4ac54c610d
Adds a track concept to bakery (separate from the existing bakery/pacman distribution channel): stable (unchanged tag-triggered releases), beta (deliberate beta-v* tag promotion), and dev (published on every push to dev). Each track gets its own signed index + artifact tree under dl.breadway.dev so stable's paths and existing installs are untouched. - bakery: new Track type, a global track preference in installed.json (defaults to stable via serde, no migration needed), `bakery track show`/`set`, a BAKERY_INDEX_BASE_URL override for testing, and a real semver comparison in `update` (was a plain string-equality check before). ANSI-colored/aligned CLI output (TTY + NO_COLOR aware). - gen-index.sh: TRACK env var selects which subtree to read/write. - CI: dev-bakery.yml/beta-bakery.yml/dev-bread-theme.yml/beta-bread-theme.yml publish those two products on the new tracks; dev/beta skip the GitHub Release upload step (no per-commit release spam). - docs/release-channels.md documents the three-track policy.
298 lines
12 KiB
Bash
Executable file
298 lines
12 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Generate dl.breadway.dev/index.json (or a track-prefixed sibling — see
|
|
# TRACK below) from:
|
|
# - registry/bread-ecosystem.toml (product list)
|
|
# - <PKG_ROOT>/<name>/bakery.toml (per-product metadata, uploaded by release.yml)
|
|
# - <PKG_ROOT>/ (built binaries + sha256 files)
|
|
#
|
|
# Fallback for local dev: looks for ../name/bakery.toml (sibling repo checkout).
|
|
# Run on hestia after each product build, before the dl server is refreshed.
|
|
#
|
|
# TRACK selects which build track to generate an index for: "stable"
|
|
# (default — reads/writes DL_DIR directly, byte-for-byte the same behavior
|
|
# as before tracks existed), "beta", or "dev" (both read/write a
|
|
# DL_DIR/<track>/ subtree, so they never collide with stable's paths). A
|
|
# product with no release dir under the selected track's tree is skipped
|
|
# with a warning, same as an unreleased product is today — most products
|
|
# won't have a beta/dev build for a while after this lands.
|
|
# Requires: jq, python3 (tomllib, stdlib since 3.11), sha256sum
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="${SCRIPT_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
|
|
DL_DIR="${DL_DIR:-/srv/breadway-dl}"
|
|
DL_BASE="${DL_BASE:-https://dl.breadway.dev}"
|
|
TRACK="${TRACK:-stable}"
|
|
GH_BASE="https://github.com"
|
|
|
|
if [[ "${TRACK}" == "stable" ]]; then
|
|
PKG_ROOT="${DL_DIR}"
|
|
URL_ROOT="${DL_BASE}"
|
|
OUT="${DL_DIR}/index.json"
|
|
else
|
|
PKG_ROOT="${DL_DIR}/${TRACK}"
|
|
URL_ROOT="${DL_BASE}/${TRACK}"
|
|
OUT="${DL_DIR}/${TRACK}/index.json"
|
|
fi
|
|
|
|
# Read the product list from the registry TOML instead of a hardcoded array.
|
|
mapfile -t products < <(python3 -c "
|
|
import tomllib, sys
|
|
with open('${SCRIPT_DIR}/registry/bread-ecosystem.toml', 'rb') as f:
|
|
d = tomllib.load(f)
|
|
for p in d['products']:
|
|
print(p['name'], p['repo'])
|
|
")
|
|
|
|
# Build a JSON package entry for one product.
|
|
# $1 = product name, $2 = github repo slug
|
|
build_package_json() {
|
|
local name="$1"
|
|
local repo="$2"
|
|
|
|
# Find the latest version dir under PKG_ROOT/<name>/
|
|
local pkg_dir="${PKG_ROOT}/${name}"
