jcoffey-dev
1332ade130
scripts/build-release.sh builds reproducible linux/amd64 and linux/arm64 archives with SHA256SUMS; the release workflow runs it on a v* tag after vet, tests and govulncheck, and publishes the release. The README now covers what the tool is, what it does step by step, why each decision is made, how to deploy and run a mail host, the security model, and troubleshooting. -h exits 0.
41 lines
1.5 KiB
Bash
Executable File
41 lines
1.5 KiB
Bash
Executable File
#!/bin/bash
|
|
# SPDX-FileCopyrightText: 2026 Coffey Labs
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
#
|
|
# Build the release archives: one per architecture, plus SHA256SUMS.
|
|
#
|
|
# Usage: scripts/build-release.sh VERSION [OUTDIR]
|
|
# scripts/build-release.sh v2026.9.13 dist
|
|
#
|
|
# The release workflow runs exactly this, so a release can be reproduced -- or
|
|
# checked before tagging -- on any machine with Go. Archive names carry no
|
|
# version, so .../releases/latest/download/<name> always means the newest.
|
|
set -euo pipefail
|
|
|
|
VERSION="${1:?usage: $0 VERSION [OUTDIR]}"
|
|
OUT="${2:-dist}"
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
|
|
rm -rf "$OUT" && mkdir -p "$OUT"
|
|
OUT="$(cd "$OUT" && pwd)"
|
|
STAGE="$(mktemp -d)"
|
|
trap 'rm -rf "$STAGE"' EXIT
|
|
|
|
# Linux only: the tool drives Docker on the host it runs on, and deploys a mail
|
|
# server that publishes ports there.
|
|
for arch in amd64 arm64; do
|
|
name="ihasmail-oneshot-linux-$arch"
|
|
mkdir -p "$STAGE/$name"
|
|
echo "==> building $name ($VERSION)"
|
|
(cd "$ROOT" && CGO_ENABLED=0 GOOS=linux GOARCH="$arch" go build -trimpath \
|
|
-ldflags "-s -w -X main.version=$VERSION" -o "$STAGE/$name/ihasmail-oneshot" ./cmd/ihasmail-oneshot)
|
|
cp "$ROOT/LICENSE" "$ROOT/README.md" "$STAGE/$name/"
|
|
# Fixed owner and time, so the same commit gives the same archive.
|
|
tar --sort=name --owner=0 --group=0 --numeric-owner --mtime="@${SOURCE_DATE_EPOCH:-0}" \
|
|
-C "$STAGE/$name" -czf "$OUT/$name.tar.gz" ihasmail-oneshot LICENSE README.md
|
|
done
|
|
|
|
(cd "$OUT" && sha256sum ./*.tar.gz | sed 's| \./| |' > SHA256SUMS)
|
|
echo "==> $OUT:"
|
|
(cd "$OUT" && cat SHA256SUMS)
|