Document packaging and release artifacts

packaging/release-artifacts.sh

@@ -0,0 +1,103 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-or-later
+# Build release artifacts: source tarball, checksum file, manifest, optional
+# detached signature over SHA256SUMS.
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+version="$(python3 - <<'PY'
+import tomllib
+from pathlib import Path
+print(tomllib.loads(Path("pyproject.toml").read_text())["project"]["version"])
+PY
+)"
+project="enodia-sentinel"
+prefix="${project}-${version}"
+distdir="${DISTDIR:-dist}"
+archive="${prefix}.tar.gz"
+manifest="RELEASE_MANIFEST.json"
+checksums="SHA256SUMS"
+signature="SHA256SUMS.asc"
+allow_dirty="${RELEASE_ALLOW_DIRTY:-0}"
+sign="${RELEASE_SIGN:-0}"
+signing_key="${RELEASE_SIGNING_KEY:-}"
+
+if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+    dirty=0
+    git diff --quiet || dirty=1
+    git diff --cached --quiet || dirty=1
+    if [ -n "$(git ls-files --others --exclude-standard)" ]; then
+        dirty=1
+    fi
+    git_commit="$(git rev-parse --verify HEAD)"
+    if [ "$dirty" -ne 0 ] && [ "$allow_dirty" != "1" ]; then
+        echo "error: worktree is dirty; commit changes or set RELEASE_ALLOW_DIRTY=1" >&2
+        exit 2
+    fi
+else
+    dirty=1
+    git_commit=""
+fi
+
+mkdir -p "$distdir"
+tmp="$(mktemp -d "${TMPDIR:-/tmp}/enodia-release.XXXXXX")"
+cleanup() {
+    rm -rf "$tmp"
+}
+trap cleanup EXIT
+
+mkdir -p "$tmp/$prefix"
+tar \
+    --exclude='./.git' \
+    --exclude='./dist' \
+    --exclude='./__pycache__' \
+    --exclude='*/__pycache__' \
+    --exclude='./.pytest_cache' \
+    --exclude='./.mypy_cache' \
+    --exclude='./.ruff_cache' \
+    --exclude='*.pyc' \
+    --exclude='*.pkg.tar.zst' \
+    -cf - . | tar -xf - -C "$tmp/$prefix"
+
+tar --sort=name --mtime='@0' --owner=0 --group=0 --numeric-owner \
+    -czf "$distdir/$archive" -C "$tmp" "$prefix"
+
+generated_at="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+cat > "$distdir/$manifest" <<JSON
+{
+  "project": "$project",
+  "version": "$version",
+  "generated_at": "$generated_at",
+  "git_commit": "$git_commit",
+  "dirty": $dirty,
+  "artifacts": [
+    "$archive",
+    "$checksums"
+  ]
+}
+JSON
+
+(
+    cd "$distdir"
+    sha256sum "$archive" "$manifest" > "$checksums"
+)
+
+if [ "$sign" = "1" ]; then
+    command -v gpg >/dev/null 2>&1 || {
+        echo "error: RELEASE_SIGN=1 requires gpg" >&2
+        exit 127
+    }
+    gpg_args=(--batch --yes --armor --detach-sign)
+    if [ -n "$signing_key" ]; then
+        gpg_args+=(--local-user "$signing_key")
+    fi
+    gpg "${gpg_args[@]}" -o "$distdir/$signature" "$distdir/$checksums"
+    echo "Signed $distdir/$signature"
+else
+    echo "Signing skipped; set RELEASE_SIGN=1 to create $signature"
+fi
+
+echo "Wrote $distdir/$archive"
+echo "Wrote $distdir/$checksums"
+echo "Wrote $distdir/$manifest"