@automattic/vip 4.1.5 → 4.1.6

package/.buildkite/build-macos-installer.sh

@@ -1,34 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-# Package the already signed/notarized binaries from this build.
-[ -f .buildkite/shared-pipeline-vars ] && . .buildkite/shared-pipeline-vars
-: "${BIN_BASE:=vip-next}"
-
-if command -v install_gems >/dev/null 2>&1; then install_gems; else bundle install; fi
-if ! command -v go >/dev/null 2>&1; then brew install go; fi
-export GOFLAGS="${GOFLAGS:--mod=mod}"
-VERSION="$(go run -mod=mod ./cmd/stamp-version)"
-numeric_version="$(go run -mod=mod ./cmd/installer-version "$VERSION")"
-
-# This lane does not run in the binary job and never creates certificates.
-bundle exec fastlane configure_installer_signing
-stage="$(mktemp -d)"
-trap 'rm -rf "$stage"' EXIT
-buildkite-agent artifact download "dist/${BIN_BASE}-darwin-*.tar.gz*" "$stage" --step binaries-macos
-mkdir -p dist
-for arch in arm64 amd64; do
-  payload="$stage/$arch"
-  go run -mod=mod ./cmd/installer-payload darwin "$stage/dist/${BIN_BASE}-darwin-${arch}.tar.gz" "$payload"
-  bin="$payload/vip-next"
-  helper="$payload/go-search-replace"
-  bundle exec fastlane verify_code_signing binary:"$bin"
-  bundle exec fastlane verify_code_signing binary:"$helper"
-  pkg="dist/${BIN_BASE}-darwin-${arch}.pkg"
-  bash packaging/macos/build-pkg.sh "$VERSION" "$arch" "$bin" "$helper" "$pkg"
-  bundle exec fastlane sign_and_notarize_installer package:"$pkg"
-  python3 packaging/macos/verify-pkg.py "$pkg" "$numeric_version" "$arch" "$bin" "$helper"
-  shasum -a 256 "$pkg" > "$pkg.sha256"
-done
-# No automatic artifact_paths: failed/unsigned/partially verified packages must
-# never be uploaded by Buildkite's post-command hook.
-buildkite-agent artifact upload "dist/${BIN_BASE}-darwin-*.pkg;dist/${BIN_BASE}-darwin-*.pkg.sha256"

package/.buildkite/build-macos.sh

@@ -1,67 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-# Build, sign, and notarize portable macOS binary archives.
-# Native installers consume these archives in a separate downstream job.
-
-[ -f .buildkite/shared-pipeline-vars ] && . .buildkite/shared-pipeline-vars
-: "${BIN_BASE:=vip-next}"
-
-echo "--- :ruby: install gems"
-if command -v install_gems >/dev/null 2>&1; then install_gems; else bundle install; fi
-
-echo "--- :go: toolchain"
-if ! command -v go >/dev/null 2>&1; then
-  echo "--- :package: install go"
-  brew install go
-fi
-go version
-
-# Bundler installs to `vendor/bundle`, which makes Go take `-mod=vendor`.
-export GOFLAGS="${GOFLAGS:--mod=mod}"
-
-echo "--- :package: fetch go-search-replace"
-.buildkite/fetch-search-replace.sh darwin/arm64 darwin/amd64
-
-VERSION="$(go run -mod=mod ./cmd/stamp-version)"
-COMMIT="$(git rev-parse --short HEAD 2>/dev/null || echo unknown)"
-
-build() {
-  local goarch="$1"
-  local out="dist/${BIN_BASE}-darwin-${goarch}"
-  echo "--- :go: build darwin/${goarch}"
-  CGO_ENABLED=0 GOOS=darwin GOARCH="${goarch}" \
-    go build -buildvcs=false -trimpath \
-    -ldflags="-s -w -X github.com/Automattic/vip/internal/version.Version=${VERSION} -X github.com/Automattic/vip/internal/version.Commit=${COMMIT}" \
-    -o "${out}" ./cmd/vip-next
-}
-
-checksum() { shasum -a 256 "$1" > "$1.sha256"; }
-
-mkdir -p dist
-build arm64
-build amd64
-
-case "$(uname -m)" in
-  arm64) native=arm64 ;;
-  x86_64) native=amd64 ;;
-  *) native="" ;;
-esac
-if [ -n "${native}" ]; then
-  echo "--- :test_tube: smoke darwin/${native}"
-  "dist/${BIN_BASE}-darwin-${native}" --version
-  "dist/${BIN_BASE}-darwin-${native}" whoami --help
-fi
-
-echo "--- :closed_lock_with_key: fetch signing certs (fastlane match)"
-bundle exec fastlane configure_code_signing
-
-for arch in arm64 amd64; do
-  bin="dist/${BIN_BASE}-darwin-${arch}"
-  helper="third_party/go-search-replace/darwin-${arch}/go-search-replace"
-  echo "--- :closed_lock_with_key: sign and notarize darwin/${arch}"
-  bundle exec fastlane sign_and_notarize binary:"${bin}"
-  bundle exec fastlane sign_and_notarize binary:"${helper}"
-  .buildkite/pack-release.sh darwin "${arch}" "${bin}" "${helper}"
-  checksum "dist/${BIN_BASE}-darwin-${arch}.tar.gz"
-  rm -f "${bin}"
-done

