@r1z4x/tezgah 1.0.0

package/packaging/install.ps1

@@ -0,0 +1,166 @@
+<#
+.SYNOPSIS
+  Install tezgah on Windows - the only Windows entry point.
+
+.DESCRIPTION
+  Fetches one release version, checks its SHA256 against the release's .sha256,
+  unpacks it under <Prefix>\<Version> and points <Prefix>\current at it, then
+  runs the installer from that tree (bin\tezgah-setup --install --prefix
+  <Prefix>). `-NoInstall` stops after the flip: `tezgah-setup --upgrade` runs
+  this script that way and re-arms the hosts itself.
+
+  It assumes no `sh`, no `python3` and no symlinks:
+
+    * unpacking uses the `tar.exe` that ships with Windows 10 1803+ (bsdtar),
+      which reads .tar.gz; there is no Expand-Archive path for this archive.
+    * `current` is a directory junction, not a symlink: a symlink needs
+      SeCreateSymbolicLinkPrivilege (admin or Developer Mode), a junction does
+      not. If the junction is refused anyway (a redirected or read-only profile
+      folder, a network path), the tree is copied instead, and a later install
+      or upgrade re-materialises it - so `current` is always a directory that
+      resolves, link or copy.
+    * the installer is started with the first Python found: `py -3`, `python`,
+      then `python3`.
+
+  The `irm ... | iex` shape takes no arguments - a piped script cannot bind
+  parameters - so set the environment first:
+
+      $env:TEZGAH_VERSION = '0.1.0'; irm https://raw.githubusercontent.com/r1z4x/tezgah/main/packaging/install.ps1 | iex
+
+.EXAMPLE
+  .\install.ps1 -Version 0.1.0 -Prefix D:\tezgah
+#>
+[CmdletBinding()]
+param(
+    [string]$Version,
+    [string]$Prefix,
+    [string]$Repo = 'r1z4x/tezgah',
+    [switch]$NoInstall
+)
+
+$ErrorActionPreference = 'Stop'
+
+# A junction target must be a local absolute path, so resolve once, here.
+function Resolve-Full([string]$Path) {
+    if ([IO.Path]::IsPathRooted($Path)) { return [IO.Path]::GetFullPath($Path) }
+    return [IO.Path]::GetFullPath((Join-Path (Get-Location).Path $Path))
+}
+
+# Replacing `current`: the junction is deleted as the link it is. -Recurse on a
+# reparse point would follow it and delete the version tree it points at.
+function Remove-Current([string]$Path) {
+    if (-not (Test-Path -LiteralPath $Path)) { return }
+    $item = Get-Item -LiteralPath $Path -Force
+    if ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) {
+        [IO.Directory]::Delete($Path, $false)
+    } else {
+        [IO.Directory]::Delete($Path, $true)      # a copy from an earlier fallback
+    }
+}
+
+if ($env:TEZGAH_REPO) { $Repo = $env:TEZGAH_REPO }
+if (-not $Version) { $Version = $env:TEZGAH_VERSION }
+if (-not $Prefix) { $Prefix = $env:TEZGAH_PREFIX }
+if (-not $Prefix) { $Prefix = Join-Path $env:LOCALAPPDATA 'tezgah' }   # Windows' data dir
+$Prefix = Resolve-Full $Prefix
+if (-not $Version) {
+    try {
+        $rel = Invoke-RestMethod "https://api.github.com/repos/$Repo/releases/latest"
+        $Version = "$($rel.tag_name)".TrimStart('v')
+    } catch {
+        throw "tezgah: cannot read the newest release of $Repo (no release yet, or no network): $_"
+    }
+}
+if (-not $Version -or $Version -match '[\\/]' -or $Version -in @('.', '..')) {
+    throw "tezgah: bad version '$Version' (want X.Y.Z)"
+}
+
+$name = "tezgah-$Version.tar.gz"
+New-Item -ItemType Directory -Force -Path $Prefix | Out-Null
+$work = Join-Path ([IO.Path]::GetTempPath()) ("tezgah-" + [Guid]::NewGuid().ToString('N'))
+New-Item -ItemType Directory -Force -Path $work | Out-Null
+try {
+    $archive = Join-Path $work $name
+    # TEZGAH_DIST is the offline seam upgrade.sh has too: a directory holding the
+    # artifacts build.sh wrote, in place of the release URL.
