From 4eaf4723640ecce3118212b618acbf6f46e42486 Mon Sep 17 00:00:00 2001 From: jnfrati Date: Mon, 29 Jun 2026 11:34:48 +0200 Subject: [PATCH 1/2] chore: publish packages to NetBird repositories --- .github/workflows/release.yml | 2 + .goreleaser.yml | 103 ++++++++++++++++++++++++++-------- README.md | 85 ++++++++++++++++------------ docs/reference.md | 2 +- 4 files changed, 133 insertions(+), 59 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 05d1d91..9cb543e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -272,3 +272,5 @@ jobs: args: release --clean env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + UPLOAD_DEBIAN_SECRET: ${{ secrets.PKG_UPLOAD_SECRET }} + UPLOAD_YUM_SECRET: ${{ secrets.PKG_UPLOAD_SECRET }} diff --git a/.goreleaser.yml b/.goreleaser.yml index e8dacb0..42f44d5 100644 --- a/.goreleaser.yml +++ b/.goreleaser.yml @@ -141,8 +141,13 @@ srpm: - docs/reference.md - docs/architecture.md +# Two single-format nfpm definitions (instead of one combined deb+rpm entry) so +# that each artifact carries a distinct id the `uploads` pipe can target. The +# packages are amd64-only because the bundled GTK/NM editor .so files are built +# by the C toolchain on the amd64 runner; both entries reference the dedicated +# amd64-only Go builds for the same reason. nfpms: - - id: linux-packages + - id: linux-packages-deb ids: - nm-netbird-service-package-amd64 - nm-netbird-auth-dialog-package-amd64 @@ -157,7 +162,56 @@ nfpms: bindir: /usr/libexec formats: - deb + dependencies: + - network-manager + - netbird + - libnm0 + - libgtk-3-0 + - libnma0 + - xdg-utils + - libgtk-4-1 + - libnma-gtk4-0 + contents: + - src: bin/linux_amd64/libnm-vpn-plugin-netbird.so + dst: /usr/lib/NetworkManager/libnm-vpn-plugin-netbird.so + - src: bin/linux_amd64/libnm-vpn-plugin-netbird-editor.so + dst: /usr/lib/NetworkManager/libnm-vpn-plugin-netbird-editor.so + - src: bin/linux_amd64/libnm-gtk4-vpn-plugin-netbird-editor.so + dst: /usr/lib/NetworkManager/libnm-gtk4-vpn-plugin-netbird-editor.so + - src: packaging/NetworkManager/VPN/nm-netbird-service.name + dst: /etc/NetworkManager/VPN/nm-netbird-service.name + - src: packaging/dbus-1/system.d/nm-netbird-service.conf + dst: /usr/share/dbus-1/system.d/nm-netbird-service.conf + - src: packaging/NetworkManager/conf.d/90-netbird-unmanaged.conf + dst: /etc/NetworkManager/conf.d/90-netbird-unmanaged.conf + type: config|noreplace + - src: LICENSE + dst: /usr/share/doc/network-manager-netbird/LICENSE + scripts: + postinstall: packaging/scripts/postinstall.sh + postremove: packaging/scripts/postremove.sh + - id: linux-packages-rpm + ids: + - nm-netbird-service-package-amd64 + - nm-netbird-auth-dialog-package-amd64 + package_name: network-manager-netbird + vendor: NetBird + homepage: https://netbird.io + maintainer: NetBird + description: NetworkManager VPN plugin for NetBird. + license: BSD-3-Clause + bindir: /usr/libexec + formats: - rpm + dependencies: + - NetworkManager + - netbird + - NetworkManager-libnm + - gtk3 + - libnma + - xdg-utils + - gtk4 + - libnma-gtk4 contents: - src: bin/linux_amd64/libnm-vpn-plugin-netbird.so dst: /usr/lib/NetworkManager/libnm-vpn-plugin-netbird.so @@ -174,33 +228,36 @@ nfpms: type: config|noreplace - src: packaging/selinux/nm_netbird.pp dst: /usr/share/selinux/packages/nm_netbird.pp - packager: rpm - src: LICENSE dst: /usr/share/doc/network-manager-netbird/LICENSE scripts: postinstall: packaging/scripts/postinstall.sh postremove: