288 lines
8.3 KiB
Bash
Executable File
288 lines
8.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# One-command Redline release: bump Info.plist, commit, signed build, zip,
|
|
# DMG, appcast, upload to mmd01, verify the public URLs.
|
|
# Hidden flag: --test — upload under .../redline/test/ and skip the git commit.
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "${ROOT}"
|
|
|
|
PLIST="${ROOT}/Info.plist"
|
|
PLISTBUDDY="/usr/libexec/PlistBuddy"
|
|
REMOTE_HOST="mmd01"
|
|
REMOTE_BASE="/opt/mmd-installer-content/cowork/redline"
|
|
PUBLIC_BASE="https://get.baobab-ts.com/cowork/redline"
|
|
SIGN_IDENTITY="Apple Development: ben@flow-master.ai (QH2H9G2LK5)"
|
|
|
|
usage() {
|
|
echo "Usage: $0 <version> [\"notes\"]" >&2
|
|
exit 1
|
|
}
|
|
|
|
TEST_MODE=0
|
|
VERSION=""
|
|
NOTES=""
|
|
NOTES_SET=0
|
|
for arg in "$@"; do
|
|
case "${arg}" in
|
|
--test)
|
|
TEST_MODE=1
|
|
;;
|
|
--help|-h)
|
|
usage
|
|
;;
|
|
--*)
|
|
echo "Unknown argument: ${arg}" >&2
|
|
usage
|
|
;;
|
|
*)
|
|
if [[ -z "${VERSION}" ]]; then
|
|
VERSION="${arg}"
|
|
elif [[ "${NOTES_SET}" -eq 0 ]]; then
|
|
NOTES="${arg}"
|
|
NOTES_SET=1
|
|
else
|
|
echo "Unexpected extra argument: ${arg}" >&2
|
|
usage
|
|
fi
|
|
;;
|
|
esac
|
|
done
|
|
|
|
if [[ -z "${VERSION}" ]]; then
|
|
usage
|
|
fi
|
|
|
|
if [[ ! "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+([+-][A-Za-z0-9.-]+)*$ ]]; then
|
|
echo "Version '${VERSION}' is not a semver (e.g. 1.2.3 or 0.0.0-test)." >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ "${VERSION}" == *'/'* || "${VERSION}" == *'..'* ]]; then
|
|
echo "Version contains illegal path characters: ${VERSION}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ "${TEST_MODE}" -eq 1 ]]; then
|
|
REMOTE_DIR="${REMOTE_BASE}/test"
|
|
PUBLIC_DIR="${PUBLIC_BASE}/test"
|
|
else
|
|
REMOTE_DIR="${REMOTE_BASE}"
|
|
PUBLIC_DIR="${PUBLIC_BASE}"
|
|
fi
|
|
|
|
ZIP_NAME="Redline-${VERSION}.zip"
|
|
DMG_NAME="Redline-${VERSION}.dmg"
|
|
ZIP_PATH="${ROOT}/.build/${ZIP_NAME}"
|
|
DMG_PATH="${ROOT}/.build/Redline.dmg"
|
|
APPCAST_PATH="${ROOT}/.build/appcast.json"
|
|
ZIP_URL="${PUBLIC_DIR}/${ZIP_NAME}"
|
|
APPCAST_URL="${PUBLIC_DIR}/appcast.json"
|
|
|
|
if [[ "${TEST_MODE}" -eq 1 ]]; then
|
|
echo "==> Publish Redline ${VERSION} (test)"
|
|
else
|
|
echo "==> Publish Redline ${VERSION}"
|
|
fi
|
|
echo " remote: ${REMOTE_HOST}:${REMOTE_DIR}/"
|
|
echo " public: ${PUBLIC_DIR}/"
|
|
|
|
if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
|
|
echo "Not inside a git work tree." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Tracked files must match HEAD. Untracked files are ignored so this script
