Release 0.1.37 deployment prep

2026-09-06 17:30:30 -05:00
parent 4862e29f57
commit 7f66228b9e
19 changed files with 866 additions and 79 deletions
@@ -0,0 +1,74 @@
+#!/bin/bash
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+python3 - "$ROOT" <<'PY'
+import json
+import re
+import sys
+from pathlib import Path
+
+root = Path(sys.argv[1])
+control = (root / "packaging/debian/control.template").read_text()
+postinst = (root / "packaging/debian/postinst").read_text()
+provision = (root / "scripts/classroom-provision").read_text()
+units = "\n".join(path.read_text() for path in (root / "systemd").rglob("*.service"))
+canary = (root / "update_canary.sh").read_text()
+policy = json.loads(
+    (root / "config/chrome/policies/managed/ekklesia-classroom.json").read_text()
+)
+
+passed = failed = 0
+
+
+def check(label, condition):
+    global passed, failed
+    if condition:
+        print(f"  ok   {label}")
+        passed += 1
+    else:
+        print(f"  FAIL {label}")
+        failed += 1
+
+
+depends = re.search(r"^Depends: (.*)$", control, re.MULTILINE).group(1).split(", ")
+
+print("1. Trixie package contract")
+for package in (
+    "network-manager",
+    "cups",
+    "cups-client",
+    "cups-filters",
+    "foomatic-db-compressed-ppds",
+):
+    check(f"depends on {package}", package in depends)
+
+print()
+print("2. networking service behavior")
+check("NetworkManager is explicitly enabled", "systemctl enable NetworkManager.service || true" in postinst)
+check("NetworkManager start is best effort", "systemctl start NetworkManager.service || true" in postinst)
+check("online waiter is disabled", "systemctl disable NetworkManager-wait-online.service || true" in postinst)
+check("no classroom NetworkManager config overrides ifupdown", not (root / "config/network").exists())
+
+print()
+print("3. printing service behavior")
+check("CUPS service and socket are enabled", "systemctl enable cups.socket cups.service || true" in postinst)
+check("CUPS start is best effort", "systemctl start cups.socket || true" in postinst)
+check("automatic remote queue browsing is disabled", "systemctl disable --now cups-browsed.service || true" in postinst)
+check("printer setup is never a boot service", "classroom-printer-setup" not in units)
+check("printer setup is never provisioning", "classroom-printer-setup" not in provision)
+check("Chrome uses the system print dialog", policy.get("DisablePrintPreview") is True)
+
+print()
+print("4. canary release gate")
+validation = canary.index('"$ROOT/tools/validate-trixie-release.sh"')
+package_copy = canary.index('cp "$package_path"')
+first_rsync = canary.index("rsync -av")
+check("Trixie validation runs before the repository copy", validation < package_copy)
+check("Trixie validation runs before any upload", validation < first_rsync)
+
+print()
+print(f"passed: {passed}  failed: {failed}")
+raise SystemExit(1 if failed else 0)
+PY