From 56c59ffb6b4ebd2eb1ce194f412cd21e770ccce9 Mon Sep 17 00:00:00 2001 From: Keegan Smith Date: Wed, 9 Sep 2026 13:59:23 +0000 Subject: [PATCH] feat/packaging: brand and validate Sourcegraph Git v2 The second immutable release needs a visible downstream identity without changing its upstream Git source. Centralize version provenance, exercise the branded binary on supported Linux and macOS, and produce a fully validated Darwin archive when dedicated Mac infrastructure is unavailable. Amp-Thread-ID: https://ampcode.com/threads/T-01a081bc-ccc0-753b-9d0d-e27952625463 Co-authored-by: Amp --- .github/workflows/sourcegraph.yml | 54 ++++++++- SOURCEGRAPH.md | 10 +- contrib/sourcegraph/packaging/README.md | 68 +++++++----- contrib/sourcegraph/packaging/build-darwin.sh | 9 +- .../packaging/build-from-source.sh | 18 ++- contrib/sourcegraph/packaging/build-linux.sh | 10 +- contrib/sourcegraph/packaging/release.sh | 8 ++ .../packaging/validate-darwin-archive.sh | 104 ++++++++++++++++++ .../packaging/validate-linux-archive.sh | 14 ++- 9 files changed, 233 insertions(+), 62 deletions(-) create mode 100644 contrib/sourcegraph/packaging/release.sh create mode 100755 contrib/sourcegraph/packaging/validate-darwin-archive.sh diff --git a/.github/workflows/sourcegraph.yml b/.github/workflows/sourcegraph.yml index 9527cca5898605..06bd04cd455f6a 100644 --- a/.github/workflows/sourcegraph.yml +++ b/.github/workflows/sourcegraph.yml @@ -28,31 +28,73 @@ jobs: steps: - uses: actions/checkout@v6 - run: test "$(uname -m)" = x86_64 + - name: Configure branded version + run: | + . contrib/sourcegraph/packaging/release.sh + echo "GIT_VERSION=$GIT_VERSION" >>"$GITHUB_ENV" - run: ci/install-dependencies.sh env: CUSTOM_PATH: ${{ runner.temp }}/custom - run: ci/run-build-and-tests.sh + - run: test "$(./git --version)" = "git version $GIT_VERSION" - if: failure() && env.FAILED_TEST_ARTIFACTS != '' run: ci/print-test-failures.sh darwin: name: Darwin ARM64 build and test - runs-on: macos-14 + runs-on: macos-15 env: CC: clang - CI_JOB_IMAGE: macos-14 + CI_JOB_IMAGE: macos-15 jobname: osx-clang TEST_OUTPUT_DIRECTORY: ${{ github.workspace }}/t steps: - uses: actions/checkout@v6 - run: test "$(uname -m)" = arm64 + - run: test "$(sw_vers -productVersion | cut -d. -f1)" = 15 + - name: Configure branded version + run: | + . contrib/sourcegraph/packaging/release.sh + echo "GIT_VERSION=$GIT_VERSION" >>"$GITHUB_ENV" - run: ci/install-dependencies.sh env: CUSTOM_PATH: ${{ runner.temp }}/custom - run: ci/run-build-and-tests.sh + - run: test "$(./git --version)" = "git version $GIT_VERSION" - if: failure() && env.FAILED_TEST_ARTIFACTS != '' run: ci/print-test-failures.sh + darwin-archive: + name: Darwin ARM64 archive + runs-on: macos-15 + steps: + - uses: actions/checkout@v6 + with: + ref: ${{ github.event.pull_request.head.sha || github.sha }} + fetch-depth: 0 + - run: test "$(uname -m)" = arm64 + - run: test "$(sw_vers -productVersion | cut -d. -f1)" = 15 + - name: Install build dependencies + run: | + brew install gnu-tar + command -v rustc + command -v cargo + command -v gtar + - name: Build archive from exact recipe head + run: ./contrib/sourcegraph/packaging/build-darwin.sh artifacts + - name: Validate archive + run: | + ./contrib/sourcegraph/packaging/validate-darwin-archive.sh \ + artifacts/git-sourcegraph-v2.55.0-2-darwin-arm64.tar.gz + - uses: actions/upload-artifact@v6 + with: + name: git-sourcegraph-v2.55.0-2-darwin-arm64 + path: | + artifacts/git-sourcegraph-v2.55.0-2-darwin-arm64.tar.gz + artifacts/git-sourcegraph-v2.55.0-2-darwin-arm64.tar.gz.sha256 + if-no-files-found: error + retention-days: 7 + fork-policy: name: Fork and packaging policy runs-on: ubuntu-24.04 @@ -73,8 +115,10 @@ jobs: do sh -n "$script" done - grep -Fx 'SOURCE_TAG=v2.55.0' contrib/sourcegraph/packaging/build-linux.sh - grep -Fx 'SOURCE_COMMIT=e9019fcafe0040228b8631c30f97ae1adb61bcdc' contrib/sourcegraph/packaging/build-linux.sh - grep -Fx 'RELEASE_VERSION=v2.55.0-1' contrib/sourcegraph/packaging/build-linux.sh + . contrib/sourcegraph/packaging/release.sh + test "$SOURCE_TAG" = v2.55.0 + test "$SOURCE_COMMIT" = e9019fcafe0040228b8631c30f97ae1adb61bcdc + test "$RELEASE_VERSION" = v2.55.0-2 + test "$GIT_VERSION" = 2.55.0.sourcegraph.2 grep -F 'FROM debian:12@sha256:' contrib/sourcegraph/packaging/Dockerfile.linux } diff --git a/SOURCEGRAPH.md b/SOURCEGRAPH.md index ce5ce3f971e69d..3ffe253ee34bd4 100644 --- a/SOURCEGRAPH.md +++ b/SOURCEGRAPH.md @@ -19,11 +19,11 @@ Release tags use `sourcegraph/v-`, for example packaging, or rebuild releases on the same upstream baseline, and resets to 1 when the upstream version changes. Tags and assets are immutable. Release metadata records the corresponding Git source and packaging recipe commits -separately. Git's reported version remains the upstream numeric version -(`2.55.0` today) for consumer parser compatibility. The release, archive, and -`BUILD-INFO` carry the downstream identity; `git version --build-options` -identifies the compiled source commit. Any branded Git version suffix requires -explicit build and consumer-parser validation first. +separately. Starting with `sourcegraph/v2.55.0-2`, the tag maps to Git output +`2.55.0.sourcegraph.2`; in general, tag revision `N` maps to the dotted suffix +`.sourcegraph.N`. The immutable first release is the exception: it reports +plain `2.55.0`. `BUILD-INFO` carries the downstream identity, and +`git version --build-options` identifies the compiled source commit. Distribution has three separate owners: diff --git a/contrib/sourcegraph/packaging/README.md b/contrib/sourcegraph/packaging/README.md index b1b900b6d35795..0dfab09e479e1b 100644 --- a/contrib/sourcegraph/packaging/README.md +++ b/contrib/sourcegraph/packaging/README.md @@ -6,13 +6,15 @@ export the exact upstream-compatible `v2.55.0` source at commit `e9019fcafe0040228b8631c30f97ae1adb61bcdc`, regardless of the branch from which the packaging script runs. -The current immutable downstream release is `sourcegraph/v2.55.0-1`. A -release consists of exactly these files: +The next immutable downstream release is `sourcegraph/v2.55.0-2`, whose Git +binary reports `2.55.0.sourcegraph.2`. It consists of exactly these files: -* `git-sourcegraph-v2.55.0-1-linux-amd64.tar.gz` -* `git-sourcegraph-v2.55.0-1-linux-amd64.tar.gz.sha256` -* `git-sourcegraph-v2.55.0-1-darwin-arm64.tar.gz` -* `git-sourcegraph-v2.55.0-1-darwin-arm64.tar.gz.sha256` +* `git-sourcegraph-v2.55.0-2-linux-amd64.tar.gz` +* `git-sourcegraph-v2.55.0-2-linux-amd64.tar.gz.sha256` +* `git-sourcegraph-v2.55.0-2-darwin-arm64.tar.gz` +* `git-sourcegraph-v2.55.0-2-darwin-arm64.tar.gz.sha256` + +The