forked from heavy-duty/stoke
33079afb33
- publish-deb: keep the token out of the process list (curl -K config file via mktemp, no JSON round-trip through node argv), mktemp the response file with trap cleanup, add --max-time to the upload - build-deb: umask 022 + chmod -R a+rX so the payload is world-readable even when built with umask 077 - install-apt: only fall back to [trusted=yes] on an actual signature verification failure; other apt-get update failures stay fatal - auth logout: warn that a manually supplied token stays active on the server and point at the web UI revocation page - repo import-batch: resolve the source token inside the per-item try so one bad item no longer aborts the whole batch - auth status: print me.login (the /user response has no username field) and exit 1 when not authenticated
108 lines
3.9 KiB
Bash
Executable file
108 lines
3.9 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
#
|
|
# Build a Debian package for stoke.
|
|
#
|
|
# Usage: scripts/build-deb.sh
|
|
#
|
|
# Produces dist/stoke_<version>_all.deb from a clean staging copy of the
|
|
# working tree (only src/, package.json and package-lock.json are shipped;
|
|
# production dependencies are installed fresh with `npm ci --omit=dev`).
|
|
#
|
|
# Requirements: bash, node/npm, dpkg-deb, gzip. Runs lintian when available.
|
|
|
|
set -euo pipefail
|
|
# The payload must be world-readable regardless of the builder's umask
|
|
# (with umask 077, `stoke` would be unreadable for non-root after install).
|
|
umask 022
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
VERSION="$(node -p "require('$ROOT/package.json').version")"
|
|
MAINTAINER="${DEB_MAINTAINER:-Heavy Duty Builders <equipo@lafamilia.so>}"
|
|
HOMEPAGE="https://forgejo.heavyduty.builders/heavy-duty/stoke"
|
|
|
|
STAGE="$(mktemp -d)"
|
|
trap 'rm -rf "$STAGE"' EXIT
|
|
|
|
PKG="$STAGE/stoke_${VERSION}_all"
|
|
LIB="$PKG/usr/lib/stoke"
|
|
DOC="$PKG/usr/share/doc/stoke"
|
|
|
|
install -d "$PKG/DEBIAN" "$LIB" "$PKG/usr/bin" "$DOC"
|
|
|
|
# --- payload -----------------------------------------------------------------
|
|
cp -r "$ROOT/src" "$LIB/src"
|
|
cp "$ROOT/package.json" "$ROOT/package-lock.json" "$LIB/"
|
|
(cd "$LIB" && npm ci --omit=dev --silent --no-audit --no-fund)
|
|
|
|
# Launcher: the CLI has a `#!/usr/bin/env node` shebang and resolves its
|
|
# node_modules relative to its real path, so a symlink is all we need.
|
|
ln -s ../lib/stoke/src/cli.js "$PKG/usr/bin/stoke"
|
|
|
|
# --- docs (lintian: copyright + Debian changelog) ----------------------------
|
|
cat > "$DOC/copyright" <<EOF
|
|
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
|
|
Upstream-Name: stoke
|
|
Source: $HOMEPAGE
|
|
|
|
Files: *
|
|
Copyright: $(date +%Y) Heavy Duty Builders
|
|
License: ISC
|
|
Permission to use, copy, modify, and/or distribute this software for any
|
|
purpose with or without fee is hereby granted, provided that the above
|
|
copyright notice and this permission notice appear in all copies.
|
|
.
|
|
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
|
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
|
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
|
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
|
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
|
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
|
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
|
EOF
|
|
|
|
cat > "$STAGE/changelog" <<EOF
|
|
stoke ($VERSION) stable; urgency=medium
|
|
|
|
* See the repository release page for notes.
|
|
|
|
-- $MAINTAINER $(date -R)
|
|
EOF
|
|
# Native package (no Debian revision in the version), so plain changelog.gz.
|
|
gzip -9n -c "$STAGE/changelog" > "$DOC/changelog.gz"
|
|
|
|
# Normalize permissions regardless of the builder's umask: no group/other
|
|
# write anywhere, everything readable, executable entry point.
|
|
chmod -R go-w "$PKG/usr"
|
|
chmod -R a+rX "$PKG/usr"
|
|
chmod 0755 "$LIB/src/cli.js"
|
|
|
|
# --- control -----------------------------------------------------------------
|
|
INSTALLED_SIZE="$(du -sk --exclude=DEBIAN "$PKG" | cut -f1)"
|
|
cat > "$PKG/DEBIAN/control" <<EOF
|
|
Package: stoke
|
|
Version: $VERSION
|
|
Section: utils
|
|
Priority: optional
|
|
Architecture: all
|
|
Depends: nodejs (>= 22.12)
|
|
Installed-Size: $INSTALLED_SIZE
|
|
Maintainer: $MAINTAINER
|
|
Homepage: $HOMEPAGE
|
|
Description: CLI for the heavy-duty forge (Forgejo)
|
|
stoke manages the Forgejo instance at forgejo.heavyduty.builders from the
|
|
command line: authentication, repositories, issues, pull requests,
|
|
branches, collaborators, organizations, teams and users.
|
|
EOF
|
|
|
|
# --- build -------------------------------------------------------------------
|
|
mkdir -p "$ROOT/dist"
|
|
dpkg-deb --build --root-owner-group "$PKG" "$ROOT/dist/" >/dev/null
|
|
DEB="$ROOT/dist/stoke_${VERSION}_all.deb"
|
|
echo "Built: $DEB"
|
|
|
|
if command -v lintian >/dev/null 2>&1; then
|
|
# binary-without-manpage is a known, accepted gap for now.
|
|
lintian --suppress-tags binary-without-manpage "$DEB" || true
|
|
else
|
|
echo "Note: lintian not installed; skipping package lint."
|
|
fi
|