bread-ecosystem/scripts/gen-index.sh

#!/usr/bin/env bash
# Generate dl.breadway.dev/index.json (or a track-prefixed sibling — see
# TRACK below) from:
#   - registry/bread-ecosystem.toml         (product list)
#   - <PKG_ROOT>/<name>/bakery.toml         (per-product metadata, uploaded by release.yml)
#   - <PKG_ROOT>/                           (built binaries + sha256 files)
#
# Fallback for local dev: looks for ../name/bakery.toml (sibling repo checkout).
# Run on hestia after each product build, before the dl server is refreshed.
#
# TRACK selects which build track to generate an index for: "stable"
# (default — reads/writes DL_DIR directly, byte-for-byte the same behavior
# as before tracks existed), "beta", or "dev" (both read/write a
# DL_DIR/<track>/ subtree, so they never collide with stable's paths). A
# product with no release dir under the selected track's tree is skipped
# with a warning, same as an unreleased product is today — most products
# won't have a beta/dev build for a while after this lands.
# Requires: jq, python3 (tomllib, stdlib since 3.11), sha256sum
set -euo pipefail

SCRIPT_DIR="${SCRIPT_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
DL_DIR="${DL_DIR:-/srv/breadway-dl}"
DL_BASE="${DL_BASE:-https://dl.breadway.dev}"
TRACK="${TRACK:-stable}"
GH_BASE="https://github.com"

if [[ "${TRACK}" == "stable" ]]; then
    PKG_ROOT="${DL_DIR}"
    URL_ROOT="${DL_BASE}"
    OUT="${DL_DIR}/index.json"
else
    PKG_ROOT="${DL_DIR}/${TRACK}"
    URL_ROOT="${DL_BASE}/${TRACK}"
    OUT="${DL_DIR}/${TRACK}/index.json"
fi

# Read the product list from the registry TOML instead of a hardcoded array.
mapfile -t products < <(python3 -c "
import tomllib, sys
with open('${SCRIPT_DIR}/registry/bread-ecosystem.toml', 'rb') as f:
    d = tomllib.load(f)
for p in d['products']:
    print(p['name'], p['repo'])
")

# Build a JSON package entry for one product.
# $1 = product name, $2 = github repo slug
build_package_json() {
    local name="$1"
    local repo="$2"

    # Find the latest version dir under PKG_ROOT/<name>/
    local pkg_dir="${PKG_ROOT}/${name}"
    if [[ ! -d "${pkg_dir}" ]]; then
        echo "  warning: no release dir for ${name} at ${pkg_dir}" >&2
        return 1
    fi

    # The latest symlink must point to the current version dir.
    local latest_link="${pkg_dir}/latest"
    if [[ ! -L "${latest_link}" ]]; then
        echo "  warning: no 'latest' symlink for ${name}" >&2
        return 1
    fi
    local version_dir
    version_dir="$(readlink -f "${latest_link}")"
    local version
    version="$(basename "${version_dir}")"

    # Locate bakery.toml. The release workflow copies it into the version dir
    # alongside the binaries (${version_dir}/bakery.toml). Fall back to a
    # sibling repo checkout for local dev use. Done before the binaries loop
    # below so license_file/desktop_file (if declared) can be excluded from
    # it by name — otherwise they'd get swept up as "binaries" with no
    # checksum, the same gotcha this loop's other exclusions guard against.
    local bakery_toml="${version_dir}/bakery.toml"
    if [[ ! -f "${bakery_toml}" ]]; then
        bakery_toml="${SCRIPT_DIR}/../${name}/bakery.toml"
    fi
    if [[ ! -f "${bakery_toml}" ]]; then
        echo "ERROR: bakery.toml not found for ${name} — the release workflow must copy it to \${PKG_ROOT}/${name}/\${VERSION}/bakery.toml" >&2
        return 1
    fi

    local license_file_name desktop_file_name data_archive_name
    license_file_name="$(python3 -c "
import tomllib
with open('${bakery_toml}', 'rb') as f:
    d = tomllib.load(f)
print(d.get('license_file', ''))
" 2>/dev/null || true)"
    desktop_file_name="$(python3 -c "
import tomllib
with open('${bakery_toml}', 'rb') as f:
    d = tomllib.load(f)
print(d.get('desktop_file', ''))
" 2>/dev/null || true)"
    data_archive_name="$(python3 -c "
import tomllib
with open('${bakery_toml}', 'rb') as f:
    d = tomllib.load(f)
print(d.get('data_archive', ''))
" 2>/dev/null || true)"