packaging/scripts/postremove.sh - overrides: - deb: - dependencies: - - network-manager - - netbird - - libnm0 - - libgtk-3-0 - - libnma0 - - xdg-utils - - libgtk-4-1 - - libnma-gtk4-0 - rpm: - dependencies: - - NetworkManager - - netbird - - NetworkManager-libnm - - gtk3 - - libnma - - xdg-utils - - gtk4 - - libnma-gtk4 + +# Publish the freshly built packages to the NetBird apt/yum repositories. These +# run in the publish phase, so they are skipped automatically for snapshot builds +# (which pass --skip=publish) and only fire on tagged releases. Authentication +# uses the UPLOAD_DEBIAN_SECRET / UPLOAD_YUM_SECRET env vars (set in CI). +uploads: + - name: debian + ids: + - linux-packages-deb + exts: + - deb + mode: archive + target: https://pkgs.wiretrustee.com/debian/pool/{{ .ArtifactName }};deb.distribution=stable;deb.component=main;deb.architecture={{ if .Arm }}armhf{{ else }}{{ .Arch }}{{ end }};deb.package= + custom_artifact_name: true + username: dev@wiretrustee.com + method: PUT + - name: yum + ids: + - linux-packages-rpm + exts: + - rpm + mode: archive + target: https://pkgs.wiretrustee.com/yum/{{ .Arch }}{{ if .Arm }}{{ .Arm }}{{ end }} + username: dev@wiretrustee.com + method: PUT checksum: name_template: checksums.txt diff --git a/README.md b/README.md index 752a6f3..34d523a 100644 --- a/README.md +++ b/README.md @@ -7,8 +7,9 @@ NetworkManager is only a control/status frontend in this integration. NetBird re ## Requirements - Linux with NetworkManager -- NetBird daemon/runtime installed (see the [official NetBird Linux installation guide](https://docs.netbird.io/get-started/install/linux)) +- NetBird daemon/runtime installed or installable from the NetBird package repository (see the [official NetBird Linux installation guide](https://docs.netbird.io/get-started/install/linux)) - NetBird daemon gRPC socket available (default: `unix:///var/run/netbird.sock`) + When building the desktop properties editor from source: - `cc`, `pkg-config`, libnm, GTK 3, and libnma development headers @@ -23,53 +24,67 @@ When building the desktop properties editor from source: ## Quick install -### One-line quickstart +Tagged releases are published to the NetBird APT/YUM repositories as `network-manager-netbird` for `amd64`/`x86_64`. The package depends on the NetBird daemon/runtime package (`netbird`), so package managers can install both from the same repository. You still need to authenticate/connect NetBird after installation. -For Ubuntu/Debian/Fedora/RHEL on `amd64`/`x86_64`, the quickstart script installs NetworkManager prerequisites, enables NetworkManager, downloads the latest package, and installs it. The NetBird daemon/runtime requirement above still applies: +### Ubuntu/Debian (APT) ```bash -curl -fsSL https://raw.githubusercontent.com/netbirdio/network-manager-vpn-plugin/main/scripts/quickstart.sh | sh +sudo apt-get update +sudo apt-get install -y ca-certificates curl gnupg network-manager + +curl -fsSL https://pkgs.netbird.io/debian/public.key \ + | sudo gpg --dearmor --yes -o /usr/share/keyrings/netbird-archive-keyring.gpg +sudo chmod 0644 /usr/share/keyrings/netbird-archive-keyring.gpg + +echo 'deb [signed-by=/usr/share/keyrings/netbird-archive-keyring.gpg] https://pkgs.netbird.io/debian stable main' \ + | sudo tee /etc/apt/sources.list.d/netbird.list + +sudo apt-get update +sudo apt-get install -y network-manager-netbird +sudo systemctl enable --now NetworkManager ``` -To