|
|
if [[ ! -d "${pkg_dir}" ]]; then
|
|
echo " warning: no release dir for ${name} at ${pkg_dir}" >&2
|
|
return 1
|
|
fi
|
|
|
|
# The latest symlink must point to the current version dir.
|
|
local latest_link="${pkg_dir}/latest"
|
|
if [[ ! -L "${latest_link}" ]]; then
|
|
echo " warning: no 'latest' symlink for ${name}" >&2
|
|
return 1
|
|
fi
|
|
local version_dir
|
|
version_dir="$(readlink -f "${latest_link}")"
|
|
local version
|
|
version="$(basename "${version_dir}")"
|
|
|
|
# Collect all binaries in the version dir (executables only; skip metadata files).
|
|
local binaries_json="[]"
|
|
for bin_path in "${version_dir}"/*; do
|
|
[[ "${bin_path}" == *.sha256 ]] && continue
|
|
[[ "${bin_path}" == *.toml ]] && continue
|
|
[[ "${bin_path}" == *.service ]] && continue
|
|
[[ "${bin_path}" == *.css ]] && continue
|
|
[[ "${bin_path}" == *.txt ]] && continue
|
|
[[ "${bin_path}" == *.minisig ]] && continue
|
|
[[ -f "${bin_path}" ]] || continue
|
|
local bin_name
|
|
bin_name="$(basename "${bin_path}")"
|
|
local sha256_path="${bin_path}.sha256"
|
|
local sha256=""
|
|
if [[ -f "${sha256_path}" ]]; then
|
|
sha256="$(awk '{print $1}' "${sha256_path}")"
|
|
fi
|
|
local dl_url="${URL_ROOT}/${name}/${version}/${bin_name}"
|
|
# dev/beta builds never get a real GitHub Release (see the dev/beta
|
|
# CI workflows — that step is intentionally skipped for those
|
|
# tracks), so github_url just mirrors dl_url rather than pointing at
|
|
# a release asset that doesn't exist.
|
|
local gh_url
|
|
if [[ "${TRACK}" == "stable" ]]; then
|
|
gh_url="${GH_BASE}/${repo}/releases/download/v${version}/${bin_name}"
|
|
else
|
|
gh_url="${dl_url}"
|
|
fi
|
|
|
|
local entry
|
|
entry="$(jq -n \
|
|
--arg name "${bin_name}" \
|
|
--arg dl_url "${dl_url}" \
|
|
--arg github_url "${gh_url}" \
|
|
--arg sha256 "${sha256}" \
|
|
'{name: $name, dl_url: $dl_url, github_url: $github_url, sha256: $sha256}')"
|
|
binaries_json="$(jq -n --argjson arr "${binaries_json}" --argjson e "${entry}" '$arr + [$e]')"
|
|
done
|
|
|
|
# Locate bakery.toml. The release workflow copies it into the version dir
|
|
# alongside the binaries (${version_dir}/bakery.toml). Fall back to a
|
|
# sibling repo checkout for local dev use.
|
|
local bakery_toml="${version_dir}/bakery.toml"
|
|
if [[ ! -f "${bakery_toml}" ]]; then
|
|
bakery_toml="${SCRIPT_DIR}/../${name}/bakery.toml"
|
|
fi
|
|
if [[ ! -f "${bakery_toml}" ]]; then
|
|
echo "ERROR: bakery.toml not found for ${name} — the release workflow must copy it to \${PKG_ROOT}/${name}/\${VERSION}/bakery.toml" >&2
|
|
return 1
|
|
fi
|
|
|
|
local description system_deps optional_system_deps bread_deps services config post_install
|
|
|
|
description="$(python3 -c "
|
|
import tomllib
|
|
with open('${bakery_toml}', 'rb') as f:
|
|
d = tomllib.load(f)
|
|
print(d.get('description', ''))
|
|
" 2>/dev/null || true)"
|
|
|
|
system_deps="$(python3 -c "
|
|
import tomllib, json
|
|
with open('${bakery_toml}', 'rb') as f:
|
|
d = tomllib.load(f)
|
|
print(json.dumps(d.get('system_deps', [])))
|
|
" 2>/dev/null || echo "[]")"
|
|
|
|
optional_system_deps="$(python3 -c "
|
|
import tomllib, json
|
|
with open('${bakery_toml}', 'rb') as f:
|
|
d = tomllib.load(f)
|
|
print(json.dumps(d.get('optional_system_deps', [])))
|
|
" 2>/dev/null || echo "[]")"
|
|
|
|
bread_deps="$(python3 -c "
|
|
import tomllib, json
|
|
with open('${bakery_toml}', 'rb') as f:
|
|
d = tomllib.load(f)
|
|
print(json.dumps(d.get('bread_deps', [])))
|
|
" 2>/dev/null || echo "[]")"
