justme
a2f88a344b
Join codes need no passkey touch and carry only public values (genesis fingerprint, owner credentials, installer hashes). Nodes pin the genesis and owners at enrollment and only follow passkey-signed operator set versions. The panel's server key is listed in the set; pinned nodes require its signature and run the control link under AES-256-GCM. Password sessions carry no capabilities. The updater adopts a next_key from a signed manifest. Bump version to 0.2.0. [CI SKIP]
118 lines
5.2 KiB
Bash
118 lines
5.2 KiB
Bash
#!/usr/bin/env bash
|
|
# Create/update the Gitea Release after all platform package workflows succeed.
|
|
set -euo pipefail
|
|
|
|
tag="${CI_COMMIT_TAG:-}"
|
|
[[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || {
|
|
echo "release must run from a vMAJOR.MINOR.PATCH tag" >&2
|
|
exit 2
|
|
}
|
|
[[ -n "${GITEA_TOKEN:-}" ]] || { echo "GITEA_TOKEN is required" >&2; exit 2; }
|
|
|
|
version="${tag#v}"
|
|
gitea_base="${GITEA_BASE:-http://192.168.2.162:3100}"
|
|
gitea_base="${gitea_base%/}"
|
|
gitea_host="${gitea_base#https://}"
|
|
gitea_host="${gitea_host#http://}"
|
|
gitea_host="${gitea_host%%/*}"
|
|
gitea_host="${gitea_host%%:*}"
|
|
api="$gitea_base/api/v1/repos/justme/MoShiro"
|
|
tmp="$(mktemp -d)"
|
|
netrc="$tmp/netrc"
|
|
release_json="$tmp/release.json"
|
|
assets_json="$tmp/assets.json"
|
|
chmod 700 "$tmp"
|
|
printf 'machine %s login justme password %s\n' "$gitea_host" "$GITEA_TOKEN" > "$netrc"
|
|
chmod 600 "$netrc"
|
|
trap 'rm -rf "$tmp"' EXIT
|
|
|
|
root_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
install_sh="$(sha256sum "$root_dir/packaging/install/install.sh" | cut -d" " -f1)"
|
|
install_ps1="$(sha256sum "$root_dir/packaging/install/install.ps1" | cut -d" " -f1)"
|
|
release_body="Install script SHA-256 (compare with the panel before you run an install command): install.sh $install_sh, install.ps1 $install_ps1. Agent and Probe builds: Linux glibc and musl (x64, arm64), macOS (x64, arm64), and Windows (x64, arm64). Linux glibc Agent and Probe OCI images: registry.oeo.one/moshiro/moshiro-agent:$version and registry.oeo.one/moshiro/moshiro-probe:$version (linux/amd64 and linux/arm64). Backend OCI image: registry.oeo.one/moshiro/moshiro-backend:$version (linux/amd64 and linux/arm64). macOS binaries are not Developer ID signed or notarized."
