Upload Snapcraft build (#495)

chidiwilliams · Jun 17, 2023 · 6854d17 · 6854d17
1 parent 530bf28
commit 6854d17
Show file tree

Hide file tree

Showing 3 changed files with 70 additions and 21 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -86,27 +86,6 @@ jobs:
         with:
           flags: ${{ runner.os }}
 
-  snapcraft:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          submodules: recursive
-      - uses: snapcore/action-build@v1
-        id: snapcraft
-      - run: |
-          sudo snap install --devmode *.snap
-      #      - uses: snapcore/action-publish@v1
-      #        env:
-      #          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_TOKEN }}
-      #        with:
-      #          snap: ${{ steps.snapcraft.outputs.snap }}
-      #          release: edge
-      - uses: actions/upload-artifact@v3
-        with:
-          name: snap
-          path: ${{ steps.snapcraft.outputs.snap }}
-
   build:
     runs-on: ${{ matrix.os }}
     strategy:

diff --git a/.github/workflows/snapcraft.yml b/.github/workflows/snapcraft.yml
@@ -0,0 +1,62 @@
+---
+name: Snapcraft
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - "*"
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    outputs:
+      snap: ${{ steps.snapcraft.outputs.snap }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          submodules: recursive
+      - uses: snapcore/action-build@v1
+        id: snapcraft
+      - run: |
+          sudo snap install --devmode *.snap
+      - uses: actions/upload-artifact@v3
+        with:
+          name: snap
+          path: ${{ steps.snapcraft.outputs.snap }}
+
+  upload-edge:
+    runs-on: ubuntu-latest
+    needs: [build]
+    if: github.ref == 'refs/heads/main'
+    steps:
+      - uses: actions/download-artifact@v3
+        with:
+          name: snap
+      - uses: snapcore/action-publish@v1
+        env:
+          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_TOKEN }}
+        with:
+          snap: ${{ needs.build.outputs.snap }}
+          release: edge
+
+  upload-stable:
+    runs-on: ubuntu-latest
+    needs: [build]
+    if: startsWith(github.ref, 'refs/tags/')
+    steps:
+      - uses: actions/download-artifact@v3
+        with:
+          name: snap
+      - uses: snapcore/action-publish@v1
+        env:
+          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_TOKEN }}
+        with:
+          snap: ${{ needs.build.outputs.snap }}
+          release: stable
+
diff --git a/snap/snapcraft.yaml b/snap/snapcraft.yaml
@@ -78,6 +78,8 @@ parts:
   buzz:
     plugin: python
     source: .
+    build-packages:
+      - execstack
     stage-packages:
       - ffmpeg
       - libportaudio2
@@ -90,6 +92,12 @@ parts:
       cp $CRAFT_PART_BUILD/libwhisper.so $CRAFT_PART_INSTALL/usr/lib/
       cp $CRAFT_PART_BUILD/whisper_cpp $CRAFT_PART_INSTALL/
       mkdir $CRAFT_PART_INSTALL/buzz && cp $CRAFT_PART_BUILD/buzz/whisper_cpp.py $CRAFT_PART_INSTALL/buzz/
+
+      # Resolves:
+      #   - Found files with executable stack. This adds PROT_EXEC to mmap(2) during mediation which may cause security denials. Either adjust your program to not require an executable stack, strip it with 'execstack --clear-execstack ...' or remove the affected file from your snap. Affected files: lib/python3.10/site-packages/ctranslate2.libs/libctranslate2-7e7a7741.so.3.15.1, lib/python3.10/site-packages/onnxruntime/capi/onnxruntime_pybind11_state.cpython-310-x86_64-linux-gnu.so, lib/python3.10/site-packages/torch/lib/libtorch_cpu.so
+      # execstack -clear-execstack $CRAFT_PART_INSTALL/lib/python3.10/site-packages/ctranslate2.libs/libctranslate2-7e7a7741.so.3.15.1
+      # execstack --clear-execstack $CRAFT_PART_INSTALL/lib/python3.10/site-packages/onnxruntime/capi/onnxruntime_pybind11_state.cpython-310-x86_64-linux-gnu.so
+      # execstack --clear-execstack $CRAFT_PART_INSTALL/lib/python3.10/site-packages/torch/lib/libtorch_cpu.so
     python-packages:
       - aiohttp==3.8.4
       - aiosignal==1.3.1