103 lines
2.6 KiB
Bash
Executable file
103 lines
2.6 KiB
Bash
Executable file
#!/bin/bash
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
# Build release artifacts: source tarball, checksum file, manifest, optional
|
|
# detached signature over SHA256SUMS.
|
|
set -euo pipefail
|
|
|
|
cd "$(dirname "$0")/.."
|
|
|
|
version="$(python3 - <<'PY'
|
|
import tomllib
|
|
from pathlib import Path
|
|
print(tomllib.loads(Path("pyproject.toml").read_text())["project"]["version"])
|
|
PY
|
|
)"
|
|
project="enodia-sentinel"
|
|
prefix="${project}-${version}"
|
|
distdir="${DISTDIR:-dist}"
|
|
archive="${prefix}.tar.gz"
|
|
manifest="RELEASE_MANIFEST.json"
|
|
checksums="SHA256SUMS"
|
|
signature="SHA256SUMS.asc"
|
|
allow_dirty="${RELEASE_ALLOW_DIRTY:-0}"
|
|
sign="${RELEASE_SIGN:-0}"
|
|
signing_key="${RELEASE_SIGNING_KEY:-}"
|
|
|
|
if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
|
|
dirty=0
|
|
git diff --quiet || dirty=1
|
|
git diff --cached --quiet || dirty=1
|
|
if [ -n "$(git ls-files --others --exclude-standard)" ]; then
|
|
dirty=1
|
|
fi
|
|
git_commit="$(git rev-parse --verify HEAD)"
|
|
if [ "$dirty" -ne 0 ] && [ "$allow_dirty" != "1" ]; then
|
|
echo "error: worktree is dirty; commit changes or set RELEASE_ALLOW_DIRTY=1" >&2
|
|
exit 2
|
|
fi
|
|
else
|
|
dirty=1
|
|
git_commit=""
|
|
fi
|
|
|
|
mkdir -p "$distdir"
|
|
tmp="$(mktemp -d "${TMPDIR:-/tmp}/enodia-release.XXXXXX")"
|
|
cleanup() {
|
|
rm -rf "$tmp"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
mkdir -p "$tmp/$prefix"
|
|
tar \
|
|
--exclude='./.git' \
|
|
--exclude='./dist' \
|
|
--exclude='./__pycache__' \
|
|
--exclude='*/__pycache__' \
|
|
--exclude='./.pytest_cache' \
|
|
--exclude='./.mypy_cache' \
|
|
--exclude='./.ruff_cache' \
|
|
--exclude='*.pyc' \
|
|
--exclude='*.pkg.tar.zst' \
|
|
-cf - . | tar -xf - -C "$tmp/$prefix"
|
|
|
|
tar --sort=name --mtime='@0' --owner=0 --group=0 --numeric-owner \
|
|
-czf "$distdir/$archive" -C "$tmp" "$prefix"
|
|
|
|
generated_at="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
|
cat > "$distdir/$manifest" <<JSON
|
|
{
|
|
"project": "$project",
|
|
"version": "$version",
|
|
"generated_at": "$generated_at",
|
|
"git_commit": "$git_commit",
|
|
"dirty": $dirty,
|
|
"artifacts": [
|
|
"$archive",
|
|
"$checksums"
|
|
]
|
|
}
|
|
JSON
|
|
|
|
(
|
|
cd "$distdir"
|
|
sha256sum "$archive" "$manifest" > "$checksums"
|
|
)
|
|
|
|
if [ "$sign" = "1" ]; then
|
|
command -v gpg >/dev/null 2>&1 || {
|
|
echo "error: RELEASE_SIGN=1 requires gpg" >&2
|
|
exit 127
|
|
}
|
|
gpg_args=(--batch --yes --armor --detach-sign)
|
|
if [ -n "$signing_key" ]; then
|
|
gpg_args+=(--local-user "$signing_key")
|
|
fi
|
|
gpg "${gpg_args[@]}" -o "$distdir/$signature" "$distdir/$checksums"
|
|
echo "Signed $distdir/$signature"
|
|
else
|
|
echo "Signing skipped; set RELEASE_SIGN=1 to create $signature"
|
|
fi
|
|
|
|
echo "Wrote $distdir/$archive"
|
|
echo "Wrote $distdir/$checksums"
|
|
echo "Wrote $distdir/$manifest"
|