Harden multi-architecture release pipeline

helpers/docker-helpers.sh

@@ -13,13 +13,21 @@ check_docker() {
   fi
 }
 
+docker_native_arch() {
+  case "$(uname -m)" in
+    x86_64) echo x86_64 ;;
+    aarch64 | arm64) echo aarch64 ;;
+    *) return 1 ;;
+  esac
+}
+
 setup_qemu() {
-  # Setup QEMU for building ARM64 packages on x86_64 hosts
+  # Register emulators for builds whose target differs from the host.
   if ! docker run --rm --privileged multiarch/qemu-user-static --reset -p yes --credential yes >/dev/null 2>&1; then
-    print_error "Failed to setup QEMU for ARM64 emulation"
+    print_error "Failed to set up QEMU emulation"
     exit 1
   fi
-  print_success "QEMU ARM64 emulation enabled"
+  print_success "QEMU emulation enabled"
 }
 
 build_docker_image() {
@@ -53,9 +61,9 @@ build_docker_image() {
 get_platform_arg() {
   local arch="$1"
   case "$arch" in
-    x86_64)  echo "--platform linux/amd64" ;;
-    aarch64) echo "--platform linux/arm64" ;;
-    *)       echo "" ;;
+    x86_64)  echo "--platform=linux/amd64" ;;
+    aarch64) echo "--platform=linux/arm64" ;;
+    *)       return 1 ;;
   esac
 }
 

helpers/package-metadata.sh

@@ -143,6 +143,31 @@ package_has_pkgbuild() {
   [[ -f "$pkgdir/PKGBUILD" ]]
 }
 
+# The architectures declared by a PKGBUILD. Set CARCH while reading it so a
+# conditional arch=() assignment is evaluated for the architecture we are
+# actually checking, even when the repository host is a different one.
+package_arches() {
+  local pkgdir="$1"
+  local arch="${2:-${ARCH:-x86_64}}"
+
+  (cd "$pkgdir" && env -u OMARCHY_SRC CARCH="$arch" bash -c '
+    source PKGBUILD >/dev/null 2>&1
+    printf "%s\n" "${arch[*]}"
+  ')
+}
+
+package_supports_arch() {
+  local pkgdir="$1"
+  local target="${2:-${ARCH:-x86_64}}"
+  local arches
+
+  arches=$(package_arches "$pkgdir" "$target") || return 1
+  case " $arches " in
+    *" any "* | *" $target "*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
 # Channel membership: where a package may be published. Packages without a
 # `channels` key are members of every channel (they flow edge -> rc -> stable).
 package_has_channels() {
@@ -301,9 +326,12 @@ packages_for_mirror() {
 
 packages_for_unscoped_build() {
   local mirror="$1"
+  local arch="${2:-${ARCH:-x86_64}}"
 
   package_dirs | while IFS= read -r pkgdir; do
-    if package_builds_for_mirror "$pkgdir" "$mirror" && ! package_build_skipped "$pkgdir"; then
+    if package_builds_for_mirror "$pkgdir" "$mirror" &&
+      ! package_build_skipped "$pkgdir" &&
+      package_supports_arch "$pkgdir" "$arch"; then
       basename "$pkgdir"
     fi
   done
@@ -502,12 +530,28 @@ validate_package_metadata() {
     return 1
   fi
 
-  if ! jq -e '(.rebuilt_against // {}) | type == "object" and (to_entries | all(.value | type == "string" and length > 0))' "$metadata" >/dev/null; then
-    echo "invalid rebuilt_against for $(basename "$pkgdir"): must be an object mapping package names to versions"
+  if ! jq -e '
+    def version_map:
+      type == "object" and (to_entries | all(.value | type == "string" and length > 0));
+    (.rebuilt_against // {}) as $record |
+    ($record | version_map) or
+      (($record | type) == "object"
+       and ((($record | keys) - ["x86_64", "aarch64"]) | length == 0)
+       and ($record | to_entries | all(.value | version_map)))
+  ' "$metadata" >/dev/null; then
+    echo "invalid rebuilt_against for $(basename "$pkgdir"): must map architectures to package-version maps"
     return 1
   fi
 
-  if ! jq -e '((.rebuilt_against // {}) | keys) - (.rebuild_on // []) | length == 0' "$metadata" >/dev/null; then
+  if ! jq -e '
+    (.rebuild_on // []) as $triggers |
+    (.rebuilt_against // {}) as $record |
+    if ($record | to_entries | all(.value | type == "string")) then
+      ((($record | keys) - $triggers) | length == 0)
+    else
+      ($record | to_entries | all((((.value | keys) - $triggers) | length) == 0))
+    end
+  ' "$metadata" >/dev/null; then
     echo "invalid rebuilt_against for $(basename "$pkgdir"): records a package that rebuild_on does not name"
     return 1
   fi

helpers/paths.sh

@@ -13,8 +13,8 @@ VALID_ARCHES="x86_64 aarch64"
 # in this order; the first entry is the reference architecture that the
 # release train observes channels through. Adding an architecture here is the
 # enablement step: the next check-versions tick queues its packages and the
-# next auto-release tick builds them. OMARCHY_ARCHES overrides it for a host
-# or a one-off run.
+# next auto-release tick builds them. OMARCHY_ARCHES overrides it for a
+# one-off run.
 PUBLISHED_ARCHES="${OMARCHY_ARCHES:-x86_64}"
 
 validate_arch() {