native-packages 0.2.0

data/examples/native-packages-all-formats.yaml

@@ -0,0 +1,87 @@
+# Supply the listed build outputs before running this example.
+schema: 1
+tool:
+  version: '0.2.0'
+  nfpm: '2.47.0'
+nfpm:
+  name: example-app
+  description: Example native application
+  maintainer: Example Maintainer <maintainer@example.org>
+  license: MIT
+  contents:
+    - src: '@PAYLOAD@/example-app'
+      dst: /usr/bin/example-app
+      file_info:
+        mode: 0755
+  overrides:
+    archlinux:
+      depends: [glibc]
+targets:
+  linux-glibc-amd64:
+    platform: linux
+    arch: amd64
+    libc: glibc
+    formats: [deb, rpm, archlinux]
+    input:
+      kind: directory
+      local: dist/linux-glibc-amd64
+  linux-static-amd64:
+    platform: linux
+    arch: amd64
+    libc: static
+    formats: [apk]
+    input:
+      kind: directory
+      local: dist/linux-static-amd64
+  openwrt-amd64:
+    platform: linux
+    arch: amd64
+    libc: static
+    abi: OpenWrt x86_64; validate against your supported device image
+    formats: [ipk]
+    input:
+      kind: directory
+      local: dist/openwrt-amd64
+  windows-amd64:
+    platform: windows
+    arch: amd64
+    formats: [msix]
+    input:
+      kind: directory
+      local: dist/windows-amd64
+    # To sign, add an argument array calling your Windows SDK SignTool script:
+    # after_package: [pwsh, -File, scripts/sign-msix.ps1, '@PACKAGE@']
+    nfpm:
+      contents:
+        - src: '@PAYLOAD@/example-app.exe'
+          dst: /example-app.exe
+        - src: '@PAYLOAD@/logo150.png'
+          dst: /Assets/logo150.png
+        - src: '@PAYLOAD@/logo44.png'
+          dst: /Assets/logo44.png
+      msix:
+        publisher: CN=ExampleMaintainer
+        properties:
+          logo: Assets/logo150.png
+        applications:
+          - id: App
+            executable: example-app.exe
+            visual_elements:
+              display_name: Example App
+              description: Example native application
+              square150x150_logo: Assets/logo150.png
+              square44x44_logo: Assets/logo44.png
+  source:
+    kind: source
+    platform: linux
+    arch: all
+    formats: [srpm]
+    input:
+      kind: directory
+      local: dist/sources
+    nfpm:
+      contents:
+        - src: '@PAYLOAD@/example-app.spec'
+          dst: /example-app.spec
+        - src: '@PAYLOAD@/example-app-@VERSION@.tar.gz'
+          dst: /example-app-@VERSION@.tar.gz

data/examples/native-packages.yaml

@@ -0,0 +1,31 @@
+schema: 1
+tool:
+  version: '0.2.0'
+  nfpm: '2.47.0'
+nfpm:
+  name: example-app
+  maintainer: Example Maintainer <maintainer@example.org>
+  description: Example native application
+  homepage: https://github.com/example/example-app
+  license: MIT
+  contents:
+    - src: '@PAYLOAD@/example-app'
+      dst: /usr/bin/example-app
+      file_info:
+        mode: 0755
+    - src: '@PAYLOAD@/LICENSE'
+      dst: /usr/share/licenses/example-app/LICENSE
+      file_info:
+        mode: 0644
+targets:
+  linux-amd64:
+    platform: linux
+    arch: amd64
+    libc: static
+    formats: [deb, rpm, archlinux]
+    input:
+      local: dist/example-app_@VERSION@_linux_amd64.tar.gz
+      release_asset: example-app_@VERSION@_linux_amd64.tar.gz
+release:
+  repository: example/example-app
+  checksums: checksums.txt

data/examples/packaging/arch/example-app-bin/PKGBUILD.in

@@ -0,0 +1,18 @@
+pkgname=example-app-bin
+pkgver=@VERSION@
+pkgrel=@PKGREL@
+pkgdesc='Example native application'
+arch=('x86_64' 'aarch64')
+url='@UPSTREAM@'
+license=('MIT')
+provides=('example-app')
+conflicts=('example-app')
+source_x86_64=('@AMD64_URL@')
+source_aarch64=('@ARM64_URL@')
+sha256sums_x86_64=('@AMD64_SHA256@')
+sha256sums_aarch64=('@ARM64_SHA256@')
+
+package() {
+  install -Dm755 example-app "$pkgdir/usr/bin/example-app"
+  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/example-app/LICENSE"
+}

