archipelagoandClaude Opus 5
5ccef0ac2f
Publishing the ISO was a manual step printed as a reminder at the end of build-iso-release.sh: upload the ISO, its .sha256 and the signed checksum JSON by hand. Only the OTA binary and frontend tarball were automated. publish-release-assets.sh now uploads all three when an ISO for the version exists in image-recipe/results/, with the same supply-chain rules the OTA manifest already gets: the checksum JSON must be signed by the pinned release root, the signature must cryptographically verify, and the image must still match its own .sha256 (a truncated or half-copied ISO is exactly what a signed checksum exists to expose). After upload it confirms every asset landed at its exact local size. The stage runs AFTER main is pushed, deliberately. The ISO is not referenced by releases/manifest.json, so no node's OTA path depends on it — running it last means a slow or failed multi-GB upload can never delay or strand an OTA release that has already been verified. When no ISO exists yet (the usual case, since the ISO build needs the tag this script pushes) it explains how to build and attach one, and exits clean. Uploads take a max-time argument: 4h and a progress bar for the ISO, where the previous fixed 15-minute silent ceiling would have killed a multi-GB transfer partway through. Verified with a stubbed harness: no-ISO skip, missing .sha256, unsigned checksum, wrong signing key, corrupted image, happy path, and a truncated upload caught by the size check. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
201 lines
9.1 KiB
Bash
Executable File
201 lines
9.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Gated ISO release build — the single command that turns a signed release
|
|
# on `main` into a tested installer ISO.
|
|
#
|
|
# Stages (fail-fast, each logged with timing):
|
|
# 0. preflight — Linux, clean tree on main, version parity across
|
|
# Cargo.toml / package.json / releases/manifest.json /
|
|
# CHANGELOG / git tag, manifest signature present
|
|
# 1. gates — tests/release/run.sh (static + frontend + backend
|
|
# slice), strict catalog drift, FULL cargo test suite
|
|
# 2. artifacts — release binary embeds the version, frontend dist
|
|
# matches, AIUI present (OTA-strip regression guard)
|
|
# 3. build — image-recipe/build-debian-iso.sh (unbundled by default)
|
|
# 4. smoke — scripts/iso-smoke-test.sh (mount-level, version-checked)
|
|
# 5. qemu — headless boot test (skippable with --no-qemu)
|
|
#
|
|
# Usage:
|
|
# scripts/build-iso-release.sh [--skip-gates] [--no-qemu] [--bundled] [--rc N]
|
|
#
|
|
# The ISO is NOT signed here — run scripts/sign-iso-checksums.sh with the
|
|
# offline RELEASE_MASTER_MNEMONIC afterwards (publisher only).
|
|
|
|
set -u
|
|
|
|
REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "$REPO"
|
|
|
|
SKIP_GATES=0 NO_QEMU=0 UNBUNDLED=1 RC_OVERRIDE=""
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
--skip-gates) SKIP_GATES=1 ;;
|
|
--no-qemu) NO_QEMU=1 ;;
|
|
--bundled) UNBUNDLED=0 ;;
|
|
--rc) RC_OVERRIDE="${2:?--rc needs a number}"; shift ;;
|
|
*) echo "unknown flag: $1" >&2; exit 2 ;;
|
|
esac
|
|
shift
|
|
done
|
|
|
|
[ -f "$HOME/.cargo/env" ] && . "$HOME/.cargo/env"
|
|
|
|
PASS=() FAIL=()
|
|
stage() { # stage <name> <cmd...>
|
|
local name="$1"; shift
|
|
local t0=$SECONDS
|
|
echo
|
|
echo "═══ [$name] $*"
|
|
if "$@"; then
|
|
echo "═══ [$name] PASS ($((SECONDS - t0))s)"
|
|
PASS+=("$name")
|
|
else
|
|
local rc=$?