review it before running: +### Fedora/RHEL (DNF/YUM) ```bash -curl -fsSLO https://raw.githubusercontent.com/netbirdio/network-manager-vpn-plugin/main/scripts/quickstart.sh -less quickstart.sh -sh quickstart.sh +sudo dnf install -y NetworkManager curl ca-certificates + +sudo tee /etc/yum.repos.d/netbird.repo >/dev/null <<'EOF' +[NetBird] +name=NetBird +baseurl=https://pkgs.netbird.io/yum/ +enabled=1 +gpgcheck=1 +gpgkey=https://pkgs.netbird.io/yum/repodata/repomd.xml.key +repo_gpgcheck=1 +EOF + +sudo dnf install -y network-manager-netbird +sudo systemctl enable --now NetworkManager ``` -For snapshot releases: +Replace `dnf` with `yum` on systems that do not provide `dnf`. + +### One-line quickstart and snapshots + +For Ubuntu/Debian/Fedora/RHEL on `amd64`/`x86_64`, the quickstart script installs NetworkManager prerequisites, enables NetworkManager, downloads a package from the GitHub release assets, and installs it: ```bash -curl -fsSL https://raw.githubusercontent.com/netbirdio/network-manager-vpn-plugin/main/scripts/quickstart.sh | env RELEASE_TAG=snapshot sh +curl -fsSL https://raw.githubusercontent.com/netbirdio/network-manager-vpn-plugin/main/scripts/quickstart.sh | sh ``` -### Ubuntu/Debian +To review it before running: ```bash -sudo apt update -sudo apt install network-manager curl -sudo systemctl enable --now NetworkManager - -curl -fL -o network-manager-netbird_linux_amd64.deb "$(curl -fsSL https://api.github.com/repos/netbirdio/network-manager-vpn-plugin/releases/latest | grep '"browser_download_url":' | grep -E 'network-manager-netbird.*(_linux_amd64|_amd64|\.x86_64)\.deb"' | cut -d '"' -f 4 | head -n 1)" -sudo apt install ./network-manager-netbird_linux_amd64.deb +curl -fsSLO https://raw.githubusercontent.com/netbirdio/network-manager-vpn-plugin/main/scripts/quickstart.sh +less quickstart.sh +sh quickstart.sh ``` -### Fedora/RHEL +Snapshot releases are not published to the package repositories. To install the latest snapshot package from GitHub release assets: ```bash -sudo dnf install NetworkManager curl -sudo systemctl enable --now NetworkManager - -RELEASE_API=https://api.github.com/repos/netbirdio/network-manager-vpn-plugin/releases/latest -asset_url="$(curl -fsSL "$RELEASE_API" | - grep '"browser_download_url":' | - grep -E 'network-manager-netbird.*(_linux_amd64|_amd64|\.x86_64)\.rpm"' | - cut -d '"' -f 4 | - head -n 1)" -curl -fL -o network-manager-netbird_linux_amd64.rpm "$asset_url" -sudo dnf install ./network-manager-netbird_linux_amd64.rpm +curl -fsSL https://raw.githubusercontent.com/netbirdio/network-manager-vpn-plugin/main/scripts/quickstart.sh | env RELEASE_TAG=snapshot sh ``` ### Other distributions (tarball) @@ -83,7 +98,7 @@ sudo ./install.sh Substitute `amd64` with `arm64` or `armv7` as needed. -For snapshot releases, use `RELEASE_TAG=snapshot` with the quickstart script, set `RELEASE_API=https://api.github.com/repos/netbirdio/network-manager-vpn-plugin/releases/tags/snapshot` in the package examples, or replace `latest/download` with `download/snapshot` in the tarball URL. +For snapshot releases, use `RELEASE_TAG=snapshot` with the quickstart script, or replace `latest/download` with `download/snapshot` in the tarball URL. ### Verify @@ -173,13 +188,13 @@ See the [Architecture](docs/architecture.md#activation-lifecycle) doc for the ac ## Upgrade and uninstall ```bash -# Upgrade a package install: download the newer .deb/.rpm and install it the same way. -sudo