native-packages 0.2.0

data/lib/native_packages/configuration.rb

@@ -0,0 +1,155 @@
+# frozen_string_literal: true
+
+require_relative "project"
+
+module NativePackages
+  class Configuration
+    include Support
+    FORMATS = %w[deb rpm archlinux apk ipk msix srpm].freeze
+    NFPM_VERSION = "2.47.0"
+    NAMES = %w[native-packages.yaml native-packages.yml].freeze
+    KEYS = %w[schema tool nfpm targets release assets templates repositories revisions libraries version_file version_section].freeze
+    attr_reader :root, :path, :data
+
+    def self.discover(root, explicit = nil)
+      return Pathname.new(explicit).expand_path(root) if explicit
+      paths = NAMES.map { |name| Pathname.new(root) / name }.select(&:exist?)
+      raise Error, "both #{NAMES.join(' and ')} exist; use --config" if paths.length > 1
+      paths.first
+    end
+
+    def initialize(path)
+      @path = Pathname.new(path).expand_path
+      @root = @path.dirname.realpath
+      @data = YAML.safe_load_file(@path, permitted_classes: [], aliases: false)
+      raise Error, "#{path}: expected a configuration mapping" unless data.is_a?(Hash)
+      raise Error, "unsupported schema; expected schema: 1" unless data["schema"] == 1
+      unknown = data.keys - KEYS
+      raise Error, "unknown configuration fields: #{unknown.join(', ')}" unless unknown.empty?
+      %w[tool targets].each { |key| mapping(data.fetch(key), key) }
+      data["nfpm"] = definition(data.fetch("nfpm", {}))
+      %w[assets templates repositories revisions libraries release].each { |key| data[key] = mapping(data.fetch(key, {}), key) }
+      data["targets"].each do |name, target|
+        mapping(target, "targets.#{name}")
+        target["nfpm"] = definition(target.fetch("nfpm", {}))
+      end
+    end
+
+    def mapping(value, label)
+      raise Error, "#{label}: expected a mapping" unless value.is_a?(Hash)
+      value
+    end
+
+    def definition(value)
+      value = YAML.safe_load_file(root / relative_path(value), permitted_classes: [], aliases: false) if value.is_a?(String)
+      mapping(value, "nfpm")
+    end
+
+    def merge(base, override)
+      base.merge(override) { |_, left, right| left.is_a?(Hash) && right.is_a?(Hash) ? merge(left, right) : right }
+    end
+
+    def name = data.fetch("nfpm").fetch("name")
+    def targets = data.fetch("targets")
+    def digest = OpenSSL::Digest::SHA256.hexdigest(JSON.generate(data))
+    def package(target) = merge(data.fetch("nfpm"), target.fetch("nfpm", {}))
+
+    def project
+      config = { "version" => 1, "name" => name, "repository" => data.fetch("release").fetch("repository", ""),
+        "assets" => data.fetch("assets"), "templates" => data.fetch("templates"), "revisions" => data.fetch("revisions") }
+      %w[version_file version_section].each { |key| config[key] = data[key] if data.key?(key) }
+      Project.new(root, config: config, registries: data.fetch("repositories"))
+    end
+
+    def validate
+      raise Error, "nfpm.name: use letters, digits, dots, underscores or hyphens" unless /\A[a-zA-Z0-9][a-zA-Z0-9._-]*\z/.match?(name)
+      %w[version nfpm].each { |key| version_arg(data.fetch("tool").fetch(key)) }
+      if data.fetch("tool").fetch("version") != VERSION
+        wanted = data.fetch("tool").fetch("version")
+        raise Error, "configuration needs native-packages #{wanted}; run gem install native-packages -v #{wanted}, then native-packages _#{wanted}_ COMMAND"
+      end
+      raise Error, "unsupported nFPM version; use #{NFPM_VERSION}" unless data.fetch("tool").fetch("nfpm") == NFPM_VERSION
+      metadata = tokens("9.8.7", epoch: 1_767_225_600)
+      targets.each do |id, target|
+        raise Error, "invalid target name: #{id}" unless /\A[a-z0-9][a-z0-9-]*\z/.match?(id)
+        unknown = target.keys - %w[platform arch libc abi kind formats input nfpm before_build after_package compiler_target]
+        raise Error, "targets.#{id}: unknown fields #{unknown.join(', ')}" unless unknown.empty?
