bread-ecosystem/scripts/gen-index.sh

#!/usr/bin/env bash
# Generate dl.breadway.dev/index.json from:
#   - registry/bread-ecosystem.toml   (product list)
#   - <DL_DIR>/<name>/bakery.toml     (per-product metadata, uploaded by release.yml)
#   - <DL_DIR>/                       (built binaries + sha256 files)
#
# Fallback for local dev: looks for ../name/bakery.toml (sibling repo checkout).
# Run on hestia after each product build, before the dl server is refreshed.
# Requires: jq, python3 (tomllib, stdlib since 3.11), sha256sum
set -euo pipefail

SCRIPT_DIR="${SCRIPT_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
DL_DIR="${DL_DIR:-/srv/breadway-dl}"
DL_BASE="${DL_BASE:-https://dl.breadway.dev}"
GH_BASE="https://github.com"
OUT="${DL_DIR}/index.json"

# Read the product list from the registry TOML instead of a hardcoded array.
mapfile -t products < <(python3 -c "
import tomllib, sys
with open('${SCRIPT_DIR}/registry/bread-ecosystem.toml', 'rb') as f:
    d = tomllib.load(f)
for p in d['products']:
    print(p['name'], p['repo'])
")

# Build a JSON package entry for one product.
# $1 = product name, $2 = github repo slug
build_package_json() {
    local name="$1"
    local repo="$2"

    # Find the latest version dir under DL_DIR/<name>/
    local pkg_dir="${DL_DIR}/${name}"
    if [[ ! -d "${pkg_dir}" ]]; then
        echo "  warning: no release dir for ${name} at ${pkg_dir}" >&2
        return 1
    fi

    # The latest symlink must point to the current version dir.
    local latest_link="${pkg_dir}/latest"
    if [[ ! -L "${latest_link}" ]]; then
        echo "  warning: no 'latest' symlink for ${name}" >&2
        return 1
    fi
    local version_dir
    version_dir="$(readlink -f "${latest_link}")"
    local version
    version="$(basename "${version_dir}")"

    # Collect all binaries in the version dir (executables only; skip metadata files).
    local binaries_json="[]"
    for bin_path in "${version_dir}"/*; do
        [[ "${bin_path}" == *.sha256 ]]  && continue
        [[ "${bin_path}" == *.toml ]]    && continue
        [[ "${bin_path}" == *.service ]] && continue
        [[ "${bin_path}" == *.css ]]     && continue
        [[ "${bin_path}" == *.txt ]]     && continue
        [[ -f "${bin_path}" ]] || continue
        local bin_name
        bin_name="$(basename "${bin_path}")"
        local sha256_path="${bin_path}.sha256"
        local sha256=""
        if [[ -f "${sha256_path}" ]]; then
            sha256="$(awk '{print $1}' "${sha256_path}")"
        fi
        local dl_url="${DL_BASE}/${name}/${version}/${bin_name}"
        local gh_url="${GH_BASE}/${repo}/releases/download/v${version}/${bin_name}"

        local entry
        entry="$(jq -n \
            --arg name "${bin_name}" \
            --arg dl_url "${dl_url}" \
            --arg github_url "${gh_url}" \
            --arg sha256 "${sha256}" \
            '{name: $name, dl_url: $dl_url, github_url: $github_url, sha256: $sha256}')"
        binaries_json="$(jq -n --argjson arr "${binaries_json}" --argjson e "${entry}" '$arr + [$e]')"
    done

