Repository navigation
feat(release): publish signed archives for Linux, macOS and Windows with install scripts - #4
Merged
Merged
Conversation
…ith install scripts The v* tag runs the gate on all three systems before anything is published, builds syspi-<os>-<arch>.tar.gz (.zip on Windows) for amd64 and arm64 with LICENSE inside, signs SHA256SUMS.txt with cosign keyless (identity: release.yml on the tag) and creates the release with the CHANGELOG.md section as its notes; install.sh and install.ps1 install a release after checking the archive against the manifest and the binary against the tag. scripts/install-test.sh runs both installers against a fake release served locally; CI runs it on ubuntu, macos and windows. scripts/changelog.py folds the fragments at release time; the fragments are rewritten to describe what 0.1.0 ships. Co-Authored-By: jason.han <hanhuijun@gmail.com>
Contributor
Author
|
I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".
|
…outs scripts/release-archive (archive/tar, archive/zip) replaces GNU tar and zip, which the Windows runner's bash lacks and macOS has only through brew, and makes the archives byte-identical across hosts for one SOURCE_DATE_EPOCH. .gitattributes pins LF so gofmt passes on the Windows gate; ci.yml moves to the Node 24 checkout/setup-go pins release.yml uses. Co-Authored-By: jason.han <hanhuijun@gmail.com>
Get-Content of a one-line file is a string on Windows PowerShell, so [0] was its first character. Co-Authored-By: jason.han <hanhuijun@gmail.com>
MSYS sha256sum defaults to binary mode and marks names with '*', which the installer tests on Windows did not match; the script now asserts the six '<sha256> <archive>' lines. Co-Authored-By: jason.han <hanhuijun@gmail.com>
GitHub's pwsh step hands back the exit code of the last native command, which is an installer expected to fail. Co-Authored-By: jason.han <hanhuijun@gmail.com>
develop now installs mercurial and subversion on the Windows runner and requires them; the release gate mirrors that instead of letting their tests skip. Co-Authored-By: jason.han <hanhuijun@gmail.com>
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
…releases; -VerifySignature on Windows The publish job's identity check looked for install.sh after cd dist, so no release would have been created. The tag check allowed v1.2.3-rc.1 while the signing identity regexp did not; both installers now accept the prerelease suffix. install.sh no longer lets head's status hide a failing 'syspi version'. install.ps1 gains -VerifySignature (cosign, same issuer and identity as install.sh), both suites cover asking for a signature the release lacks, and the README states what the checksum does and does not defend against. Co-Authored-By: jason.han <hanhuijun@gmail.com>
Co-Authored-By: jason.han <hanhuijun@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Gives SysPI the same binary line as OpenSysML, GitHub Actions only, so that package signing is in place from the first release.
release.yml(tagv*):gate(ubuntu, macos, windows: build, vet, gofmt, tidy, tests) →publish→validate-install. Nothing is published from a red tree.publishrunsscripts/build-release-artifacts.sh <tag>, which cross-builds six static archives (CGO_ENABLED=0 -trimpath -ldflags "-s -w -X main.Version=<tag>"), checks every binary carries the tag, and writesSHA256SUMS.txt:The manifest is signed keyless with
cosign sign-blob(OIDC identity…/.github/workflows/release.yml@refs/tags/vX.Y.Z), verified in-job against the same regexpinstall.sh --verify-signatureuses, thengh release create --verify-tagwith notes taken from the tag'sCHANGELOG.mdsection.validate-installthen runs the published one-liners on all three systems.Installers
install.sh/install.ps1at the repo root (curl … | sh,irm … | iex):--version <tag>|latest,--prefix/--bin-dir(-InstallDir),--os/--arch,--base-url,--verify-signature(sh),--dry-run,SYSPI_*env twins.latestresolves through the/releases/latestredirect and falls back to/latest/downloadfor mirrors. The manifest is fetched before the archive, the archive digest is checked before anything is written, the install is atomic, and the binary is run once (syspi version) and must report the tag; a foreign--os/--archis staged, not run.Tests:
scripts/install-test.shbuilds real fake releases with the build script, serves them withscripts/install-test-server.py, and drives both installers through 20 bash cases and 15 PowerShell cases (tag/latest/mirror/dry-run/foreign platform, tampered archive, conflicting digests, binary reporting another version, missing asset, unknown release, bad inputs, unwritable prefix).ci.ymlruns it on ubuntu, macos and windows (install-scriptsjob), adds windows to the Go gate, validates fragments (changelog-fragmentsjob), and pins actions to commit SHAs.Changelog:
scripts/changelog.py check | release x.y.z | release-notes x.y.zfoldschanges/unreleased/intoCHANGELOG.mdon the release branch (OpenSysML style; noCHANGELOG.mdis created here). The stale fragments that describedindex emit/pkg:sysandand then removed them are rewritten into what 0.1.0 actually ships. README gains the install section; CONTRIBUTING documents the release procedure (release/x.y.z→ develop →main→ tag).Not included, can follow as separate jobs: Authenticode/MSI for the Windows exe, Homebrew/Scoop/winget, nightly channel, SBOM/SLSA.
Verified locally: reproducible archives (two builds with the same
SOURCE_DATE_EPOCH→ identicalSHA256SUMS.txt),scripts/install-test.shall 35 cases passing, shellcheck and PSScriptAnalyzer clean. The tag workflow itself has not run yet: it needsmainandv0.1.0.