+        formats = target.fetch("formats")
+        unless formats.is_a?(Array) && !formats.empty? && formats.uniq == formats && (formats - FORMATS).empty?
+          raise Error, "targets.#{id}.formats: choose from #{FORMATS.join(', ')}"
+        end
+        raise Error, "targets.#{id}.platform: use linux or windows" unless %w[linux windows].include?(target.fetch("platform"))
+        raise Error, "targets.#{id}.arch: expected an architecture" unless /\A[a-zA-Z0-9_+-]+\z/.match?(target.fetch("arch"))
+        kind = target.fetch("kind", "binary")
+        raise Error, "targets.#{id}.kind: use binary, data or source" unless %w[binary data source].include?(kind)
+        raise Error, "#{id}: MSIX requires a Windows target with only msix format" if formats.include?("msix") && (target["platform"] != "windows" || formats != ["msix"])
+        raise Error, "#{id}: Windows targets require msix" if target["platform"] == "windows" && formats != ["msix"]
+        raise Error, "#{id}: SRPM requires a separate source target" if (formats.include?("srpm") && (kind != "source" || formats != ["srpm"])) || (kind == "source" && formats != ["srpm"])
+        if kind == "binary" && target["platform"] == "linux"
+          raise Error, "#{id}.libc: declare glibc, musl or static" unless %w[glibc musl static].include?(target["libc"])
+        end
+        raise Error, "#{id}: IPK needs an explicit abi (device/distribution baseline)" if formats.include?("ipk") && target.fetch("abi", "").empty?
+        input = mapping(target.fetch("input"), "#{id}.input")
+        raise Error, "#{id}.input: declare local or release_asset" unless input["local"] || input["release_asset"]
+        raise Error, "#{id}.input.kind: use file, directory or archive" unless %w[file directory archive].include?(input.fetch("kind", "archive"))
+        %w[before_build after_package].each do |key|
+          hook = target[key]
+          raise Error, "#{id}.#{key}: use a nonempty array of command arguments" if hook && (!hook.is_a?(Array) || hook.empty? || !hook.all? { |part| part.is_a?(String) })
+        end
+        rendered = render_tree(package(target), target_tokens(metadata, id, target, "/payload"))
+        raise Error, "#{id}: nfpm.contents must be an array" unless rendered["contents"].is_a?(Array)
+        %w[maintainer description license].each do |key|
+          raise Error, "#{id}: fill in nfpm.#{key}" unless rendered[key].is_a?(String) && !rendered[key].strip.empty?
+        end
+        if formats.include?("msix")
+          msix = mapping(rendered.fetch("msix"), "#{id}.nfpm.msix")
+          raise Error, "#{id}: supply msix.publisher" unless msix["publisher"].is_a?(String) && !msix["publisher"].empty?
+          raise Error, "#{id}: supply msix.applications" unless msix["applications"].is_a?(Array) && !msix["applications"].empty?