existing `sourcegraph/v2.55.0-1` tag and assets remain immutable. Each archive has one `git-sourcegraph/` root. Stripping that directory exposes `bin/`, `libexec/`, `share/`, optional `lib/`, and `BUILD-INFO`. The latter @@ -21,11 +23,12 @@ versions, recipe commit, and the identity embedded in Git. The source commit is what was compiled; the recipe commit identifies the packaging implementation. Consumers should verify the checksum sidecar before extracting. -The source constants in both entry-point scripts move together. They currently -pin upstream `v2.55.0` because this experiment has no behavior patches. When a -future Sourcegraph behavior patch lands, update the source ref and commit to the -exact downstream revision containing that patch; never leave the builder -exporting an older upstream commit. +`release.sh` is the source of truth for upstream version, release revision, Git +version, and source identity. It currently pins upstream `v2.55.0` because this +experiment has no behavior patches. When a future Sourcegraph behavior patch +lands, update the source ref and commit to the exact downstream revision +containing that patch; never leave the builder exporting an older upstream +commit. ## Linux AMD64 @@ -34,7 +37,7 @@ Install Docker, then run: ```console ./contrib/sourcegraph/packaging/build-linux.sh ./contrib/sourcegraph/packaging/validate-linux-archive.sh \ - artifacts/git-sourcegraph-v2.55.0-1-linux-amd64.tar.gz + artifacts/git-sourcegraph-v2.55.0-2-linux-amd64.tar.gz ``` The builder image starts from Debian 12 at a pinned multi-platform image @@ -50,19 +53,26 @@ PCRE2, user config, `/etc/gitconfig`, HTTPS, and all ELF dependencies. ## macOS ARM64 -The Mac artifact must be built and validated on a supported Apple Silicon Mac. -Install Xcode command-line tools, Rust, and GNU tar, then run: +The Mac artifact supports the latest released macOS major (26) and the +previous major (15) on Apple Silicon. Build and validate it on either supported +major. Install Xcode command-line tools, Rust, and GNU tar, then run: ```console xcode-select --install # if the tools are not already installed brew install rust gnu-tar ./contrib/sourcegraph/packaging/build-darwin.sh +./contrib/sourcegraph/packaging/validate-darwin-archive.sh \ + artifacts/git-sourcegraph-v2.55.0-2-darwin-arm64.tar.gz ``` +The `Darwin ARM64 archive` job runs the same commands on GitHub's macOS 15 +ARM64 runner and uploads the archive and checksum as a temporary workflow +artifact. It does not create tags, releases, or release assets. + The script discards inherited Nix SDK, compiler, and library search settings; -uses an Apple Xcode SDK; and targets macOS 14 by default. If `xcode-select` -points outside the normal Apple developer directories, the script uses -`/Applications/Xcode.app` when available and otherwise stops before building. +uses an Apple Xcode SDK; and currently targets macOS 15 by default. If +`xcode-select` points outside the normal Apple developer directories, the +script uses `/Applications/Xcode.app` when available and otherwise stops before building. Override Xcode with `SOURCEGRAPH_GIT_DEVELOPER_DIR` or the deployment floor with `SOURCEGRAPH_GIT_DEPLOYMENT_TARGET` only when deliberately preparing a different artifact. It downloads checksum-pinned PCRE2 10.48 source and builds @@ -73,24 +83,24 @@ the build machine. Git still includes its English fallthrough messages. The full install includes `git-credential-osxkeychain`, rejects non-system Mach-O dependencies (including `/opt/homebrew` and build paths), verifies -arm64 and the macOS 14 deployment floor, strips ephemeral source/staging paths, +arm64 and the configured deployment floor, strips ephemeral source/staging paths, and then ad-hoc signs unsigned installed binaries. Ad-hoc signatures are not Apple notarization and do not establish publisher identity. -Before an experimental service release, unpack the archive into two different +Before release, unpack the archive into two different directories and run `bin/git version --build-options`, `bin/git init`, a PCRE2 `git grep -P`, an HTTPS clone/fetch, and the team's normal SSH, GPG signing, and Git LFS workflows. Inspect every Mach-O file with `otool -L` and -`codesign --verify --verbose`. Publish the checksummed archives only as an -opt-in prerelease under an immutable downstream tag; sign that tag separately -when signing infrastructure is available. Creating the tag or GitHub release -is intentionally outside these scripts. - -Validation on macOS 26.6.2 exercised those core workflows, but the locked -noninteractive login keychain prevented a `credential-osxkeychain` store/get/ -erase round trip. The macOS 14 deployment floor was inspected in Mach-O load -commands, not run on macOS 14. Complete both checks before describing this as a -fully supported everyday Git replacement. +`codesign --verify --verbose`. Publish the checksummed archives under an +immutable downstream tag; sign that tag separately when signing infrastructure +is available. Creating the tag or GitHub release is intentionally outside +these scripts. + +Sourcegraph gitserver clears `credential.helper`, so an interactive +`credential-osxkeychain` round trip is not a service-release gate. The helper +remains included for other uses; validate it separately before broad engineer +adoption. A deployment target below the two supported majors is conservative +binary metadata, not a promise of runtime support for that older macOS release. ## License notices diff --git a/contrib/sourcegraph/packaging/build-darwin.sh b/contrib/sourcegraph/packaging/build-darwin.sh index fe51c82efe341f..71b85f8f83ec07 100755 --- a/contrib/sourcegraph/packaging/build-darwin.sh +++ b/contrib/sourcegraph/packaging/build-darwin.sh @@ -1,9 +1,6 @@ #!/bin/sh set -eu -SOURCE_TAG=v2.55.0 -SOURCE_COMMIT=e9019fcafe0040228b8631c30f97ae1adb61bcdc -RELEASE_VERSION=v2.55.0-1 PCRE2_VERSION=10.48 PCRE2_SHA256=b6c68fdf6f3ac31388b50aa89ff0fc49c00c987c16e7b5146491d12003f2c8ed @@ -13,6 +10,7 @@ test "$(uname -s)" = Darwin && test "$(uname -m)" = arm64 || { } root=$(git rev-parse --show-toplevel) +. "$root/contrib/sourcegraph/packaging/release.sh" output=${1:-"$root/artifacts"} RECIPE_COMMIT=$(git -C "$root" rev-parse HEAD) actual=$(git -C "$root" rev-parse "$SOURCE_TAG^{commit}") @@ -57,7 +55,7 @@ fi export DEVELOPER_DIR SDKROOT=$(/usr/bin/xcrun --sdk macosx --show-sdk-path) export SDKROOT -MACOSX_DEPLOYMENT_TARGET=${SOURCEGRAPH_GIT_DEPLOYMENT_TARGET:-14.0} +MACOSX_DEPLOYMENT_TARGET=${SOURCEGRAPH_GIT_DEPLOYMENT_TARGET:-15.0} export MACOSX_DEPLOYMENT_TARGET CC=$(/usr/bin/xcrun --find clang) AR=$(/usr/bin/xcrun --find ar) @@ -93,8 +91,7 @@ pcre_prefix="$work/pcre2-install" ( cd "$work" SOURCE_DATE_EPOCH=$(git -C "$root" show -s --format=%ct "$SOURCE_COMMIT") \ - SOURCE_COMMIT="$SOURCE_COMMIT" SOURCE_TAG="$SOURCE_TAG" \ - RECIPE_COMMIT="$RECIPE_COMMIT" RELEASE_VERSION="$RELEASE_VERSION" \ + RECIPE_COMMIT="$RECIPE_COMMIT" \ PCRE2_PREFIX="$pcre_prefix" \ PCRE2_LICENSE="$work/pcre2-$PCRE2_VERSION/LICENCE.md" \ SOURCE_BUILD_ROOT="$work" \ diff --git a/contrib/sourcegraph/packaging/build-from-source.sh b/contrib/sourcegraph/packaging/build-from-source.sh index d04a12b4b14b22..325ca31157f07a 100755 --- a/contrib/sourcegraph/packaging/build-from-source.sh +++ b/contrib/sourcegraph/packaging/build-from-source.sh @@ -1,12 +1,12 @@ #!/bin/sh set -eu +script_dir=$(CDPATH= cd "$(dirname "$0")" && pwd) +. "$script_dir/release.sh" + platform=${1:?usage: build-from-source.sh PLATFORM [OUTPUT]} output=${2:-/out} -: "${SOURCE_COMMIT:?SOURCE_COMMIT is required}" -: "${SOURCE_TAG:?SOURCE_TAG is required}" : "${RECIPE_COMMIT:?RECIPE_COMMIT is required}" -: "${RELEASE_VERSION:?RELEASE_VERSION is required}" : "${SOURCE_DATE_EPOCH:?SOURCE_DATE_EPOCH is required}" stage=$(mktemp -d) @@ -44,12 +44,16 @@ mkdir -p "$prefix" "$output" make clean # shellcheck disable=SC2086 make -j"$(getconf _NPROCESSORS_ONLN)" $make_options \ - prefix=/ sysconfdir=/etc GIT_VERSION=2.55.0 \ + prefix=/ sysconfdir=/etc GIT_VERSION="$GIT_VERSION" \ GIT_BUILT_FROM_COMMIT="$SOURCE_COMMIT" all # shellcheck disable=SC2086 -make $make_options prefix=/ sysconfdir=/etc GIT_VERSION=2.55.0 \ +make $make_options prefix=/ sysconfdir=/etc GIT_VERSION="$GIT_VERSION" \ GIT_BUILT_FROM_COMMIT="$SOURCE_COMMIT" DESTDIR="$prefix" install +test "$($prefix/bin/git --version)" = "git version $GIT_VERSION" +$prefix/bin/git version --build-options | + grep -F "built from commit: $SOURCE_COMMIT" + mkdir "$prefix/LICENSES" cp COPYING "$prefix/LICENSES/Git-COPYING" @@ -63,7 +67,7 @@ then cp "$pcre2_license" "$prefix/LICENSES/PCRE2-LICENCE" # The keychain helper is intentionally included in the full Mac install. # shellcheck disable=SC2086 - make $make_options prefix=/ sysconfdir=/etc GIT_VERSION=2.55.0 \ + make $make_options prefix=/ sysconfdir=/etc GIT_VERSION="$GIT_VERSION" \ GIT_BUILT_FROM_COMMIT="$SOURCE_COMMIT" DESTDIR="$prefix" \ install-git-credential-osxkeychain contrib/sourcegraph/packaging/verify-darwin-dependencies.sh "$prefix" @@ -73,6 +77,8 @@ fi { echo "release_version=$RELEASE_VERSION" + echo "upstream_version=$UPSTREAM_VERSION" + echo "release_revision=$RELEASE_REVISION" echo "source_tag=$SOURCE_TAG" echo "source_commit=$SOURCE_COMMIT" echo "recipe_commit=$RECIPE_COMMIT" diff --git a/contrib/sourcegraph/packaging/build-linux.sh b/contrib/sourcegraph/packaging/build-linux.sh index 891cd81b4d823f..d3e6abe304e1ec 100755 --- a/contrib/sourcegraph/packaging/build-linux.sh +++ b/contrib/sourcegraph/packaging/build-linux.sh @@ -1,12 +1,9 @@ #!