From fc7a77c500a94a29363904ce937e4e443bc2a387 Mon Sep 17 00:00:00 2001 From: chick Date: Thu, 17 Sep 2026 23:51:35 +0800 Subject: [PATCH] =?UTF-8?q?feat:=20=E6=9C=AC=E4=BB=93=E5=BA=93=E8=87=AA?= =?UTF-8?q?=E5=B7=B1=E5=8F=91=E5=B8=83=E4=BA=8C=E8=BF=9B=E5=88=B6?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 发布逻辑搬到这里，因为二进制从这里构建、这里拥有契约。simadmin-relay 的那个脚本改成 转发（一条命令，不是两份实现——两处知道怎么发同一批产物，就是两处要在注册表 API 变化时 一起改，这个仓库已经犯过一次）。 与本仓库的一条硬约束绑定：**必须公开可读**。安装命令由节点执行、节点没有凭据，而 Gitea 对私有仓库返回 404，所以节点上看到的失败长得像 URL 写错。脚本现在会检查并**拒绝发布**， 而不是发出一批拿不到的东西。 VERSION 提到 1.0.0，release body 里的安装片段更新为 enroll + install 两步。 --- scripts/release.sh | 161 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 161 insertions(+) create mode 100755 scripts/release.sh diff --git a/scripts/release.sh b/scripts/release.sh new file mode 100755 index 0000000..8d1f60b --- /dev/null +++ b/scripts/release.sh @@ -0,0 +1,161 @@ +#!/usr/bin/env bash +# Publishes this agent's cross-compiled binaries as a Gitea release. +# +# The release is what makes the install command real: `msa-agent enroll` runs on the node, and the node +# has no Go toolchain, so the binary has to come from somewhere. Before this the only way to get one was +# to build it on another machine and scp it, which is a step the install command cannot express. +# +# The token is read from the git credential helper rather than an environment variable, so it is not in +# the process table and not in a shell history. Override with MSA_GITEA_TOKEN when running somewhere +# that has no helper. +# +# Usage: +# ./scripts/release.sh # publish the version in the Makefile +# ./scripts/release.sh --tag v1.0.0 # publish an explicit tag +# ./scripts/release.sh --dry-run # build, checksum, print, upload nothing +# +# This repository must stay publicly readable: the install command fetches the binary from a node that +# has no credentials, and Gitea answers 404 for a private repository, so the failure on the node looks +# like a wrong URL. The script checks that and refuses rather than publishing something unreachable. +set -euo pipefail + +ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +cd "$ROOT" + +REMOTE="$(git config --get remote.origin.url)" +HOST="$(printf '%s' "$REMOTE" | sed -E 's#^https?://([^/]+)/.*#\1#')" +SLUG="$(printf '%s' "$REMOTE" | sed -E 's#^https?://[^/]+/##; s#\.git$##')" +if [[ -z "$HOST" || -z "$SLUG" ]]; then + echo "release: cannot parse the origin remote ($REMOTE)" >&2 + exit 1 +fi + +VERSION="$(sed -n 's/^VERSION[[:space:]]*?*=[[:space:]]*//p' Makefile | head -1)" +TAG="v${VERSION}" +DRY_RUN=0 +while [[ $# -gt 0 ]]; do + case "$1" in + --tag) TAG="$2"; shift 2 ;; + --dry-run) DRY_RUN=1; shift ;; + *) echo "release: unknown argument $1" >&2; exit 2 ;; + esac +done + +step() { printf '\n\033[1m== %s\033[0m\n' "$1"; } + +step "building ${TAG}" +# VERSION is passed through so the binary reports the tag it was published under, which is what an +# operator sees in `msa-agent version` and in the agent's startup log line. +make build-arm64 build-armv7 VERSION="${VERSION}" + +step "checksums" +( + cd dist + shasum -a 256 msa-agent-linux-arm64 msa-agent-linux-armv7 > SHA256SUMS + cat SHA256SUMS +) + +if [[ "$DRY_RUN" -eq 1 ]]; then + step "dry run: nothing was uploaded" + exit 0 +fi + +TOKEN="${MSA_GITEA_TOKEN:-}" +if [[ -z "$TOKEN" ]]; then + # The credential helper is what `git push` already uses, so there is no second secret to keep. + TOKEN="$(printf 'protocol=https\nhost=%s\n\n' "$HOST" | git credential fill 2>/dev/null | sed -n 's/^password=//p')" +fi +if [[ -z "$TOKEN" ]]; then + echo "release: no API token. Set MSA_GITEA_TOKEN, or make sure git can authenticate to $HOST." >&2 + exit 1 +fi + +API="https://${HOST}/api/v1/repos/${SLUG}" +AUTH=(-H "Authorization: token ${TOKEN}") + +step "target repository" +PRIVATE="$(curl -sf "${AUTH[@]}" "${API}" | python3 -c 'import json,sys; print(json.load(sys.stdin).get("private"))' 2>/dev/null || echo unknown)" +echo "${SLUG} (private: ${PRIVATE})" +if [[ "$PRIVATE" != "False" ]]; then + echo "release: ${SLUG} is not publicly readable. A node fetching the binary has no credentials and" >&2 + echo " would get 404, which looks like a wrong URL. Make it public before publishing." >&2 + exit 1 +fi + +step "creating the release ${TAG}" +# A release that already exists is reused rather than refused: re-running this after a fix should +# replace the binaries, and failing here would mean the operator has to delete the release by hand. +EXISTING="$(curl -sf "${AUTH[@]}" "${API}/releases/tags/${TAG}" 2>/dev/null || true)" +if [[ -n "$EXISTING" ]]; then + RELEASE_ID="$(printf '%s' "$EXISTING" | python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])')" + echo "reusing release ${TAG} (id ${RELEASE_ID})" +else + BODY="$(python3 - "$TAG" "$VERSION" <<'PY' +import json, sys +tag, version = sys.argv[1], sys.argv[2] +print(json.dumps({ + "tag_name": tag, + "name": f"simadmin-relay agent {version}", + "body": ( + "Outbound-only node agent for SimAdmin nodes, cross-compiled for the ARM Debian boxes SimAdmin " + "runs on. Static, no runtime dependencies, no third-party modules.\n\n" + "Install on a node:\n\n" + "```sh\n" + f"curl -fsSL https://HOST/SLUG/releases/download/{tag}/msa-agent-linux-arm64 \\\n" + " -o /opt/msa-agent/msa-agent && chmod 755 /opt/msa-agent/msa-agent\n" + "/opt/msa-agent/msa-agent enroll --relay https://your-relay --code \\\n" + " --write /etc/msa-agent/config.json\n" + "/opt/msa-agent/msa-agent install\n" + "```\n\n" + "`armv7` is the same build for 32-bit ARM. `SHA256SUMS` covers both.\n\n" + "Removing it again is `msa-agent uninstall` on the node; `--dry-run` shows the plan first.\n" + ), + "draft": False, + "prerelease": False, +}, ensure_ascii=False)) +PY +)" + BODY="${BODY//HOST/$HOST}" + BODY="${BODY//SLUG/$SLUG}" + RELEASE_ID="$(curl -sf -X POST "${AUTH[@]}" -H 'Content-Type: application/json' \ + "${API}/releases" -d "$BODY" | python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])')" + echo "created release ${TAG} (id ${RELEASE_ID})" +fi + +step "uploading binaries" +for asset in msa-agent-linux-arm64 msa-agent-linux-armv7 SHA256SUMS; do + # An asset with the same name cannot be replaced, so an existing one is deleted first: otherwise a + # re-run after a rebuild would silently leave the previous binary in place. + EXISTING_ASSET="$(curl -sf "${AUTH[@]}" "${API}/releases/${RELEASE_ID}/assets" \ + | python3 -c " +import json, sys +name = sys.argv[1] +for asset in json.load(sys.stdin): + if asset['name'] == name: + print(asset['id']) + break +" "$asset" || true)" + if [[ -n "$EXISTING_ASSET" ]]; then + # Gitea's delete path carries the release id; GitHub's does not. Using GitHub's shape here returns + # 404 and, under `set -e`, killed the script silently after the first asset — which is how a + # re-publish left the old binary in place while looking like it had replaced it. + curl -sf -X DELETE "${AUTH[@]}" "${API}/releases/${RELEASE_ID}/assets/${EXISTING_ASSET}" >/dev/null + echo " replaced ${asset}" + fi + curl -sf -X POST "${AUTH[@]}" \ + -F "attachment=@dist/${asset}" \ + "${API}/releases/${RELEASE_ID}/assets?name=${asset}" >/dev/null + echo " uploaded ${asset}" +done + +step "published" +printf 'release: https://%s/%s/releases/tag/%s\n' "$HOST" "$SLUG" "$TAG" +printf 'download: https://%s/%s/releases/download/%s/msa-agent-linux-arm64\n' "$HOST" "$SLUG" "$TAG" +printf '\n' +# The app renders the install command, so the URL it carries has to be this one. Printing it in the +# exact form DefaultContainer holds is what makes the two comparable by eye. +printf 'DefaultContainer.agentDownload must be:\n' +printf ' https://%s/%s/releases/download/%s/msa-agent-linux-arm64\n' "$HOST" "$SLUG" "$TAG" +printf '\nVerify it is fetchable with no credentials:\n' +printf ' curl -fsSL -o /dev/null -w "%%{http_code}\\n" %s\n' \ + "https://${HOST}/${SLUG}/releases/download/${TAG}/msa-agent-linux-arm64"