+        end
+        %w[name arch platform version].each do |key|
+          expected = { "name" => name, "arch" => target["arch"], "platform" => target["platform"], "version" => "9.8.7" }.fetch(key)
+          raise Error, "#{id}: conflicting nfpm.#{key}; declare it once" if rendered.key?(key) && rendered[key] != expected
+        end
+        render_tree(input, target_tokens(metadata, id, target, "/payload"))
+        render_tree(target["before_build"], target_tokens(metadata, id, target, "/payload")) if target["before_build"]
+        render_tree(target["after_package"], target_tokens(metadata, id, target, "/payload").merge("PACKAGE" => "/output/package", "FORMAT" => formats.first)) if target["after_package"]
+      end
+      data.fetch("templates").each do |destination, source|
+        relative_path(render(destination, metadata))
+        render((root / relative_path(source)).binread, metadata)
+      end
+      project.repositories
+      true
+    end
+
+    def tokens(version, epoch: nil)
+      epoch ||= Integer(ENV.fetch("SOURCE_DATE_EPOCH", Time.now.to_i.to_s))
+      result = { "NAME" => name, "VERSION" => version, "TAG" => "v#{version}", "DATE" => Time.at(epoch).utc.iso8601,
+        "SOURCE_DATE_EPOCH" => epoch, "ROOT" => root.to_s, "PKGREL" => 1,
+        "UPSTREAM" => "https://github.com/#{data.fetch('release').fetch('repository', '')}", "GIT_VERSION" => "r0.unknown" }
+      data.fetch("assets").each do |key, asset|
+        raise Error, "invalid asset key: #{key}" unless /\A[A-Z][A-Z0-9_]*\z/.match?(key)
+        result["#{key}_FILE"] = render(asset.fetch("file"), result)
+        result["#{key}_URL"] = render(asset.fetch("url", "#{result['UPSTREAM']}/releases/download/@TAG@/@#{key}_FILE@"), result)
+        result["#{key}_SHA256"] = "0" * 64
+      end
+      result
+    end
+
+    def target_tokens(metadata, id, target, payload)
+      metadata.merge("ARCH" => target.fetch("arch"), "PLATFORM" => target.fetch("platform"),
+        "TARGET" => target.fetch("compiler_target", id), "TARGET_ID" => id, "PAYLOAD" => payload.to_s)
+    end
+
+    def select(ids: [], formats: [])
+      raise Error, "unknown targets: #{(ids - targets.keys).join(', ')}" unless (ids - targets.keys).empty?
+      raise Error, "unknown formats: #{(formats - FORMATS).join(', ')}" unless (formats - FORMATS).empty?
+      chosen = targets.select { |id, _| ids.empty? || ids.include?(id) }.filter_map do |id, target|
+        selected = formats.empty? ? target.fetch("formats") : target.fetch("formats") & formats
+        [id, target.merge("formats" => selected)] unless selected.empty?
+      end.to_h
+      raise Error, "no configured targets match the selection" if chosen.empty? && (!targets.empty? || !ids.empty? || !formats.empty?)
+      chosen
+    end
+  end
+end

data/lib/native_packages/inspection.rb

@@ -0,0 +1,125 @@
+# frozen_string_literal: true
+
+module NativePackages
+  class Inspection
+    include Support
+    ELF_ARCHES = { "386" => [3, 1, 1], "amd64" => [62, 2, 1], "arm64" => [183, 2, 1],
+      "arm5" => [40, 1, 1], "arm6" => [40, 1, 1], "arm7" => [40, 1, 1],
+      "mips" => [8, 1, 2], "mipsle" => [8, 1, 1], "mips64" => [8, 2, 2], "mips64le" => [8, 2, 1],
+      "ppc64" => [21, 2, 2], "ppc64le" => [21, 2, 1], "s390x" => [22, 2, 2],
+      "riscv64" => [243, 2, 1], "loong64" => [258, 2, 1] }.freeze
+    PE_ARCHES = { "386" => 0x14c, "amd64" => 0x8664, "arm64" => 0xaa64 }.freeze
+    LIBRARIES = {
+      "libgcc_s.so.1" => { "deb" => "libgcc-s1", "rpm" => "libgcc" },
+      "libstdc++.so.6" => { "deb" => "libstdc++6", "rpm" => "libstdc++" },
+      "libasound.so.2" => { "deb" => "libasound2", "rpm" => "alsa-lib" },
+      "libpulse.so.0" => { "deb" => "libpulse0", "rpm" => "pulseaudio-libs" },
+      "libpulse-simple.so.0" => { "deb" => "libpulse0", "rpm" => "pulseaudio-libs" },
+      "libpipewire-0.3.so.0" => { "deb" => "libpipewire-0.3-0", "rpm" => "pipewire-libs" },
+      "libssl.so.3" => { "deb" => "libssl3", "rpm" => "openssl-libs" },
+      "libcrypto.so.3" => { "deb" => "libssl3", "rpm" => "openssl-libs" }
+    }.freeze
+    attr_reader :root
+
+    def initialize(root, libraries = {})
+      @root = root
+      @libraries = LIBRARIES.merge(libraries)
+    end
+
+    def selected_files(package, format)
+      # nFPM overrides replace the contents list when one is supplied.
