feat: publish verifiable proxyctl v1
This commit is contained in:
proxyctl coordinator
Executable
+39
@@ -0,0 +1,39 @@
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
|
||||
repo=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)
|
||||
out=${1:-"$repo/dist"}
|
||||
: "${VERSION:?set VERSION to the release version, for example v1.0.0}"
|
||||
|
||||
case $VERSION in
|
||||
*[!A-Za-z0-9._+-]*|'')
|
||||
echo "VERSION contains unsupported characters: $VERSION" >&2
|
||||
exit 2
|
||||
;;
|
||||
esac
|
||||
|
||||
mkdir -p "$out"
|
||||
out=$(CDPATH= cd -- "$out" && pwd)
|
||||
rm -f "$out/proxyctl-linux-amd64" "$out/proxyctl-linux-arm64" "$out/SHA256SUMS"
|
||||
|
||||
build() {
|
||||
arch=$1
|
||||
output="$out/proxyctl-linux-$arch"
|
||||
(
|
||||
cd "$repo"
|
||||
CGO_ENABLED=0 GOOS=linux GOARCH="$arch" \
|
||||
go build -mod=readonly -buildvcs=false -trimpath \
|
||||
-ldflags="-s -w -X main.version=$VERSION" \
|
||||
-o "$output" ./cmd/proxyctl
|
||||
)
|
||||
}
|
||||
|
||||
umask 022
|
||||
build amd64
|
||||
build arm64
|
||||
(
|
||||
cd "$out"
|
||||
sha256sum proxyctl-linux-amd64 proxyctl-linux-arm64 > SHA256SUMS
|
||||
)
|
||||
|
||||
printf 'built Linux amd64 and arm64 binaries in %s\n' "$out"
|
||||
Executable
+23
@@ -0,0 +1,23 @@
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
|
||||
repo=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)
|
||||
readme="$repo/README.md"
|
||||
|
||||
test -s "$readme"
|
||||
for text in \
|
||||
'## Install' 'go install ./cmd/proxyctl' '## First use and Profiles' \
|
||||
'## Shell integration' 'Shell' 'APT' 'Docker daemon' \
|
||||
'Docker containers/builds' 'GNOME' '## Target states' 'Enabled' \
|
||||
'Disabled' 'External' 'Drifted' '## Permissions, sudo, and restarts' \
|
||||
'proxyctl doctor' 'proxyctl reset' 'proxyctl shell uninstall' \
|
||||
'no telemetry' 'automatic update checks' 'proxy-connectivity tests' \
|
||||
'does **not** manage or supervise proxy processes' 'Support is limited'
|
||||
do
|
||||
grep -Fq "$text" "$readme" || {
|
||||
echo "README is missing required documentation: $text" >&2
|
||||
exit 1
|
||||
}
|
||||
done
|
||||
|
||||
printf 'README documentation contract passed\n'
|
||||
Executable
+43
@@ -0,0 +1,43 @@
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
|
||||
repo=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)
|
||||
work=$(mktemp -d)
|
||||
trap 'rm -rf "$work"' EXIT HUP INT TERM
|
||||
|
||||
snapshot() {
|
||||
for path in \
|
||||
"$HOME/.bashrc" "$HOME/.zshrc" "$HOME/.docker/config.json" \
|
||||
/etc/apt/apt.conf.d /etc/docker/daemon.json /var/lib/proxyctl \
|
||||
/etc/systemd/system/docker.service.d
|
||||
do
|
||||
if [ -d "$path" ]; then
|
||||
find "$path" -type f -print0 2>/dev/null | sort -z | xargs -0 -r sha256sum 2>/dev/null || ls -ld "$path"
|
||||
elif [ -r "$path" ]; then
|
||||
sha256sum "$path"
|
||||
elif [ -e "$path" ]; then
|
||||
ls -ld "$path"
|
||||
else
|
||||
printf 'absent %s\n' "$path"
|
||||
fi
|
||||
done
|
||||
if command -v gsettings >/dev/null 2>&1; then
|
||||
gsettings list-recursively org.gnome.system.proxy 2>&1 || true
|
||||
else
|
||||
printf 'gsettings absent\n'
|
||||
fi
|
||||
if command -v systemctl >/dev/null 2>&1; then
|
||||
systemctl show docker.service -p ActiveState -p SubState -p NRestarts -p ExecMainStartTimestampMonotonic 2>&1 || true
|
||||
else
|
||||
printf 'systemctl absent\n'
|
||||
fi
|
||||
}
|
||||
|
||||
snapshot >"$work/before"
|
||||
(
|
||||
cd "$repo"
|
||||
go test ./...