data/examples/packaging/nfpm.yml

@@ -0,0 +1,15 @@
+maintainer: Example Maintainer <maintainer@example.org>
+description: Example native application
+homepage: https://github.com/example/example-app
+license: MIT
+contents:
+  - src: '@PAYLOAD@/example-app'
+    dst: /usr/bin/example-app
+    file_info:
+      mode: 0755
+  - src: '@PAYLOAD@/LICENSE'
+    dst: /usr/share/licenses/example-app/LICENSE
+    file_info:
+      mode: 0644
+# Add actual runtime dependencies under overrides.deb.depends and
+# overrides.rpm.depends, including dynamically loaded libraries.

data/examples/packaging/project.yml

@@ -0,0 +1,15 @@
+version: 1
+name: example-app
+repository: example/example-app
+assets:
+  AMD64:
+    file: example-app_@VERSION@_linux_amd64.tar.gz
+  ARM64:
+    file: example-app_@VERSION@_linux_arm64.tar.gz
+templates:
+  arch/example-app-bin/PKGBUILD: packaging/arch/example-app-bin/PKGBUILD.in
+binary:
+  architectures:
+    amd64: AMD64
+    arm64: ARM64
+  nfpm: packaging/nfpm.yml

data/examples/packaging/repositories.yml

@@ -0,0 +1,14 @@
+version: 1
+repositories:
+  aur-bin:
+    group: aur
+    url: https://aur.archlinux.org/example-app-bin.git
+    push_url: ssh://aur@aur.archlinux.org/example-app-bin.git
+    branch: master
+    package_path: .
+    files:
+      arch/example-app-bin/PKGBUILD: PKGBUILD
+      arch/example-app-bin/.SRCINFO: .SRCINFO
+    version_file: PKGBUILD
+    version_pattern: '^pkgver=(\S+)'
+    publish: push

data/exe/native-packages

@@ -0,0 +1,5 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require "native_packages"
+NativePackages::CLI.run(Dir.pwd, ARGV)