+      contents = package.fetch("overrides", {}).fetch(format, {}).fetch("contents", package.fetch("contents"))
+      contents.flat_map do |item|
+        next [] if item["packager"] && item["packager"] != format
+        next [] if %w[symlink ghost dir].include?(item["type"]) || !item["src"]
+        source = File.expand_path(item.fetch("src"), root)
+        paths = package["disable_globbing"] ? [Pathname.new(source)].select(&:exist?) : Dir.glob(source).map { |path| Pathname.new(path) }
+        raise Error, "missing package content: #{source}" if paths.empty?
+        paths.flat_map { |path| path.directory? ? files(path) : path }
+      end.uniq
+    end
+
+    def check(package, target, format)
+      paths = selected_files(package, format)
+      kind = target.fetch("kind", "binary")
+      if kind != "binary"
+        binaries = paths.select { |path| ["\x7fELF".b, "MZ".b].any? { |magic| path.binread(magic.bytesize) == magic } }
+        raise Error, "#{kind} target contains executable binaries; declare a binary target" unless binaries.empty?
+        raise Error, "source target requires an RPM spec" if kind == "source" && paths.none? { |path| path.extname == ".spec" }
+        return { "kind" => kind, "files" => paths.length, "installation" => "not-tested" }
+      end
+      target.fetch("platform") == "windows" ? pe(paths, target) : elf(paths, package, target, format)
+    end
+
+    def pe(paths, target)
+      expected = PE_ARCHES[target.fetch("arch")]
+      raise Error, "PE inspection does not support #{target.fetch('arch')}" unless expected
+      binaries = paths.select { |path| path.binread(2) == "MZ" }
+      raise Error, "Windows target contains no PE binaries" if binaries.empty?
+      binaries.each do |path|
+        File.open(path, "rb") do |file|
+          file.seek(0x3c)
+          offset = file.read(4)&.unpack1("L<")
+          raise Error, "invalid PE header: #{path}" unless offset && offset >= 0x40 && offset + 24 <= file.size
+          file.seek(offset)
+          raise Error, "wrong PE architecture or signature: #{path}" unless file.read(4) == "PE\0\0" && file.read(2).unpack1("S<") == expected
+        end
+      end
+      { "kind" => "pe", "binaries" => binaries.length, "architecture" => target.fetch("arch"), "dependencies" => "explicit", "installation" => "not-tested" }
+    end
+
+    def elf(paths, package, target, format)
+      expected = ELF_ARCHES[target.fetch("arch")]
+      raise Error, "ELF inspection does not support #{target.fetch('arch')}" unless expected
+      binaries = paths.select { |path| path.binread(4) == "\x7fELF" }
+      raise Error, "Linux target contains no ELF binaries" if binaries.empty?
+      required, versions, interpreters = [], [], []
+      bundled = binaries.map { |path| path.basename.to_s }
+      binaries.each do |path|
+        header = path.binread(20)
+        machine = header.byteslice(18, 2)&.unpack1(header.getbyte(5) == 2 ? "S>" : "S<")
+        raise Error, "wrong ELF architecture: #{path}" unless [machine, header.getbyte(4), header.getbyte(5)] == expected
+        dynamic = capture("readelf", "-d", path)
+        required.concat(dynamic.scan(/Shared library: \[([^\]]+)\]/).flatten)
+        bundled.concat(dynamic.scan(/Library soname: \[([^\]]+)\]/).flatten)
+        versions.concat(capture("readelf", "--version-info", path).scan(/GLIBC_(\d+\.\d+)/).flatten)
+        interpreters.concat(capture("readelf", "-l", path).scan(/Requesting program interpreter: ([^\]]+)/).flatten)
+      end
+      libc = target.fetch("libc")
+      if libc == "static" && (!required.empty? || !interpreters.empty?)