+    if ($env:TEZGAH_DIST) {
+        $archive = Join-Path (Resolve-Full $env:TEZGAH_DIST) $name
+        if (-not (Test-Path -LiteralPath $archive)) { throw "tezgah: no $archive" }
+    } else {
+        $base = "https://github.com/$Repo/releases/download/v$Version"
+        try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch { }
+        Invoke-WebRequest -UseBasicParsing "$base/$name" -OutFile $archive
+    }
+    $sidecar = "$archive.sha256"
+    if (-not $env:TEZGAH_DIST) {
+        Invoke-WebRequest -UseBasicParsing "$base/$name.sha256" -OutFile $sidecar
+    }
+
+    $want = ((Get-Content -LiteralPath $sidecar -Raw).Trim() -split '\s+')[0]
+    if (-not $want) { throw "tezgah: $name.sha256 carries no digest" }
+    $got = (Get-FileHash -LiteralPath $archive -Algorithm SHA256).Hash.ToLower()
+    if ($want.ToLower() -ne $got) {
+        throw "tezgah: checksum mismatch for $name`: recorded $want, downloaded $got"
+    }
+    Write-Output "ok      verified $name ($got)"
+
+    $dest = Join-Path $Prefix $Version
+    if (Test-Path -LiteralPath $dest) {
+        Write-Output "ok      kept $dest (already unpacked)"
+    } else {
+        if (-not (Get-Command tar.exe -ErrorAction SilentlyContinue)) {
+            throw "tezgah: tar.exe is required (Windows 10 1803+ ships it) - cannot unpack $name"
+        }
+        # Unpack beside the destination and rename it into place: a failed unpack
+        # leaves no half tree where a version is expected, and `current` is only
+        # touched after this point.
+        $part = Join-Path $Prefix ".$Version.part"
+        Remove-Item -LiteralPath $part -Recurse -Force -ErrorAction SilentlyContinue
+        New-Item -ItemType Directory -Force -Path $part | Out-Null
+        & tar.exe -xzf $archive -C $part
+        if ($LASTEXITCODE -ne 0) {
+            Remove-Item -LiteralPath $part -Recurse -Force -ErrorAction SilentlyContinue
+            throw "tezgah: cannot unpack $name"
+        }
+        Move-Item -LiteralPath $part -Destination $dest
+        Write-Output "ok      unpacked $dest"
+    }
+
+    $current = Join-Path $Prefix 'current'
+    $old = $null
+    if (Test-Path -LiteralPath $current) {
+        $old = (Get-Item -LiteralPath $current -Force).Target
+    }
+    Remove-Current $current
+    try {
+        New-Item -ItemType Junction -Path $current -Target $dest | Out-Null
+    } catch {
+        # No privilege, no junction: a copy needs none, and the next install or
+        # upgrade replaces it with a junction when one can be made.
+        Write-Output "note    junction refused ($($_.Exception.Message.Trim())) - copied instead"
+        Copy-Item -LiteralPath $dest -Destination $current -Recurse -Force
+    }
+    if ($old) { Write-Output "ok      current -> $Version (was $old, still installed)" }
+    else { Write-Output "ok      current -> $Version" }
+
+    if (-not $NoInstall) {
+        $setup = Join-Path $current 'bin\tezgah-setup'
+        $py = $null
+        foreach ($cand in @('py', 'python', 'python3')) {
+            if (Get-Command $cand -ErrorAction SilentlyContinue) { $py = $cand; break }
+        }
+        if (-not $py) { throw "tezgah: no python on PATH (py, python or python3) to run $setup" }
+        # The prefix goes along: the installer records it, and `update` and
+        # `--uninstall` act on the recorded prefix, not on a POSIX default.
+        if ($py -eq 'py') { & py -3 $setup --install --prefix $Prefix } else { & $py $setup --install --prefix $Prefix }
+        # No `exit` here: under the documented `irm ... | iex` this script runs in
+        # the caller's own session, and `exit` closed the user's PowerShell window
+        # with the install output in it (audit L-10, ENV-05). A failure is thrown
+        # instead, and $LASTEXITCODE keeps the installer's code for the caller.
