Archipelago — open-source initial import

2026-08-12 10:55:50 +00:00
commit d6366097bc
1658 changed files with 357286 additions and 0 deletions
@@ -0,0 +1,108 @@
+#!/bin/bash
+# Validate releases/manifest.json:
+#   - version matches core/archipelago/Cargo.toml
+#   - changelog contains curated release notes, not raw git log output
+#   - every component's download_url exists on disk and matches sha256/size
+#
+# Run on every push from CI, and also locally before publishing a release:
+#   scripts/check-release-manifest.sh
+#
+# Exits non-zero on any mismatch so the release process fails loud.
+
+set -eo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+MANIFEST="$REPO_ROOT/releases/manifest.json"
+
+if [ ! -f "$MANIFEST" ]; then
+    echo "❌ releases/manifest.json missing"
+    exit 1
+fi
+
+fail() { echo "❌ $*"; exit 1; }
+ok() { echo "✅ $*"; }
+
+MANIFEST_VERSION=$(python3 -c "import json; print(json.load(open('$MANIFEST'))['version'])")
+CARGO_VERSION=$(grep '^version' "$REPO_ROOT/core/archipelago/Cargo.toml" | head -1 | sed -E 's/.*"([^"]+)".*/\1/')
+
+if [ "$MANIFEST_VERSION" != "$CARGO_VERSION" ]; then
+    fail "manifest version ($MANIFEST_VERSION) ≠ Cargo.toml ($CARGO_VERSION)"
+fi
+ok "version matches: $MANIFEST_VERSION"
+
+# Release notes mandatory — ships stuff nobody can read otherwise. Require
+# curated user/operator-facing notes and reject raw `git log --oneline` output.
+NOTES_CHECK=$(python3 - "$MANIFEST" <<'PY'
+import json
+import re
+import sys
+
+manifest = sys.argv[1]
+notes = json.load(open(manifest)).get("changelog", [])
+if len(notes) < 3:
+    print(f"FAIL: changelog has {len(notes)} lines; need at least 3 curated release-note bullets")
+    sys.exit(0)
+
+bad = []
+for note in notes:
+    text = str(note).strip()
+    if not text:
+        bad.append("empty release-note entry")
+    if len(text) < 40:
+        bad.append(f"too short: {text!r}")
+    if re.match(r"^[0-9a-f]{7,40}\s+", text):
+        bad.append(f"raw commit hash entry: {text!r}")
+    if re.match(r"^(feat|fix|chore|docs|test|refactor|build|ci|perf)(\([^)]+\))?:\s", text):
+        bad.append(f"raw conventional-commit entry: {text!r}")
+
+if bad:
+    print("FAIL: release notes must be curated user/operator-facing bullets, not raw git log lines:\n" + "\n".join(bad))
+else:
+    print(f"OK: changelog has {len(notes)} curated lines")
+PY
+)
+case "$NOTES_CHECK" in
+    OK:*) ok "${NOTES_CHECK#OK: }" ;;
+    FAIL:*) fail "${NOTES_CHECK#FAIL: }" ;;
+    *) fail "unexpected release-note validation output: $NOTES_CHECK" ;;
+esac
+
+# Each component: the artifact on disk under releases/v<version>/ must match
+# the declared sha256 and size_bytes.
+VERSION_DIR="$REPO_ROOT/releases/v${MANIFEST_VERSION}"
+if [ ! -d "$VERSION_DIR" ]; then
+    fail "releases/v${MANIFEST_VERSION}/ missing — artifacts not staged"
+fi
+
+COMPONENT_COUNT=$(python3 -c "import json; print(len(json.load(open('$MANIFEST'))['components']))")
+for i in $(seq 0 $((COMPONENT_COUNT - 1))); do
+    NAME=$(python3 -c "import json; print(json.load(open('$MANIFEST'))['components'][$i]['name'])")
+    DECLARED_SHA=$(python3 -c "import json; print(json.load(open('$MANIFEST'))['components'][$i]['sha256'])")
+    DECLARED_SIZE=$(python3 -c "import json; print(json.load(open('$MANIFEST'))['components'][$i]['size_bytes'])")
+
+    # Component names other than exactly "archipelago" are the tarball's
+    # filename; use as-is. The bare "archipelago" component maps to the
+    # binary file literally named `archipelago`.
+    FILE="$VERSION_DIR/$NAME"
+    if [ "$NAME" = "archipelago" ]; then
+        FILE="$VERSION_DIR/archipelago"
+    fi
+
+    if [ ! -f "$FILE" ]; then
+        fail "component '$NAME' file missing at $FILE"
+    fi
+
+    ACTUAL_SHA=$(sha256sum "$FILE" | awk '{print $1}')
+    ACTUAL_SIZE=$(stat -c%s "$FILE")
+
+    if [ "$ACTUAL_SHA" != "$DECLARED_SHA" ]; then
+        fail "component '$NAME' sha256 mismatch (declared=$DECLARED_SHA actual=$ACTUAL_SHA)"
+    fi
+    if [ "$ACTUAL_SIZE" != "$DECLARED_SIZE" ]; then
+        fail "component '$NAME' size mismatch (declared=$DECLARED_SIZE actual=$ACTUAL_SIZE)"
+    fi
+    ok "component '$NAME': sha256 + size match on-disk artifact"
+done
+
+echo
+ok "releases/manifest.json passes all checks — safe to publish v${MANIFEST_VERSION}"