+        raise Error, "target declares static but contains dynamic ELF binaries"
+      end
+      if libc == "musl" && (!versions.empty? || interpreters.any? { |value| !value.include?("musl") })
+        raise Error, "target declares musl but contains a different libc ABI"
+      end
+      if libc == "glibc" && interpreters.any? { |value| value.include?("musl") }
+        raise Error, "target declares glibc but contains a musl loader"
+      end
+      raise Error, "APK binary targets need musl/static inputs; glibc compatibility is not inferred" if format == "apk" && libc == "glibc"
+      external = required.uniq - bundled
+      glibc = versions.max_by { |version| Gem::Version.new(version) }
+      if %w[deb rpm].include?(format)
+        overrides = package["overrides"] ||= {}
+        override = overrides[format] ||= {}
+        depends = override.fetch("depends", package.fetch("depends", [])).dup
+        external.each do |library|
+          next if /\A(?:lib(?:c|m|dl|rt|pthread|resolv)\.so\.|ld-linux)/.match?(library)
+          dependency = @libraries[library]&.[](format)
+          raise Error, "add libraries.#{library}.#{format} and declare runtime-loaded dependencies" unless dependency
+          depends << dependency
+        end
+        if glibc
+          previous = depends.grep(format == "deb" ? /\Alibc6(?: |$)/ : /\Aglibc(?: |$)/)
+          floor = ([glibc] + previous.flat_map { |value| value.scan(/\d+\.\d+/) }).max_by { |value| Gem::Version.new(value) }
+          depends -= previous
+          depends << (format == "deb" ? "libc6 (>= #{floor})" : "glibc >= #{floor}")
+        end
+        override["depends"] = depends.uniq
+      elsif !external.empty? && package.fetch("overrides", {}).fetch(format, {}).fetch("depends", package.fetch("depends", [])).empty?
+        raise Error, "#{format}: declare dependencies for #{external.join(', ')}"
+      end
+      { "kind" => "elf", "binaries" => binaries.length, "architecture" => target.fetch("arch"), "libc" => libc,
+        "required_libraries" => external.sort, "glibc_floor" => glibc, "installation" => "not-tested" }
+    end
+  end
+end

data/lib/native_packages/project.rb

@@ -0,0 +1,258 @@
+# frozen_string_literal: true
+
+require_relative "support"
+require_relative "repositories"
+require_relative "inspection"
+
+module NativePackages
+  class Project
+    include Support
+    attr_reader :root, :config
+
+    def initialize(root, config: nil, registries: nil)
+      @root = Pathname.new(root).realpath
+      @config = config || YAML.safe_load_file(@root / "packaging/project.yml", permitted_classes: [], aliases: false)
+      @registries = registries
+      raise Error, "unsupported packaging configuration" unless @config.fetch("version") == 1
+      raise Error, "invalid package name" unless /\A[a-zA-Z0-9][a-zA-Z0-9._-]*\z/.match?(package_name)
+      @config.fetch("assets").each_key do |key|
+        raise Error, "invalid asset key: #{key}" unless /\A[A-Z][A-Z0-9_]*\z/.match?(key)
+      end
+    end
+
+    def package_name = config.fetch("name")
+    def repository = config.fetch("release_repository", config.fetch("repository"))
+    def upstream = "https://github.com/#{repository}"
+    def cache(version) = root / ".cache/packaging" / version
+    def repositories = Repositories.new(project: self, entries: @registries)
+
+    def validate
+      metadata = { "NAME" => package_name, "VERSION" => "9.8.7", "TAG" => "v9.8.7", "UPSTREAM" => upstream,
+        "DATE" => "2026-01-01T00:00:00Z", "SOURCE_DATE_EPOCH" => 1_767_225_600, "GIT_VERSION" => "r123.abcdef0" }
+      render_tree(config.fetch("assets"), metadata).each do |key, asset|
+        metadata["#{key}_FILE"] = asset.fetch("file")
+        metadata["#{key}_URL"] = asset.fetch("url", "#{upstream}/releases/download/v9.8.7/#{asset.fetch('file')}")
+        metadata["#{key}_SHA256"] = "0" * 64
+      end
+      if config["binary"]
