Yoshihiro OKUMURA
c24a285cf5
`mdrs selfupdate` replaced the running binary with whatever the release endpoint returned, checking only that the transport succeeded. Nothing proved the archive was the one the release publishes. - Compare the downloaded archive against the release's `.sha256` asset and abort the update on a mismatch. - Report a release that publishes no checksum as unverified, rather than letting its absence pass for a verified download. - Exclude `.sha256` assets when matching the archive for the build target: those assets carry the target name too. - Write and upload a checksum beside every archive, from the Gitea release workflow and the three local build scripts.
72 lines
2.6 KiB
YAML
72 lines
2.6 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
jobs:
|
|
build-linux-x86_64:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Rust stable
|
|
run: |
|
|
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
|
|
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
|
|
- name: Add musl target
|
|
run: rustup target add x86_64-unknown-linux-musl
|
|
- name: Install musl tools
|
|
run: sudo apt-get update && sudo apt-get install -y musl-tools
|
|
- name: Build
|
|
run: cargo build --release --target x86_64-unknown-linux-musl
|
|
- name: Create archive
|
|
run: |
|
|
VERSION=${GITHUB_REF_NAME#v}
|
|
TARGET=x86_64-unknown-linux-musl
|
|
ARCHIVE="mdrs-${VERSION}-${TARGET}.tar.gz"
|
|
tar -czf "${ARCHIVE}" -C target/${TARGET}/release mdrs
|
|
# Published alongside the archive so `mdrs selfupdate` can check what it fetched.
|
|
sha256sum "${ARCHIVE}" > "${ARCHIVE}.sha256"
|
|
echo "ARCHIVE=${ARCHIVE}" >> "$GITHUB_ENV"
|
|
- name: Create release and upload asset
|
|
uses: akkuman/gitea-release-action@v1
|
|
with:
|
|
token: ${{ github.token }}
|
|
files: |
|
|
${{ env.ARCHIVE }}
|
|
${{ env.ARCHIVE }}.sha256
|
|
|
|
build-linux-aarch64:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Rust stable
|
|
run: |
|
|
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
|
|
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
|
|
- name: Install cargo-zigbuild
|
|
run: |
|
|
pip3 install ziglang --break-system-packages
|
|
cargo install cargo-zigbuild --locked
|
|
- name: Add aarch64 musl target
|
|
run: rustup target add aarch64-unknown-linux-musl
|
|
- name: Build
|
|
run: cargo zigbuild --release --target aarch64-unknown-linux-musl
|
|
- name: Create archive
|
|
run: |
|
|
VERSION=${GITHUB_REF_NAME#v}
|
|
TARGET=aarch64-unknown-linux-musl
|
|
ARCHIVE="mdrs-${VERSION}-${TARGET}.tar.gz"
|
|
tar -czf "${ARCHIVE}" -C target/${TARGET}/release mdrs
|
|
# Published alongside the archive so `mdrs selfupdate` can check what it fetched.
|
|
sha256sum "${ARCHIVE}" > "${ARCHIVE}.sha256"
|
|
echo "ARCHIVE=${ARCHIVE}" >> "$GITHUB_ENV"
|
|
- name: Create release and upload asset
|
|
uses: akkuman/gitea-release-action@v1
|
|
with:
|
|
token: ${{ github.token }}
|
|
files: |
|
|
${{ env.ARCHIVE }}
|
|
${{ env.ARCHIVE }}.sha256
|