#!/bin/bash
|
# Generate internal and public release manifests from an existing Aligner release
|
# directory. This does not upload, notarize, staple, or mark artifacts as public.
|
|
set -euo pipefail
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
OUTPUT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
SOURCE_ROOT="$OUTPUT_ROOT/C1.source"
|
INFO_PLIST="$SOURCE_ROOT/Resources/Aligner-Info.plist"
|
|
fail() {
|
echo "generate-release-manifest.sh failed: $*" >&2
|
exit 1
|
}
|
|
usage() {
|
cat <<'USAGE' >&2
|
Usage:
|
03-O/C3.tools/generate-release-manifest.sh <release-dir>
|
|
Optional environment:
|
ALIGNER_RELEASE_DOWNLOAD_URL
|
ALIGNER_RELEASE_NOTES_URL
|
ALIGNER_RELEASE_NOTARIZED=1
|
ALIGNER_NOTARIZATION_REQUEST_ID
|
ALIGNER_SIGNING_IDENTITY
|
ALIGNER_TEAM_ID
|
USAGE
|
}
|
|
RELEASE_DIR="${1:-}"
|
[ -n "$RELEASE_DIR" ] || { usage; exit 2; }
|
[ -d "$RELEASE_DIR" ] || fail "release dir does not exist: $RELEASE_DIR"
|
|
VERSION="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$INFO_PLIST" 2>/dev/null)" \
|
|| fail "unable to read CFBundleShortVersionString"
|
BUILD="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleVersion' "$INFO_PLIST" 2>/dev/null)" \
|
|| fail "unable to read CFBundleVersion"
|
MINIMUM_MACOS="$(/usr/libexec/PlistBuddy -c 'Print :LSMinimumSystemVersion' "$INFO_PLIST" 2>/dev/null)" \
|
|| fail "unable to read LSMinimumSystemVersion"
|
DMG_NAME="Aligner-${VERSION}-build${BUILD}.dmg"
|
DMG_PATH="$RELEASE_DIR/$DMG_NAME"
|
SUMS_PATH="$RELEASE_DIR/SHA256SUMS.txt"
|
INTERNAL_MANIFEST="$RELEASE_DIR/release-manifest.json"
|
PUBLIC_MANIFEST="$RELEASE_DIR/public-latest.json"
|
|
[[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] \
|
|| fail "version must be MAJOR.MINOR.PATCH, got: $VERSION"
|
[[ "$BUILD" =~ ^[0-9]{8}\.[0-9]{4}$ ]] \
|
|| fail "build must be YYYYMMDD.HHMM, got: $BUILD"
|
[ -f "$DMG_PATH" ] || fail "missing expected DMG: $DMG_PATH"
|
[ -f "$SUMS_PATH" ] || fail "missing SHA256SUMS.txt: $SUMS_PATH"
|
|
DMG_SHA256="$(awk -v name="$DMG_NAME" '$2 == name { print $1 }' "$SUMS_PATH")"
|
[ -n "$DMG_SHA256" ] || fail "SHA256SUMS.txt does not contain $DMG_NAME"
|
ACTUAL_SHA="$(shasum -a 256 "$DMG_PATH" | awk '{ print $1 }')"
|
[ "$DMG_SHA256" = "$ACTUAL_SHA" ] || fail "SHA256 mismatch for $DMG_NAME"
|
DMG_SIZE="$(stat -f%z "$DMG_PATH")"
|
|
GIT_BRANCH="$(git -C "$OUTPUT_ROOT" rev-parse --abbrev-ref HEAD 2>/dev/null || true)"
|
GIT_COMMIT="$(git -C "$OUTPUT_ROOT" rev-parse HEAD 2>/dev/null || true)"
|
EXPECTED_GIT_TAG="v${VERSION}-build${BUILD}"
|
ACTUAL_GIT_TAG="$(git -C "$OUTPUT_ROOT" describe --tags --exact-match 2>/dev/null || true)"
|
if [ "$ACTUAL_GIT_TAG" = "$EXPECTED_GIT_TAG" ]; then
|
GIT_TAG="$ACTUAL_GIT_TAG"
|
else
|
GIT_TAG=""
|
fi
|
if git -C "$OUTPUT_ROOT" diff --quiet --ignore-submodules -- 2>/dev/null \
