xavierk
b47a65c91e
Every release is built from its tag alone by packaging/void/build-release.sh, shared by the tag workflow and local dry runs. Signs in a network-less container with the key mounted read-only and publishes to the tag release and the rolling latest release.
72 lines
2.8 KiB
Bash
Executable File
72 lines
2.8 KiB
Bash
Executable File
#!/bin/sh
|
|
# Renders the voculinux template for one release inside a void-packages build
|
|
# tree (ticket #27, spec #16 "Release pipeline and upstream intake").
|
|
#
|
|
# The committed template is never edited by a build. This script runs against
|
|
# the container's copy of srcpkgs and does three things, each refused unless it
|
|
# lands exactly once:
|
|
#
|
|
# 1. pins version, _tag and checksum to the release being built;
|
|
# 2. checks the sdist's digest is the checksum it just pinned;
|
|
# 3. places the sdist where xbps-src looks for a distfile of this package
|
|
# (hostdir/sources/<pkgname>-<version>/<basename>), so xbps-src verifies
|
|
# the local file and never downloads it.
|
|
#
|
|
# Run as root, by container-release.sh (release) and container-main.sh (smoke).
|
|
# Inputs arrive as environment variables from build-release.sh:
|
|
# VOID_PACKAGES void-packages checkout (default /void-packages)
|
|
# SDIST_DIR directory holding the sdist (read only)
|
|
# XBPS_VERSION xbps spelling of the release, e.g. 0.18.5 or 0.19.0beta
|
|
# TAG the release tag, e.g. v0.19.0-beta
|
|
# SDIST_NAME distfile basename, voculinux-<XBPS_VERSION>.tar.gz
|
|
# SDIST_SHA256 sha256 of $SDIST_DIR/$SDIST_NAME
|
|
set -eu
|
|
|
|
fail() {
|
|
echo "render-voculinux.sh: $*" >&2
|
|
exit 1
|
|
}
|
|
|
|
VP=${VOID_PACKAGES:-/void-packages}
|
|
TEMPLATE="$VP/srcpkgs/voculinux/template"
|
|
|
|
for name in SDIST_DIR XBPS_VERSION TAG SDIST_NAME SDIST_SHA256; do
|
|
eval "value=\${$name:-}"
|
|
[ -n "$value" ] || fail "$name is not set"
|
|
done
|
|
for name in XBPS_VERSION TAG SDIST_NAME SDIST_SHA256; do
|
|
eval "value=\${$name}"
|
|
case "$value" in
|
|
*[!A-Za-z0-9._-]*) fail "$name has characters outside [A-Za-z0-9._-]: $value" ;;
|
|
esac
|
|
done
|
|
[ -f "$TEMPLATE" ] || fail "no voculinux template at $TEMPLATE"
|
|
[ -s "$SDIST_DIR/$SDIST_NAME" ] || fail "sdist is missing: $SDIST_DIR/$SDIST_NAME"
|
|
|
|
digest=$(sha256sum "$SDIST_DIR/$SDIST_NAME" | cut -d' ' -f1)
|
|
[ "$digest" = "$SDIST_SHA256" ] || fail "sdist digest $digest is not the expected $SDIST_SHA256"
|
|
|
|
# set_line KEY VALUE: the template must hold exactly one KEY= line, and the
|
|
# rewritten line must read back exactly as asked.
|
|
set_line() {
|
|
key=$1
|
|
value=$2
|
|
count=$(grep -c "^$key=" "$TEMPLATE" || true)
|
|
[ "$count" = 1 ] || fail "template must hold exactly one $key= line, found $count"
|
|
sed -i "s|^$key=.*|$key=$value|" "$TEMPLATE"
|
|
grep -qxF "$key=$value" "$TEMPLATE" || fail "could not pin $key=$value in the build tree"
|
|
}
|
|
|
|
set_line version "$XBPS_VERSION"
|
|
set_line _tag "$TAG"
|
|
set_line checksum "$SDIST_SHA256"
|
|
|
|
DEST="$VP/hostdir/sources/voculinux-$XBPS_VERSION"
|
|
mkdir -p "$DEST"
|
|
cp "$SDIST_DIR/$SDIST_NAME" "$DEST/$SDIST_NAME"
|
|
[ "$(sha256sum "$DEST/$SDIST_NAME" | cut -d' ' -f1)" = "$SDIST_SHA256" ] ||
|
|
fail "the copied distfile does not match $SDIST_SHA256"
|
|
|
|
echo "render-voculinux.sh: pinned version=$XBPS_VERSION _tag=$TAG checksum=$SDIST_SHA256"
|
|
echo "render-voculinux.sh: distfile staged at $DEST/$SDIST_NAME"
|