/bin/sh set -eu -SOURCE_TAG=v2.55.0 -SOURCE_COMMIT=e9019fcafe0040228b8631c30f97ae1adb61bcdc -RELEASE_VERSION=v2.55.0-1 -IMAGE=git-sourcegraph-linux-builder:v2.55.0-1 - root=$(git rev-parse --show-toplevel) +. "$root/contrib/sourcegraph/packaging/release.sh" +IMAGE=git-sourcegraph-linux-builder:$RELEASE_VERSION output=${1:-"$root/artifacts"} RECIPE_COMMIT=$(git -C "$root" rev-parse HEAD) actual=$(git -C "$root" rev-parse "$SOURCE_TAG^{commit}") @@ -37,10 +34,7 @@ docker run --rm \ --user "$(id -u):$(id -g)" \ -e HOME=/tmp \ -e SOURCE_DATE_EPOCH="$(git -C "$root" show -s --format=%ct "$SOURCE_COMMIT")" \ - -e SOURCE_COMMIT="$SOURCE_COMMIT" \ - -e SOURCE_TAG="$SOURCE_TAG" \ -e RECIPE_COMMIT="$RECIPE_COMMIT" \ - -e RELEASE_VERSION="$RELEASE_VERSION" \ -v "$work:/src" \ -v "$output:/out" \ "$IMAGE" diff --git a/contrib/sourcegraph/packaging/release.sh b/contrib/sourcegraph/packaging/release.sh new file mode 100644 index 00000000000000..650e16712151d6 --- /dev/null +++ b/contrib/sourcegraph/packaging/release.sh @@ -0,0 +1,8 @@ +#!/bin/sh + +UPSTREAM_VERSION=2.55.0 +RELEASE_REVISION=2 +SOURCE_TAG=v$UPSTREAM_VERSION +SOURCE_COMMIT=e9019fcafe0040228b8631c30f97ae1adb61bcdc +RELEASE_VERSION=v$UPSTREAM_VERSION-$RELEASE_REVISION +GIT_VERSION=$UPSTREAM_VERSION.sourcegraph.$RELEASE_REVISION diff --git a/contrib/sourcegraph/packaging/validate-darwin-archive.sh b/contrib/sourcegraph/packaging/validate-darwin-archive.sh new file mode 100755 index 00000000000000..3107d6c26a9341 --- /dev/null +++ b/contrib/sourcegraph/packaging/validate-darwin-archive.sh @@ -0,0 +1,104 @@ +#!/bin/sh +set -eu + +script_dir=$(CDPATH= cd "$(dirname "$0")" && pwd) +. "$script_dir/release.sh" + +archive=${1:?usage: validate-darwin-archive.sh ARCHIVE} +test "$(uname -s)-$(uname -m)" = Darwin-arm64 +expected_recipe=$(git -C "$script_dir" rev-parse HEAD) + +archive_dir=$(CDPATH= cd "$(dirname "$archive")" && pwd) +archive_name=$(basename "$archive") +(cd "$archive_dir" && shasum -a 256 -c "$archive_name.sha256") + +work=$(mktemp -d) +status_file=$(mktemp) +trap 'rm -rf "$work" "$status_file"' EXIT HUP INT TERM + +roots=$(tar -tzf "$archive" | sed 's,/.*,,' | LC_ALL=C sort -u) +test "$roots" = git-sourcegraph + +validate_prefix() { + prefix=$1 + git="$prefix/bin/git" + test -s "$prefix/LICENSES/Git-COPYING" + test -s "$prefix/LICENSES/PCRE2-LICENCE" + test "$("$git" --version)" = "git version $GIT_VERSION" + build_options=$("$git" version --build-options) + printf '%s\n' "$build_options" | grep -F "built from commit: $SOURCE_COMMIT" + printf '%s\n' "$build_options" | grep -F 'rust: enabled' + grep -Fx "release_version=$RELEASE_VERSION" "$prefix/BUILD-INFO" + grep -Fx "upstream_version=$UPSTREAM_VERSION" "$prefix/BUILD-INFO" + grep -Fx "release_revision=$RELEASE_REVISION" "$prefix/BUILD-INFO" + grep -Fx "source_tag=$SOURCE_TAG" "$prefix/BUILD-INFO" + grep -Fx "source_commit=$SOURCE_COMMIT" "$prefix/BUILD-INFO" + grep -Fx "recipe_commit=$expected_recipe" "$prefix/BUILD-INFO" + test "$("$git" --exec-path)" = "$prefix/libexec/git-core" + test "$("$git" --html-path)" = "$prefix/share/doc/git-doc" + + home="$work/home" + mkdir -p "$home" + GIT_CONFIG_SYSTEM=/dev/null HOME="$home" "$git" init -q "$work/repository" + test -f "$work/repository/.git/hooks/applypatch-msg.sample" + printf 'needle\n' >"$work/repository/content" + GIT_CONFIG_SYSTEM=/dev/null HOME="$home" "$git" -C "$work/repository" add content + GIT_CONFIG_SYSTEM=/dev/null HOME="$home" "$git" -C "$work/repository" grep -P 'n(?