mirror of
https://git.quad4.io/RNS-Things/MeshChatX.git
synced 2026-09-17 01:24:24 +00:00
chore(workflows): clean up Flatpak CI workflow and remove deprecated Snap build scripts
This commit is contained in:
Ivan
@@ -1,4 +1,4 @@
|
||||
# Linux packaging build test: Flatpak (Snap job commented out for now).
|
||||
# Linux packaging build test: Flatpak.
|
||||
#
|
||||
# Pinned first-party actions (bump tag and SHA together when upgrading):
|
||||
# actions/checkout@v6.0.1 8e8c483db84b4bee98b60c0593521ed34d9990e8
|
||||
@@ -139,87 +139,3 @@ jobs:
|
||||
out/make/**/*.flatpak
|
||||
if-no-files-found: warn
|
||||
retention-days: 7
|
||||
|
||||
# snap:
|
||||
# name: Snap (electron-forge)
|
||||
# needs: frontend
|
||||
# runs-on: ubuntu-latest
|
||||
# timeout-minutes: 90
|
||||
# permissions:
|
||||
# contents: read
|
||||
# env:
|
||||
# FRONTEND_ARTIFACT_NAME: ${{ needs.frontend.outputs.artifact_name }}
|
||||
# MESHCHATX_FRONTEND_PREBUILT: "1"
|
||||
# SNAPCRAFT_BUILD_INFO: "1"
|
||||
# steps:
|
||||
# - name: Checkout
|
||||
# uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
|
||||
#
|
||||
# - name: Install snapcraft
|
||||
# run: |
|
||||
# set -euo pipefail
|
||||
# sudo snap install snapcraft --classic
|
||||
# snapcraft --version
|
||||
#
|
||||
# - name: Prepare snaps for Snapcraft (destructive mode)
|
||||
# run: |
|
||||
# set -euo pipefail
|
||||
# sudo snap wait system seed.loaded 2>/dev/null || true
|
||||
# for snap_name in core22 gnome-42-2204; do
|
||||
# if ! snap list "$snap_name" >/dev/null 2>&1; then
|
||||
# sudo snap install "$snap_name"
|
||||
# fi
|
||||
# snap list "$snap_name"
|
||||
# done
|
||||
#
|
||||
# - name: Set up Python
|
||||
# uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
|
||||
# with:
|
||||
# python-version: ${{ env.PYTHON_VERSION }}
|
||||
#
|
||||
# - name: Install Poetry (PyPI pin)
|
||||
# env:
|
||||
# POETRY_VERSION: ${{ env.POETRY_VERSION }}
|
||||
# run: bash scripts/ci/github-install-poetry.sh
|
||||
#
|
||||
# - name: Set up Node
|
||||
# uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f
|
||||
# with:
|
||||
# node-version: ${{ env.NODE_VERSION }}
|
||||
#
|
||||
# - name: Enable pnpm (corepack)
|
||||
# run: corepack enable && corepack prepare "pnpm@${PNPM_VERSION}" --activate
|
||||
#
|
||||
# - name: Install dependencies
|
||||
# run: bash scripts/ci/github-install-deps.sh
|
||||
#
|
||||
# - name: Download frontend artifact
|
||||
# uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
|
||||
# with:
|
||||
# name: ${{ env.FRONTEND_ARTIFACT_NAME }}
|
||||
# path: meshchatx/public
|
||||
#
|
||||
# - name: Verify frontend artifact contents
|
||||
# run: |
|
||||
# set -euo pipefail
|
||||
# test -f meshchatx/public/index.html
|
||||
# test -d meshchatx/public/assets
|
||||
# test -d meshchatx/public/reticulum-docs-bundled/current
|
||||
#
|
||||
# - name: Build snap package
|
||||
# run: bash scripts/ci/github-build-linux-snap.sh
|
||||
#
|
||||
# - name: List snap output
|
||||
# run: |
|
||||
# set -euo pipefail
|
||||
# ls -la out/make 2>/dev/null || true
|
||||
# find out/make -maxdepth 5 -type f -name "*.snap" -print || true
|
||||
#
|
||||
# - name: Upload snap artifact
|
||||
# uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
|
||||
# with:
|
||||
# name: meshchatx-linux-snap-${{ github.ref_name }}-${{ github.run_id }}
|
||||
# path: |
|
||||
# out/make/**/*.snap
|
||||
# if-no-files-found: warn
|
||||
# retention-days: 7
|
||||
|
||||
@@ -1,22 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Build a Snap via electron-forge's @electron-forge/maker-snap.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
|
||||
cd "$ROOT"
|
||||
|
||||
if [[ ! -f "meshchatx/public/index.html" ]]; then
|
||||
echo "meshchatx/public/index.html is missing; download the prebuilt frontend artifact first." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
export PLATFORM=linux
|
||||
|
||||
pnpm run electron-postinstall
|
||||
pnpm run version:sync
|
||||
pnpm run build-backend
|
||||
|
||||
export DEBUG="${DEBUG:+$DEBUG,}electron-installer-snap:snapcraft"
|
||||
|
||||
FORGE_MAKE_SNAP=1 node scripts/electron-forge-local-tmp.js make --targets @electron-forge/maker-snap
