Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Provide .deb and .rpm package repositories #463

Open
edigaryev opened this issue Jan 24, 2024 · 1 comment
Open

Provide .deb and .rpm package repositories #463

edigaryev opened this issue Jan 24, 2024 · 1 comment
Labels
artifact:deb Issues related to DEB packages artifact:rpm Issues related to RPM packages

Comments

@edigaryev
Copy link

edigaryev commented Jan 24, 2024

Currently, when you follow the DEB Installation instructions for the OpenTelemetry Collector, you install a specific version that won't be upgraded with apt-get update && apt-get upgrade when the new one comes out.

This places a burden on the administrators, because you have constantly track new Collector versions and update your Ansible Playbooks to include the new .deb URL. This is simply not how things are done normally when administering Debian-based distributions. The same applies to the current state of .rpm packages.

To solve this, a repository needs to be provided.

Good news is that since this project already uses GoReleaser and has nfpms configured, providing a repository will be just 2 lines of YAML added to .goreleaser.yml:

furies:
  - account: open-telemetry

(this assumes that this project has an access to open-telemetry account on Gemfury and an appropriate FURY_TOKEN is provided when running GoReleaser in CI)

Here's an example of how Cirrus Labs's Vetu project uses GoReleaser's furies: to publish both .deb and .rpm repositories:

@edigaryev edigaryev changed the title Provide appropriate .deb and .rpm package repositories Provide .deb and .rpm package repositories Jan 24, 2024
@jpkrohling
Copy link
Member

I wasn't aware of fury.io and was able to secure both "opentelemetry" and "open-telemetry" there. While I think it's a good idea in general, I think the TC would have to approve the usage of this to host our official artifacts. I think I would be somewhat OK with that only if we provide ways for our users to independently verify that the artifacts are indeed coming from the project, likely by signing the packages/binaries.

@mx-psi mx-psi added artifact:rpm Issues related to RPM packages artifact:deb Issues related to DEB packages labels Mar 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
artifact:deb Issues related to DEB packages artifact:rpm Issues related to RPM packages
Projects
None yet
Development

No branches or pull requests

3 participants