|
|
# can be dry-run (--test) before it is itself committed.
|
|
if [[ -n "$(git status --porcelain -uno)" ]]; then
|
|
echo "git tree is not clean; commit or stash before publishing." >&2
|
|
git status --porcelain -uno >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ ! -x "${PLISTBUDDY}" ]]; then
|
|
echo "PlistBuddy not found at ${PLISTBUDDY}" >&2
|
|
exit 1
|
|
fi
|
|
if [[ ! -f "${PLIST}" ]]; then
|
|
echo "Info.plist not found at ${PLIST}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
restore_plist() {
|
|
git checkout -- "${PLIST}" >/dev/null 2>&1 || true
|
|
}
|
|
|
|
if [[ "${TEST_MODE}" -eq 1 ]]; then
|
|
trap restore_plist EXIT
|
|
fi
|
|
|
|
CURRENT_BUILD="$("${PLISTBUDDY}" -c 'Print :CFBundleVersion' "${PLIST}")"
|
|
if [[ ! "${CURRENT_BUILD}" =~ ^[0-9]+$ ]]; then
|
|
echo "CFBundleVersion is not an integer: ${CURRENT_BUILD}" >&2
|
|
exit 1
|
|
fi
|
|
NEW_BUILD=$((CURRENT_BUILD + 1))
|
|
|
|
echo "==> Bumping Info.plist"
|
|
echo " CFBundleShortVersionString -> ${VERSION}"
|
|
echo " CFBundleVersion ${CURRENT_BUILD} -> ${NEW_BUILD}"
|
|
"${PLISTBUDDY}" -c "Set :CFBundleShortVersionString ${VERSION}" "${PLIST}"
|
|
"${PLISTBUDDY}" -c "Set :CFBundleVersion ${NEW_BUILD}" "${PLIST}"
|
|
|
|
if [[ "${TEST_MODE}" -eq 0 ]]; then
|
|
echo "==> Committing version bump on $(git rev-parse --abbrev-ref HEAD)"
|
|
git add "${PLIST}"
|
|
git commit -m "release: v${VERSION}"
|
|
else
|
|
echo "==> --test: skipping git commit of version bump"
|
|
fi
|
|
|
|
# Restricted HOMEs (agent sandboxes) hide the login keychain from codesign.
|
|
# Re-run signed steps with the account's real home when the identity is missing.
|
|
signing_home() {
|
|
if security find-identity -v -p codesigning 2>/dev/null | grep -Fq "${SIGN_IDENTITY}"; then
|
|
echo "${HOME}"
|
|
return
|
|
fi
|
|
local rh
|
|
rh="$(dscl . -read "/Users/$(id -un)" NFSHomeDirectory 2>/dev/null | awk '{print $2}')"
|
|
if [[ -n "${rh}" && -d "${rh}" ]]; then
|
|
echo "${rh}"
|
|
else
|
|
echo "${HOME}"
|
|
fi
|
|
}
|
|
|
|
run_signed() {
|
|
local sign_home
|
|
sign_home="$(signing_home)"
|
|
if [[ "${sign_home}" != "${HOME}" ]]; then
|
|
echo "==> Using HOME=${sign_home} so codesign can see the login keychain"
|
|
fi
|
|
HOME="${sign_home}" "$@"
|
|
}
|
|
|
|
echo "==> Building signed Redline.app"
|
|
run_signed ./scripts/build-app.sh
|
|
|
|
if [[ ! -d "${ROOT}/.build/Redline.app" ]]; then
|
|
echo "Signed app missing at ${ROOT}/.build/Redline.app" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "==> Zipping Redline.app -> ${ZIP_PATH}"
|
|
mkdir -p "${ROOT}/.build"
|
|
(
|
|
cd "${ROOT}/.build"
|
|
rm -f "${ZIP_NAME}"
|
|
ditto -c -k --keepParent Redline.app "${ZIP_NAME}"
|
|
)
|
|
|
|
if [[ ! -s "${ZIP_PATH}" ]]; then
|
|
echo "Zip was not created at ${ZIP_PATH}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "==> Building manual installer DMG"
|
|
run_signed ./scripts/make-dmg.sh
|
|
|
|
if [[ ! -s "${DMG_PATH}" ]]; then
|
|
echo "DMG was not created at ${DMG_PATH}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
SHA256="$(shasum -a 256 "${ZIP_PATH}" | awk '{print $1}')"
|
|
ZIP_BYTES="$(stat -f%z "${ZIP_PATH}")"
|
|
PUBDATE="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