|
||||
@@ -1,26 +0,0 @@
|
||||
#!/bin/sh
|
||||
# Set up QEMU and Docker Buildx for multi-platform builds.
|
||||
# Optionally log in to a container registry.
|
||||
#
|
||||
# Usage: setup-docker.sh [registry] [username] [password]
|
||||
# or set REGISTRY, REGISTRY_USERNAME, REGISTRY_PASSWORD env vars.
|
||||
set -eu
|
||||
|
||||
. "$(dirname "$0")/priv.sh"
|
||||
|
||||
REGISTRY="${1:-${REGISTRY:-}}"
|
||||
USERNAME="${2:-${REGISTRY_USERNAME:-}}"
|
||||
PASSWORD="${3:-${REGISTRY_PASSWORD:-}}"
|
||||
|
||||
echo "Registering QEMU binfmt handlers"
|
||||
run_priv apt-get update -qq
|
||||
run_priv apt-get install -y -qq qemu-user-static binfmt-support
|
||||
|
||||
echo "Creating Docker Buildx builder"
|
||||
docker buildx create --name multiarch --driver docker-container --use
|
||||
docker buildx inspect --bootstrap
|
||||
|
||||
if [ -n "$REGISTRY" ] && [ -n "$USERNAME" ] && [ -n "$PASSWORD" ]; then
|
||||
echo "Logging in to ${REGISTRY}"
|
||||
echo "$PASSWORD" | docker login "$REGISTRY" -u "$USERNAME" --password-stdin
|
||||
fi
|
||||
@@ -1,67 +0,0 @@
|
||||
#!/bin/sh
|
||||
# Install Adoptium Temurin JDK with SHA256 verification.
|
||||
# Uses the Adoptium assets API to obtain the checksum and download URL
|
||||
# directly from the source, avoiding opaque redirects.
|
||||
# Source: https://adoptium.net (Eclipse Foundation)
|
||||
# Usage: setup-java.sh [major_version]
|
||||
set -eu
|
||||
|
||||
. "$(dirname "$0")/priv.sh"
|
||||
|
||||
JAVA_VERSION="${1:-17}"
|
||||
|
||||
ARCH="$(uname -m)"
|
||||
case "$ARCH" in
|
||||
x86_64) ARCH="x64" ;;
|
||||
aarch64) ARCH="aarch64" ;;
|
||||
*) echo "Unsupported architecture: $ARCH" >&2; exit 1 ;;
|
||||
esac
|
||||
|
||||
echo "Installing Temurin JDK ${JAVA_VERSION} (${ARCH})"
|
||||
|
||||
ASSETS_API="https://api.adoptium.net/v3/assets/latest/${JAVA_VERSION}/hotspot?architecture=${ARCH}&image_type=jdk&os=linux&vendor=eclipse"
|
||||
API_JSON="$(curl -fsSL "$ASSETS_API")"
|
||||
|
||||
DOWNLOAD_URL="$(echo "$API_JSON" | sed -n 's/.*"link" *: *"\([^"]*\)".*/\1/p' | head -1)"
|
||||
CHECKSUM_URL="$(echo "$API_JSON" | sed -n 's/.*"checksum_link" *: *"\([^"]*\)".*/\1/p' | head -1)"
|
||||
EXPECTED="$(echo "$API_JSON" | sed -n 's/.*"checksum" *: *"\([0-9a-f]*\)".*/\1/p' | head -1)"
|
||||
|
||||
if [ -z "$DOWNLOAD_URL" ] || [ -z "$EXPECTED" ]; then
|
||||
echo "Failed to resolve Temurin JDK ${JAVA_VERSION} for ${ARCH}" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
curl -fsSL "$DOWNLOAD_URL" -o /tmp/jdk.tar.gz
|
||||
|
||||
ACTUAL="$(sha256sum /tmp/jdk.tar.gz | cut -d' ' -f1)"
|
||||
if [ "$EXPECTED" != "$ACTUAL" ]; then
|
||||
echo "SHA256 verification failed for JDK ${JAVA_VERSION}" >&2
|
||||
echo " expected: ${EXPECTED}" >&2
|
||||