package/.buildkite/build-windows-installer.ps1

@@ -1,65 +0,0 @@
-#Requires -Version 5.1
-# Consume the signed binaries from this build; installer failures are isolated.
-$ErrorActionPreference = 'Stop'
-$binBase = if ($env:BIN_BASE) { $env:BIN_BASE } else { 'vip-next' }
-
-# Any Go will do: go.mod's `toolchain` directive makes it fetch go1.27.0 itself.
-if (-not (Get-Command go -ErrorAction SilentlyContinue)) {
-  Write-Host "--- :package: install go"
-  choco install golang -y --no-progress
-  if ($LASTEXITCODE -ne 0) { throw 'choco install golang failed' }
-  # choco updates the machine PATH, not this process's.
-  $env:PATH = "$env:PATH;$env:ProgramFiles\Go\bin"
-}
-go version
-if ($LASTEXITCODE -ne 0) { throw 'go not usable after install' }
-
-$version = (& go run -mod=mod ./cmd/stamp-version | Out-String).Trim()
-if ($LASTEXITCODE -ne 0 -or -not $version) { throw 'stamp-version failed' }
-$stage = Join-Path ([System.IO.Path]::GetTempPath()) ([System.Guid]::NewGuid().ToString())
-New-Item -ItemType Directory -Path $stage | Out-Null
-try {
-  # Agent v3 stores Windows artifact paths with backslashes; v4 uses slashes.
-  # Match either prefix while retaining the exact upstream step and platform.
-  buildkite-agent artifact download "*$binBase-windows-amd64.tar.gz*" $stage --step binaries-windows
-  if ($LASTEXITCODE -ne 0) { throw 'binary artifact download failed' }
-  $payload = Join-Path $stage 'payload'
-  go run -mod=mod ./cmd/installer-payload windows "$stage/dist/$binBase-windows-amd64.tar.gz" $payload
-  if ($LASTEXITCODE -ne 0) { throw 'binary archive verification failed' }
-  $out = Join-Path $payload 'vip-next.exe'
-  $helper = Join-Path $payload 'go-search-replace.exe'
-  . "$PSScriptRoot/sign-windows.ps1"
-  foreach ($binary in @($out, $helper)) {
-    & $env:SIGNTOOL_PATH verify /pa /v $binary
-    if ($LASTEXITCODE -ne 0) { throw "binary signature verification failed: $binary" }
-  }
-  New-Item -ItemType Directory -Force -Path dist | Out-Null
-  Write-Host "--- :package: MSI"
-  $dotnet = Get-Command dotnet -ErrorAction SilentlyContinue
-  $dotnetMajor = 0
-  if ($dotnet) {
-    $dotnetVersion = (& $dotnet.Source --version | Out-String).Trim()
-    if ($LASTEXITCODE -eq 0 -and $dotnetVersion -match '^(\d+)\.') {
-      $dotnetMajor = [int]$Matches[1]
-    }
-  }
-  if ($dotnetMajor -lt 8) {
-    choco install dotnet-8.0-sdk -y --no-progress
-    if ($LASTEXITCODE -ne 0) { throw 'choco install dotnet-8.0-sdk failed' }
-    $env:PATH = "$env:PATH;$env:ProgramFiles\dotnet"
-  }
-
-  $msi = "dist/$binBase-windows-amd64.msi"
-  & ./packaging/windows/build-msi.ps1 -Version $version -CLI $out -Helper $helper -Output $msi
-  if ($LASTEXITCODE -ne 0) { throw 'build-msi.ps1 failed' }
-  Sign-File $msi
-  & ./packaging/windows/verify-msi.ps1 -MSI $msi -CLI $out -Helper $helper
-  if ($LASTEXITCODE -ne 0) { throw 'verify-msi.ps1 failed' }
-  $msiHash = (Get-FileHash -Algorithm SHA256 $msi).Hash.ToLower()
-  "$msiHash *$(Split-Path $msi -Leaf)" | Set-Content "$msi.sha256" -NoNewline -Encoding ascii
-  # Upload only after the signed MSI and its payload have passed verification.
-  buildkite-agent artifact upload "$msi;$msi.sha256"
-  if ($LASTEXITCODE -ne 0) { throw 'installer artifact upload failed' }
-} finally {
-  Remove-Item $stage -Recurse -Force
-}