+        if ($LASTEXITCODE) {
+            throw "tezgah: tezgah-setup --install exited $LASTEXITCODE - read its output above"
+        }
+    }
+} finally {
+    Remove-Item -LiteralPath $work -Recurse -Force -ErrorAction SilentlyContinue
+}

package/packaging/install.sh

@@ -0,0 +1,56 @@
+#!/bin/sh
+# packaging/install.sh - install tezgah on a machine that has nothing yet.
+#
+#   install.sh [--version V] [--prefix P] [--reply-lang tr|en|any]
+#
+# Runs packaging/upgrade.sh (the one place a version is fetched, verified,
+# unpacked and made current), then the installer from the tree it made current.
+# Needs sh and curl; tar and sha256sum are upgrade.sh's. Env, unlike its flags:
+# TEZGAH_REPO, TEZGAH_DIST, TEZGAH_PREFIX, as in upgrade.sh.
+set -eu
+
+REPO=${TEZGAH_REPO:-r1z4x/tezgah}
+VERSION_ARG=
+PREFIX_ARG=
+REPLY_ARG=
+work=
+while [ $# -gt 0 ]; do case $1 in
+    --version) [ $# -ge 2 ] || { echo "tezgah: --version needs a value" >&2; exit 2; }; VERSION_ARG=$2; shift 2 ;;
+    --prefix)  [ $# -ge 2 ] || { echo "tezgah: --prefix needs a value" >&2; exit 2; }; PREFIX_ARG=$2; shift 2 ;;
+    --reply-lang) [ $# -ge 2 ] || { echo "tezgah: --reply-lang needs a value" >&2; exit 2; }; REPLY_ARG=$2; shift 2 ;;
+    -h|--help) sed -n '2,4p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+    *) echo "tezgah: unknown option $1" >&2; exit 2 ;;
+esac; done
+
+# The default upgrade.sh resolves: the installer is reached through the tree it picks.
+PREFIX=${PREFIX_ARG:-${TEZGAH_PREFIX:-${XDG_DATA_HOME:-$HOME/.local/share}/tezgah}}
+finish() { [ -z "$work" ] || rm -rf "$work"; }
+trap finish EXIT INT TERM
+
+here=$(CDPATH= cd -- "$(dirname -- "$0")" 2>/dev/null && pwd || echo .)
+if [ -f "$here/upgrade.sh" ]; then
+    up=$here/upgrade.sh                    # a checkout, or an unpacked release
+else
+    # Nothing to read it from: the bootstrapper comes from the release this install
+    # targets; which *version* that is stays upgrade.sh's answer.
+    ref=main
+    [ -z "$VERSION_ARG" ] || ref=v$VERSION_ARG
+    work=$(mktemp -d "${TMPDIR:-/tmp}/tezgah-install.XXXXXX") || exit 1
+    up=$work/upgrade.sh
+    curl -fsSL "https://raw.githubusercontent.com/$REPO/$ref/packaging/upgrade.sh" -o "$up" \
+        || { echo "tezgah: cannot fetch packaging/upgrade.sh at $ref" >&2; exit 1; }
+fi
+
+set -- --prefix "$PREFIX"                  # explicit flags: a prefix may hold a space
+[ -z "$VERSION_ARG" ] || set -- --version "$VERSION_ARG" "$@"
+sh "$up" "$@"
+
+# Called, not exec'd, so the trap above still removes a fetched bootstrapper. The
+# artifact carries the exec bit on bin/tezgah-setup (tests/test_packaging_scripts.py
+# holds it to that), so no interpreter lookup is needed here. --reply-lang rides
+# along because this run is non-interactive: no wizard asks it.
+if [ -n "$REPLY_ARG" ]; then
+    "$PREFIX/current/bin/tezgah-setup" --install --reply-lang "$REPLY_ARG"
+else
+    "$PREFIX/current/bin/tezgah-setup" --install
+fi

package/packaging/upgrade.sh

@@ -0,0 +1,142 @@
+#!/bin/sh
+# packaging/upgrade.sh - the one place a version is fetched, verified, unpacked
+# and made current.