echo " got: ${ACTUAL}" >&2
|
||||
rm -f /tmp/jdk.tar.gz
|
||||
exit 1
|
||||
fi
|
||||
echo "SHA256 verified: ${ACTUAL}"
|
||||
|
||||
if [ -n "$CHECKSUM_URL" ]; then
|
||||
EXPECTED_LINK="$(curl -fsSL "$CHECKSUM_URL" | cut -d' ' -f1)"
|
||||
if [ "$EXPECTED_LINK" != "$ACTUAL" ]; then
|
||||
echo "Cross-check against checksum_link also failed" >&2
|
||||
rm -f /tmp/jdk.tar.gz
|
||||
exit 1
|
||||
fi
|
||||
echo "Cross-verified against checksum_link"
|
||||
fi
|
||||
|
||||
run_priv mkdir -p /opt/java
|
||||
run_priv tar -xzf /tmp/jdk.tar.gz -C /opt/java --strip-components=1
|
||||
rm -f /tmp/jdk.tar.gz
|
||||
|
||||
CI_ENV="${GITEA_ENV:-${GITHUB_ENV:-/dev/null}}"
|
||||
CI_PATH="${GITEA_PATH:-${GITHUB_PATH:-/dev/null}}"
|
||||
echo "JAVA_HOME=/opt/java" >> "$CI_ENV"
|
||||
echo "/opt/java/bin" >> "$CI_PATH"
|
||||
|
||||
export JAVA_HOME=/opt/java
|
||||
export PATH="/opt/java/bin:$PATH"
|
||||
java -version
|
||||
@@ -1,68 +0,0 @@
|
||||
#!/bin/sh
|
||||
# Install Node.js from the official binary distribution with SHA256 verification.
|
||||
# Source: https://nodejs.org
|
||||
# Usage: setup-node.sh [major_version]
|
||||
set -eu
|
||||
|
||||
. "$(dirname "$0")/priv.sh"
|
||||
|
||||
NODE_MAJOR="${1:-24}"
|
||||
|
||||
ARCH="$(uname -m)"
|
||||
case "$ARCH" in
|
||||
x86_64) ARCH="x64" ;;
|
||||
aarch64) ARCH="arm64" ;;
|
||||
armv7l) ARCH="armv7l" ;;
|
||||
*) echo "Unsupported architecture: $ARCH" >&2; exit 1 ;;
|
||||
esac
|
||||
|
||||
DIST_URL="https://nodejs.org/dist/latest-v${NODE_MAJOR}.x"
|
||||
|
||||
curl -fsSL "${DIST_URL}/SHASUMS256.txt" -o /tmp/node-shasums.txt
|
||||
|
||||
VERSION="$(grep -o "node-v[0-9.]*-linux-${ARCH}" /tmp/node-shasums.txt \
|
||||
| head -1 \
|
||||
| sed "s/-linux-${ARCH}//" \
|
||||
| sed 's/node-//')"
|
||||
|
||||
if [ -z "$VERSION" ]; then
|
||||
echo "Failed to resolve Node.js v${NODE_MAJOR} for ${ARCH}" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
TARBALL="node-${VERSION}-linux-${ARCH}.tar.xz"
|
||||
echo "Installing Node.js ${VERSION} (${ARCH})"
|
||||
curl -fsSL "${DIST_URL}/${TARBALL}" -o /tmp/node.tar.xz
|
||||
|
||||
EXPECTED="$(grep " ${TARBALL}\$" /tmp/node-shasums.txt | cut -d' ' -f1)"
|
||||
ACTUAL="$(sha256sum /tmp/node.tar.xz | cut -d' ' -f1)"
|
||||
if [ -z "$EXPECTED" ] || [ "$EXPECTED" != "$ACTUAL" ]; then
|
||||
echo "SHA256 verification failed for ${TARBALL}" >&2
|
||||
echo " expected: ${EXPECTED}" >&2
|
||||
echo " got: ${ACTUAL}" >&2
|
||||
rm -f /tmp/node.tar.xz /tmp/node-shasums.txt
|
||||
exit 1
|
||||
fi
|
||||
echo "SHA256 verified: ${ACTUAL}"
|
||||
|
||||
run_priv tar -xJf /tmp/node.tar.xz -C /usr/local --strip-components=1
|
||||
rm -f /tmp/node.tar.xz /tmp/node-shasums.txt
|
||||
|
||||
export PATH="/usr/local/bin:$PATH"
