publish.sh RawHistoryFolder

1#!/usr/bin/env bash
2# Builds an AUR package with makepkg, then pushes its PKGBUILD and .SRCINFO.
3# makepkg downloads every source and checks its sha256sum, so a PKGBUILD that
4# does not build, or does not match its release assets, is never published.
5#
6# Usage: publish.sh <pkgname> <PKGBUILD>
7# Env:   AUR_SSH_PRIVATE_KEY, AUR_USERNAME, AUR_EMAIL
8#        DRY_RUN=1 builds and prints the files without pushing.
9# Runs as a non-root user that may run pacman through sudo (makepkg -s).
10set -euo pipefail
11CARCH=$(uname -m)
12
13pkgname=$1
14work=$(mktemp -d)
15trap 'rm -rf "$work"' EXIT
16cp "$2" "$work/PKGBUILD"
17cd "$work"
18
19makepkg --syncdeps --force --noconfirm
20# A -git pkgver() rewrites pkgver in PKGBUILD; .SRCINFO must match it.
21makepkg --printsrcinfo >.SRCINFO
22pkgver=$(sed -n 's/^\tpkgver = //p' .SRCINFO)
23
24# makepkg only fetches the sources of this machine's arch: check the others too.
25while read -r arch; do
26	if [[ $arch == "$CARCH" ]] || ! grep -q "^source_$arch=" PKGBUILD; then
27		continue
28	fi
29	{ cat /etc/makepkg.conf; echo "CARCH=$arch"; } >"makepkg-$arch.conf"
30	makepkg --config "makepkg-$arch.conf" --verifysource --noconfirm
31done < <(sed -n 's/^\tarch = //p' .SRCINFO)
32
33# pacman versions use _ where the tag has - (0.2.0-rc1 -> 0.2.0_rc1).
34got=$("pkg/$pkgname/usr/bin/neferafk" version)
35if [[ $got != "$pkgver" && $got != "${pkgver//_/-}" ]]; then
36	echo "packaged neferafk reports version $got, want $pkgver" >&2
37	exit 1
38fi
39
40if [[ ${DRY_RUN:-} == 1 ]]; then
41	cat PKGBUILD .SRCINFO
42	exit 0
43fi
44
45ssh_dir=$HOME/.ssh
46key=$ssh_dir/aur
47install -d -m 700 "$ssh_dir"
48(umask 077 && printf '%s\n' "$AUR_SSH_PRIVATE_KEY" >"$key")
49# Pinned host key. Fingerprint SHA256:RFzBCUItH9LZS0cKB5UE6ceAYhBD5C8GeOBip8Z11+4
50# is published on https://aur.archlinux.org.
51echo 'aur.archlinux.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEuBKrPzbawxA/k2g6NcyV5jmqwJ2s+zpgZGZ7tpLIcN' >"$ssh_dir/known_hosts"
52export GIT_SSH_COMMAND="ssh -i $key -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$ssh_dir/known_hosts"
53
54git clone "ssh://aur@aur.archlinux.org/$pkgname.git" aur
55cp PKGBUILD .SRCINFO aur/
56cd aur
57git add PKGBUILD .SRCINFO
58if git diff --cached --quiet; then
59	echo "$pkgname $pkgver is already on the AUR"
60	exit 0
61fi
62# Commits are signed with the AUR SSH key.
63git -c user.name="$AUR_USERNAME" -c user.email="$AUR_EMAIL" \
64	-c gpg.format=ssh -c user.signingkey="$key" \
65	commit -S -m "Update to $pkgver"
66git push origin HEAD:master