data/lib/native_packages/build.rb

@@ -0,0 +1,306 @@
+# frozen_string_literal: true
+
+require_relative "configuration"
+require_relative "inspection"
+
+module NativePackages
+  class Build
+    include Support
+    attr_reader :configuration, :root, :project
+
+    def initialize(configuration)
+      @configuration = configuration
+      @root = configuration.root
+      @project = configuration.project
+    end
+
+    def nfpm_version
+      raise Error, "install nFPM #{Configuration::NFPM_VERSION}; https://nfpm.goreleaser.com/docs/install/" unless available?("nfpm")
+      version = capture("nfpm", "--version")[/(?:GitVersion|Version):\s*v?(\d+\.\d+\.\d+)/, 1]
+      if !version && available?("go")
+        executable = ENV.fetch("PATH").split(File::PATH_SEPARATOR).map { |path| File.join(path, Gem.win_platform? ? "nfpm.exe" : "nfpm") }.find { |path| File.file?(path) }
+        version = capture("go", "version", "-m", executable)[/\bmod\s+github\.com\/goreleaser\/nfpm\/v2\s+v(\d+\.\d+\.\d+)/, 1] if executable
+      end
+      wanted = configuration.data.fetch("tool").fetch("nfpm")
+      raise Error, "nFPM version is #{version || 'unknown'}; install #{wanted}" unless version == wanted
+      version
+    end
+
+    def doctor(ids: [], formats: [], release: false)
+      configuration.validate
+      selected = configuration.select(ids: ids, formats: formats)
+      nfpm_version unless selected.empty?
+      required = []
+      required << "readelf" if selected.values.any? { |target| target["platform"] == "linux" && target.fetch("kind", "binary") == "binary" }
+      required << "bsdtar" if selected.values.any? { |target| target.fetch("input").fetch("kind", "archive") == "archive" }
+      required << "curl" if release
+      required += %w[tar xz] unless configuration.data.fetch("templates").empty?
+      missing = required.uniq.reject { |tool| available?(tool) }
+      raise Error, "install required tools: #{missing.join(', ')}" unless missing.empty?
+      if configuration.data.fetch("templates").keys.any? { |path| path.match?(%r{\Aarch/[^/]+/PKGBUILD\z}) }
+        raise Error, "AUR metadata needs makepkg or accessible Docker" unless available?("makepkg") || available?("docker")
+      end
+      selected
+    end
+
+    def version(value, release)
+      if release && value && version_arg(value) != version_arg(release)
+        raise Error, "--release and --version disagree"
+      end
+      value ||= release
+      value ||= capture("git", "describe", "--exact-match", "--tags", "HEAD")
+      version_arg(value)
+    rescue Error => error
+      raise error if value
+      raise Error, "no exact release tag at HEAD; supply --version"
+    end
+
+    def metadata(version, release: false)
+      epoch = ENV["SOURCE_DATE_EPOCH"] && Integer(ENV.fetch("SOURCE_DATE_EPOCH"))
+      ref = release ? "v#{version}^{commit}" : "HEAD"
+      begin
+        epoch ||= Integer(capture("git", "show", "-s", "--format=%ct", ref))
+        git_version = "r#{capture('git', 'rev-list', '--count', ref)}.#{capture('git', 'rev-parse', '--short', ref)}"
+      rescue Error, Errno::ENOENT
+        git_version = "r0.unknown"
+      end
+      configuration.tokens(version, epoch: epoch).merge("GIT_VERSION" => git_version)
+    end
+
+    def run_build(value: nil, release: nil, ids: [], formats: [], output: nil, dry_run: false)
+      configuration.validate
+      selected = configuration.select(ids: ids, formats: formats)
+      number = version(value, release)
+      output = Pathname.new(output || root / "dist/packages" / number).expand_path(root)
+      if dry_run
+        puts JSON.pretty_generate("version" => number, "mode" => release ? "release" : "local", "output" => output.to_s,
+          "targets" => selected.transform_values { |target| target.slice("formats", "platform", "arch", "input", "before_build", "after_package") })
+        return
+      end
+      raise Error, "output exists: #{output}; choose a fresh --output" if output.exist?
+      doctor(ids: ids, formats: formats, release: !!release)
+      info = metadata(number, release: !!release)
+      sources = []
+      expected = release ? release_checksums(info) : nil
+      acquire_assets(info, expected, sources)
+      output.dirname.mkpath
+      Dir.mktmpdir(".native-packages-", output.dirname) do |temporary|
+        staging = Pathname.new(temporary) / "result"
+        staging.mkpath