|
|
echo "═══ [$name] FAIL exit=$rc ($((SECONDS - t0))s)"
|
|
FAIL+=("$name")
|
|
summary 1
|
|
fi
|
|
}
|
|
summary() {
|
|
echo
|
|
echo "──────── ISO release build summary ────────"
|
|
printf 'PASS: %s\n' "${PASS[@]:-none}"
|
|
[[ ${#FAIL[@]} -gt 0 ]] && printf 'FAIL: %s\n' "${FAIL[@]}"
|
|
exit "${1:-0}"
|
|
}
|
|
|
|
# ── Stage 0: preflight ───────────────────────────────────────────────
|
|
preflight() {
|
|
[ "$(uname -s)" = "Linux" ] || { echo "ISO builds run on Linux only"; return 1; }
|
|
|
|
local branch; branch="$(git rev-parse --abbrev-ref HEAD)"
|
|
[ "$branch" = "main" ] || { echo "must build from main (on: $branch)"; return 1; }
|
|
|
|
if [ -n "$(git status --porcelain)" ]; then
|
|
echo "working tree is not clean — release ISOs build from committed state only:"
|
|
git status --porcelain | head -20
|
|
return 1
|
|
fi
|
|
|
|
VERSION="$(grep -m1 '^version' core/archipelago/Cargo.toml | sed 's/.*"\(.*\)".*/\1/')"
|
|
local ui_ver manifest_ver
|
|
ui_ver="$(python3 -c 'import json;print(json.load(open("neode-ui/package.json"))["version"])')"
|
|
manifest_ver="$(python3 -c 'import json;print(json.load(open("releases/manifest.json"))["version"])')"
|
|
echo " Cargo.toml: $VERSION"
|
|
echo " package.json: $ui_ver"
|
|
echo " releases/manifest: $manifest_ver"
|
|
[ "$VERSION" = "$ui_ver" ] || { echo "version mismatch Cargo vs package.json"; return 1; }
|
|
[ "$VERSION" = "$manifest_ver" ] || { echo "version mismatch Cargo vs releases/manifest.json"; return 1; }
|
|
|
|
head -5 CHANGELOG.md | grep -qF "v$VERSION" \
|
|
|| { echo "CHANGELOG.md top entry is not v$VERSION"; return 1; }
|
|
|
|
git rev-parse -q --verify "refs/tags/v$VERSION" >/dev/null \
|
|
|| { echo "tag v$VERSION does not exist — cut the release first (scripts/create-release.sh)"; return 1; }
|
|
|
|
# The ISO must only ever be cut from a ceremony-signed manifest.
|
|
python3 - <<'EOF' || return 1
|
|
import json, sys
|
|
m = json.load(open("releases/manifest.json"))
|
|
sig, by = m.get("signature"), m.get("signed_by", "")
|
|
if not sig or not by.startswith("did:key:"):
|
|
print("releases/manifest.json is UNSIGNED — run the signing ceremony first")
|
|
sys.exit(1)
|
|
print(f" manifest signed by {by[:32]}…")
|
|
EOF
|
|
|
|
echo " version: $VERSION @ $(git rev-parse --short HEAD), tree clean, manifest signed"
|
|
}
|
|
stage "preflight" preflight
|
|
VERSION="$(grep -m1 '^version' core/archipelago/Cargo.toml | sed 's/.*"\(.*\)".*/\1/')"
|
|
|
|
# ── Stage 1: gates ───────────────────────────────────────────────────
|
|
if [ "$SKIP_GATES" = "0" ]; then
|
|
stage "release-gate-harness" bash tests/release/run.sh
|
|
stage "catalog-drift-strict" python3 scripts/check-app-catalog-drift.py --release --strict
|
|
# Full Rust suite — the release harness only runs a 6-module slice;
|
|
# ~1000 tests otherwise go unverified at ISO time (hardening plan §H).
|
|
stage "cargo-test-full" timeout 5400 env CARGO_INCREMENTAL=0 \
|
|
nice -n 10 cargo test --manifest-path core/Cargo.toml -p archipelago --bin archipelago
|
|
else
|
|
echo; echo "═══ [gates] SKIPPED (--skip-gates)"
|
|
fi
|
|
|
|
# ── Stage 2: artifact verification ───────────────────────────────────
|
|
verify_artifacts() {
|
|
local bin="core/target/release/archipelago"
|
|
[ -x "$bin" ] || { echo "missing release binary $bin — build it first"; return 1; }
|
|
strings "$bin" | grep -qF "$VERSION" \
|
|
|| { echo "release binary does not embed $VERSION — stale build"; return 1; }
|
|
echo " backend binary embeds $VERSION ($(du -h "$bin" | cut -f1))"
|
|
|
|
[ -f web/dist/neode-ui/index.html ] || { echo "missing frontend dist"; return 1; }
|
|
grep -rqoF "$VERSION" web/dist/neode-ui/assets/*.js \
|
|
|| { echo "frontend dist does not contain $VERSION — stale build"; return 1; }
|
|
echo " frontend dist contains $VERSION"