=eedle)' + rm -rf "$work/repository" +} + +for location in 'first prefix' second/original +do + mkdir -p "$work/$location" + tar -xzf "$archive" -C "$work/$location" --strip-components=1 + validate_prefix "$work/$location" +done + +mkdir -p "$work/second/moved" +mv "$work/second/original" "$work/second/moved/prefix" +validate_prefix "$work/second/moved/prefix" +prefix="$work/second/moved/prefix" +GIT_CONFIG_SYSTEM=/dev/null HOME="$work/home" "$prefix/bin/git" ls-remote \ + https://github.com/git/git.git HEAD | grep -E '^[0-9a-f]{40}[[:space:]]+HEAD$' + +mkdir "$work/external" +cat >"$work/external/git-lfs" <&2 + echo failed >>"$status_file" + } + minos=$(otool -l "$executable" | awk \ + '/cmd LC_BUILD_VERSION/ { found = 1; next } found && $1 == "minos" { print $2; exit }') + test "$minos" = 15.0 || { + echo "error: $executable targets macOS $minos, expected 15.0" >&2 + echo failed >>"$status_file" + } + if strings "$executable" | grep -E '/(nix/store|opt/homebrew|private/var/folders|Users/runner/work)/' >/dev/null + then + echo "error: build-machine path embedded in $executable" >&2 + echo failed >>"$status_file" + fi + otool -L "$executable" | tail -n +2 | awk '{ print $1 }' | while IFS= read -r library + do + case "$library" in + /System/Library/*|/usr/lib/*) ;; + *) echo "error: non-system dependency in $executable: $library" >&2; echo failed >>"$status_file" ;; + esac + done + codesign --verify --verbose "$executable" || echo failed >>"$status_file" +done +test ! -s "$status_file" + +echo 'Darwin archive validation passed.' diff --git a/contrib/sourcegraph/packaging/validate-linux-archive.sh b/contrib/sourcegraph/packaging/validate-linux-archive.sh index f97d9b9921c477..21f98c1060acf7 100755 --- a/contrib/sourcegraph/packaging/validate-linux-archive.sh +++ b/contrib/sourcegraph/packaging/validate-linux-archive.sh @@ -1,8 +1,10 @@ #!/bin/sh set -eu +script_dir=$(CDPATH= cd "$(dirname "$0")" && pwd) +. "$script_dir/release.sh" + archive=${1:?usage: validate-linux-archive.sh ARCHIVE} -expected_commit=e9019fcafe0040228b8631c30f97ae1adb61bcdc work=$(mktemp -d) trap 'rm -rf "$work"' EXIT HUP INT TERM @@ -16,8 +18,14 @@ do git="$work/$location/bin/git" test -s "$work/$location/LICENSES/Git-COPYING" test -s "$work/$location/BUNDLED-LIBRARIES" - test "$($git --version)" = 'git version 2.55.0' - $git version --build-options | grep -F "built from commit: $expected_commit" + test "$($git --version)" = "git version $GIT_VERSION" + $git version --build-options | grep -F "built from commit: $SOURCE_COMMIT" + grep -Fx "release_version=$RELEASE_VERSION" "$work/$location/BUILD-INFO" + grep -Fx "upstream_version=$UPSTREAM_VERSION" "$work/$location/BUILD-INFO" + grep -Fx "release_revision=$RELEASE_REVISION" "$work/$location/BUILD-INFO" + grep -Fx "source_tag=$SOURCE_TAG" "$work/$location/BUILD-INFO" + grep -Fx "source_commit=$SOURCE_COMMIT" "$work/$location/BUILD-INFO" + grep -Ex 'recipe_commit=[0-9a-f]{40}' "$work/$location/BUILD-INFO" test "$($git --exec-path)" = "$work/$location/libexec/git-core" test "$($git --html-path)" = "$work/$location/share/doc/git-doc"