+        records = []
+        selected.each do |id, target|
+          local = configuration.target_tokens(info, id, target, "")
+          hook = target["before_build"]
+          run(*render_tree(hook, local), env: { "NATIVE_PACKAGES_TARGET" => id, "NATIVE_PACKAGES_VERSION" => number }) if hook && !release
+          input = render_tree(target.fetch("input"), local)
+          source = release ? release_input(input, info, expected) : root / input.fetch("local")
+          raise Error, "input does not exist: #{source}" unless source.exist?
+          if source.directory? && (output.to_s == source.expand_path.to_s || output.to_s.start_with?(source.expand_path.to_s + File::SEPARATOR))
+            raise Error, "package output must be outside the input directory"
+          end
+          sources << { "target" => id, "path" => source.to_s, "sha256" => input_digest(source) }
+          Dir.mktmpdir("native-packages-input-") do |directory|
+            payload = Pathname.new(directory) / "payload"
+            copy_input(source, payload, input.fetch("kind", "archive"))
+            target.fetch("formats").each do |format|
+              package = render_tree(configuration.package(target), configuration.target_tokens(info, id, target, payload))
+              package.merge!("name" => configuration.name, "version" => number, "arch" => target.fetch("arch"),
+                "platform" => target.fetch("platform"), "mtime" => info.fetch("DATE"))
+              inspection = Inspection.new(root, configuration.data.fetch("libraries")).check(package, target, format)
+              config_path = Pathname.new(directory) / "nfpm.yaml"
+              write(config_path, YAML.dump(package))
+              destination = staging / "packages" / id / format
+              destination.mkpath
+              run "nfpm", "package", "--config", config_path, "--packager", format, "--target", destination,
+                env: { "SOURCE_DATE_EPOCH" => info.fetch("SOURCE_DATE_EPOCH").to_s }
+              packages = files(destination)
+              raise Error, "nFPM did not create exactly one #{format} package" unless packages.length == 1
+              if target["after_package"]
+                signing = configuration.target_tokens(info, id, target, payload).merge("PACKAGE" => packages.first.to_s, "FORMAT" => format)
+                run(*render_tree(target.fetch("after_package"), signing), env: { "NATIVE_PACKAGES_TARGET" => id, "NATIVE_PACKAGES_VERSION" => number })
+                raise Error, "after_package must preserve the package path and output set" unless files(destination) == packages
+              end
+              records << { "target" => id, "format" => format, "path" => packages.first.relative_path_from(staging).to_s,
+                "sha256" => sha256(packages.first), "validation" => inspection }
+            end
+          end
+        end
+        recipes = staging / "recipes"
+        project.generate(recipes, info)
+        project.check(recipes)
+        if !configuration.data.fetch("templates").empty?
+          project.recipe_archive(recipes, staging, name: configuration.name, version: number, epoch: info.fetch("SOURCE_DATE_EPOCH"))
+          (staging / "packaging-checksums.txt").delete
+        end
+        manifest = { "schema" => 1, "name" => configuration.name, "version" => number, "configuration" => configuration.digest,
+          "tool" => configuration.data.fetch("tool"), "epoch" => info.fetch("SOURCE_DATE_EPOCH"), "inputs" => sources,
+          "targets" => selected.transform_values { |target| target.fetch("formats") }, "packages" => records,
+          "files" => files(staging).to_h { |file| [file.relative_path_from(staging).to_s, sha256(file)] } }
+        write(staging / "build.json", JSON.pretty_generate(manifest) + "\n")
+        write(staging / "packaging-checksums.txt", files(staging).map { |file| "#{sha256(file)}  #{file.relative_path_from(staging)}\n" }.join)
+        staging.rename(output)
+      end
+      puts "Built #{selected.values.sum { |target| target.fetch('formats').length }} packages in #{output}"
+      output
+    end
+
+    def release_cache(info)
+      repository = configuration.data.fetch("release").fetch("repository")
+      raise Error, "release.repository must be owner/repository" unless /\A[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\z/.match?(repository)
