765ec4188f
The tree adds the installer, service and test paths admitted by this source commit. Nothing else changes about what may cross. Source-Sha: 3e4a3aa4ce092e9e3f51bc78daf3ddc14d9638f8 Policy-Sha: 3e4a3aa4ce092e9e3f51bc78daf3ddc14d9638f8 Tree-Digest: 89d6fce3828a0e0de0c8eeb41ee6750f4462217e2a04b5190297134d7f4a50c3
74 lines
2.7 KiB
Shell
Executable file
74 lines
2.7 KiB
Shell
Executable file
#!/usr/bin/env bash
|
|
# Canonical CI entry point for the RedFlag Server MSI custody build.
|
|
|
|
set -euo pipefail
|
|
|
|
[ "$#" -eq 6 ] || {
|
|
echo "usage: $0 <server-exe> <redflag-version> <output-msi> <proof-json> <source-commit> <source-ref>" >&2
|
|
exit 2
|
|
}
|
|
|
|
SERVER_EXE="$1"
|
|
REDFLAG_VERSION="$2"
|
|
OUTPUT_MSI="$3"
|
|
PROOF_JSON="$4"
|
|
SOURCE_COMMIT="$5"
|
|
SOURCE_REF="$6"
|
|
ROOT=$(cd "$(dirname "$0")/../.." && pwd)
|
|
|
|
for tool in jq msiinfo msiextract wixl python3; do
|
|
command -v "$tool" >/dev/null || { echo "$tool not found" >&2; exit 2; }
|
|
done
|
|
[ "$(wixl --version)" = "0.106" ] || {
|
|
echo "wixl 0.106 is required for the Server UI; use provision-msitools.sh" >&2
|
|
exit 2
|
|
}
|
|
MSI_VERSION=$(python3 "$ROOT/installer/windows/msi_version.py" "$REDFLAG_VERSION")
|
|
[ -f "$SERVER_EXE" ] || { echo "no such Server executable: $SERVER_EXE" >&2; exit 2; }
|
|
|
|
SERVER_EXE=$(realpath "$SERVER_EXE")
|
|
OUTPUT_MSI=$(realpath -m "$OUTPUT_MSI")
|
|
PROOF_JSON=$(realpath -m "$PROOF_JSON")
|
|
mkdir -p "$ROOT/installer/windows/dist" "$(dirname "$OUTPUT_MSI")" "$(dirname "$PROOF_JSON")"
|
|
cp "$SERVER_EXE" "$ROOT/installer/windows/dist/redflag-server-windows-amd64.exe"
|
|
python3 "$ROOT/installer/windows/render-license.py" \
|
|
"$ROOT/LICENSE" "$ROOT/installer/windows/dist/License.rtf"
|
|
|
|
(
|
|
cd "$ROOT/installer/windows"
|
|
wixl -a x64 --ext ui Product.wxs ServerUI.wxs -D RedFlagVersion="$MSI_VERSION" -o "$OUTPUT_MSI"
|
|
)
|
|
|
|
CAB_FILE=$(find "$(dirname "$OUTPUT_MSI")" "$ROOT/installer/windows" \
|
|
-maxdepth 2 -type f -name '*.cab' -print -quit)
|
|
if [ -n "$CAB_FILE" ]; then
|
|
echo "[FAIL] external cabinet produced"
|
|
find "$(dirname "$OUTPUT_MSI")" "$ROOT/installer/windows" \
|
|
-maxdepth 2 -type f -name '*.cab' -print
|
|
exit 1
|
|
fi
|
|
|
|
"$ROOT/installer/windows/verify-msi.sh" \
|
|
"$OUTPUT_MSI" \
|
|
"$ROOT/installer/windows/dist/redflag-server-windows-amd64.exe" \
|
|
"$ROOT/installer/windows/config/redflag.env.example" \
|
|
--redflag-version "$REDFLAG_VERSION" \
|
|
--msi-version "$MSI_VERSION" \
|
|
--source-commit "$SOURCE_COMMIT" \
|
|
--source-ref "$SOURCE_REF" \
|
|
--proof-record "$PROOF_JSON"
|
|
|
|
python3 "$ROOT/installer/windows/verify-msi-boundary.py" "$OUTPUT_MSI"
|
|
|
|
FIXTURE="$ROOT/installer/windows/testdata/run3181-hollow.msi"
|
|
if "$ROOT/installer/windows/verify-msi.sh" "$FIXTURE" \
|
|
"$ROOT/installer/windows/dist/redflag-server-windows-amd64.exe" \
|
|
"$ROOT/installer/windows/config/redflag.env.example" > /tmp/hollow-msi.log 2>&1; then
|
|
echo "[FAIL] hollow MSI regression fixture passed custody verification"
|
|
cat /tmp/hollow-msi.log
|
|
exit 1
|
|
fi
|
|
grep -E '^\[FAIL\]|^RESULT:' /tmp/hollow-msi.log
|
|
echo "Hollow MSI regression fixture rejected, as required."
|
|
echo "Installer custody proof record:"
|
|
jq . "$PROOF_JSON"
|