|
||||
|
||||
# Act / Gitea runners often ship an older Node in /usr/bin; later steps start a new shell.
|
||||
if [ -n "${GITHUB_ENV:-}" ]; then
|
||||
echo "PATH=/usr/local/bin:$PATH" >> "$GITHUB_ENV"
|
||||
fi
|
||||
if [ -n "${GITEA_ENV:-}" ]; then
|
||||
echo "PATH=/usr/local/bin:$PATH" >> "$GITEA_ENV"
|
||||
fi
|
||||
if [ -n "${GITHUB_PATH:-}" ]; then
|
||||
echo "/usr/local/bin" >> "$GITHUB_PATH"
|
||||
fi
|
||||
if [ -n "${GITEA_PATH:-}" ]; then
|
||||
echo "/usr/local/bin" >> "$GITEA_PATH"
|
||||
fi
|
||||
|
||||
node --version
|
||||
npm --version
|
||||
@@ -1,15 +0,0 @@
|
||||
#!/bin/sh
|
||||
# Activate pnpm via corepack.
|
||||
# Usage: setup-pnpm.sh [version]
|
||||
set -eu
|
||||
|
||||
export PATH="/usr/local/bin:$PATH"
|
||||
|
||||
PNPM_VERSION="${1:-10.32.1}"
|
||||
|
||||
corepack enable
|
||||
corepack prepare "pnpm@${PNPM_VERSION}" --activate
|
||||
|
||||
pnpm config set verify-store-integrity true
|
||||
|
||||
pnpm --version
|
||||
@@ -1,166 +0,0 @@
|
||||
#!/bin/sh
|
||||
# Build and install Python from official python.org source.
|
||||
# Verifies: OpenPGP (.asc) when present, otherwise Sigstore (.sigstore) with cosign.
|
||||
# https://www.python.org/download/sigstore/ PEP 761 (3.14+): PGP removed; Sigstore only.
|
||||
#
|
||||
# Usage: setup-python.sh [version]
|
||||
# version: exact (3.14.x) or minor (3.14, resolved to latest patch).
|
||||
set -eu
|
||||
|
||||
. "$(dirname "$0")/priv.sh"
|
||||
|
||||
# Sigstore identity and OIDC issuer per release (see python.org/download/sigstore).
|
||||
sigstore_identity_for() {
|
||||
_v="$1"
|
||||
case "$_v" in
|
||||
3.7.*) echo "nad@python.org|https://github.com/login/oauth" ;;
|
||||
3.8.*|3.9.*) echo "lukasz@langa.pl|https://github.com/login/oauth" ;;
|
||||
3.10.*|3.11.*) echo "pablogsal@python.org|https://accounts.google.com" ;;
|
||||
3.12.*|3.13.*) echo "thomas@python.org|https://accounts.google.com" ;;
|
||||
3.14.*|3.15.*) echo "hugo@python.org|https://github.com/login/oauth" ;;
|
||||
3.16.*|3.17.*) echo "savannah@python.org|https://github.com/login/oauth" ;;
|
||||
3.*.*) echo "savannah@python.org|https://github.com/login/oauth" ;;
|
||||
*) echo "" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
download_cosign() {
|
||||
COSIGN_VERSION="${COSIGN_VERSION:-2.4.1}"
|
||||
COSIGN_ARCH="linux-amd64"
|
||||
case "$(uname -m)" in
|
||||
aarch64|arm64) COSIGN_ARCH="linux-arm64" ;;
|
||||
x86_64|amd64) COSIGN_ARCH="linux-amd64" ;;
|
||||
x86_64-gnu) COSIGN_ARCH="linux-amd64" ;;
|
||||
*)
|
||||
echo "unsupported uname -m for cosign: $(uname -m)" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
COSIGN_BIN="/tmp/cosign-${COSIGN_VERSION}-${COSIGN_ARCH}"
|
||||
if [ ! -x "$COSIGN_BIN" ]; then
|
||||
curl -fsSL "https://github.com/sigstore/cosign/releases/download/v${COSIGN_VERSION}/cosign-${COSIGN_ARCH}" \