package/.buildkite/build-windows.ps1

@@ -1,59 +0,0 @@
-#Requires -Version 5.1
-# Build and Authenticode-sign vip-next.exe on a Buildkite Windows agent.
-# Checksum is computed AFTER signing (signing changes the bytes).
-$ErrorActionPreference = 'Stop'
-
-$binBase = if ($env:BIN_BASE) { $env:BIN_BASE } else { 'vip-next' }
-
-function Get-GitOr($cmd, $fallback) {
-  try { $v = & git @cmd 2>$null; if ($LASTEXITCODE -eq 0 -and $v) { return $v.Trim() } } catch {}
-  return $fallback
-}
-
-New-Item -ItemType Directory -Force -Path dist | Out-Null
-$out = "dist/$binBase-windows-amd64.exe"
-
-# Any Go will do: go.mod's `toolchain` directive makes it fetch go1.27.0 itself.
-if (-not (Get-Command go -ErrorAction SilentlyContinue)) {
-  Write-Host "--- :package: install go"
-  choco install golang -y --no-progress
-  if ($LASTEXITCODE -ne 0) { throw 'choco install golang failed' }
-  # choco updates the machine PATH, not this process's.
-  $env:PATH = "$env:PATH;$env:ProgramFiles\Go\bin"
-}
-go version
-if ($LASTEXITCODE -ne 0) { throw 'go not usable after install' }
-
-$version = (& go run -mod=mod ./cmd/stamp-version | Out-String).Trim()
-if ($LASTEXITCODE -ne 0 -or -not $version) { throw 'stamp-version failed' }
-$commit = Get-GitOr @('rev-parse','--short','HEAD') 'unknown'
-
-Write-Host "--- :go: build windows/amd64"
-$env:CGO_ENABLED = '0'; $env:GOOS = 'windows'; $env:GOARCH = 'amd64'
-$ldflags = "-s -w -X github.com/Automattic/vip/internal/version.Version=$version -X github.com/Automattic/vip/internal/version.Commit=$commit"
-go build -buildvcs=false -trimpath -ldflags="$ldflags" -o $out ./cmd/vip-next
-if ($LASTEXITCODE -ne 0) { throw 'go build failed' }
-
-Write-Host "--- :test_tube: smoke"
-& $out --version
-& $out whoami --help
-
-Write-Host "--- :package: fetch go-search-replace"
-bash .buildkite/fetch-search-replace.sh windows/amd64
-if ($LASTEXITCODE -ne 0) { throw 'fetch-search-replace.sh failed' }
-$helper = 'third_party/go-search-replace/windows-amd64/go-search-replace.exe'
-
-. "$PSScriptRoot/sign-windows.ps1"
-
-Sign-File $out
-Sign-File $helper
-
-Write-Host "--- :package: tarball"
-$env:BIN_BASE = $binBase
-bash .buildkite/pack-release.sh windows amd64 $out $helper
-if ($LASTEXITCODE -ne 0) { throw 'pack-release.sh failed' }
-$tar = "dist/$binBase-windows-amd64.tar.gz"
-$hash = (Get-FileHash -Algorithm SHA256 $tar).Hash.ToLower()
-"$hash *$(Split-Path $tar -Leaf)" | Set-Content "$tar.sha256" -NoNewline
-
-Remove-Item $out -Force