+        render_tree(nfpm_definition, metadata.merge("ROOT" => root.to_s, "PAYLOAD" => "/payload",
+          "ARCH" => "amd64", "TARGET" => "x86_64-unknown-linux-gnu"))
+      end
+      repositories
+      Dir.mktmpdir("native-packages-validate-") do |temporary|
+        output = Pathname.new(temporary)
+        generate(output, metadata)
+        check(output)
+      end
+    end
+
+    def release_metadata(version)
+      version = version_arg(version)
+      tag = "v#{version}"
+      commit = "#{tag}^{commit}"
+      date = capture("git", "show", "-s", "--format=%cI", commit)
+      metadata = { "NAME" => package_name, "VERSION" => version, "TAG" => tag, "UPSTREAM" => upstream,
+        "DATE" => date, "SOURCE_DATE_EPOCH" => Time.iso8601(date).to_i,
+        "GIT_VERSION" => "r#{capture('git', 'rev-list', '--count', commit)}.#{capture('git', 'rev-parse', '--short', commit)}" }
+      assets = render_tree(config.fetch("assets"), metadata)
+      checksums = cache(version) / "checksums.txt"
+      download("#{upstream}/releases/download/#{tag}/checksums.txt", checksums)
+      expected = checksums.readlines.to_h do |line|
+        match = /\A([a-fA-F0-9]{64})\s+\*?(.+?)\s*\z/.match(line) or raise Error, "invalid release checksum entry"
+        [match[2], match[1].downcase]
+      end
+      assets.each do |key, asset|
+        file = asset.fetch("file")
+        raise Error, "asset must be a filename" unless File.basename(file) == file
+        path = cache(version) / file
+        url = asset.fetch("url", "#{upstream}/releases/download/#{tag}/#{file}")
+        download(url, path)
+        digest = sha256(path)
+        if asset.fetch("checksummed", true)
+          raise Error, "missing checksum for #{file}" unless expected.key?(file)
+          raise Error, "checksum mismatch for #{file}" unless expected.fetch(file) == digest
+        end
+        metadata["#{key}_FILE"] = file
+        metadata["#{key}_URL"] = url
+        metadata["#{key}_SHA256"] = digest
+      end
+      metadata
+    end
+
+    def srcinfo(directory)
+      if available?("makepkg")
+        capture("makepkg", "--printsrcinfo", chdir: directory) + "\n"
+      elsif available?("docker")
+        capture("docker", "run", "--rm", "-v", "#{directory}:/recipe:ro", "archlinux:base-devel", "bash", "-ec",
+          'useradd -m builder; cp -r /recipe /tmp/package; chown -R builder:builder /tmp/package; runuser -u builder -- bash -ec "cd /tmp/package; makepkg --printsrcinfo"') + "\n"
+      else
+        raise Error, "AUR metadata generation needs makepkg or Docker"
+      end
+    end
+
+    def generate(output, metadata)
+      config.fetch("templates", {}).each do |destination, source|
+        local = metadata.merge("PKGREL" => config.fetch("revisions", {}).fetch(metadata.fetch("VERSION"), {}).fetch(destination, 1))
+        target = output / relative_path(render(destination, local))
+        template = root / relative_path(source)
+        write(target, render(template.binread, local), executable: template.executable?)
+      end
+      Pathname.glob(output / "arch/*/PKGBUILD").each do |recipe|
+        write(recipe.dirname / ".SRCINFO", srcinfo(recipe.dirname))
+      end
+      write(output / "release.json", JSON.pretty_generate(metadata.sort.to_h) + "\n")
+    end
+
+    def check(output)
+      output = Pathname.new(output).expand_path
+      metadata = JSON.parse((output / "release.json").read)
+      raise Error, "prepared recipes belong to another project" unless metadata.fetch("NAME") == package_name
+      version_arg(metadata.fetch("VERSION"))
+      Dir.mktmpdir("native-packages-check-") do |temporary|
+        expected = Pathname.new(temporary)
+        generate(expected, metadata)
+        extra = files(output).map { |file| file.relative_path_from(output) } - files(expected).map { |file| file.relative_path_from(expected) }
+        raise Error, "unexpected files in prepared recipes: #{extra.join(', ')}" unless extra.empty?