|
&& git -C "$OUTPUT_ROOT" diff --cached --quiet --ignore-submodules -- 2>/dev/null \
|
&& [ -z "$(git -C "$OUTPUT_ROOT" ls-files --others --exclude-standard)" ]; then
|
SOURCE_STATUS="clean"
|
else
|
SOURCE_STATUS="dirty"
|
fi
|
|
CREATED_AT="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
|
CREATED_BY="$(id -un)"
|
NOTARIZED=false
|
if [ "${ALIGNER_RELEASE_NOTARIZED:-0}" = "1" ]; then
|
NOTARIZED=true
|
fi
|
|
/usr/bin/python3 - \
|
"$INTERNAL_MANIFEST" \
|
"$PUBLIC_MANIFEST" \
|
"$VERSION" \
|
"$BUILD" \
|
"$MINIMUM_MACOS" \
|
"$DMG_PATH" \
|
"$DMG_SHA256" \
|
"$DMG_SIZE" \
|
"$GIT_BRANCH" \
|
"$GIT_COMMIT" \
|
"$GIT_TAG" \
|
"$EXPECTED_GIT_TAG" \
|
"$SOURCE_STATUS" \
|
"$CREATED_AT" \
|
"$CREATED_BY" \
|
"$NOTARIZED" <<'PY'
|
import json
|
import os
|
import pathlib
|
import sys
|
|
(
|
internal_path,
|
public_path,
|
version,
|
build,
|
minimum_macos,
|
dmg_path,
|
sha256,
|
size,
|
git_branch,
|
git_commit,
|
git_tag,
|
expected_git_tag,
|
source_status,
|
created_at,
|
created_by,
|
notarized_text,
|
) = sys.argv[1:]
|
|
notarized = notarized_text.lower() == "true"
|
download_url = os.environ.get("ALIGNER_RELEASE_DOWNLOAD_URL", "")
|
release_notes_url = os.environ.get("ALIGNER_RELEASE_NOTES_URL", "")
|
|
internal = {
|
"product": "Aligner",
|
"version": version,
|
"build": build,
|
"gitBranch": git_branch,
|
"gitCommit": git_commit,
|
"gitTag": git_tag,
|
"expectedGitTag": expected_git_tag,
|
"sourceStatus": source_status,
|
"buildCommand": "03-O/C3.tools/package-app.sh",
|
"signingIdentity": os.environ.get("ALIGNER_SIGNING_IDENTITY", ""),
|
"teamID": os.environ.get("ALIGNER_TEAM_ID", ""),
|
"notarizationRequestID": os.environ.get("ALIGNER_NOTARIZATION_REQUEST_ID", ""),
|
"notarizationStatus": "passed" if notarized else "not-submitted",
|
"stapleStatus": "not-run",
|
"codesignVerifyStatus": "not-run",
|
"spctlStatus": "not-run",
|
"dmgPath": dmg_path,
|
"dmgSHA256": sha256,
|
"dmgSize": int(size),
|
"qaCommands": [],
|
"qaReports": [],
|
"createdAt": created_at,
|
"createdBy": created_by,
|
}
|
|
public = {
|
"product": "Aligner",
|
"version": version,
|
"build": build,
|
"minimumMacOS": minimum_macos or "14.0",
|
"architecture": "arm64",
|
"downloadURL": download_url,
|
"sha256": sha256,
|
"size": int(size),
|
"notarized": notarized,
|
"releaseNotesURL": release_notes_url,
|
"publishedAt": created_at if download_url else "",
|
}
|
|
pathlib.Path(internal_path).write_text(
|
json.dumps(internal, indent=2, ensure_ascii=False, sort_keys=True) + "\n",
|
encoding="utf-8",
|
)
|
pathlib.Path(public_path).write_text(
|
json.dumps(public, indent=2, ensure_ascii=False, sort_keys=True) + "\n",
|
encoding="utf-8",
|
)
|
PY
|
|
echo "Internal manifest: $INTERNAL_MANIFEST"
|
echo "Public manifest: $PUBLIC_MANIFEST"
|