|
||||
-o "$COSIGN_BIN"
|
||||
chmod +x "$COSIGN_BIN"
|
||||
fi
|
||||
echo "$COSIGN_BIN"
|
||||
}
|
||||
|
||||
PY_INPUT="${1:-3.14}"
|
||||
|
||||
CURRENT="$(python3 --version 2>/dev/null | sed 's/Python //')" || true
|
||||
|
||||
case "$PY_INPUT" in
|
||||
*.*.*)
|
||||
PY_VERSION="$PY_INPUT"
|
||||
;;
|
||||
*)
|
||||
echo "Resolving latest Python ${PY_INPUT}.x from python.org"
|
||||
PY_VERSION="$(curl -fsSL "https://www.python.org/ftp/python/" \
|
||||
| grep -o "href=\"${PY_INPUT}\.[0-9]*/" \
|
||||
| sed 's/href="//;s/\///' \
|
||||
| sort -t. -k3 -n \
|
||||
| tail -1)"
|
||||
if [ -z "$PY_VERSION" ]; then
|
||||
echo "Failed to resolve Python ${PY_INPUT}.x" >&2
|
||||
exit 1
|
||||
fi
|
||||
echo "Resolved to ${PY_VERSION}"
|
||||
;;
|
||||
esac
|
||||
|
||||
if [ "$CURRENT" = "$PY_VERSION" ]; then
|
||||
echo "Python ${PY_VERSION} already installed"
|
||||
python3 --version
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "Building Python ${PY_VERSION} from source (python.org)"
|
||||
|
||||
run_priv apt-get update -qq
|
||||
run_priv apt-get install -y -qq \
|
||||
build-essential gnupg curl \
|
||||
libssl-dev zlib1g-dev libbz2-dev libreadline-dev \
|
||||
libsqlite3-dev libffi-dev liblzma-dev libncurses-dev > /dev/null 2>&1
|
||||
|
||||
TARBALL="Python-${PY_VERSION}.tar.xz"
|
||||
SRC_URL="https://www.python.org/ftp/python/${PY_VERSION}/${TARBALL}"
|
||||
SIG_URL="${SRC_URL}.asc"
|
||||
|
||||
curl -fsSL "$SRC_URL" -o "/tmp/${TARBALL}"
|
||||
|
||||
SIG_HTTP="$(curl -sS -o "/tmp/${TARBALL}.asc" -w "%{http_code}" "$SIG_URL" || true)"
|
||||
if [ "$SIG_HTTP" != "200" ]; then
|
||||
rm -f "/tmp/${TARBALL}.asc"
|
||||
fi
|
||||
|
||||
GPG_KEYS=""
|
||||
case "$PY_VERSION" in
|
||||
3.13.*|3.14.*)
|
||||
GPG_KEYS="A035C8C19219BA821ECEA86B64E628F8D684696D 7169605F62C751356D054A26A821E680E5FA6305"
|
||||
;;
|
||||
3.11.*|3.12.*)
|
||||
GPG_KEYS="A035C8C19219BA821ECEA86B64E628F8D684696D 7169605F62C751356D054A26A821E680E5FA6305"
|
||||
;;
|
||||
3.9.*|3.10.*)
|
||||
GPG_KEYS="E3FF2839C048B25C084DEBE9B26995E310250568"
|
||||
;;
|
||||
*)
|
||||
echo "No known GPG key for Python ${PY_VERSION}; skipping OpenPGP signature check" >&2
|
||||
;;
|
||||
esac
|
||||
|
||||
GPG_VERIFIED=0
|
||||
if [ "$SIG_HTTP" = "200" ] && [ -n "$GPG_KEYS" ]; then
|
||||
export GNUPGHOME="$(mktemp -d)"
|
||||
for key in $GPG_KEYS; do
|
||||
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" 2>/dev/null || \
|
||||
gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" 2>/dev/null || true
|
||||
done
|
||||
gpg --batch --verify "/tmp/${TARBALL}.asc" "/tmp/${TARBALL}"
|
||||
rm -rf "$GNUPGHOME"
|
||||
unset GNUPGHOME
|
||||
echo "OpenPGP signature verified"
|
||||
GPG_VERIFIED=1
|
||||
fi
|
||||
|
||||
if [ "$GPG_VERIFIED" != "1" ]; then
|
||||
SIGSTORE_URL="${SRC_URL}.sigstore"
|
||||