+        files(expected).each do |reference|
+          actual = output / reference.relative_path_from(expected)
+          raise Error, "generated file is stale: #{actual}" unless actual.file? && actual.binread == reference.binread
+        end
+      end
+      files(output).each do |file|
+        raise Error, "unexpanded packaging token: #{file}" if Support::TOKEN.match?(file.read)
+        run "bash", "-n", file if %w[PKGBUILD APKBUILD template].include?(file.basename.to_s) || %w[.install .ebuild .SlackBuild].include?(file.extname)
+        run "ruby", "-c", file if file.extname == ".rb"
+      end
+      puts "Checked #{package_name} #{metadata.fetch('VERSION')}"
+    end
+
+    def prepare(version, output: nil)
+      version = version_arg(version)
+      output = Pathname.new(output || root / "dist/packaging" / version).expand_path
+      raise Error, "output exists: #{output}; choose --output with a fresh path" if output.exist?
+      metadata = release_metadata(version)
+      output.dirname.mkpath
+      Dir.mktmpdir(".packaging-", output.dirname) do |temporary|
+        staging = Pathname.new(temporary) / "recipes"
+        generate(staging, metadata)
+        check(staging)
+        staging.rename(output)
+      end
+      puts "Prepared #{output}"
+    end
+
+    def extract(archive, destination)
+      capture("bsdtar", "-tf", archive).each_line { |path| relative_path(path.strip) }
+      destination.mkpath
+      run "bsdtar", "-xf", archive, "-C", destination
+      Pathname.glob(destination / "**/*", File::FNM_DOTMATCH).each do |path|
+        raise Error, "unexpected archive symlink: #{path}" if path.symlink?
+      end
+    end
+
+    def nfpm_definition
+      definition = config.fetch("binary").fetch("nfpm")
+      definition = YAML.safe_load_file(root / relative_path(definition), permitted_classes: [], aliases: false) if definition.is_a?(String)
+      raise Error, "nFPM configuration must contain a contents array" unless definition.is_a?(Hash) && definition["contents"].is_a?(Array)
+      definition
+    end
+
+    def binary_packages(metadata, output)
+      return unless config["binary"]
+      raise Error, "install nfpm 2.47.0 to build binary packages" unless available?("nfpm")
+      config.fetch("binary").fetch("architectures").each do |architecture, asset_key|
+        archive = cache(metadata.fetch("VERSION")) / metadata.fetch("#{asset_key}_FILE")
+        raise Error, "release archive checksum changed: #{archive}" unless sha256(archive) == metadata.fetch("#{asset_key}_SHA256")
+        Dir.mktmpdir("native-package-payload-") do |temporary|
+          payload = Pathname.new(temporary) / "payload"
+          extract(archive, payload)
+          local = metadata.merge("ARCH" => architecture, "PAYLOAD" => payload.to_s, "ROOT" => root.to_s,
+            "TARGET" => { "amd64" => "x86_64-unknown-linux-gnu", "arm64" => "aarch64-unknown-linux-gnu" }.fetch(architecture))
+          package = render_tree(nfpm_definition, local)
+          package.merge!("name" => package_name, "version" => metadata.fetch("VERSION"), "arch" => architecture,
+            "platform" => "linux", "mtime" => metadata.fetch("DATE"))
+          runtime_dependencies(payload, architecture, package)
+          package.fetch("contents").each do |item|
+            next unless item["src"]
+            raise Error, "missing package content: #{item.fetch('src')}" if Dir.glob(item.fetch("src")).empty?
