87 lines
2.8 KiB
Shell
87 lines
2.8 KiB
Shell
|
#!/usr/bin/env bash
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
readonly HLCC_VERSION="16.0.1"
|
||
|
|
readonly RELAY_ROOT="/home/ubuntu/guanghu/release-relay/hlcc-v${HLCC_VERSION}"
|
||
|
|
readonly BINARY_NAME="forgejo-${HLCC_VERSION}-linux-amd64"
|
||
|
|
readonly RELEASE_URL="https://code.forgejo.org/forgejo/forgejo/releases/download/v${HLCC_VERSION}/${BINARY_NAME}"
|
||
|
|
readonly RELEASE_KEY="EB114F5E6C0DC2BCDD183550A4B61A2DC5923710"
|
||
|
|
readonly GPG_HOME="${RELAY_ROOT}/gpg"
|
||
|
|
readonly UPSTREAM_REPOSITORY="/home/ubuntu/guanghu/upstream-parts/forgejo-official.git"
|
||
|
|
readonly PRODUCT_REPOSITORY="/home/ubuntu/guanghu/products/guanghu-code-channel"
|
||
|
|
|
||
|
|
if [[ "$(id -un)" != "ubuntu" ]]; then
|
||
|
|
echo "Refusing to prepare overseas release material as any user other than ubuntu." >&2
|
||
|
|
exit 2
|
||
|
|
fi
|
||
|
|
|
||
|
|
for command_name in curl git gpg sha256sum; do
|
||
|
|
if ! command -v "${command_name}" >/dev/null 2>&1; then
|
||
|
|
echo "Missing required command: ${command_name}" >&2
|
||
|
|
exit 3
|
||
|
|
fi
|
||
|
|
done
|
||
|
|
|
||
|
|
if [[ ! -d "${UPSTREAM_REPOSITORY}" || ! -d "${PRODUCT_REPOSITORY}/.git" ]]; then
|
||
|
|
echo "Required Forgejo upstream mirror or Guanghu product worktree is missing." >&2
|
||
|
|
exit 3
|
||
|
|
fi
|
||
|
|
|
||
|
|
umask 077
|
||
|
|
mkdir -p "${RELAY_ROOT}" "${GPG_HOME}"
|
||
|
|
chmod 700 "${GPG_HOME}"
|
||
|
|
|
||
|
|
curl --fail --location --proto '=https' --tlsv1.2 \
|
||
|
|
--output "${RELAY_ROOT}/${BINARY_NAME}" \
|
||
|
|
"${RELEASE_URL}"
|
||
|
|
curl --fail --location --proto '=https' --tlsv1.2 \
|
||
|
|
--output "${RELAY_ROOT}/${BINARY_NAME}.asc" \
|
||
|
|
"${RELEASE_URL}.asc"
|
||
|
|
|
||
|
|
GNUPGHOME="${GPG_HOME}" gpg \
|
||
|
|
--batch \
|
||
|
|
--keyserver hkps://keys.openpgp.org \
|
||
|
|
--recv-keys "${RELEASE_KEY}"
|
||
|
|
|
||
|
|
if ! GNUPGHOME="${GPG_HOME}" gpg \
|
||
|
|
--batch \
|
||
|
|
--with-colons \
|
||
|
|
--fingerprint "${RELEASE_KEY}" \
|
||
|
|
| grep -Fq "fpr:::::::::${RELEASE_KEY}:"; then
|
||
|
|
echo "Forgejo release key fingerprint mismatch." >&2
|
||
|
|
exit 4
|
||
|
|
fi
|
||
|
|
|
||
|
|
GNUPGHOME="${GPG_HOME}" gpg \
|
||
|
|
--batch \
|
||
|
|
--verify "${RELAY_ROOT}/${BINARY_NAME}.asc" "${RELAY_ROOT}/${BINARY_NAME}"
|
||
|
|
GNUPGHOME="${GPG_HOME}" gpg \
|
||
|
|
--batch \
|
||
|
|
--armor \
|
||
|
|
--export "${RELEASE_KEY}" > "${RELAY_ROOT}/forgejo-release-key.asc"
|
||
|
|
|
||
|
|
git -C "${UPSTREAM_REPOSITORY}" bundle create \
|
||
|
|
"${RELAY_ROOT}/forgejo-upstream-all.bundle" \
|
||
|
|
--all
|
||
|
|
git -C "${PRODUCT_REPOSITORY}" bundle create \
|
||
|
|
"${RELAY_ROOT}/guanghu-code-channel.bundle" \
|
||
|
|
guanghu/main
|
||
|
|
git -C "${UPSTREAM_REPOSITORY}" bundle verify \
|
||
|
|
"${RELAY_ROOT}/forgejo-upstream-all.bundle"
|
||
|
|
git -C "${PRODUCT_REPOSITORY}" bundle verify \
|
||
|
|
"${RELAY_ROOT}/guanghu-code-channel.bundle"
|
||
|
|
|
||
|
|
(
|
||
|
|
cd "${RELAY_ROOT}"
|
||
|
|
sha256sum \
|
||
|
|
"${BINARY_NAME}" \
|
||
|
|
"${BINARY_NAME}.asc" \
|
||
|
|
forgejo-release-key.asc \
|
||
|
|
forgejo-upstream-all.bundle \
|
||
|
|
guanghu-code-channel.bundle \
|
||
|
|
> MANIFEST.sha256
|
||
|
|
)
|
||
|
|
|
||
|
|
echo "Verified HLCC release material prepared at ${RELAY_ROOT}"
|
||
|
|
echo "The offline package contains full upstream and Guanghu product Git bundles."
|
||
|
|
echo "No service was started and no transfer to a domestic node was attempted."
|