SIGSTORE_HTTP="$(curl -sS -o "/tmp/${TARBALL}.sigstore" -w "%{http_code}" "$SIGSTORE_URL" || true)"
|
||||
if [ "$SIGSTORE_HTTP" != "200" ]; then
|
||||
rm -f "/tmp/${TARBALL}.sigstore"
|
||||
echo "No OpenPGP signature (HTTP ${SIG_HTTP}) and no Sigstore bundle at ${SIGSTORE_URL} (HTTP ${SIGSTORE_HTTP})" >&2
|
||||
exit 1
|
||||
fi
|
||||
II="$(sigstore_identity_for "$PY_VERSION")"
|
||||
if [ -z "$II" ]; then
|
||||
echo "No Sigstore identity mapping for Python ${PY_VERSION}" >&2
|
||||
exit 1
|
||||
fi
|
||||
SIG_IDENTITY="$(echo "$II" | cut -d'|' -f1)"
|
||||
SIG_ISSUER="$(echo "$II" | cut -d'|' -f2)"
|
||||
COSIGN_BIN="$(download_cosign)"
|
||||
"$COSIGN_BIN" verify-blob --new-bundle-format \
|
||||
--certificate-oidc-issuer "$SIG_ISSUER" \
|
||||
--certificate-identity "$SIG_IDENTITY" \
|
||||
--bundle "/tmp/${TARBALL}.sigstore" \
|
||||
"/tmp/${TARBALL}"
|
||||
echo "Sigstore signature verified"
|
||||
fi
|
||||
|
||||
cd /tmp
|
||||
tar -xJf "${TARBALL}"
|
||||
cd "Python-${PY_VERSION}"
|
||||
|
||||
BUILD_LOG="/tmp/python-build.log"
|
||||
./configure --prefix=/usr/local --with-ensurepip=install > "$BUILD_LOG" 2>&1
|
||||
make -j"$(nproc)" >> "$BUILD_LOG" 2>&1
|
||||
run_priv make install >> "$BUILD_LOG" 2>&1
|
||||
|
||||
run_priv ln -sf /usr/local/bin/python3 /usr/local/bin/python
|
||||
run_priv ln -sf /usr/local/bin/pip3 /usr/local/bin/pip
|
||||
|
||||
cd /
|
||||
rm -rf "/tmp/${TARBALL}" "/tmp/${TARBALL}.asc" "/tmp/${TARBALL}.sigstore" "/tmp/Python-${PY_VERSION}" "$BUILD_LOG"
|
||||
|
||||
python3 --version
|
||||
pip3 --version
|
||||
@@ -1,38 +0,0 @@
|
||||
#!/bin/sh
|
||||
# Install rekor-cli from GitHub releases with SHA256 verification.
|
||||
# Usage: setup-rekor-cli.sh [version]
|
||||
set -eu
|
||||
|
||||
. "$(dirname "$0")/priv.sh"
|
||||
|
||||
REKOR_VERSION="${1:-1.5.1}"
|
||||
|
||||
ARCH="$(uname -m)"
|
||||
case "$ARCH" in
|
||||
x86_64)
|
||||
BINARY="rekor-cli-linux-amd64"
|
||||
EXPECTED_SHA256="0b4964af85477892c37039fb80793b151864970d19838873eaa1a777ca2fb813"
|
||||
;;
|
||||
aarch64)
|
||||
BINARY="rekor-cli-linux-arm64"
|
||||
EXPECTED_SHA256="6417ea36bea9239125ec21e73c5d9b5e7e837b580cfdfea1e47e04bb02235534"
|
||||
;;
|
||||
*)
|
||||
echo "Unsupported architecture: $ARCH" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
BASE_URL="https://github.com/sigstore/rekor/releases/download/v${REKOR_VERSION}"
|
||||
curl -fsSL "${BASE_URL}/${BINARY}" -o /tmp/rekor-cli
|
||||
|
||||
ACTUAL="$(sha256sum /tmp/rekor-cli | awk '{print $1}')"
|
||||
if [ "$EXPECTED_SHA256" != "$ACTUAL" ]; then
|
||||
echo "SHA256 verification failed for ${BINARY}" >&2
|
||||
rm -f /tmp/rekor-cli
|
||||
exit 1
|
||||
fi
|
||||
|
||||
run_priv install -m 0755 /tmp/rekor-cli /usr/local/bin/rekor-cli
|
||||
rm -f /tmp/rekor-cli
|
||||
rekor-cli version
|
||||
Reference in New Issue
Block a user