+          end
+          %w[deb rpm].each do |format|
+            path = Pathname.new(temporary) / "nfpm.yml"
+            write(path, YAML.dump(package))
+            run "nfpm", "package", "--config", path, "--packager", format,
+              "--target", output / "#{package_name}_#{metadata.fetch('VERSION')}_#{architecture}.#{format}",
+              env: { "SOURCE_DATE_EPOCH" => metadata.fetch("SOURCE_DATE_EPOCH").to_s }
+          end
+        end
+      end
+    end
+
+    # Inspect release binaries without running them, including when packaging ARM on x86.
+    def runtime_dependencies(payload, architecture, package)
+      libraries = Inspection::LIBRARIES.merge(config.fetch("binary").fetch("libraries", {}))
+      elfs = files(payload).select { |file| file.binread(4) == "\x7fELF" }
+      raise Error, "release archive contains no ELF binaries" if elfs.empty?
+      bundled = elfs.map { |file| file.basename.to_s }
+      required = []
+      versions = []
+      elfs.each do |file|
+        header = file.binread(20)
+        machine = header.byteslice(18, 2).unpack1("S<")
+        raise Error, "wrong binary architecture in #{file}" unless machine == { "amd64" => 62, "arm64" => 183 }.fetch(architecture)
+        required.concat(capture("readelf", "-d", file).scan(/Shared library: \[([^\]]+)\]/).flatten)
+        versions.concat(capture("readelf", "--version-info", file).scan(/GLIBC_(\d+\.\d+)/).flatten)
+      end
+      glibc = versions.max_by { |version| version.split(".").map(&:to_i) }
+      required.uniq!
+      external = required - bundled
+      unknown = external.reject { |name| libraries.key?(name) || /\A(?:lib(?:c|m|dl|rt|pthread|resolv)\.so\.|ld-linux)/.match?(name) }
+      raise Error, "add binary.libraries mappings for: #{unknown.join(', ')}" unless unknown.empty?
+      %w[deb rpm].each do |format|
+        package["overrides"] ||= {}
+        package["overrides"][format] ||= {}
+        depends = package["overrides"][format]["depends"] ||= []
+        depends.concat(external.filter_map { |name| libraries[name]&.fetch(format) })
+        if glibc
+          previous = depends.grep(format == "deb" ? /\Alibc6(?: |$)/ : /\Aglibc(?: |$)/)
+          floor = ([glibc] + previous.flat_map { |dependency| dependency.scan(/\d+\.\d+/) }).max_by { |version| version.split(".").map(&:to_i) }
+          depends -= previous
+          depends << (format == "deb" ? "libc6 (>= #{floor})" : "glibc >= #{floor}")
+        end
+        package["overrides"][format]["depends"] = depends.uniq
+      end
+    end
+
+    def artifacts(recipes, output: root / "dist/package-assets")
+      recipes = Pathname.new(recipes).expand_path
+      output = Pathname.new(output).expand_path
+      raise Error, "artifact output exists: #{output}" if output.exist?
+      check(recipes)
+      metadata = JSON.parse((recipes / "release.json").read)
+      output.dirname.mkpath
+      Dir.mktmpdir(".package-assets-", output.dirname) do |temporary|
+        staging = Pathname.new(temporary) / "assets"
+        staging.mkpath
+        binary_packages(metadata, staging)
+        recipe_archive(recipes, staging, name: package_name, version: metadata.fetch("VERSION"), epoch: metadata.fetch("SOURCE_DATE_EPOCH"))
+        staging.rename(output)
+      end
+      puts "Built release assets in #{output}"
+    end
+
+    def publish_release(version, output)
+      upload_assets(repository, version, output)
+    end
+
+    def check_version(tag)
+      version = version_arg(tag)
+      if config["version_file"]
+        source = (root / relative_path(config.fetch("version_file"))).read
+        section = config.fetch("version_section", "package")
+        body = source.split(/^\[#{Regexp.escape(section)}\]\s*$/)[1]&.split(/^\[/)&.first
+        actual = body&.match(/^version\s*=\s*"([^"]+)"/)&.captures&.first
+        raise Error, "#{config.fetch('version_file')} reports #{actual.inspect}, tag reports #{version}" unless actual == version
+      end
+      puts version
+    end
+  end
+end