55 lines
2.6 KiB
Bash
Executable File
55 lines
2.6 KiB
Bash
Executable File
#!/usr/bin/env sh
|
|
set -eu
|
|
|
|
ROOT=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
|
|
OUT=${OUT:-"$ROOT/dist/qiu.subscription-admin.s2plugin"}
|
|
RELEASE_BUILD=${RELEASE_BUILD:-false}
|
|
command -v jq >/dev/null 2>&1 || { printf '%s\n' 'jq is required to build a package' >&2; exit 2; }
|
|
TMP=$(mktemp -d)
|
|
cleanup() {
|
|
rm -rf "$TMP"
|
|
}
|
|
trap cleanup EXIT INT TERM
|
|
|
|
mkdir -p "$TMP/ui" "$(dirname -- "$OUT")"
|
|
cp "$ROOT/ui/index.html" "$ROOT/ui/app.js" "$ROOT/ui/styles.css" "$TMP/ui/"
|
|
|
|
# Recompute declared hashes at package time so a UI change cannot produce an
|
|
# archive that the control plane rejects. The repository descriptor remains
|
|
# the human-readable source contract.
|
|
INDEX_HASH=$(shasum -a 256 "$ROOT/ui/index.html" | awk '{print $1}')
|
|
APP_HASH=$(shasum -a 256 "$ROOT/ui/app.js" | awk '{print $1}')
|
|
STYLES_HASH=$(shasum -a 256 "$ROOT/ui/styles.css" | awk '{print $1}')
|
|
jq --arg index_hash "$INDEX_HASH" --arg app_hash "$APP_HASH" --arg styles_hash "$STYLES_HASH" \
|
|
'.files["ui/index.html"]=$index_hash | .files["ui/app.js"]=$app_hash | .files["ui/styles.css"]=$styles_hash' \
|
|
"$ROOT/business-plugin-manifest.v1.json" > "$TMP/manifest.json"
|
|
|
|
if [ -n "${SIGNATURE_FILE:-}" ]; then
|
|
[ -f "$SIGNATURE_FILE" ] || { printf '%s\n' 'SIGNATURE_FILE does not exist' >&2; exit 2; }
|
|
SIGNATURE_KEY=$(jq -r '.publisher.key_id // empty' "$TMP/manifest.json")
|
|
SIGNATURE_ALGORITHM=$(jq -r '.algorithm // empty' "$SIGNATURE_FILE")
|
|
SIGNATURE_FILE_KEY=$(jq -r '.key_id // empty' "$SIGNATURE_FILE")
|
|
SIGNATURE_VALUE=$(jq -r '.signature // empty' "$SIGNATURE_FILE")
|
|
[ "$SIGNATURE_ALGORITHM" = "ed25519" ] || { printf '%s\n' 'signature.json must use ed25519' >&2; exit 2; }
|
|
[ -n "$SIGNATURE_KEY" ] && [ "$SIGNATURE_FILE_KEY" = "$SIGNATURE_KEY" ] || { printf '%s\n' 'signature key_id does not match manifest publisher' >&2; exit 2; }
|
|
[ -n "$SIGNATURE_VALUE" ] || { printf '%s\n' 'signature value is required' >&2; exit 2; }
|
|
cp "$SIGNATURE_FILE" "$TMP/signature.json"
|
|
elif [ "$RELEASE_BUILD" = "true" ]; then
|
|
printf '%s\n' 'RELEASE_BUILD=true requires SIGNATURE_FILE' >&2
|
|
exit 2
|
|
else
|
|
printf '%s\n' 'warning: building an unsigned development package' >&2
|
|
fi
|
|
|
|
OUT_DIR=$(CDPATH= cd -- "$(dirname -- "$OUT")" && pwd)
|
|
OUT_PATH="$OUT_DIR/$(basename -- "$OUT")"
|
|
find "$TMP" -type f -exec touch -t 198001010000 {} +
|
|
if [ -f "$TMP/signature.json" ]; then
|
|
(cd "$TMP" && zip -X -q -r "$OUT_PATH" manifest.json signature.json ui)
|
|
else
|
|
(cd "$TMP" && zip -X -q -r "$OUT_PATH" manifest.json ui)
|
|
fi
|
|
ARCHIVE_HASH=$(shasum -a 256 "$OUT_PATH" | awk '{print $1}')
|
|
printf '%s %s\n' "$ARCHIVE_HASH" "$(basename -- "$OUT_PATH")" > "$OUT_PATH.sha256"
|
|
printf '%s\n' "$OUT_PATH"
|