Skip to content

Commit 1e1ca9f

Browse files
vincentkocvincentkoc
committed
fix: harden release scripts
1 parent e4a14f4 commit 1e1ca9f

7 files changed

Lines changed: 51 additions & 22 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,18 @@ on:
88
jobs:
99
macos:
1010
runs-on: macos-15
11+
env:
12+
SWIFTLINT_VERSION: 0.64.0
1113
steps:
1214
- uses: actions/checkout@v6
1315
- name: Swift version
1416
run: swift --version
1517
- name: Install SwiftLint
16-
run: brew install swiftlint
18+
run: |
19+
curl -fsSL "https://github.com/realm/SwiftLint/releases/download/${SWIFTLINT_VERSION}/portable_swiftlint.zip" -o /tmp/swiftlint.zip
20+
unzip -q /tmp/swiftlint.zip -d /tmp/swiftlint
21+
sudo install -m 0755 /tmp/swiftlint/swiftlint /usr/local/bin/swiftlint
22+
swiftlint version
1723
- name: Lint
1824
run: make lint
1925
- name: Test

‎.github/workflows/crabbox-hydrate.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,12 @@ jobs:
5656
set -euo pipefail
5757
job="${CRABBOX_JOB}"
5858
if [ -z "$job" ]; then job=hydrate; fi
59+
case "$job" in
60+
''|*[!A-Za-z0-9._-]*)
61+
echo "Invalid crabbox_job" >&2
62+
exit 2
63+
;;
64+
esac
5965
case "$CRABBOX_ID" in
6066
''|*[!A-Za-z0-9._-]*)
6167
echo "Invalid crabbox_id" >&2

‎Tests/imsgTests/ReleasePackagingTests.swift‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ func universalBuildScriptDefaultsToBothMacArchitectures() throws {
1717
let script = try readRepositoryFile("scripts/build-universal.sh")
1818

1919
#expect(script.contains(#"ARCHES_VALUE=${ARCHES:-"arm64 x86_64"}"#))
20-
#expect(script.contains(#"HELPER_ARCHES_VALUE=${HELPER_ARCHES:-"arm64e x86_64"}"#))
20+
#expect(script.contains(#"HELPER_ARCHES_VALUE=${HELPER_ARCHES:-"$ARCHES_VALUE"}"#))
2121
#expect(script.contains("lipo -create"))
2222
#expect(script.contains("imsg-bridge-helper.dylib"))
2323
#expect(script.contains(#"codesign --force --sign -"#))

‎scripts/build-linux.sh‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,6 @@ ROOT=$(cd "$(dirname "$0")/.." && pwd)
55
APP_NAME="imsg"
66
OUTPUT_DIR="${OUTPUT_DIR:-${ROOT}/dist}"
77
BUILD_MODE=${BUILD_MODE:-release}
8-
TARGET_TRIPLE=$(swift -print-target-info | python3 -c 'import json,sys; print(json.load(sys.stdin)["target"]["triple"])')
9-
BUILD_DIR="${ROOT}/.build/${TARGET_TRIPLE}/${BUILD_MODE}"
10-
ARCHIVE_NAME="${APP_NAME}-linux-x86_64.tar.gz"
118
DIST_DIR="$(mktemp -d "/tmp/${APP_NAME}-linux.XXXXXX")"
129

1310
cleanup() {
@@ -20,6 +17,11 @@ if [[ "$(uname -s)" != "Linux" ]]; then
2017
exit 1
2118
fi
2219

20+
TARGET_TRIPLE=$(swift -print-target-info | python3 -c 'import json,sys; print(json.load(sys.stdin)["target"]["triple"])')
21+
TARGET_ARCH="${TARGET_TRIPLE%%-*}"
22+
BUILD_DIR="${ROOT}/.build/${TARGET_TRIPLE}/${BUILD_MODE}"
23+
ARCHIVE_NAME="${APP_NAME}-linux-${TARGET_ARCH}.tar.gz"
24+
2325
swift build -c "$BUILD_MODE" --product "$APP_NAME"
2426

2527
cp "${BUILD_DIR}/${APP_NAME}" "${DIST_DIR}/${APP_NAME}"

‎scripts/build-universal.sh‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ ENTITLEMENTS="${ROOT}/Resources/imsg.entitlements"
88
OUTPUT_DIR="${OUTPUT_DIR:-${ROOT}/bin}"
99
ARCHES_VALUE=${ARCHES:-"arm64 x86_64"}
1010
ARCH_LIST=( ${ARCHES_VALUE} )
11-
HELPER_ARCHES_VALUE=${HELPER_ARCHES:-"arm64e x86_64"}
11+
HELPER_ARCHES_VALUE=${HELPER_ARCHES:-"$ARCHES_VALUE"}
1212
HELPER_ARCH_LIST=( ${HELPER_ARCHES_VALUE} )
1313
BUILD_MODE=${BUILD_MODE:-release}
1414
CODESIGN_IDENTITY=${CODESIGN_IDENTITY:-"-"}
@@ -63,12 +63,14 @@ for bundle in "${ROOT}/.build/${FIRST_ARCH}-apple-macosx/${BUILD_MODE}"/*.bundle
6363
done
6464

6565
mkdir -p "$OUTPUT_DIR"
66-
if command -v trash >/dev/null 2>&1; then
67-
for existing in "$OUTPUT_DIR/$APP_NAME" "$OUTPUT_DIR/$HELPER_NAME" "$OUTPUT_DIR"/*.bundle; do
68-
[[ -e "$existing" ]] || continue
66+
for existing in "$OUTPUT_DIR/$APP_NAME" "$OUTPUT_DIR/$HELPER_NAME" "$OUTPUT_DIR"/*.bundle; do
67+
[[ -e "$existing" ]] || continue
68+
if command -v trash >/dev/null 2>&1; then
6969
trash "$existing"
70-
done
71-
fi
70+
else
71+
rm -rf -- "$existing"
72+
fi
73+
done
7274