package/.buildkite/fetch-search-replace.sh

@@ -1,65 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-# Fetch go-search-replace for each goos/goarch argument, verify against
-# third_party/go-search-replace/MANIFEST, install under that tree.
-# Usage: fetch-search-replace.sh darwin/arm64 darwin/amd64
-# No args: this host's GOOS/GOARCH.
-
-GSR_DIR=third_party/go-search-replace
-GSR_REPO=Automattic/go-search-replace
-
-sha256() {
-	if command -v shasum >/dev/null 2>&1; then
-		shasum -a 256 "$1" | awk '{ print $1 }'
-	else
-		sha256sum "$1" | awk '{ print $1 }'
-	fi
-}
-
-tag="$(awk '$1=="TAG"{print $2}' "${GSR_DIR}/MANIFEST")"
-[ -n "${tag}" ] || { echo "no TAG in ${GSR_DIR}/MANIFEST" >&2; exit 1; }
-
-if [ "$#" -eq 0 ]; then
-	set -- "$(go env GOOS)/$(go env GOARCH)"
-fi
-
-tmp="$(mktemp -d)"
-trap 'rm -rf "${tmp}"' EXIT
-
-for t in "$@"; do
-	os="${t%%/*}"
-	arch="${t##*/}"
-	want="$(awk -v k="${t}" '$1==k{print $2}' "${GSR_DIR}/MANIFEST")"
-	if [ -z "${want}" ]; then
-		echo "ERROR: ${t} is not pinned in ${GSR_DIR}/MANIFEST" >&2
-		exit 1
-	fi
-	name="go-search-replace_${os}_${arch}"
-	if [ "${os}" = windows ]; then
-		name="${name}.exe"
-	fi
-	url="https://github.com/${GSR_REPO}/releases/download/${tag}/${name}.gz"
-	echo "  fetching ${name} (${tag})"
-	if ! curl -fsSL "${url}" -o "${tmp}/${name}.gz"; then
-		echo "ERROR: could not download ${url}" >&2
-		exit 1
-	fi
-	gunzip -f "${tmp}/${name}.gz"
-	got="$(sha256 "${tmp}/${name}")"
-	if [ "${got}" != "${want}" ]; then
-		echo "ERROR: checksum mismatch for ${t}" >&2
-		echo "  expected (from upstream SLSA provenance): ${want}" >&2
-		echo "  got:                                      ${got}" >&2
-		echo "  Refusing to install. Do not bypass this." >&2
-		exit 1
-	fi
-	out="${GSR_DIR}/${os}-${arch}"
-	mkdir -p "${out}"
-	d="${out}/go-search-replace"
-	if [ "${os}" = windows ]; then
-		d="${d}.exe"
-	fi
-	mv "${tmp}/${name}" "${d}"
-	chmod +x "${d}"
-	echo "  verified + installed ${d}"
-done

package/.buildkite/pack-release.sh

@@ -1,26 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-# Pack vip-next + go-search-replace into dist/${BIN_BASE}-<os>-<arch>.tar.gz
-# Usage: pack-release.sh <goos> <goarch> <vip-next-path> <helper-path>
-
-: "${BIN_BASE:=vip-next}"
-
-os="${1:?}"
-arch="${2:?}"
-bin="${3:?}"
-helper="${4:?}"
-
-stage="$(mktemp -d)"
-trap 'rm -rf "${stage}"' EXIT
-
-if [ "${os}" = windows ]; then
-	cp "${bin}" "${stage}/vip-next.exe"
-	cp "${helper}" "${stage}/go-search-replace.exe"
-	chmod +x "${stage}/vip-next.exe" "${stage}/go-search-replace.exe"
-	tar -czf "dist/${BIN_BASE}-windows-${arch}.tar.gz" -C "${stage}" vip-next.exe go-search-replace.exe
-else
-	cp "${bin}" "${stage}/vip-next"
-	cp "${helper}" "${stage}/go-search-replace"
-	chmod +x "${stage}/vip-next" "${stage}/go-search-replace"
-	tar -czf "dist/${BIN_BASE}-${os}-${arch}.tar.gz" -C "${stage}" vip-next go-search-replace
-fi