+      root / ".cache/native-packages/releases" / repository / info.fetch("VERSION")
+    end
+
+    def release_checksums(info)
+      name = configuration.data.fetch("release").fetch("checksums", "checksums.txt")
+      raise Error, "release.checksums must be a filename" unless File.basename(name) == name
+      path = release_cache(info) / name
+      download("#{info.fetch('UPSTREAM')}/releases/download/#{info.fetch('TAG')}/#{name}", path)
+      path.readlines.each_with_object({}) do |line, result|
+        match = /\A([a-fA-F0-9]{64})\s+\*?([^\r\n]+)\s*\z/.match(line) or raise Error, "invalid checksum entry"
+        filename = match[2].strip
+        raise Error, "duplicate checksum: #{filename}" if result.key?(filename)
+        result[filename] = match[1].downcase
+      end
+    end
+
+    def release_input(input, info, checksums, checksummed: true)
+      filename = input.fetch("release_asset")
+      raise Error, "release_asset must be a filename" unless File.basename(filename) == filename && !%w[. ..].include?(filename)
+      path = release_cache(info) / filename
+      url = input.fetch("url", "#{info.fetch('UPSTREAM')}/releases/download/#{info.fetch('TAG')}/#{filename}")
+      download(url, path)
+      if checksummed
+        raise Error, "missing release checksum for #{filename}" unless checksums.key?(filename)
+        raise Error, "checksum mismatch: #{filename}" unless sha256(path) == checksums.fetch(filename)
+      end
+      path
+    end
+
+    def acquire_assets(info, expected, sources)
+      configuration.data.fetch("assets").each do |key, definition|
+        asset = render_tree(definition, info)
+        path = if expected
+          release_input(asset.merge("release_asset" => asset.fetch("file")), info, expected, checksummed: asset.fetch("checksummed", true))
+        else
+          root / asset.fetch("local") { raise Error, "assets.#{key}: declare local input or use --release" }
+        end
+        digest = sha256(path)
+        info["#{key}_SHA256"] = digest
+        info["#{key}_FILE"] = asset.fetch("file")
+        info["#{key}_URL"] = asset.fetch("url", "#{info.fetch('UPSTREAM')}/releases/download/#{info.fetch('TAG')}/#{asset.fetch('file')}")
+        sources << { "asset" => key, "path" => path.to_s, "sha256" => digest }
+      end
+    end
+
+    def input_digest(source)
+      paths = source.directory? ? files(source) : [source]
+      raise Error, "input symlinks must be represented as nFPM symlink contents" if source.symlink? || paths.any?(&:symlink?)
+      return sha256(source) if source.file?
+      OpenSSL::Digest::SHA256.hexdigest(JSON.generate(paths.map { |path| [path.relative_path_from(source).to_s, path.stat.mode & 0o777, sha256(path)] }))
+    end
+
+    def copy_input(source, payload, kind)
+      case kind
+      when "archive" then project.extract(source, payload)
+      when "directory"
+        raise Error, "expected input directory: #{source}" unless source.directory?
+        FileUtils.cp_r(source, payload)
+      when "file"
+        raise Error, "expected input file: #{source}" unless source.file?
+        payload.mkpath
+        FileUtils.cp(source, payload / source.basename)
+      end
+    end
+
+    def verify(output, complete: true)
+      output = Pathname.new(output).expand_path(root)
+      manifest = JSON.parse((output / "build.json").read)
+      raise Error, "unsupported build manifest" unless manifest.fetch("schema") == 1
+      raise Error, "build belongs to another project/configuration" unless manifest.fetch("name") == configuration.name && manifest.fetch("configuration") == configuration.digest
+      version_arg(manifest.fetch("version"))
+      expected = configuration.targets.transform_values { |target| target.fetch("formats") }
+      raise Error, "incomplete target set; aggregate all configured targets before publishing" if complete && manifest.fetch("targets") != expected
+      expected_pairs = manifest.fetch("targets").flat_map { |id, formats| formats.map { |format| [id, format] } }.sort
+      actual_pairs = manifest.fetch("packages").map { |entry| entry.values_at("target", "format") }.sort
+      raise Error, "manifest packages do not match its target set" unless actual_pairs == expected_pairs
+      manifest.fetch("files").each do |relative, digest|
+        path = output / relative_path(relative)
+        inside = path.exist? && path.realpath.to_s.start_with?(output.realpath.to_s + File::SEPARATOR)