    # Collect all binaries in the version dir (executables only; skip metadata files).
    local binaries_json="[]"
    for bin_path in "${version_dir}"/*; do
        [[ "${bin_path}" == *.sha256 ]]  && continue
        [[ "${bin_path}" == *.toml ]]    && continue
        [[ "${bin_path}" == *.service ]] && continue
        [[ "${bin_path}" == *.css ]]     && continue
        [[ "${bin_path}" == *.txt ]]     && continue
        [[ "${bin_path}" == *.minisig ]] && continue
        [[ -n "${license_file_name}" && "${bin_path}" == "${version_dir}/${license_file_name}" ]] && continue
        [[ -n "${desktop_file_name}" && "${bin_path}" == "${version_dir}/${desktop_file_name}" ]] && continue
        [[ -n "${data_archive_name}" && "${bin_path}" == "${version_dir}/${data_archive_name}" ]] && continue
        [[ -f "${bin_path}" ]] || continue
        local bin_name
        bin_name="$(basename "${bin_path}")"
        local sha256_path="${bin_path}.sha256"
        local sha256=""
        if [[ -f "${sha256_path}" ]]; then
            sha256="$(awk '{print $1}' "${sha256_path}")"
        fi
        local dl_url="${URL_ROOT}/${name}/${version}/${bin_name}"
        # dev/beta builds never get a real GitHub Release (see the dev/beta
        # CI workflows — that step is intentionally skipped for those
        # tracks), so github_url just mirrors dl_url rather than pointing at
        # a release asset that doesn't exist.
        local gh_url
        if [[ "${TRACK}" == "stable" ]]; then
            gh_url="${GH_BASE}/${repo}/releases/download/v${version}/${bin_name}"
        else
            gh_url="${dl_url}"
        fi

        local entry
        entry="$(jq -n \
            --arg name "${bin_name}" \
            --arg dl_url "${dl_url}" \
            --arg github_url "${gh_url}" \
            --arg sha256 "${sha256}" \
            '{name: $name, dl_url: $dl_url, github_url: $github_url, sha256: $sha256}')"
        binaries_json="$(jq -n --argjson arr "${binaries_json}" --argjson e "${entry}" '$arr + [$e]')"
    done

    local description system_deps optional_system_deps bread_deps services config post_install

    description="$(python3 -c "
import tomllib
with open('${bakery_toml}', 'rb') as f:
    d = tomllib.load(f)
print(d.get('description', ''))
" 2>/dev/null || true)"

    system_deps="$(python3 -c "
import tomllib, json
with open('${bakery_toml}', 'rb') as f:
    d = tomllib.load(f)
print(json.dumps(d.get('system_deps', [])))
" 2>/dev/null || echo "[]")"

    optional_system_deps="$(python3 -c "
import tomllib, json
with open('${bakery_toml}', 'rb') as f:
    d = tomllib.load(f)
print(json.dumps(d.get('optional_system_deps', [])))
" 2>/dev/null || echo "[]")"

    bread_deps="$(python3 -c "
import tomllib, json
with open('${bakery_toml}', 'rb') as f:
    d = tomllib.load(f)
print(json.dumps(d.get('bread_deps', [])))
" 2>/dev/null || echo "[]")"

    # [[service]] entries → [{unit, enable, sha256}]. sha256 comes from the
    # actual unit file shipped in this version dir — the same
    # artifact-integrity guarantee binaries already get. A missing unit file
    # gets an empty sha256; install.rs refuses to install an unverified
    # download rather than silently skipping the check.
    service_units="$(python3 -c "
import tomllib, json
with open('${bakery_toml}', 'rb') as f:
    d = tomllib.load(f)
svcs = d.get('service', [])
print(json.dumps([{'unit': s['unit'], 'enable': s.get('enable', False)} for s in svcs]))
" 2>/dev/null || echo "[]")"

