publish.sh RawHistoryFolder

1#!/usr/bin/env bash
2# Builds an AUR package with makepkg, then pushes its PKGBUILD and .SRCINFO.
3# makepkg downloads every source and checks its sha256sum, so a PKGBUILD that
4# does not build, or does not match its release assets, is never published.
5#
6# Usage: publish.sh <pkgname> <PKGBUILD>
7# Env:   AUR_SSH_PRIVATE_KEY, AUR_USERNAME, AUR_EMAIL
8#        DRY_RUN=1 builds and prints the files without pushing.
9# Runs as a non-root user that may run pacman through sudo (makepkg -s).
10set -euo pipefail
11CARCH=$(uname -m)
12
13pkgname=$1
14work=$(mktemp -d)
15trap 'rm -rf "$work"' EXIT
16cp "$2" "$work/PKGBUILD"
17# The install script sets CAP_SYS_NICE; the AUR repo carries it too.
18cp "$(dirname "$0")/../neferwl.install" "$work/"
19cd "$work"
20
21makepkg --syncdeps --force --noconfirm
22# A -git pkgver() rewrites pkgver in PKGBUILD; .SRCINFO must match it.
23makepkg --printsrcinfo >.SRCINFO
24pkgver=$(sed -n 's/^\tpkgver = //p' .SRCINFO)
25
26# makepkg only fetches the sources of this machine's arch: check the others too.
27while read -r arch; do
28	if [[ $arch == "$CARCH" ]] || ! grep -q "^source_$arch=" PKGBUILD; then
29		continue
30	fi
31	{ cat /etc/makepkg.conf; echo "CARCH=$arch"; } >"makepkg-$arch.conf"
32	makepkg --config "makepkg-$arch.conf" --verifysource --noconfirm
33done < <(sed -n 's/^\tarch = //p' .SRCINFO)
34
35# pacman versions use _ where the tag has - (0.2.0-rc1 -> 0.2.0_rc1).
36got=$("pkg/$pkgname/usr/bin/neferwl" version)
37if [[ $got != "$pkgver" && $got != "${pkgver//_/-}" ]]; then
38	echo "packaged neferwl reports version $got, want $pkgver" >&2
39	exit 1
40fi
41
42if [[ ${DRY_RUN:-} == 1 ]]; then
43	cat PKGBUILD .SRCINFO
44	exit 0
45fi
46
47ssh_dir=$HOME/.ssh
48key=$ssh_dir/aur
49install -d -m 700 "$ssh_dir"
50(umask 077 && printf '%s\n' "$AUR_SSH_PRIVATE_KEY" >"$key")
51# Pinned host key. Fingerprint SHA256:RFzBCUItH9LZS0cKB5UE6ceAYhBD5C8GeOBip8Z11+4
52# is published on https://aur.archlinux.org.
53echo 'aur.archlinux.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEuBKrPzbawxA/k2g6NcyV5jmqwJ2s+zpgZGZ7tpLIcN' >"$ssh_dir/known_hosts"
54export GIT_SSH_COMMAND="ssh -i $key -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$ssh_dir/known_hosts"
55
56git clone "ssh://aur@aur.archlinux.org/$pkgname.git" aur
57cp PKGBUILD .SRCINFO neferwl.install aur/
58cd aur
59git add PKGBUILD .SRCINFO neferwl.install
60if git diff --cached --quiet; then
61	echo "$pkgname $pkgver is already on the AUR"
62	exit 0
63fi
64# Commits are signed with the AUR SSH key.
65git -c user.name="$AUR_USERNAME" -c user.email="$AUR_EMAIL" \
66	-c gpg.format=ssh -c user.signingkey="$key" \
67	commit -S -m "Update to $pkgver"
68git push origin HEAD:master