+        raise Error, "package output changed: #{relative}" unless inside && path.file? && !path.symlink? && sha256(path) == digest
+      end
+      extras = files(output).map { |path| path.relative_path_from(output).to_s } - manifest.fetch("files").keys - %w[build.json packaging-checksums.txt]
+      raise Error, "unexpected build files: #{extras.join(', ')}" unless extras.empty?
+      manifest.fetch("packages").each do |entry|
+        raise Error, "package hash does not match file manifest" unless entry.fetch("sha256") == manifest.fetch("files").fetch(entry.fetch("path"))
+      end
+      manifest
+    end
+
+    def publish(output, destinations, body_file: nil)
+      configuration.validate
+      output = Pathname.new(output).expand_path(root)
+      manifest = verify(output)
+      raise Error, "supply at least one --to destination" if destinations.empty?
+      destinations.each { |name| project.repositories.select(name) unless name == "github" }
+      destinations.each do |destination|
+        if destination == "github"
+          paths = manifest.fetch("packages").map { |entry| output / entry.fetch("path") }
+          paths += manifest.fetch("files").keys.grep(/-packaging\.tar\.xz\z/).map { |path| output / path }
+          names = paths.map { |path| path.basename.to_s }
+          raise Error, "duplicate release asset names; give variants distinct nFPM names/releases" unless names.uniq == names
+          raise Error, "release.repository is required" if project.repository.empty?
+          Dir.mktmpdir("native-packages-upload-") do |directory|
+            checksums = Pathname.new(directory) / "packaging-checksums.txt"
+            write(checksums, paths.map { |path| "#{sha256(path)}  #{path.basename}\n" }.join)
+            run "gh", "release", "upload", "v#{manifest.fetch('version')}", *paths, checksums, "--repo", project.repository, "--clobber"
+          end
+        else
+          project.repositories.stage(destination, output / "recipes")
+          project.repositories.publish(destination, body_file: body_file)
+        end
+      end
+    end
+
+    def aggregate(inputs, output:)
+      configuration.validate
+      output = Pathname.new(output).expand_path(root)
+      raise Error, "output exists: #{output}" if output.exist?
+      roots = inputs.map { |path| Pathname.new(path).expand_path(root) }
+      manifests = roots.map { |path| verify(path, complete: false) }
+      raise Error, "supply builds to aggregate" if manifests.empty?
+      %w[version epoch tool].each do |key|
+        raise Error, "builds disagree on #{key}" unless manifests.map { |entry| entry.fetch(key) }.uniq.length == 1
+      end
+      result = Marshal.load(Marshal.dump(manifests.first))
+      result.merge!("targets" => {}, "packages" => [], "files" => {}, "inputs" => manifests.flat_map { |entry| entry.fetch("inputs") }.uniq)
+      output.dirname.mkpath
+      Dir.mktmpdir(".native-packages-aggregate-", output.dirname) do |directory|
+        staging = Pathname.new(directory) / "result"
+        staging.mkpath
+        manifests.zip(roots).each do |manifest, source|
+          manifest.fetch("targets").each do |id, formats|
+            result["targets"][id] ||= []
+            raise Error, "duplicate target/format: #{id}" unless (result["targets"][id] & formats).empty?
+            result["targets"][id] += formats
+          end
+          result["packages"] += manifest.fetch("packages")
+          manifest.fetch("files").each do |path, digest|
+            raise Error, "conflicting build file: #{path}" if result["files"][path] && result["files"][path] != digest
+            destination = staging / relative_path(path)
+            destination.dirname.mkpath
+            FileUtils.cp(source / path, destination)
+            result["files"][path] = digest
+          end
+        end
+        configuration.targets.each do |id, target|
+          result["targets"][id] = target.fetch("formats").select { |format| result["targets"].fetch(id, []).include?(format) }
+        end
+        write(staging / "build.json", JSON.pretty_generate(result) + "\n")
+        write(staging / "packaging-checksums.txt", files(staging).map { |file| "#{sha256(file)}  #{file.relative_path_from(staging)}\n" }.join)
+        verify(staging)
+        staging.rename(output)
+      end
+      puts "Aggregated #{output}"
+    end
+  end
+end