package/.buildkite/pipeline.yml

@@ -1,81 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/pipeline-schema/main/schema.json
----
-# Shared vars (CI_TOOLKIT_PLUGIN, BIN_BASE) come from
-# .buildkite/shared-pipeline-vars, which our setup source's before
-# `buildkite-agent pipeline upload` interpolates this file.
-#
-# Every commit builds + smoke-tests all three platforms. macOS signs and
-# notarizes, and Windows Authenticode-signs, on every build so those paths
-# are not tag-only.
-
-env:
-  DO_NOT_TRACK: '1'
-
-steps:
-  - label: ':macos: Build & sign (macOS)'
-    key: binaries-macos
-    command: .buildkite/build-macos.sh
-    plugins:
-      - $CI_TOOLKIT_PLUGIN
-    agents:
-      queue: mac
-    env:
-      IMAGE_ID: $IMAGE_ID
-    notify:
-      - github_commit_status:
-          context: 'Build & sign (macOS)'
-    artifact_paths:
-      - 'dist/vip-next-darwin-*.tar.gz*'
-
-  - label: ':windows: Build & sign (Windows)'
-    key: binaries-windows
-    command: powershell -NoProfile -ExecutionPolicy Bypass -File .buildkite/build-windows.ps1
-    plugins:
-      - $CI_TOOLKIT_PLUGIN
-    agents:
-      queue: windows
-    notify:
-      - github_commit_status:
-          context: 'Build & sign (Windows)'
-    artifact_paths:
-      - 'dist/vip-next-windows-amd64.tar.gz*'
-
-  - label: ':linux: Build (Linux)'
-    command: .buildkite/build-linux.sh
-    agents:
-      queue: default
-    notify:
-      - github_commit_status:
-          context: 'Build (Linux)'
-    artifact_paths:
-      - 'dist/vip-next-linux-*.tar.gz*'
-
-  # Installer failures remain visible but cannot fail the binary release build.
-  # Scripts explicitly upload only fully signed and verified installer pairs.
-  - label: ':macos: Package & sign installer (macOS)'
-    key: installer-macos
-    depends_on: binaries-macos
-    soft_fail: true
-    command: bash .buildkite/build-macos-installer.sh
-    plugins:
-      - $CI_TOOLKIT_PLUGIN
-    agents:
-      queue: mac
-    env:
-      IMAGE_ID: $IMAGE_ID
-    notify:
-      - github_commit_status:
-          context: 'Package & sign installer (macOS)'
-
-  - label: ':windows: Package & sign installer (Windows)'
-    key: installer-windows
-    depends_on: binaries-windows
-    soft_fail: true
-    command: powershell -NoProfile -ExecutionPolicy Bypass -File .buildkite/build-windows-installer.ps1
-    plugins:
-      - $CI_TOOLKIT_PLUGIN
-    agents:
-      queue: windows
-    notify:
-      - github_commit_status:
-          context: 'Package & sign installer (Windows)'

package/.buildkite/shared-pipeline-vars

@@ -1,16 +0,0 @@
-#!/bin/sh
-# This file is `source`'d before `buildkite-agent pipeline upload`, so the
-# variables below get interpolated into pipeline.yml before it is uploaded.
-# (Same mechanism as Automattic/download's .buildkite/shared-pipeline-vars.)
-
-# a8c CI toolkit Buildkite plugin — provides install_gems, secret injection, and
-# GitHub status helpers on the macOS agent.
-export CI_TOOLKIT_PLUGIN="automattic/a8c-ci-toolkit#6.3.0"
-
-export BIN_BASE="vip-next"
-
-# The macOS VM to run on. The `mac` queue's command hook aborts when IMAGE_ID is
-# unset, and the signing step needs `codesign` and `xcrun notarytool`
-# regardless of Go being the compiler.
-XCODE_VERSION=$(grep -Ev '^[[:space:]]*(#|$)' .xcode-version | head -n1 | sed -E 's/^[[:space:]]*//; s/^~> ?//; s/[[:space:]]*$//')
-export IMAGE_ID="xcode-$XCODE_VERSION"