|
|
|
|
echo "==> Zip SHA256: ${SHA256}"
|
|
echo " Zip bytes: ${ZIP_BYTES}"
|
|
|
|
echo "==> Writing ${APPCAST_PATH}"
|
|
python3 - "${VERSION}" "${ZIP_URL}" "${SHA256}" "${NOTES}" "${PUBDATE}" "${APPCAST_PATH}" <<'PY'
|
|
import json
|
|
import sys
|
|
|
|
version, zip_url, sha256, notes, pub_date, out_path = sys.argv[1:]
|
|
payload = {
|
|
"version": version,
|
|
"zipURL": zip_url,
|
|
"sha256": sha256,
|
|
"notes": notes,
|
|
"pubDate": pub_date,
|
|
}
|
|
with open(out_path, "w", encoding="utf-8") as fh:
|
|
json.dump(payload, fh, indent=2)
|
|
fh.write("\n")
|
|
PY
|
|
|
|
echo "==> Uploading to ${REMOTE_HOST}:${REMOTE_DIR}/"
|
|
ssh -o BatchMode=yes "${REMOTE_HOST}" "mkdir -p '${REMOTE_DIR}'"
|
|
rsync -e "ssh -o BatchMode=yes" -av "${ZIP_PATH}" "${REMOTE_HOST}:${REMOTE_DIR}/${ZIP_NAME}"
|
|
rsync -e "ssh -o BatchMode=yes" -av "${DMG_PATH}" "${REMOTE_HOST}:${REMOTE_DIR}/Redline.dmg"
|
|
rsync -e "ssh -o BatchMode=yes" -av "${DMG_PATH}" "${REMOTE_HOST}:${REMOTE_DIR}/${DMG_NAME}"
|
|
rsync -e "ssh -o BatchMode=yes" -av "${APPCAST_PATH}" "${REMOTE_HOST}:${REMOTE_DIR}/appcast.json"
|
|
ssh -o BatchMode=yes "${REMOTE_HOST}" \
|
|
"chmod 644 \
|
|
'${REMOTE_DIR}/${ZIP_NAME}' \
|
|
'${REMOTE_DIR}/Redline.dmg' \
|
|
'${REMOTE_DIR}/${DMG_NAME}' \
|
|
'${REMOTE_DIR}/appcast.json'"
|
|
|
|
echo "==> Verifying public appcast ${APPCAST_URL}"
|
|
APPCAST_BODY=""
|
|
ok=0
|
|
attempt=1
|
|
while [[ "${attempt}" -le 15 ]]; do
|
|
if APPCAST_BODY="$(curl -fsS "${APPCAST_URL}")"; then
|
|
echo "${APPCAST_BODY}"
|
|
if grep -F -q "${VERSION}" <<<"${APPCAST_BODY}"; then
|
|
echo "OK: appcast contains ${VERSION}"
|
|
ok=1
|
|
break
|
|
fi
|
|
echo "appcast fetched but does not contain '${VERSION}' (attempt ${attempt})" >&2
|
|
else
|
|
echo "appcast fetch failed (attempt ${attempt})" >&2
|
|
fi
|
|
attempt=$((attempt + 1))
|
|
sleep 2
|
|
done
|
|
if [[ "${ok}" -ne 1 ]]; then
|
|
echo "Public appcast verification failed for ${APPCAST_URL}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "==> Verifying public zip HEAD ${ZIP_URL}"
|
|
ok=0
|
|
attempt=1
|
|
HEAD_OUT=""
|
|
while [[ "${attempt}" -le 15 ]]; do
|
|
HEAD_OUT="$(curl -sS -D - -o /dev/null -I "${ZIP_URL}" || true)"
|
|
echo "${HEAD_OUT}"
|
|
HTTP_CODE="$(awk 'BEGIN{c=""} toupper($1) ~ /^HTTP\//{c=$2} END{print c}' <<<"${HEAD_OUT}" | tr -d '\r')"
|
|
CONTENT_LENGTH="$(awk 'tolower($1)=="content-length:" {gsub("\r","",$2); print $2}' <<<"${HEAD_OUT}" | tail -n 1)"
|
|
if [[ "${HTTP_CODE}" == "200" && "${CONTENT_LENGTH}" == "${ZIP_BYTES}" ]]; then
|
|
echo "OK: zip HTTP ${HTTP_CODE}, Content-Length ${CONTENT_LENGTH} matches local ${ZIP_BYTES}"
|
|
ok=1
|
|
break
|
|
fi
|
|
echo "zip HEAD mismatch (attempt ${attempt}): HTTP '${HTTP_CODE}', Content-Length '${CONTENT_LENGTH}', local '${ZIP_BYTES}'" >&2
|
|
attempt=$((attempt + 1))
|
|
sleep 2
|
|
done
|
|
if [[ "${ok}" -ne 1 ]]; then
|
|
echo "Public zip verification failed for ${ZIP_URL}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo
|
|
echo "Published v${VERSION}"
|
|
echo " appcast: ${APPCAST_URL}"
|
|
echo " zip: ${ZIP_URL}"
|
|
echo " sha256: ${SHA256}"
|
|
echo " dmg: ${PUBLIC_DIR}/${DMG_NAME}"
|
|
echo " dmg: ${PUBLIC_DIR}/Redline.dmg"
|