|
|
payload="$(printf '{"tag_name":"%s","target_commitish":"%s","name":"MoShiro %s","body":"%s","draft":false,"prerelease":false}' \
|
|
"$tag" "${CI_COMMIT_SHA:-}" "$tag" "$release_body")"
|
|
release_status="$(curl --silent --show-error --retry 3 --netrc-file "$netrc" \
|
|
--output "$release_json" --write-out '%{http_code}' "$api/releases/tags/$tag")"
|
|
release_created=false
|
|
if [[ "$release_status" == 404 ]]; then
|
|
release_status="$(curl --silent --show-error --retry 3 --netrc-file "$netrc" \
|
|
--header 'Content-Type: application/json' --data "$payload" \
|
|
--output "$release_json" --write-out '%{http_code}' "$api/releases")"
|
|
release_created=true
|
|
fi
|
|
[[ "$release_status" =~ ^2 ]] || {
|
|
echo "Gitea Release lookup/create failed (HTTP $release_status)" >&2
|
|
cat "$release_json" >&2
|
|
exit 1
|
|
}
|
|
release_id="$(grep -o '"id":[[:space:]]*[0-9][0-9]*' "$release_json" | head -1 | tr -cd '0-9')"
|
|
[[ -n "$release_id" ]] || { echo "Could not read Gitea Release ID" >&2; exit 1; }
|
|
if [[ "$release_created" == false ]]; then
|
|
update_response="$tmp/release-update.json"
|
|
update_status="$(curl --silent --show-error --retry 3 --netrc-file "$netrc" \
|
|
--request PATCH --header 'Content-Type: application/json' --data "$payload" \
|
|
--output "$update_response" --write-out '%{http_code}' "$api/releases/$release_id")"
|
|
[[ "$update_status" =~ ^2 ]] || {
|
|
echo "Gitea Release update failed (HTTP $update_status)" >&2
|
|
cat "$update_response" >&2
|
|
exit 1
|
|
}
|
|
fi
|
|
curl --fail-with-body --silent --show-error --retry 3 --netrc-file "$netrc" \
|
|
"$api/releases/$release_id/assets" -o "$assets_json"
|
|
|
|
assets=(
|
|
"moshiro-agent-v$version-linux-amd64.tar.gz"
|
|
"moshiro-agent-v$version-linux-arm64.tar.gz"
|
|
"moshiro-probe-v$version-linux-amd64.tar.gz"
|
|
"moshiro-probe-v$version-linux-arm64.tar.gz"
|
|
"moshiro-agent-v$version-linux-musl-amd64.tar.gz"
|
|
"moshiro-probe-v$version-linux-musl-amd64.tar.gz"
|
|
"moshiro-agent-v$version-linux-musl-arm64.tar.gz"
|
|
"moshiro-probe-v$version-linux-musl-arm64.tar.gz"
|
|
"moshiro-agent-v$version-macos-x64.tar.gz"
|
|
"moshiro-probe-v$version-macos-x64.tar.gz"
|
|
"moshiro-agent-v$version-macos-arm64.tar.gz"
|
|
"moshiro-probe-v$version-macos-arm64.tar.gz"
|
|
"moshiro-agent-v$version-windows-amd64.zip"
|
|
"moshiro-agent-v$version-windows-arm64.zip"
|
|
"moshiro-probe-v$version-windows-amd64.zip"
|
|
"moshiro-probe-v$version-windows-arm64.zip"
|
|
)
|
|
|
|
upload_release_asset() {
|
|
local name="$1" file="$tmp/$1" upload_response="$tmp/$1.upload.json" status
|
|
curl --fail-with-body --silent --show-error --retry 3 --netrc-file "$netrc" \
|
|
"$gitea_base/api/packages/justme/generic/moshiro-node/$version/$name" -o "$file"
|
|
status="$(curl --silent --show-error --retry 3 --netrc-file "$netrc" \
|
|
--request POST --header 'Content-Type: application/octet-stream' --data-binary "@$file" \
|
|
--output "$upload_response" --write-out '%{http_code}' \
|
|
"$api/releases/$release_id/assets?name=$name")"
|
|
case "$status" in
|
|
2*) echo "attached $name" ;;
|
|
*) echo "Gitea Release asset upload failed for $name (HTTP $status)" >&2; cat "$upload_response" >&2; return 1 ;;
|
|
esac
|
|
}
|
|
|
|
pids=()
|
|
for archive in "${assets[@]}"; do
|
|
for name in "$archive" "$archive.sha256"; do
|
|
if grep -Eq "\"name\"[[:space:]]*:[[:space:]]*\"$name\"" "$assets_json"; then
|
|
echo "release asset $name already exists; keeping the existing asset"
|
|
continue
|
|
fi
|
|
upload_release_asset "$name" &
|
|
pids+=("$!")
|
|
if ((${#pids[@]} >= 8)); then
|
|
wait "${pids[0]}"
|
|
pids=("${pids[@]:1}")
|
|
fi
|
|
done
|
|
done
|
|
for pid in "${pids[@]}"; do
|
|
wait "$pid"
|
|
done
|
|
|
|
echo "published Gitea Release $tag: https://git.oeo.one/justme/MoShiro/releases/tag/$tag"
|