package/.buildkite/sign-windows.ps1

@@ -1,21 +0,0 @@
-# Shared Azure setup and signing for independent binary and installer jobs.
-$ErrorActionPreference = 'Stop'
-
-Write-Host "--- :closed_lock_with_key: Azure Trusted Signing"
-$setupScript = (Get-Command setup_azure_trusted_signing.ps1 -ErrorAction Stop).Source
-& $setupScript
-if ($LASTEXITCODE -ne 0) { throw 'setup_azure_trusted_signing.ps1 failed' }
-
-function Sign-File([string]$path) {
-  Write-Host "--- :closed_lock_with_key: Authenticode sign $path"
-  & $env:SIGNTOOL_PATH sign /v `
-    /fd $env:AZURE_FILE_DIGEST `
-    /tr $env:AZURE_TIMESTAMP_SERVER `
-    /td $env:AZURE_TIMESTAMP_DIGEST `
-    /dlib $env:AZURE_CODE_SIGNING_DLIB `
-    /dmdf $env:AZURE_METADATA_JSON `
-    $path
-  if ($LASTEXITCODE -ne 0) { throw "signtool sign failed for $path" }
-  & $env:SIGNTOOL_PATH verify /pa /v $path
-  if ($LASTEXITCODE -ne 0) { throw "signtool verify failed for $path" }
-}

package/.buildkite/test-windows-installer-download.ps1

@@ -1,54 +0,0 @@
-#Requires -Version 5.1
-# Run the real installer script through artifact lookup with agent-v3 Windows
-# paths. Stop before package construction; no signing or host installation.
-$ErrorActionPreference = 'Stop'
-$previousBinBase = $env:BIN_BASE
-$env:BIN_BASE = 'vip-next'
-
-function go {
-  $global:LASTEXITCODE = 0
-  if ($args[0] -eq 'version') { return 'go version test' }
-  if ($args -contains './cmd/stamp-version') { return '5.0.0-alpha.1' }
-  if ($args -contains './cmd/installer-payload') {
-    $archive = $args[$args.Count - 2]
-    if (-not (Test-Path -LiteralPath $archive) -or -not (Test-Path -LiteralPath "$archive.sha256")) {
-      throw 'Downloaded artifacts were not placed at the expected extraction paths'
-    }
-    throw 'TEST_STOP_BEFORE_PACKAGING'
-  }
-  throw "Unexpected Go invocation: $args"
-}
-
-function buildkite-agent {
-  if ($args[0] -ne 'artifact' -or $args[1] -ne 'download' -or
-      $args[4] -ne '--step' -or $args[5] -ne 'binaries-windows') {
-    throw "Unexpected or unscoped artifact command: $args"
-  }
-  $pattern = '^' + [regex]::Escape($args[2]).Replace('\*', '.*') + '$'
-  # These are the paths actually recorded by Buildkite build #96.
-  $paths = @("dist${artifactSeparator}vip-next-windows-amd64.tar.gz", "dist${artifactSeparator}vip-next-windows-amd64.tar.gz.sha256")
-  $matches = @($paths | Where-Object { $_ -cmatch $pattern })
-  $global:LASTEXITCODE = 1
-  if ($matches.Count -ne 2) { return }
-  foreach ($path in $matches) {
-    $destination = Join-Path $args[3] $path
-    New-Item -ItemType Directory -Force -Path (Split-Path $destination -Parent) | Out-Null
-    [System.IO.File]::WriteAllText($destination, 'test artifact')
-  }
-  $global:LASTEXITCODE = 0
-}
-
-try {
-  foreach ($artifactSeparator in @('\', '/')) {
-    try {
-      & "$PSScriptRoot/build-windows-installer.ps1"
-      throw 'Installer script did not stop at the test boundary'
-    } catch {
-      # Only the Go extraction stub emits this after verifying both downloads.
-      if ($_.Exception.Message -ne 'TEST_STOP_BEFORE_PACKAGING') { throw }
-    }
-  }
-  Write-Host 'Windows artifact lookup regression passed for both separator styles'
-} finally {
-  $env:BIN_BASE = $previousBinBase
-}