data/lib/native_packages/cli.rb

@@ -0,0 +1,128 @@
+# frozen_string_literal: true
+
+require_relative "build"
+require_relative "scaffold"
+
+module NativePackages
+  module CLI
+    HELP = <<~TEXT
+      Usage: native-packages [--config FILE] COMMAND [options]
+        init [--interactive]                       Create native-packages.yaml
+        doctor                                     Check configuration and packaging tools
+        validate                                   Validate configuration and templates
+        build [--version VERSION | --release TAG]  Build all configured packages
+          [--target ID] [--format FORMAT]          Select targets/formats (repeatable)
+          [--output DIRECTORY] [--dry-run]         Choose output or inspect the plan
+        aggregate DIR... --output DIRECTORY        Combine target builds before publishing
+        publish --from DIRECTORY --to github,aur   Publish a complete, verified build
+        migrate [--dry-run]                        Convert packaging/project.yml
+        repositories                               List downstream destinations
+        stage TARGET DIRECTORY                     Stage prepared recipes
+        diff TARGET                                Review pending changes
+        publish TARGET [--body-file FILE]          Publish a staged downstream update
+        status [TARGET] [--json] [--offline]        Check downstream versions and requests
+        check-version TAG                          Check the application's version
+      Legacy commands remain available:
+        prepare VERSION [--output DIRECTORY]
+        check DIRECTORY
+        artifacts DIRECTORY [--output DIRECTORY]
+        publish-release VERSION DIRECTORY
+        publish-aur DIRECTORY
+    TEXT
+
+    def self.run(root, arguments)
+      arguments = arguments.dup
+      config_path = nil
+      if arguments.first == "--config"
+        arguments.shift
+        config_path = arguments.shift or raise Error, "--config needs a path"
+      end
+      command = arguments.shift
+      return puts(HELP) if command.nil? || %w[--help -h].include?(command)
+      return puts(VERSION) if command == "--version"
+      options = { ids: [], formats: [], destinations: [] }
+      parser = OptionParser.new do |flags|
+        flags.on("--config FILE") { |value| config_path = value }
+        flags.on("--help", "-h") { puts HELP; return }
+        flags.on("--output DIRECTORY") { |value| options[:output] = Pathname.new(value).expand_path(root) } if %w[build aggregate artifacts prepare].include?(command)
+        flags.on("--body-file FILE") { |value| options[:body_file] = Pathname.new(value).expand_path(root) } if command == "publish"
+        if %w[build doctor].include?(command)
+          flags.on("--target ID") { |value| options[:ids] << value }
+          flags.on("--format FORMAT") { |value| options[:formats] << value }
+          flags.on("--release TAG") { |value| options[:release] = value }
+        end
+        if command == "build"
+          flags.on("--version VERSION") { |value| options[:value] = value }
+          flags.on("--dry-run") { options[:dry_run] = true }
+        end
+        if command == "init"
+          flags.on("--interactive") { options[:interactive] = true }
+          flags.on("--name NAME") { |value| options[:name] = value }
+          flags.on("--input PATH") { |value| options[:input] = value }
+          flags.on("--formats FORMATS") { |value| options[:init_formats] = value }
+        end
+        flags.on("--dry-run") { options[:dry_run] = true } if command == "migrate"
+        if command == "publish"
+          flags.on("--from DIRECTORY") { |value| options[:from] = value }
+          flags.on("--to DESTINATIONS") { |value| options[:destinations] += value.split(",") }
+        end
+        if command == "status"
+          flags.on("--offline") { options[:offline] = true }
+          flags.on("--json") { options[:json] = true }
+        end
+      end
+      parser.parse!(arguments)
+      arity = { "init" => 0..0, "migrate" => 0..0, "build" => 0..0, "doctor" => 0..0, "aggregate" => 1..,
+        "prepare" => 1..1, "check" => 1..1, "artifacts" => 1..1, "publish-release" => 2..2,
+        "repositories" => 0..0, "stage" => 2..2, "diff" => 1..1, "publish" => options[:from] ? 0..0 : 1..1,
+        "publish-aur" => 1..1, "status" => 0..1, "check-version" => 1..1, "validate" => 0..0 }[command]
+      raise Error, HELP unless arity&.cover?(arguments.length)
+      if command == "init"
+        raise Error, "init writes native-packages.yaml in the current directory" if config_path
+        return Scaffold.new(root).init(**options.slice(:interactive, :name, :input).merge(formats: options[:init_formats]))
+      end
+      return Scaffold.new(root).migrate(dry_run: options[:dry_run]) if command == "migrate"
+      path = Configuration.discover(root, config_path)
+      configuration = path && Configuration.new(path)
+      if %w[build doctor aggregate].include?(command) || options[:from]
+        raise Error, "create native-packages.yaml with init, or convert existing packaging with migrate" unless configuration
+        builder = Build.new(configuration)
+        case command
+        when "build" then return builder.run_build(**options.slice(:value, :release, :ids, :formats, :output, :dry_run))
+        when "doctor"
+          builder.doctor(**options.slice(:ids, :formats, :release))
+          return puts "Configuration and packaging tools are ready. Build checks input files and package contents."
+        when "aggregate"
+          raise Error, "aggregate requires --output" unless options[:output]
+          return builder.aggregate(arguments, output: options.fetch(:output))
+        when "publish" then return builder.publish(options.fetch(:from), options.fetch(:destinations), body_file: options[:body_file])
+        end
+      end
+      if configuration
+        configuration.validate
+        return puts "Configuration and templates are valid." if command == "validate"
+      end
+      project = configuration ? configuration.project : Project.new(root)
+      case command
+      when "validate" then project.validate
+      when "prepare" then project.prepare(arguments.first, **options.slice(:output))
+      when "check" then project.check(arguments.first)
+      when "artifacts" then project.artifacts(arguments.first, **options.slice(:output))
+      when "publish-release" then project.publish_release(*arguments)
+      when "repositories" then project.repositories.list
+      when "stage" then project.repositories.stage(*arguments)
+      when "diff" then project.repositories.diff(arguments.first)
+      when "publish" then project.repositories.publish(arguments.first, body_file: options[:body_file])
+      when "publish-aur"
+        project.repositories.stage("aur", arguments.first)
+        project.repositories.publish("aur")
+      when "status"
+        exit 1 unless project.repositories.status(arguments.first || "all", offline: options[:offline], json: options[:json])
+      when "check-version" then project.check_version(arguments.first)
+      end
+    rescue Error, SystemCallError, KeyError, ArgumentError, OptionParser::ParseError, JSON::ParserError,
+           OpenSSL::OpenSSLError, Psych::Exception, IOError, Timeout::Error => error
+      abort "native-packages: #{error.message}"
+    end
+  end
+end