    # Locate bakery.toml. The release workflow copies it into the version dir
    # alongside the binaries (${version_dir}/bakery.toml). Fall back to a
    # sibling repo checkout for local dev use.
    local bakery_toml="${version_dir}/bakery.toml"
    if [[ ! -f "${bakery_toml}" ]]; then
        bakery_toml="${SCRIPT_DIR}/../${name}/bakery.toml"
    fi
    if [[ ! -f "${bakery_toml}" ]]; then
        echo "ERROR: bakery.toml not found for ${name} — release.yml must copy it to \${DL_DIR}/${name}/\${VERSION}/bakery.toml" >&2
        return 1
    fi

    local description system_deps optional_system_deps bread_deps services config post_install

    description="$(python3 -c "
import tomllib
with open('${bakery_toml}', 'rb') as f:
    d = tomllib.load(f)
print(d.get('description', ''))
" 2>/dev/null || true)"

    system_deps="$(python3 -c "
import tomllib, json
with open('${bakery_toml}', 'rb') as f:
    d = tomllib.load(f)
print(json.dumps(d.get('system_deps', [])))
" 2>/dev/null || echo "[]")"

    optional_system_deps="$(python3 -c "
import tomllib, json
with open('${bakery_toml}', 'rb') as f:
    d = tomllib.load(f)
print(json.dumps(d.get('optional_system_deps', [])))
" 2>/dev/null || echo "[]")"

    bread_deps="$(python3 -c "
import tomllib, json
with open('${bakery_toml}', 'rb') as f:
    d = tomllib.load(f)
print(json.dumps(d.get('bread_deps', [])))
" 2>/dev/null || echo "[]")"

    # [[service]] entries → [{unit, enable, sha256}]. sha256 comes from the
    # actual unit file shipped in this version dir — the same
    # artifact-integrity guarantee binaries already get. A missing unit file
    # gets an empty sha256; install.rs refuses to install an unverified
    # download rather than silently skipping the check.
    service_units="$(python3 -c "
import tomllib, json
with open('${bakery_toml}', 'rb') as f:
    d = tomllib.load(f)
svcs = d.get('service', [])
print(json.dumps([{'unit': s['unit'], 'enable': s.get('enable', False)} for s in svcs]))
" 2>/dev/null || echo "[]")"

    services="[]"
    while IFS= read -r svc_entry; do
        [[ -z "${svc_entry}" ]] && continue
        unit_name="$(echo "${svc_entry}" | jq -r '.unit')"
        enable="$(echo "${svc_entry}" | jq -r '.enable')"
        unit_path="${version_dir}/${unit_name}"
        unit_sha256=""
        if [[ -f "${unit_path}" ]]; then
            unit_sha256="$(sha256sum "${unit_path}" | awk '{print $1}')"
        else
            echo "  warning: service unit '${unit_name}' not found at ${unit_path}" >&2
        fi
        svc_json="$(jq -n --arg unit "${unit_name}" --argjson enable "${enable}" --arg sha256 "${unit_sha256}" \
            '{unit: $unit, enable: $enable, sha256: $sha256}')"
        services="$(jq -n --argjson arr "${services}" --argjson e "${svc_json}" '$arr + [$e]')"
    done < <(echo "${service_units}" | jq -c '.[]')

    # [config] → {dir, example?, example_sha256?} or null
    config="$(python3 -c "
import tomllib, json
with open('${bakery_toml}', 'rb') as f:
    d = tomllib.load(f)
cfg = d.get('config')
if cfg:
    obj = {'dir': cfg['dir']}
    if 'example' in cfg:
        obj['example'] = cfg['example']
    print(json.dumps(obj))
else:
    print('null')
" 2>/dev/null || echo "null")"
    if [[ "${config}" != "null" ]]; then
        example_name="$(echo "${config}" | jq -r '.example // empty')"
        if [[ -n "${example_name}" ]]; then
            example_path="${version_dir}/${example_name}"
            example_sha256=""
            if [[ -f "${example_path}" ]]; then
                example_sha256="$(sha256sum "${example_path}" | awk '{print $1}')"
            else
                echo "  warning: config.example '${example_name}' not found at ${example_path}" >&2
            fi
            config="$(echo "${config}" | jq -c --arg sha "${example_sha256}" '. + {example_sha256: $sha}')"
        fi
    fi