|
|
|
|
# AIUI must ride inside the dist BEFORE packaging or OTA upgrades
|
|
# silently strip it from nodes in the field.
|
|
[ -f web/dist/neode-ui/aiui/index.html ] \
|
|
|| { echo "AIUI missing from web/dist/neode-ui/aiui — fold it in before building"; return 1; }
|
|
echo " AIUI present in frontend dist"
|
|
}
|
|
stage "verify-artifacts" verify_artifacts
|
|
|
|
# ── Stage 3: build the ISO ───────────────────────────────────────────
|
|
build_iso() {
|
|
local env_args=(
|
|
UNBUNDLED="$UNBUNDLED"
|
|
BUILD_FROM_SOURCE=0
|
|
DEV_SERVER=localhost
|
|
ARCHIPELAGO_BIN="$REPO/core/target/release/archipelago"
|
|
)
|
|
[ -n "$RC_OVERRIDE" ] && env_args+=(RC="$RC_OVERRIDE")
|
|
sudo -E env "${env_args[@]}" nice -n 5 bash image-recipe/build-debian-iso.sh
|
|
}
|
|
stage "build-iso" build_iso
|
|
|
|
find_iso() {
|
|
ls -t "$REPO"/image-recipe/results/archipelago-installer-"$VERSION"*-x86_64_RC*.iso 2>/dev/null | head -1
|
|
}
|
|
ISO="$(find_iso)"
|
|
[ -n "$ISO" ] || { echo "FAIL: no ISO produced for $VERSION in image-recipe/results/"; FAIL+=("locate-iso"); summary 1; }
|
|
|
|
# ── Stage 4: mount-level smoke test ──────────────────────────────────
|
|
stage "iso-smoke" bash scripts/iso-smoke-test.sh "$ISO" "$VERSION"
|
|
|
|
# ── Stage 5: QEMU boot test (best-effort) ────────────────────────────
|
|
# The ISO's kernel cmdline has no serial console, so the serial-log
|
|
# sanity grep can miss a perfectly healthy boot. Run it, report it,
|
|
# but don't fail an otherwise-green build on it.
|
|
if [ "$NO_QEMU" = "0" ] && command -v qemu-system-x86_64 >/dev/null 2>&1; then
|
|
echo
|
|
echo "═══ [qemu-boot] (best-effort) test-iso-qemu.sh $ISO 180"
|
|
if bash image-recipe/_archived/test-iso-qemu.sh "$ISO" 180; then
|
|
echo "═══ [qemu-boot] PASS"
|
|
PASS+=("qemu-boot")
|
|
else
|
|
echo "═══ [qemu-boot] INCONCLUSIVE (not gating — verify on real hardware)"
|
|
PASS+=("qemu-boot(inconclusive)")
|
|
fi
|
|
else
|
|
echo; echo "═══ [qemu-boot] SKIPPED"
|
|
fi
|
|
|
|
# ── Done ─────────────────────────────────────────────────────────────
|
|
SHA_FILE="$ISO.sha256"
|
|
[ -f "$SHA_FILE" ] || (cd "$(dirname "$ISO")" && sha256sum "$(basename "$ISO")" > "$SHA_FILE")
|
|
|
|
echo
|
|
echo "════════════════════════════════════════════════════"
|
|
echo " ISO RELEASE BUILD COMPLETE — v$VERSION"
|
|
echo "════════════════════════════════════════════════════"
|
|
echo " ISO: $ISO ($(du -h "$ISO" | cut -f1))"
|
|
echo " SHA256: $(cut -d' ' -f1 "$SHA_FILE")"
|
|
echo
|
|
echo " Next steps (publisher, offline mnemonic required):"
|
|
echo " 1. bash scripts/sign-iso-checksums.sh $ISO"
|
|
echo " 2. bash scripts/publish-release-assets.sh $VERSION"
|
|
echo " (attaches the ISO, its .sha256 and the signed checksum JSON to"
|
|
echo " the v$VERSION Gitea release, then verifies the stored sizes)"
|
|
summary 0
|