|
||||
)
|
||||
snapshot >"$work/after"
|
||||
cmp "$work/before" "$work/after"
|
||||
printf 'full Go suite passed without changing host Shell, APT, Docker, GNOME, or system-service state\n'
|
||||
Executable
+33
@@ -0,0 +1,33 @@
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
|
||||
repo=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)
|
||||
work=$(mktemp -d)
|
||||
trap 'rm -rf "$work"' EXIT HUP INT TERM
|
||||
|
||||
VERSION=v1.0.0 "$repo/scripts/build-release.sh" "$work/first"
|
||||
VERSION=v1.0.0 "$repo/scripts/build-release.sh" "$work/second"
|
||||
|
||||
for arch in amd64 arm64; do
|
||||
binary="proxyctl-linux-$arch"
|
||||
test -x "$work/first/$binary"
|
||||
cmp "$work/first/$binary" "$work/second/$binary"
|
||||
done
|
||||
cmp "$work/first/SHA256SUMS" "$work/second/SHA256SUMS"
|
||||
(
|
||||
cd "$work/first"
|
||||
sha256sum -c SHA256SUMS
|
||||
)
|
||||
|
||||
amd64_format=$(file -b "$work/first/proxyctl-linux-amd64")
|
||||
arm64_format=$(file -b "$work/first/proxyctl-linux-arm64")
|
||||
printf '%s\n' "$amd64_format" | grep -Eq 'ELF 64-bit.*(x86-64|x86_64)'
|
||||
printf '%s\n' "$arm64_format" | grep -Eq 'ELF 64-bit.*(ARM aarch64|aarch64)'
|
||||
|
||||
# Only execute the binary matching the build host; format checks cover both.
|
||||
case $(go env GOARCH) in
|
||||
amd64) test "$($work/first/proxyctl-linux-amd64 version --short)" = v1.0.0 ;;
|
||||
arm64) test "$($work/first/proxyctl-linux-arm64 version --short)" = v1.0.0 ;;
|
||||
esac
|
||||
|
||||
printf 'amd64: %s\narm64: %s\nrelease automation is reproducible and checksums verify\n' "$amd64_format" "$arm64_format"
|
||||
Executable
+74
@@ -0,0 +1,74 @@
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
|
||||
repo=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)
|
||||
work=$(mktemp -d)
|
||||
trap 'rm -rf "$work"' EXIT HUP INT TERM
|
||||
home="$work/home"
|
||||
config="$work/config"
|
||||
state="$work/state"
|
||||
bin="$work/bin"
|
||||
mkdir -p "$home" "$config" "$state" "$bin"
|
||||
|
||||
snapshot_host() {
|
||||
for path in \
|
||||
"$HOME/.bashrc" "$HOME/.zshrc" "$HOME/.docker/config.json" \
|
||||
/etc/apt/apt.conf.d/99proxyctl /etc/docker/daemon.json \
|
||||
/var/lib/proxyctl/docker-daemon.json
|
||||
do
|
||||
if [ -r "$path" ]; then
|
||||
sha256sum "$path"
|
||||
elif [ -e "$path" ]; then
|
||||
ls -ld "$path"
|
||||
else
|
||||
printf 'absent %s\n' "$path"
|
||||
fi
|
||||
done
|
||||
if command -v gsettings >/dev/null 2>&1; then
|
||||
gsettings get org.gnome.system.proxy mode 2>&1 || true
|
||||
else
|
||||
printf 'gsettings absent\n'
|
||||
fi
|
||||
}
|
||||
|
||||
snapshot_host >"$work/host-before"
|
||||
|
||||
(
|
||||
cd "$repo"
|
||||
GOFLAGS='-mod=readonly' GOBIN="$bin" go install ./cmd/proxyctl
|
||||
)
|
||||
test "$("$bin/proxyctl" version --short)" != ""
|
||||
mv "$bin/proxyctl" "$bin/proxyctl-production"
|
||||
(
|
||||
cd "$repo"
|
||||
GOFLAGS='-mod=readonly -tags=proxyctl_process_test' GOBIN="$bin" go install ./cmd/proxyctl
|
||||
go test ./internal/app -run 'TestUserCanCreateAndActivatePersistentSingleProxyProfile|TestApplicationCoordinatesMultipleRealAndFakeHermeticAdaptersThroughPartialFailure' -count=1
|
||||
)
|
||||
|
||||
env_run() {
|
||||
env -i \
|
||||
PATH="$PATH" HOME="$home" XDG_CONFIG_HOME="$config" XDG_STATE_HOME="$state" \
|
||||
SHELL=/bin/bash PROXYCTL_PROCESS_TEST_HOME="$home" \
|
||||
"$bin/proxyctl" "$@"
|
||||
}
|
||||
|
||||
test "$(env_run version --short)" != ""
|
||||
doctor_output=$(env_run doctor 2>&1 || true)
|
||||
printf '%s\n' "$doctor_output" | grep -q 'Profile validity'
|
||||
printf 'no\n' | env_run reset | grep -q 'Reset cancelled'
|
||||
printf 'yes\n' | env_run reset | grep -q 'shell: skipped (Disabled)'
|
||||
env_run shell install | grep -q 'installed'
|
||||
grep -q 'proxyctl shell integration' "$home/.bashrc"
|
||||
env_run shell uninstall | grep -q 'uninstalled'
|
||||
if grep -q 'proxyctl shell integration' "$home/.bashrc"; then
|
||||
echo 'Shell integration remained after uninstall' >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
rm "$bin/proxyctl" "$bin/proxyctl-production"
|
||||
test ! -e "$bin/proxyctl"
|
||||
test ! -e "$bin/proxyctl-production"
|
||||
snapshot_host >"$work/host-after"
|
||||
cmp "$work/host-before" "$work/host-after"
|
||||
|
||||
printf 'clean-machine verification passed: go install, Profile workflow, hermetic Target workflow, doctor, reset cancellation/confirmation, Shell install/uninstall, binary removal, and unchanged host state\n'
|
||||
Reference in New Issue
Block a user