feat: add a snap for notary (#67)

Signed-off-by: guillaume <[email protected]>

.github/workflows/build-snap.yaml

@@ -0,0 +1,21 @@
+name: Build Snap
+
+on:
+  workflow_call:
+
+jobs:
+  build-snap:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build snap
+        uses: snapcore/action-build@v1
+        id: build
+
+      - name: Upload locally built snap artifact
+        if: ${{ github.ref_name == 'main' }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: snap
+          path: ${{ steps.build.outputs.snap }}

.github/workflows/main.yml

@@ -11,28 +11,35 @@ on:
 jobs: 
   unit-test-frontend:
     uses: ./.github/workflows/test-frontend.yaml
-  build-nextjs:
+  nextjs-build:
     uses: ./.github/workflows/build-frontend.yaml
-  unit-test-notary:
-    needs: [build-nextjs]
+  go-unit-test:
+    needs: [nextjs-build]
     uses: ./.github/workflows/test-notary.yaml
   go-vet:
-    needs: [build-nextjs]
+    needs: [nextjs-build]
     uses: ./.github/workflows/go-vet.yaml
   go-lint:
-    needs: [build-nextjs]
+    needs: [nextjs-build]
     uses: ./.github/workflows/go-lint.yaml
-  build-notary:
-    needs: [build-nextjs]
+  go-build:
+    needs: [nextjs-build]
     uses: ./.github/workflows/build-notary.yaml
   rock-build:
-    needs: [build-notary, unit-test-notary, go-vet, go-lint]
+    needs: [go-build, go-unit-test, go-vet, go-lint]
     uses: ./.github/workflows/build-rock.yaml
   rock-scan:
     if: github.ref_name == 'main'
     needs: [rock-build]
     uses: ./.github/workflows/scan-rock.yaml
-  publish:
+  rock-publish:
     if: github.ref_name == 'main'
     needs: [rock-build]
     uses: ./.github/workflows/publish-rock.yaml
+  snap-build:
+    needs: [go-build, go-unit-test, go-vet, go-lint]
+    uses: ./.github/workflows/build-snap.yaml
+  snap-publish:
+    if: github.ref_name == 'main'
+    needs: [snap-build]
+    uses: ./.github/workflows/publish-snap.yaml

.github/workflows/publish-snap.yaml

@@ -0,0 +1,32 @@
+name: Publish Snap
+
+on:
+  workflow_call:
+
+jobs:
+  publish-snap:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Downloads locally built snap artifact
+        uses: actions/download-artifact@v4
+        id: download
+        with:
+          name: snap
+
+      - name: Determine snap file name
+        id: find-snap
+        run: |
+          SNAP_FILE=$(ls *.snap)
+          echo "Found snap file: $SNAP_FILE"
+          echo "snap_file=${SNAP_FILE}" >>$GITHUB_OUTPUT
+
+      - name: Publish snap
+        uses: snapcore/[email protected]
+        env:
+          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
+        if: ${{ github.ref_name == 'main' }}
+        with:
+          snap: ${{ steps.find-snap.outputs.snap_file }}
+          release: edge

README.md

@@ -38,6 +38,25 @@ pebble_notifications: true
 
 ## Installation
 
+### From Snap
+
+Install the snap:
+```bash
+sudo snap install notary
+```
+
+Generate (or copy) a certificate and private key to the following location:
+```bash
+sudo openssl req -newkey rsa:2048 -nodes -keyout /var/snap/notary/common/key.pem -x509 -days 1 -out /var/snap/notary/common/cert.pem -subj "/CN=example.com"
+```
+
+Start the service:
+```bash
+sudo snap start notary.notaryd
+```
+
+Navigate to `https://localhost:3000` to access the Notary UI.
+
 ### From OCI Image
 
 ```bash

service/bin/notaryd-start

@@ -0,0 +1,5 @@
+#!/bin/bash
+
+set -ex
+
+"$SNAP"/bin/notary -config "$SNAP_COMMON"/notary.yaml

service/notary.yaml

@@ -0,0 +1,5 @@
+key_path:  "/var/snap/notary/common/key.pem"
+cert_path: "/var/snap/notary/common/cert.pem"
+db_path: "/var/snap/notary/common/certs.db"
+port: 3000
+pebble_notifications: false

snap/hooks/install

@@ -0,0 +1,4 @@
+#!/bin/sh -e
+
+# Create Notary config file
+cp "$SNAP/notary.yaml" "$SNAP_COMMON/notary.yaml"

snap/snapcraft.yaml

@@ -0,0 +1,41 @@
+name: notary
+base: core24
+version: '0.0.3'
+summary: Notary is a certificate management tool.
+description: Notary is a certificate management tool.
+
+grade: stable
+confinement: strict
+
+apps:
+  notary:
+    command: bin/notary
+    plugs:
+      - network
+      - network-bind
+      - home
+  notaryd:
+    daemon: simple
+    install-mode: disable
+    command: bin/notaryd-start
+    refresh-mode: endure
+    plugs:
+      - network
+      - network-bind
+
+parts:
+  notary:
+    plugin: go
+    source: .
+    source-type: local
+    build-snaps:
+      - go/1.22/stable
+      - node/20/stable
+    override-build: |
+      npm install --prefix ui
+      npm run build --prefix ui
+      craftctl default
+
+  service-files:
+    plugin: dump
+    source: service