agw
f3a6822744
Serve from /srv/tarballz on CT148 via a 'location /tarballz/' alias, NOT from under /var/www/asger: the asger-web deploy swaps that whole directory atomically, so tarballs kept inside it would be deleted on the next site deploy. CT148's rootfs was 3G with 2.7G free - one tarball would have filled it - so it is grown to 15G; speedy's thin pool has room even though vgs reports the VG nearly full. Publishing uploads to a .part name and renames on arrival so a download can never see a truncated file, verifies sha256 on the host, then fetches the public URL and checks it against the sha256 baked into the PKGBUILD. Both checks run before the AUR push, so the package cannot go out pointing at a missing file. Old tarballs are pruned to the newest three. GH_TOKEN is kept but demoted to an optional GITHUB_PAT for R module downloads; it no longer has anything to do with publishing.
65 lines
2.7 KiB
Bash
Executable File
65 lines
2.7 KiB
Bash
Executable File
#!/bin/bash
|
|
# Publish the built tarball to asger.weirsoe.dk, which is what the AUR PKGBUILD
|
|
# downloads from.
|
|
#
|
|
# TARBALL_SSH_KEY private key authorised on the web host (required)
|
|
# TARBALL_HOST web host, e.g. 192.168.10.148 (required)
|
|
# TARBALL_PATH directory on that host (required)
|
|
# KEEP_RELEASES how many tarballs to retain (default 3)
|
|
# $1 path to the tarball to upload
|
|
#
|
|
# The files live in /srv/tarballz, deliberately NOT under /var/www/asger: the
|
|
# asger-web deploy replaces that directory atomically (build into .new, swap,
|
|
# delete .old), so anything stored inside it disappears on the next site deploy.
|
|
# nginx exposes /srv/tarballz via a `location /tarballz/` alias.
|
|
|
|
set -euo pipefail
|
|
|
|
TARBALL="${1:?path to tarball is required}"
|
|
: "${TARBALL_SSH_KEY:?TARBALL_SSH_KEY is required}"
|
|
: "${TARBALL_HOST:?TARBALL_HOST is required}"
|
|
: "${TARBALL_PATH:?TARBALL_PATH is required}"
|
|
KEEP_RELEASES="${KEEP_RELEASES:-3}"
|
|
|
|
name="$(basename "$TARBALL")"
|
|
|
|
mkdir -p ~/.ssh
|
|
printf '%s\n' "$TARBALL_SSH_KEY" > ~/.ssh/tarball_key
|
|
chmod 600 ~/.ssh/tarball_key
|
|
ssh-keyscan -t ed25519 "$TARBALL_HOST" >> ~/.ssh/known_hosts 2>/dev/null || true
|
|
SSH=(ssh -i "$HOME/.ssh/tarball_key" -o StrictHostKeyChecking=accept-new)
|
|
|
|
echo ":: uploading ${name} ($(du -h "$TARBALL" | cut -f1)) to ${TARBALL_HOST}:${TARBALL_PATH}"
|
|
|
|
# Upload to a temporary name and rename on arrival, so a download that starts
|
|
# mid-transfer can never see a truncated file at the final URL.
|
|
"${SSH[@]}" "root@${TARBALL_HOST}" "mkdir -p '${TARBALL_PATH}'"
|
|
"${SSH[@]}" "root@${TARBALL_HOST}" "cat > '${TARBALL_PATH}/.${name}.part'" < "$TARBALL"
|
|
"${SSH[@]}" "root@${TARBALL_HOST}" "mv '${TARBALL_PATH}/.${name}.part' '${TARBALL_PATH}/${name}' && chmod 644 '${TARBALL_PATH}/${name}'"
|
|
|
|
echo ":: verifying the uploaded copy matches"
|
|
local_sum="$(sha256sum "$TARBALL" | awk '{print $1}')"
|
|
remote_sum="$("${SSH[@]}" "root@${TARBALL_HOST}" "sha256sum '${TARBALL_PATH}/${name}'" | awk '{print $1}')"
|
|
if [[ "$local_sum" != "$remote_sum" ]]; then
|
|
echo "error: checksum mismatch after upload" >&2
|
|
echo " local $local_sum" >&2
|
|
echo " remote $remote_sum" >&2
|
|
exit 1
|
|
fi
|
|
echo ":: sha256 matches ($local_sum)"
|
|
|
|
# Old releases are kept so that a user mid-install of the previous version is
|
|
# not left with a dead URL, but not forever - each one is well over a gigabyte.
|
|
echo ":: pruning to the newest ${KEEP_RELEASES} tarballs"
|
|
"${SSH[@]}" "root@${TARBALL_HOST}" "
|
|
cd '${TARBALL_PATH}' || exit 0
|
|
ls -1t jasp-desktop-*.tar.zst 2>/dev/null | tail -n +\$((${KEEP_RELEASES} + 1)) | while read -r old; do
|
|
echo \" removing \$old\"
|
|
rm -f -- \"\$old\"
|
|
done
|
|
echo ' remaining:'
|
|
ls -1sh jasp-desktop-*.tar.zst 2>/dev/null | sed 's/^/ /'
|
|
"
|
|
|
|
echo ":: published"
|