|
|
|
|
# [[service]] entries → [{unit, enable, sha256}]. sha256 comes from the
|
|
# actual unit file shipped in this version dir — the same
|
|
# artifact-integrity guarantee binaries already get. A missing unit file
|
|
# gets an empty sha256; install.rs refuses to install an unverified
|
|
# download rather than silently skipping the check.
|
|
service_units="$(python3 -c "
|
|
import tomllib, json
|
|
with open('${bakery_toml}', 'rb') as f:
|
|
d = tomllib.load(f)
|
|
svcs = d.get('service', [])
|
|
print(json.dumps([{'unit': s['unit'], 'enable': s.get('enable', False)} for s in svcs]))
|
|
" 2>/dev/null || echo "[]")"
|
|
|
|
services="[]"
|
|
while IFS= read -r svc_entry; do
|
|
[[ -z "${svc_entry}" ]] && continue
|
|
unit_name="$(echo "${svc_entry}" | jq -r '.unit')"
|
|
enable="$(echo "${svc_entry}" | jq -r '.enable')"
|
|
unit_path="${version_dir}/${unit_name}"
|
|
unit_sha256=""
|
|
if [[ -f "${unit_path}" ]]; then
|
|
unit_sha256="$(sha256sum "${unit_path}" | awk '{print $1}')"
|
|
else
|
|
echo " warning: service unit '${unit_name}' not found at ${unit_path}" >&2
|
|
fi
|
|
svc_json="$(jq -n --arg unit "${unit_name}" --argjson enable "${enable}" --arg sha256 "${unit_sha256}" \
|
|
'{unit: $unit, enable: $enable, sha256: $sha256}')"
|
|
services="$(jq -n --argjson arr "${services}" --argjson e "${svc_json}" '$arr + [$e]')"
|
|
done < <(echo "${service_units}" | jq -c '.[]')
|
|
|
|
# [config] → {dir, example?, example_sha256?} or null
|
|
config="$(python3 -c "
|
|
import tomllib, json
|
|
with open('${bakery_toml}', 'rb') as f:
|
|
d = tomllib.load(f)
|
|
cfg = d.get('config')
|
|
if cfg:
|
|
obj = {'dir': cfg['dir']}
|
|
if 'example' in cfg:
|
|
obj['example'] = cfg['example']
|
|
print(json.dumps(obj))
|
|
else:
|
|
print('null')
|
|
" 2>/dev/null || echo "null")"
|
|
if [[ "${config}" != "null" ]]; then
|
|
example_name="$(echo "${config}" | jq -r '.example // empty')"
|
|
if [[ -n "${example_name}" ]]; then
|
|
example_path="${version_dir}/${example_name}"
|
|
example_sha256=""
|
|
if [[ -f "${example_path}" ]]; then
|
|
example_sha256="$(sha256sum "${example_path}" | awk '{print $1}')"
|
|
else
|
|
echo " warning: config.example '${example_name}' not found at ${example_path}" >&2
|
|
fi
|
|
config="$(echo "${config}" | jq -c --arg sha "${example_sha256}" '. + {example_sha256: $sha}')"
|
|
fi
|
|
fi
|
|
|
|
post_install="$(python3 -c "
|
|
import tomllib, json
|
|
with open('${bakery_toml}', 'rb') as f:
|
|
d = tomllib.load(f)
|
|
print(json.dumps(d.get('install', {}).get('post_install', [])))
|
|
" 2>/dev/null || echo "[]")"
|
|
|
|
jq -n \
|
|
--arg name "${name}" \
|
|
--arg description "${description}" \
|
|
--arg version "${version}" \
|
|
--argjson binaries "${binaries_json}" \
|
|
--argjson system_deps "${system_deps}" \
|
|
--argjson optional_system_deps "${optional_system_deps}" \
|
|
--argjson bread_deps "${bread_deps}" \
|
|
--argjson services "${services}" \
|
|
--argjson config "${config}" \
|
|
--argjson post_install "${post_install}" \
|
|
'{
|
|
name: $name,
|
|
description: $description,
|
|
version: $version,
|
|
binaries: $binaries,
|
|
system_deps: $system_deps,
|
|
optional_system_deps: $optional_system_deps,
|
|
bread_deps: $bread_deps,
|
|
services: $services,
|
|
config: $config,
|
|
post_install: $post_install
|
|
}'
