRASE={{.NFPM_RPM_PASSPHRASE}}{{end}}
+          {{if .GPG_KEY_FILE}}-e GPG_KEY_FILE={{.GPG_KEY_FILE}}{{end}}
+          {{if .GPG_KEY_PASSPHRASE}}-e GPG_KEY_PASSPHRASE{{end}}
           {{.PACKAGING_DOCKER_IMAGE}}
-          .github/packaging/scripts/build-rpm.sh
+          .github/packaging/scripts/build-package.sh
 
   test-build-rpms:
     desc: Builds and validates RPMs end-to-end
@@ -112,5 +119,6 @@ tasks:
     env:
       TAG: '{{.PACKAGING_TAG}}'
       GIT_COMMIT: '{{.PACKAGING_GIT_COMMIT}}'
+      PACKAGE_ARCH: '{{.PACKAGE_ARCH | default .PACKAGING_HOST_ARCH}}'
     cmds:
       - cmd: '{{.REPO_ROOT}}/.github/packaging/scripts/validate-rpm.sh'

.github/packaging/nfpm/avalanchego.yml → .github/packaging/nfpm/avalanchego-rpm.yml

@@ -1,5 +1,5 @@
 name: avalanchego
-arch: "${RPM_ARCH}"
+arch: "${PACKAGE_ARCH}"
 version: "${VERSION}"
 maintainer: "Ava Labs <security@avalabs.org>"
 description: "AvalancheGo node — the official Avalanche protocol implementation"
@@ -8,14 +8,12 @@ license: "BSD-3-Clause"
 depends:
   - "glibc >= 2.34"
 contents:
-  - src: "${AVALANCHEGO_BINARY}"
+  - src: "${BINARY_PATH}"
     dst: /var/opt/avalanchego/bin/avalanchego
-    expand: true
     file_info:
       mode: 0755
-# changelog and key_file paths are set to well-known locations by build-rpm.sh
-changelog: "/build/build/nfpm-changelog.yml"
+changelog: "${NFPM_CHANGELOG}"
 rpm:
   compression: zstd
   signature:
-    key_file: "/build/build/gpg/signing-key.asc"
+    key_file: "${NFPM_SIGNING_KEY}"

.github/packaging/nfpm/subnet-evm.yml → .github/packaging/nfpm/subnet-evm-rpm.yml

@@ -1,5 +1,5 @@
 name: subnet-evm
-arch: "${RPM_ARCH}"
+arch: "${PACKAGE_ARCH}"
 version: "${VERSION}"
 maintainer: "Ava Labs <security@avalabs.org>"
 description: "Subnet-EVM plugin for AvalancheGo"
@@ -8,15 +8,13 @@ license: "BSD-3-Clause"
 depends:
   - "glibc >= 2.34"
 contents:
-  - src: "${SUBNET_EVM_BINARY}"
+  - src: "${BINARY_PATH}"
     # SUBNET_EVM_VM_ID is sourced from graft/subnet-evm/scripts/constants.sh
     dst: /var/opt/avalanchego/plugins/${SUBNET_EVM_VM_ID}
-    expand: true
     file_info:
       mode: 0755
-# changelog and key_file paths are set to well-known locations by build-rpm.sh
-changelog: "/build/build/nfpm-changelog.yml"
+changelog: "${NFPM_CHANGELOG}"
 rpm:
   compression: zstd
   signature:
-    key_file: "/build/build/gpg/signing-key.asc"
+    key_file: "${NFPM_SIGNING_KEY}"

.github/packaging/scripts/build-builder-image.sh

@@ -9,12 +9,14 @@
 #   GO_VERSION    - Go version to install (e.g., "1.24.12")
 #   DOCKER_IMAGE  - Name for the built Docker image
 #   CONTEXT_DIR   - Path to the Dockerfile directory
+#   DOCKERFILE    - Dockerfile name (e.g., "Dockerfile.rpm")
 
 set -euo pipefail
 
 : "${GO_VERSION:?GO_VERSION must be set}"
 : "${DOCKER_IMAGE:?DOCKER_IMAGE must be set}"
 : "${CONTEXT_DIR:?CONTEXT_DIR must be set}"
+: "${DOCKERFILE:?DOCKERFILE must be set (e.g. Dockerfile.rpm)}"
 
 command -v jq >/dev/null 2>&1 || { echo "ERROR: jq is required but not found on PATH" >&2; exit 1; }
 