7375
cp "${DIST_DIR}/${APP_NAME}" "$OUTPUT_DIR/$APP_NAME"
7476
cp "${DIST_DIR}/${HELPER_NAME}" "$OUTPUT_DIR/$HELPER_NAME"

‎scripts/patch-deps.sh‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,6 @@ set -euo pipefail
44
SQLITE_PACKAGE=".build/checkouts/SQLite.swift/Package.swift"
55
PHONE_NUMBER_BUNDLE=".build/checkouts/PhoneNumberKit/PhoneNumberKit/Bundle+Resources.swift"
66

7-
if [[ ! -f "$SQLITE_PACKAGE" ]]; then
8-
exit 0
9-
fi
10-
11-
chmod u+w "$SQLITE_PACKAGE" || true
12-
137
# Try python3, then python, then fail
148
if command -v python3 >/dev/null 2>&1; then
159
PYTHON_BIN="python3"
@@ -20,22 +14,28 @@ else
2014
exit 1
2115
fi
2216

23-
$PYTHON_BIN - <<'PY'
17+
if [[ -f "$SQLITE_PACKAGE" ]]; then
18+
chmod u+w "$SQLITE_PACKAGE" || true
19+
$PYTHON_BIN - <<'PY'
20+
import sys
2421
from pathlib import Path
2522
path = Path('.build/checkouts/SQLite.swift/Package.swift')
2623
text = path.read_text()
2724
if 'PrivacyInfo.xcprivacy' in text:
2825
raise SystemExit(0)
2926
needle = 'exclude: [\n "Info.plist"\n ]'
3027
replacement = 'exclude: [\n "Info.plist",\n "PrivacyInfo.xcprivacy"\n ]'
31-
if needle in text:
32-
text = text.replace(needle, replacement)
33-
path.write_text(text)
28+
if needle not in text:
29+
print(f"Error: SQLite.swift Package.swift no longer contains the expected resource exclude block: {path}", file=sys.stderr)
30+
raise SystemExit(1)
31+
path.write_text(text.replace(needle, replacement))
3432
PY
33+
fi
3534

3635
if [[ -f "$PHONE_NUMBER_BUNDLE" ]]; then
3736
chmod u+w "$PHONE_NUMBER_BUNDLE" || true
3837
$PYTHON_BIN - <<'PY'
38+
import sys
3939
from pathlib import Path
4040
4141
path = Path(".build/checkouts/PhoneNumberKit/PhoneNumberKit/Bundle+Resources.swift")
@@ -45,12 +45,18 @@ updated = False
4545
if "#if DEBUG && SWIFT_PACKAGE" in text:
4646
text = text.replace("#if DEBUG && SWIFT_PACKAGE", "#if SWIFT_PACKAGE")
4747
updated = True
48+
elif "#if SWIFT_PACKAGE" not in text:
49+
print(f"Error: PhoneNumberKit bundle guard no longer matches expected Swift package condition: {path}", file=sys.stderr)
50+
raise SystemExit(1)
4851
4952
needle = "Bundle.main.bundleURL,\n"
5053
insert = "Bundle.main.bundleURL,\n Bundle.main.bundleURL.resolvingSymlinksInPath(),\n"
5154
if "resolvingSymlinksInPath()" not in text and needle in text:
5255
text = text.replace(needle, insert)
5356
updated = True
57+
elif "resolvingSymlinksInPath()" not in text:
58+
print(f"Error: PhoneNumberKit bundle URL list no longer contains the expected insertion point: {path}", file=sys.stderr)
59+
raise SystemExit(1)
5460
5561
if updated:
5662
path.write_text(text)

‎scripts/sign-and-notarize.sh‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ OUTPUT_DIR="${OUTPUT_DIR:-/tmp}"
1212
ZIP_PATH="${OUTPUT_DIR}/imsg-macos.zip"
1313
ARCHES_VALUE=${ARCHES:-"arm64 x86_64"}
1414
ARCH_LIST=( ${ARCHES_VALUE} )
15-
HELPER_ARCHES_VALUE=${HELPER_ARCHES:-"arm64e x86_64"}
15+
HELPER_ARCHES_VALUE=${HELPER_ARCHES:-"$ARCHES_VALUE"}
1616
HELPER_ARCH_LIST=( ${HELPER_ARCHES_VALUE} )
1717
DIST_DIR="$(mktemp -d "/tmp/${APP_NAME}-dist.XXXXXX")"
1818
API_KEY_FILE="$(mktemp "/tmp/${APP_NAME}-notary.XXXXXX.p8")"
@@ -51,6 +51,13 @@ clang -dynamiclib "${HELPER_CLANG_ARCH_ARGS[@]}" -fobjc-arc \
5151
-o "$DIST_DIR/$HELPER_NAME" \
5252
"$ROOT/Sources/IMsgHelper/IMsgInjected.m"
5353

54+
for ARCH in "${ARCH_LIST[@]}"; do
55+
if ! lipo -archs "$DIST_DIR/$HELPER_NAME" | tr ' ' '\n' | grep -Fxq "$ARCH"; then
56+
echo "Helper missing required architecture slice: $ARCH" >&2
57+
exit 1
58+
fi
59+
done
60+
5461
codesign --force --timestamp --options runtime --sign "$CODESIGN_IDENTITY" \
5562
--entitlements "$ENTITLEMENTS" \
5663
"$DIST_DIR/imsg"

0 commit comments

Comments
 (0)