    post_install="$(python3 -c "
import tomllib, json
with open('${bakery_toml}', 'rb') as f:
    d = tomllib.load(f)
print(json.dumps(d.get('install', {}).get('post_install', [])))
" 2>/dev/null || echo "[]")"

    jq -n \
        --arg name "${name}" \
        --arg description "${description}" \
        --arg version "${version}" \
        --argjson binaries "${binaries_json}" \
        --argjson system_deps "${system_deps}" \
        --argjson optional_system_deps "${optional_system_deps}" \
        --argjson bread_deps "${bread_deps}" \
        --argjson services "${services}" \
        --argjson config "${config}" \
        --argjson post_install "${post_install}" \
        '{
            name: $name,
            description: $description,
            version: $version,
            binaries: $binaries,
            system_deps: $system_deps,
            optional_system_deps: $optional_system_deps,
            bread_deps: $bread_deps,
            services: $services,
            config: $config,
            post_install: $post_install
        }'
}

# Assemble the full index.
packages_json="{}"
for entry in "${products[@]}"; do
    name="$(echo "${entry}" | awk '{print $1}')"
    repo="$(echo "${entry}" | awk '{print $2}')"
    echo "processing ${name}…"
    pkg="$(build_package_json "${name}" "${repo}")" || { echo "  skipping ${name}"; continue; }
    [[ -z "${pkg}" ]] && { echo "  skipping ${name}: no output"; continue; }
    packages_json="$(jq -n --argjson m "${packages_json}" --arg k "${name}" --argjson v "${pkg}" '$m + {($k): $v}')"
done

jq -n \
    --arg version "1" \
    --arg generated_at "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
    --argjson packages "${packages_json}" \
    '{version: $version, generated_at: $generated_at, packages: $packages}' \
    > "${OUT}"

echo "wrote ${OUT}"

# Sign the index so `bakery` can verify it before trusting a single byte.
# Every artifact sha256 and post_install hook string lives inside index.json,
# so a valid signature over these raw bytes transitively covers all of it —
# no separate per-artifact signing is needed.
#
# MINISIGN_SEC_KEY must point at the *secret* key file generated with
# `minisign -G`. It is intentionally never read from inside either git repo;
# point it at wherever the key actually lives on the machine that runs this
# script (e.g. a root-only path on hestia), and set MINISIGN_SEC_KEY_PASSWORD
# too if the key was generated with a password.
#
# This step is a no-op (with a loud warning) if the key isn't configured, so
# existing unsigned publishing flows don't break until the key is actually
# wired up — see the handoff note in the fix commit for this repo.
if [[ -n "${MINISIGN_SEC_KEY:-}" ]]; then
    if [[ ! -f "${MINISIGN_SEC_KEY}" ]]; then
        echo "ERROR: MINISIGN_SEC_KEY=${MINISIGN_SEC_KEY} does not exist" >&2
        exit 1
    fi
    if ! command -v minisign >/dev/null 2>&1; then
        echo "ERROR: MINISIGN_SEC_KEY is set but the 'minisign' binary is not installed" >&2
        exit 1
    fi
    sign_args=(-S -s "${MINISIGN_SEC_KEY}" -m "${OUT}" -x "${OUT}.minisig")
    if [[ -n "${MINISIGN_SEC_KEY_PASSWORD:-}" ]]; then
        MINISIGN_PASSWORD="${MINISIGN_SEC_KEY_PASSWORD}" minisign "${sign_args[@]}" </dev/null
    else
        # -W: the key has no password (matches how CI-facing signing keys are
        # normally generated, since there's no human to type a passphrase).
        minisign -W "${sign_args[@]}" </dev/null
    fi
    echo "signed ${OUT} -> ${OUT}.minisig"
else
    echo "WARNING: MINISIGN_SEC_KEY not set — index.json was NOT signed." >&2
    echo "         bakery clients built with signature verification will reject" >&2
    echo "         this index. Set MINISIGN_SEC_KEY before running this in" >&2
    echo "         production once the signing key has been provisioned." >&2
fi