@@ -45,13 +47,14 @@ build_flags=()
 build_driver=$(
     docker buildx inspect 2>/dev/null \
         | awk '/^Driver:/ { print $2; exit }'
-)
+) || true
 if [[ "${build_driver}" == "docker-container" ]]; then
     build_flags+=(--load)
 fi
 
 docker build "${build_flags[@]}" \
     --build-arg GO_VERSION="${GO_VERSION}" \
     --build-arg GO_CHECKSUM="${checksum}" \
+    -f "${CONTEXT_DIR}/${DOCKERFILE}" \
     -t "${DOCKER_IMAGE}" \
     "${CONTEXT_DIR}"

.github/packaging/scripts/build-package.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+
+# Build and sign a Linux package inside the container.
+
+set -euo pipefail
+
+: "${PACKAGE:?PACKAGE must be set (avalanchego or subnet-evm)}"
+: "${VERSION:?VERSION must be set (semver without v prefix, e.g. 1.14.1)}"
+: "${TAG:?TAG must be set (git tag, e.g. v1.14.1)}"
+: "${PACKAGE_ARCH:?PACKAGE_ARCH must be set (x86_64 or aarch64)}"
+: "${OUTPUT_DIR:?OUTPUT_DIR must be set (bind-mounted output dir)}"
+
+: "${PKG_FORMAT:?PKG_FORMAT must be set (RPM or DEB)}"
+pkg_format_lower="${PKG_FORMAT,,}"
+
+REPO_ROOT="/build"
+PACKAGING_DIR="${REPO_ROOT}/.github/packaging"
+
+# shellcheck disable=SC1091
+source "${PACKAGING_DIR}/scripts/lib-build-common.sh"
+
+# Well-known paths referenced by nfpm configs
+export NFPM_CHANGELOG="${REPO_ROOT}/build/nfpm-changelog.yml"
+export NFPM_SIGNING_KEY="${REPO_ROOT}/build/gpg/signing-key.asc"
+
+echo "=== Building ${PACKAGE} ${PKG_FORMAT} for ${PACKAGE_ARCH} (tag: ${TAG}) ==="
+
+init_build_env
+build_binary "${PACKAGE}"
+generate_changelog "${VERSION}"
+
+# ── GPG signing ───────────────────────────────────────────────────
+
+GPG_KEY_FILE="${GPG_KEY_FILE:-}"
+GPG_PUBLIC_KEY="${OUTPUT_DIR}/GPG-KEY-avalanchego"
+
+# nfpm reads the signing passphrase from a packager-specific env var
+# (NFPM_RPM_PASSPHRASE, NFPM_DEB_PASSPHRASE, ...); mirror our format-
+# agnostic GPG_KEY_PASSPHRASE into the name nfpm expects.
+nfpm_passphrase_var="NFPM_${PKG_FORMAT}_PASSPHRASE"
+export "${nfpm_passphrase_var}=${GPG_KEY_PASSPHRASE:-}"
+
+# Ephemeral keys use a known throwaway passphrase so local and CI builds
+# exercise passphrase handling without release credentials.
+if [[ -z "${GPG_KEY_FILE}" ]]; then
+    use_ephemeral_gpg_passphrase "${nfpm_passphrase_var}"
+fi
+
+setup_gpg "${GPG_KEY_FILE}" "${GPG_PUBLIC_KEY}" "${PKG_FORMAT}"
+
+# ── Package with nfpm ─────────────────────────────────────────────
+
+export VERSION PACKAGE_ARCH BINARY_PATH
+
+PKG_FILENAME="${PACKAGE}-${TAG}-${PACKAGE_ARCH}.${pkg_format_lower}"
+PKG_PATH="${OUTPUT_DIR}/${PKG_FILENAME}"
+
+run_nfpm_package \
+    "${PACKAGING_DIR}/nfpm/${PACKAGE}-${pkg_format_lower}.yml" \
+    "${REPO_ROOT}/build/${PACKAGE}-${pkg_format_lower}-resolved.yml" \
+    "${pkg_format_lower}" \
+    "${PKG_PATH}"
+
+echo "${PKG_FORMAT} built: ${PKG_PATH}"