    services="[]"
    while IFS= read -r svc_entry; do
        [[ -z "${svc_entry}" ]] && continue
        unit_name="$(echo "${svc_entry}" | jq -r '.unit')"
        enable="$(echo "${svc_entry}" | jq -r '.enable')"
        unit_path="${version_dir}/${unit_name}"
        unit_sha256=""
        if [[ -f "${unit_path}" ]]; then
            unit_sha256="$(sha256sum "${unit_path}" | awk '{print $1}')"
        else
            echo "  warning: service unit '${unit_name}' not found at ${unit_path}" >&2
        fi
        svc_json="$(jq -n --arg unit "${unit_name}" --argjson enable "${enable}" --arg sha256 "${unit_sha256}" \
            '{unit: $unit, enable: $enable, sha256: $sha256}')"
        services="$(jq -n --argjson arr "${services}" --argjson e "${svc_json}" '$arr + [$e]')"
    done < <(echo "${service_units}" | jq -c '.[]')

    # [config] → {dir, example?, example_sha256?} or null
    config="$(python3 -c "
import tomllib, json
with open('${bakery_toml}', 'rb') as f:
    d = tomllib.load(f)
cfg = d.get('config')
if cfg:
    obj = {'dir': cfg['dir']}
    if 'example' in cfg:
        obj['example'] = cfg['example']
    print(json.dumps(obj))
else:
    print('null')
" 2>/dev/null || echo "null")"
    if [[ "${config}" != "null" ]]; then
        example_name="$(echo "${config}" | jq -r '.example // empty')"
        if [[ -n "${example_name}" ]]; then
            example_path="${version_dir}/${example_name}"
            example_sha256=""
            if [[ -f "${example_path}" ]]; then
                example_sha256="$(sha256sum "${example_path}" | awk '{print $1}')"
            else
                echo "  warning: config.example '${example_name}' not found at ${example_path}" >&2
            fi
            config="$(echo "${config}" | jq -c --arg sha "${example_sha256}" '. + {example_sha256: $sha}')"
        fi
    fi

    post_install="$(python3 -c "
import tomllib, json
with open('${bakery_toml}', 'rb') as f:
    d = tomllib.load(f)
print(json.dumps(d.get('install', {}).get('post_install', [])))
" 2>/dev/null || echo "[]")"

    # license_file / desktop_file: plain filename fields in bakery.toml
    # (names already read above, before the binaries loop), same "artifact
    # in the version dir, sha256 computed here" pattern as config.example.
    # Empty string (not null) when unset, matching how the rest of this
    # script signals "field absent" to jq below.
    license_file="${license_file_name}"
    license_file_sha256=""
    if [[ -n "${license_file}" ]]; then
        license_path="${version_dir}/${license_file}"
        if [[ -f "${license_path}" ]]; then
            license_file_sha256="$(sha256sum "${license_path}" | awk '{print $1}')"
        else
            echo "  warning: license_file '${license_file}' not found at ${license_path}" >&2
            license_file=""
        fi
    fi

    desktop_file="${desktop_file_name}"
    desktop_file_sha256=""
    if [[ -n "${desktop_file}" ]]; then
        desktop_path="${version_dir}/${desktop_file}"
        if [[ -f "${desktop_path}" ]]; then
            desktop_file_sha256="$(sha256sum "${desktop_path}" | awk '{print $1}')"
        else
            echo "  warning: desktop_file '${desktop_file}' not found at ${desktop_path}" >&2
            desktop_file=""
        fi
    fi

    data_archive="${data_archive_name}"
    data_archive_sha256=""
    if [[ -n "${data_archive}" ]]; then
        data_archive_path="${version_dir}/${data_archive}"
        if [[ -f "${data_archive_path}" ]]; then
            data_archive_sha256="$(sha256sum "${data_archive_path}" | awk '{print $1}')"
        else
            echo "  warning: data_archive '${data_archive}' not found at ${data_archive_path}" >&2
            data_archive=""
        fi
    fi