apt install ./network-manager-netbird_linux_amd64.deb # Debian -sudo dnf install ./network-manager-netbird_linux_amd64.rpm # Fedora +# Upgrade a package-repository install +sudo apt-get update && sudo apt-get install -y --only-upgrade network-manager-netbird # Ubuntu/Debian +sudo dnf upgrade -y network-manager-netbird # Fedora/RHEL # Uninstall -sudo apt remove network-manager-netbird # Ubuntu/Debian -sudo dnf remove network-manager-netbird # Fedora/RHEL +sudo apt-get remove network-manager-netbird # Ubuntu/Debian +sudo dnf remove network-manager-netbird # Fedora/RHEL ``` For tarball installs, run the bundled `uninstall.sh`. diff --git a/docs/reference.md b/docs/reference.md index a7313cd..3e6a3f8 100644 --- a/docs/reference.md +++ b/docs/reference.md @@ -183,7 +183,7 @@ The plugin communicates with the local NetBird daemon over gRPC at the configure ## Installed files -Package installs (`.deb`, `.rpm`) place files at the following paths. Tarball installs use the same layout for binaries, NetworkManager metadata, editor modules, and unmanaged-interface config by default, with overrides available through `DESTDIR`, `LIBEXEC_DIR`, `NM_PLUGIN_DIR`, `NM_VPN_DIR`, `DBUS_POLICY_DIR`, and `NM_CONF_DIR`. +Package installs (`network-manager-netbird` from the NetBird APT/YUM repositories, or a local `.deb`/`.rpm`) place files at the following paths. Tarball installs use the same layout for binaries, NetworkManager metadata, editor modules, and unmanaged-interface config by default, with overrides available through `DESTDIR`, `LIBEXEC_DIR`, `NM_PLUGIN_DIR`, `NM_VPN_DIR`, `DBUS_POLICY_DIR`, and `NM_CONF_DIR`. | Path | Purpose | | --- | --- | From 90e7a744733a27f46697ed7ac1551c8c59777127 Mon Sep 17 00:00:00 2001 From: jnfrati Date: Fri, 10 Jul 2026 13:04:43 +0200 Subject: [PATCH 2/2] fix: use fixed package upload architectures --- .goreleaser.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.goreleaser.yml b/.goreleaser.yml index 42f44d5..63a15e3 100644 --- a/.goreleaser.yml +++ b/.goreleaser.yml @@ -236,8 +236,11 @@ nfpms: # Publish the freshly built packages to the NetBird apt/yum repositories. These # run in the publish phase, so they are skipped automatically for snapshot builds -# (which pass --skip=publish) and only fire on tagged releases. Authentication -# uses the UPLOAD_DEBIAN_SECRET / UPLOAD_YUM_SECRET env vars (set in CI). +# (which pass --skip=publish) and only fire on tagged releases. The legacy +# wiretrustee.com hostname is the authenticated upload endpoint; users access the +# same repositories through the canonical pkgs.netbird.io hostname documented in +# the README. Authentication uses the UPLOAD_DEBIAN_SECRET / UPLOAD_YUM_SECRET +# env vars (set in CI). uploads: - name: debian ids: @@ -245,7 +248,7 @@ uploads: exts: - deb mode: archive - target: https://pkgs.wiretrustee.com/debian/pool/{{ .ArtifactName }};deb.distribution=stable;deb.component=main;deb.architecture={{ if .Arm }}armhf{{ else }}{{ .Arch }}{{ end }};deb.package= + target: https://pkgs.wiretrustee.com/debian/pool/{{ .ArtifactName }};deb.distribution=stable;deb.component=main;deb.architecture=amd64;deb.package= custom_artifact_name: true username: dev@wiretrustee.com method: PUT @@ -255,7 +258,7 @@ uploads: exts: - rpm mode: archive - target: https://pkgs.wiretrustee.com/yum/{{ .Arch }}{{ if .Arm }}{{ .Arm }}{{ end }} + target: https://pkgs.wiretrustee.com/yum/amd64 username: dev@wiretrustee.com method: PUT