|
|
}
|
|
|
|
# Assemble the full index.
|
|
packages_json="{}"
|
|
for entry in "${products[@]}"; do
|
|
name="$(echo "${entry}" | awk '{print $1}')"
|
|
repo="$(echo "${entry}" | awk '{print $2}')"
|
|
echo "processing ${name}…"
|
|
pkg="$(build_package_json "${name}" "${repo}")" || { echo " skipping ${name}"; continue; }
|
|
[[ -z "${pkg}" ]] && { echo " skipping ${name}: no output"; continue; }
|
|
packages_json="$(jq -n --argjson m "${packages_json}" --arg k "${name}" --argjson v "${pkg}" '$m + {($k): $v}')"
|
|
done
|
|
|
|
jq -n \
|
|
--arg version "1" \
|
|
--arg generated_at "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
|
|
--argjson packages "${packages_json}" \
|
|
'{version: $version, generated_at: $generated_at, packages: $packages}' \
|
|
> "${OUT}"
|
|
|
|
echo "wrote ${OUT}"
|
|
|
|
# Sign the index so `bakery` can verify it before trusting a single byte.
|
|
# Every artifact sha256 and post_install hook string lives inside index.json,
|
|
# so a valid signature over these raw bytes transitively covers all of it —
|
|
# no separate per-artifact signing is needed.
|
|
#
|
|
# MINISIGN_SEC_KEY must point at the *secret* key file generated with
|
|
# `minisign -G`. It is intentionally never read from inside either git repo;
|
|
# point it at wherever the key actually lives on the machine that runs this
|
|
# script (e.g. a root-only path on hestia), and set MINISIGN_SEC_KEY_PASSWORD
|
|
# too if the key was generated with a password.
|
|
#
|
|
# This step is a no-op (with a loud warning) if the key isn't configured, so
|
|
# existing unsigned publishing flows don't break until the key is actually
|
|
# wired up — see the handoff note in the fix commit for this repo.
|
|
if [[ -n "${MINISIGN_SEC_KEY:-}" ]]; then
|
|
if [[ ! -f "${MINISIGN_SEC_KEY}" ]]; then
|
|
echo "ERROR: MINISIGN_SEC_KEY=${MINISIGN_SEC_KEY} does not exist" >&2
|
|
exit 1
|
|
fi
|
|
if ! command -v minisign >/dev/null 2>&1; then
|
|
echo "ERROR: MINISIGN_SEC_KEY is set but the 'minisign' binary is not installed" >&2
|
|
exit 1
|
|
fi
|
|
sign_args=(-S -s "${MINISIGN_SEC_KEY}" -m "${OUT}" -x "${OUT}.minisig")
|
|
if [[ -n "${MINISIGN_SEC_KEY_PASSWORD:-}" ]]; then
|
|
MINISIGN_PASSWORD="${MINISIGN_SEC_KEY_PASSWORD}" minisign "${sign_args[@]}" </dev/null
|
|
else
|
|
# -W: the key has no password (matches how CI-facing signing keys are
|
|
# normally generated, since there's no human to type a passphrase).
|
|
minisign -W "${sign_args[@]}" </dev/null
|
|
fi
|
|
echo "signed ${OUT} -> ${OUT}.minisig"
|
|
else
|
|
echo "WARNING: MINISIGN_SEC_KEY not set — index.json was NOT signed." >&2
|
|
echo " bakery clients built with signature verification will reject" >&2
|
|
echo " this index. Set MINISIGN_SEC_KEY before running this in" >&2
|
|
echo " production once the signing key has been provisioned." >&2
|
|
fi
|