package/.buildkite/test_pipeline.py

@@ -1,69 +0,0 @@
-"""Exercise the real binary script with unavailable installer signing."""
-import os
-from pathlib import Path
-import shutil
-import subprocess
-import tempfile
-import unittest
-
-ROOT = Path(__file__).resolve().parents[1]
-
-
-class SigningIsolationTest(unittest.TestCase):
-    def test_binary_archives_survive_unavailable_installer_signing(self):
-        with tempfile.TemporaryDirectory() as directory:
-            root = Path(directory)
-            (root / ".buildkite").mkdir()
-            (root / "tools").mkdir()
-            for name in ["build-macos.sh", "pack-release.sh", "build-macos-installer.sh"]:
-                shutil.copy2(ROOT / ".buildkite" / name, root / ".buildkite" / name)
-
-            def executable(name, content):
-                target = root / name
-                target.write_text("#!/usr/bin/env bash\nset -eu\n" + content)
-                target.chmod(0o755)
-
-            executable(".buildkite/fetch-search-replace.sh", '''
-for arch in arm64 amd64; do
-  mkdir -p "third_party/go-search-replace/darwin-$arch"
-  printf '#!/bin/sh\\nexit 0\\n' > "third_party/go-search-replace/darwin-$arch/go-search-replace"
-done
-''')
-            executable("tools/go", '''
-case "$*" in
-  *stamp-version*) echo 5.0.0-alpha.1 ;;
-  *installer-version*) echo 5.0.101 ;;
-  build*)
-    while [ "$1" != -o ]; do shift; done
-    printf '#!/bin/sh\\nexit 0\\n' > "$2"
-    chmod +x "$2" ;;
-esac
-''')
-            executable("tools/bundle", '''
-printf '%s\\n' "$*" >> "$CALL_LOG"
-case "$*" in
-  *installer*) echo 'Installer certificate unavailable' >&2; exit 1 ;;
-esac
-''')
-            executable("tools/buildkite-agent", 'echo "unexpected artifact operation" >&2; exit 99\n')
-            env = dict(os.environ, PATH=str(root / "tools") + os.pathsep + os.environ["PATH"],
-                       CALL_LOG=str(root / "calls"), BIN_BASE="vip-next")
-            binary = subprocess.run(["bash", ".buildkite/build-macos.sh"], cwd=root, env=env,
-                                    capture_output=True, text=True)
-            self.assertEqual(binary.returncode, 0, binary.stdout + binary.stderr)
-            archives = sorted((root / "dist").glob("*.tar.gz*"))
-            self.assertEqual(len(archives), 4)
-            before = {p.name: p.read_bytes() for p in archives}
-            calls = (root / "calls").read_text()
-            self.assertIn("configure_code_signing", calls)
-            self.assertNotIn("installer", calls)
-            installer = subprocess.run(["bash", ".buildkite/build-macos-installer.sh"], cwd=root,
-                                       env=env, capture_output=True, text=True)
-            self.assertNotEqual(installer.returncode, 0)
-            self.assertIn("Installer certificate unavailable", installer.stderr)
-            self.assertEqual(before, {p.name: p.read_bytes() for p in archives})
-            self.assertFalse(list((root / "dist").glob("*.pkg*")))
-
-
-if __name__ == "__main__":
-    unittest.main()

package/.bundle/config

@@ -1,4 +0,0 @@
----
-BUNDLE_PATH: "vendor/bundle"
-BUNDLE_JOBS: "3"
-BUNDLE_RETRY: "3"

package/.editorconfig

@@ -1,11 +0,0 @@
-root = true
-
-[*]
-charset = utf-8
-end_of_line = lf
-indent_style = tab
-insert_final_newline = true
-trim_trailing_whitespace = true
-
-[*.json,*.yaml,*.yml]
-indent_style = space

package/.prettierignore

@@ -1,13 +0,0 @@
-/docs/CHANGELOG.md
-/__fixtures__/
-/dist/
-/npm-shrinkwrap.json
-
-# Go tree: source, fixtures and recorded parity payloads.
-# The parity recordings must stay byte-exact — reformatting them changes the
-# payloads the harness replays and invalidates expected_drift signatures.
-/testdata/
-/internal/
-/cmd/
-/scripts/
-/third_party/

package/.ruby-version

@@ -1 +0,0 @@
-3.4.9

package/.sonarcloud.properties

@@ -1,2 +0,0 @@
-sonar.sources=src, helpers
-sonar.tests=__tests__

package/.xcode-version

@@ -1 +0,0 @@
-26.6