    jq -n \
        --arg name "${name}" \
        --arg description "${description}" \
        --arg version "${version}" \
        --argjson binaries "${binaries_json}" \
        --argjson system_deps "${system_deps}" \
        --argjson optional_system_deps "${optional_system_deps}" \
        --argjson bread_deps "${bread_deps}" \
        --argjson services "${services}" \
        --argjson config "${config}" \
        --argjson post_install "${post_install}" \
        --arg license_file "${license_file}" \
        --arg license_file_sha256 "${license_file_sha256}" \
        --arg desktop_file "${desktop_file}" \
        --arg desktop_file_sha256 "${desktop_file_sha256}" \
        --arg data_archive "${data_archive}" \
        --arg data_archive_sha256 "${data_archive_sha256}" \
        '{
            name: $name,
            description: $description,
            version: $version,
            binaries: $binaries,
            system_deps: $system_deps,
            optional_system_deps: $optional_system_deps,
            bread_deps: $bread_deps,
            services: $services,
            config: $config,
            post_install: $post_install,
            license_file: (if $license_file == "" then null else $license_file end),
            license_file_sha256: (if $license_file_sha256 == "" then null else $license_file_sha256 end),
            desktop_file: (if $desktop_file == "" then null else $desktop_file end),
            desktop_file_sha256: (if $desktop_file_sha256 == "" then null else $desktop_file_sha256 end),
            data_archive: (if $data_archive == "" then null else $data_archive end),
            data_archive_sha256: (if $data_archive_sha256 == "" then null else $data_archive_sha256 end)
        }'
}

# Assemble the full index.
packages_json="{}"
for entry in "${products[@]}"; do
    name="$(echo "${entry}" | awk '{print $1}')"
    repo="$(echo "${entry}" | awk '{print $2}')"
    echo "processing ${name}…"
    pkg="$(build_package_json "${name}" "${repo}")" || { echo "  skipping ${name}"; continue; }
    [[ -z "${pkg}" ]] && { echo "  skipping ${name}: no output"; continue; }
    packages_json="$(jq -n --argjson m "${packages_json}" --arg k "${name}" --argjson v "${pkg}" '$m + {($k): $v}')"
done

jq -n \
    --arg version "1" \
    --arg generated_at "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
    --argjson packages "${packages_json}" \
    '{version: $version, generated_at: $generated_at, packages: $packages}' \
    > "${OUT}"

echo "wrote ${OUT}"

# Sign the index so `bakery` can verify it before trusting a single byte.
# Every artifact sha256 and post_install hook string lives inside index.json,
# so a valid signature over these raw bytes transitively covers all of it —
# no separate per-artifact signing is needed.
#
# MINISIGN_SEC_KEY must point at the *secret* key file generated with
# `minisign -G`. It is intentionally never read from inside either git repo;
# point it at wherever the key actually lives on the machine that runs this
# script (e.g. a root-only path on hestia), and set MINISIGN_SEC_KEY_PASSWORD
# too if the key was generated with a password.
#
# This step is a no-op (with a loud warning) if the key isn't configured, so
# existing unsigned publishing flows don't break until the key is actually
# wired up — see the handoff note in the fix commit for this repo.
if [[ -n "${MINISIGN_SEC_KEY:-}" ]]; then
    if [[ ! -f "${MINISIGN_SEC_KEY}" ]]; then
        echo "ERROR: MINISIGN_SEC_KEY=${MINISIGN_SEC_KEY} does not exist" >&2
        exit 1
    fi
    if ! command -v minisign >/dev/null 2>&1; then
        echo "ERROR: MINISIGN_SEC_KEY is set but the 'minisign' binary is not installed" >&2
        exit 1
    fi
    sign_args=(-S -s "${MINISIGN_SEC_KEY}" -m "${OUT}" -x "${OUT}.minisig")
    if [[ -n "${MINISIGN_SEC_KEY_PASSWORD:-}" ]]; then
        MINISIGN_PASSWORD="${MINISIGN_SEC_KEY_PASSWORD}" minisign "${sign_args[@]}" </dev/null
    else
        # -W: the key has no password (matches how CI-facing signing keys are
        # normally generated, since there's no human to type a passphrase).
        minisign -W "${sign_args[@]}" </dev/null
    fi
    echo "signed ${OUT} -> ${OUT}.minisig"
else
    echo "WARNING: MINISIGN_SEC_KEY not set — index.json was NOT signed." >&2
    echo "         bakery clients built with signature verification will reject" >&2
    echo "         this index. Set MINISIGN_SEC_KEY before running this in" >&2
    echo "         production once the signing key has been provisioned." >&2
fi