Public availability of automatically built TrenchBoot packages integrated on top of the QubesOS upstream

[BeataZdunczyk]

The problem you're addressing (if any)

QubesOS packages that are being built as a part of TrenchBoot project are not evailable In an RP repository so the QubesOS users cannot easily install and use the packages.

Describe the solution you'd like

Packages should:

1. Be built and pushed to an RPM repository automatically.
2. Packages should be signed, so they can be trusted.

[DaniilKl]

As for the verification. The building of QubesOS packages has been working for some time already:

• https://github.com/TrenchBoot/xen/actions/runs/15347948325
• https://github.com/TrenchBoot/grub/actions/runs/15347943560
• https://github.com/TrenchBoot/secure-kernel-loader/actions/runs/15347940290
• https://github.com/TrenchBoot/qubes-antievilmaid/actions/runs/15347945683

The following PRs will enable building and publishing RC versions of the QubesOS packages built as a part of TrenchBoot project.

• Add workflow for automatic rebase. .github#16 , .github: workflows: trigger-woodpecker-pipeline.yml: add .github#17: this PR adds a reusable CI/CD workflow trigger-woodpecker-pipeline.yml that will trigger signing and publishing built packages.
• .github: workflows: build-rc.yml: add xen#30: this PR adds the building and signing workflows for Xen component.
• .github: workflows: build-rc.yml: add grub#33: this PR adds the building and signing workflows for GRUB component.
• .github: workflows: build-rc.yml: add qubes-antievilmaid#16: this PR adds the building and signing workflows for AEM component.
• .github: workflows: qubesos.yml: add trigger-woodpecker-cicd job for signing secure-kernel-loader#26: this PR adds the buuilding and signing workflows for SKL component.
• Documentation PR: docs: dev-docs: QubesOS-packages-sync.md: add TrenchBoot.github.io#59 Add TrenchBoot packages for QubesOS docs TrenchBoot.github.io#60.

UPD: for the detailed description why most of the above PRs are closed check the commit TrenchBoot/TrenchBoot.github.io@ce335ad .

As for the signing workflow on the ci.3mdeb.com side:

As you can see I have tested it separately with packages from qubes-antievilmaid component, and you can find the packages signed and published on our RPM repository.

As for the final test, when all the PRs above will be merged, we need to do the following:

1. Create a test RC tag in every repository where the TrenchBoot packages are build.
2. Make sure all four workflows will pass and all needed packages will land signed in our RPM.

Currently the merge is blocked by the missing tokens on the ci.3mdeb.com side (the token for downloading the artifacts from GitHub). UPD: The tokens have been added. You can find all the packages built from the v0.5.0-rc5-automation-test tag and signed automatically in the current-testing RPM repository. The building workflows:

• https://github.com/TrenchBoot/qubes-antievilmaid/actions/runs/25174954532
• https://github.com/TrenchBoot/xen/actions/runs/25174793138
• https://github.com/TrenchBoot/grub/actions/runs/25174867303
• https://github.com/TrenchBoot/secure-kernel-loader/actions/runs/25174908111

---

Additionally, though not a part of this issue, I have added the following PRs that extend our CI/CDs with a workflow for automating rebase of the TrenchBoot patches on top of the QubesOS patches:

• .github: workflows: add rebasing workflows grub#32
• .github: workflows: rebase-and-build.yml: add qubes-antievilmaid#15
• .github: workflows: rebase-and-build.yml: add xen#26

The only thing that is left is the PR with changes to docs on TrenchBoot.com according to this: TrenchBoot/.github#16 (comment) .

[DaniilKl]

The only thing that is left is the PR with changes to docs on TrenchBoot.com according to this: TrenchBoot/.github#16 (comment) .

I have added a PR with the documentation: TrenchBoot/TrenchBoot.github.io#59 .