ekklesiaandClaude Opus 5.5
690ef95aff
0.2.6.1 is a maintenance release of 0.2.6. The build refused four parts, update_canary.sh's automatic bump could not add one to "6.1", and neither publish script would have noticed a version being published twice — which is what happened to 0.2.6 this morning: it was rebuilt with the Presentations hardening and uploaded over the first 0.2.6, and a room that had installed the first can never be offered the second. One release library now holds the version pattern (three or four parts, no leading zeros, no .0 maintenance), orders by dpkg --compare-versions, refuses a version that has ever been published or is not newer than all of them, uploads with --ignore-existing and checks the server's checksum, writes a manifest only for a package the server holds, and reads the channel back over HTTPS afterwards. update_canary.sh takes the version explicitly; update_stable.sh refuses to go backwards. The classroom updater refuses a manifest whose version, package name or checksum is malformed, and refuses a download whose own control file is not the version the manifest promised, so a room can never loop on reinstalling and rebooting. tests/test-release-versions.sh: 87 checks against a stand-in server and real dpkg. The Trixie gate now also rehearses a stable room: 0.2.2 to an interim 0.2.6.1 upgraded with settings, channel and Presentations=false intact, and the installed updater answering correctly. Co-Authored-By: Claude Opus 5.5 <[email protected]>
66 lines
1.9 KiB
Bash
Executable File
66 lines
1.9 KiB
Bash
Executable File
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
cd "$ROOT"
|
|
|
|
source "$ROOT/tools/release-lib.sh"
|
|
|
|
# Stable never gets a package of its own. It is pointed at one canary
|
|
# already published, so the file every classroom downloads is byte for
|
|
# byte the one the canary machine ran.
|
|
if [[ $# -eq 1 ]]; then
|
|
version="$1"
|
|
else
|
|
if [[ ! -f "$RELEASE_LOCAL/canary/manifest.json" ]]; then
|
|
echo "No local canary manifest exists."
|
|
exit 1
|
|
fi
|
|
|
|
version="$(python3 -c \
|
|
'import json, sys; print(json.load(open(sys.argv[1]))["version"])' \
|
|
"$RELEASE_LOCAL/canary/manifest.json")"
|
|
fi
|
|
|
|
release_require_version "$version"
|
|
|
|
package_name="$(release_package_name "$version")"
|
|
package_path="$RELEASE_LOCAL/packages/$package_name"
|
|
|
|
if [[ ! -f "$package_path" ]]; then
|
|
echo "Package does not exist locally:"
|
|
echo "$package_path"
|
|
exit 1
|
|
fi
|
|
|
|
if [[ "$(release_package_version "$package_path")" != "$version" ]]; then
|
|
echo "$package_name says it is $(release_package_version "$package_path")." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# A classroom only ever installs a version newer than its own, so a stable
|
|
# manifest that went backwards would reach nobody and would only make the
|
|
# channel say something untrue.
|
|
current="$(release_channel_version stable || true)"
|
|
|
|
if [[ -n "$current" ]] && ! release_version_gt "$version" "$current"; then
|
|
echo "Stable is on $current; $version is not newer." >&2
|
|
exit 1
|
|
fi
|
|
|
|
hash="$(sha256sum "$package_path" | awk '{print $1}')"
|
|
|
|
echo "Promoting $version to STABLE (from ${current:-nothing})"
|
|
|
|
# Refuses unless the server already holds exactly this package.
|
|
release_publish_manifest stable "$version" "$hash"
|
|
|
|
echo "$RELEASE_URL/stable/latest.deb -> $package_name"
|
|
|
|
echo
|
|
release_verify_channel stable "$version"
|
|
|
|
echo
|
|
echo "Ekklesia Classroom $version is now STABLE"
|
|
echo "$RELEASE_URL/stable/manifest.json"
|