Allow publishing of externally built tarballs

[juliusknorr]

I just tried to release a nightly build of deck to the app store, but if fails with the following error message:

$  krankerl publish --nightly https://download.bitgrid.net/nextcloud/deck/nightly/deck_nightly_2017-12-07.tar.gz
an error occured: Other("No package found")

@ChristophWurst

[juliusknorr]

Ah I needed to package the nightly build with krankerl as well. Maybe it should be possible to use a prebuild package url and just download it if it is not present in the build/artifacts/ directory.

[ChristophWurst]

Did you run krankerl package before? Does build/artifacts/<appid>.tar.gz exist?

The error originates from

krankerl/src/lib.rs

Line 84 in a5e345b

return Err(error::Error::Other("No package found".to_string()));

.

[ChristophWurst]

Ah I needed to package the nightly build with krankerl as well. Maybe it should be possible to use a prebuild package url and just download it if it is not present in the build/artifacts/ directory.

Yup, right. What package URL do you mean?

[juliusknorr]

Well, I run a remote cron to build nightly tarballs so i just tried to upload it as a release with krankerl without building it locally.

[ChristophWurst]

Right now you could trick krankerl by simply downloading the tarball to build/artifacts. I could be wrong but it should be possible to release a nightly build this way, although it's a bit hacky.

[juliusknorr]

Yep, that worked fine. I guess it kind of makes sense from a security point of view to require a local build. Maybe it should not download by default but a possible download CLI parameter would be great, or at least showing an error message that gives a bit more detail on what's wrong.

[ChristophWurst]

not download by default but a possible download CLI parameter would be great

Something like krankerl publish --nightly --download <url>? Then, if the --download flag is set, it does not use the local build, but download the file from the given URL, sign it and register the release on the app store.

[juliusknorr]

Exactly. That would give the possibility to do so but not download it automatically.

[ChristophWurst]

I'm considering making this the default. Because I noticed a little flaw in the current process: the tool uses the locally available artifact to generate the tarball signature.

This fails

• Package tarball 1
• Upload tarball 1 to github
• Package another tarball 2
• Publish with URL from github asset
• 💥 app store can't verify signature