+#
+#   upgrade.sh [--version V] [--prefix P]
+#
+# V defaults to the newest GitHub release of $TEZGAH_REPO; P to
+# $TEZGAH_PREFIX, else $XDG_DATA_HOME/tezgah, else ~/.local/share/tezgah. The
+# version unpacks at <P>/<V> and <P>/current is pointed at it, so a rollback is
+# `ln -sfn <P>/<previous> <P>/current` - the older tree is never removed.
+#
+# Callers: packaging/install.sh (a first install) and `tezgah-setup --upgrade`.
+# Neither re-implements the fetch, the checksum or the flip.
+#
+# Needs: sh, curl, tar, and sha256sum or shasum. No python. Uses `gh` when it
+# is on PATH to check the release's build provenance; without it, says so.
+# Env: TEZGAH_PREFIX, XDG_DATA_HOME, TEZGAH_VERSION, TEZGAH_REPO, TEZGAH_DIST
+#      (a directory holding tezgah-<V>.tar.gz + .sha256 - what build.sh --out
+#      writes; it swaps the release URL for that directory, one code path, and
+#      is how upgrade.sh is exercised without a published release), TEZGAH_GH
+#      (the gh to run for the provenance check; default `gh` on PATH).
+set -eu
+
+REPO=${TEZGAH_REPO:-r1z4x/tezgah}
+VERSION_ARG=
+PREFIX_ARG=
+
+while [ $# -gt 0 ]; do
+    case $1 in
+        --version) [ $# -ge 2 ] || { echo "tezgah: --version needs a value" >&2; exit 2; }; VERSION_ARG=$2; shift 2 ;;
+        --prefix)  [ $# -ge 2 ] || { echo "tezgah: --prefix needs a value" >&2; exit 2; }; PREFIX_ARG=$2; shift 2 ;;
+        -h|--help) sed -n '2,5p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+        *) echo "tezgah: unknown option $1" >&2; exit 2 ;;
+    esac
+done
+
+die() {
+    echo "tezgah: $*" >&2
+    exit 1
+}
+
+# The newest release tag. The API answers `tag_name`; the raw redirect would
+# too, but GitHub answers this without a rate-limit surprise on a repeat run.
+latest_release() {
+    body=$(curl -fsSL "https://api.github.com/repos/$REPO/releases/latest" 2>/dev/null) \
+        || return 1
+    tag=$(printf '%s\n' "$body" \
+        | sed -n 's/.*"tag_name":[[:space:]]*"\([^"]*\)".*/\1/p' | head -n 1)
+    [ -n "$tag" ] || return 1
+    printf '%s\n' "${tag#v}"
+}
+
+sha256_of() {
+    if command -v sha256sum >/dev/null 2>&1; then
+        sha256sum "$1" | sed 's/[[:space:]].*//'
+    elif command -v shasum >/dev/null 2>&1; then
+        shasum -a 256 "$1" | sed 's/[[:space:]].*//'
+    else
+        die "neither sha256sum nor shasum is on PATH - cannot verify the artifact"
+    fi
+}
+
+PREFIX=${PREFIX_ARG:-${TEZGAH_PREFIX:-${XDG_DATA_HOME:-$HOME/.local/share}/tezgah}}
+VERSION=${VERSION_ARG:-${TEZGAH_VERSION:-}}
+if [ -z "$VERSION" ]; then
+    VERSION=$(latest_release) || die "cannot read the newest release of $REPO (no release yet, or no network)"
+fi
+# The version becomes a path component and part of a filename, so a separator
+# must never get through.
+case $VERSION in
+    ""|*/*|.|..) die "bad version '$VERSION' (want X.Y.Z)" ;;
+esac
+
+if [ -n "${TEZGAH_DIST:-}" ]; then
+    case $TEZGAH_DIST in
+        /*) dist=$TEZGAH_DIST ;;
+        *)  dist=$PWD/$TEZGAH_DIST ;;
+    esac
+    base="file://$dist"
+else
+    base="https://github.com/$REPO/releases/download/v$VERSION"
+fi
+
+work=$(mktemp -d "${TMPDIR:-/tmp}/tezgah-upgrade.XXXXXX") || die "cannot create a temp dir"
+trap 'rm -rf "$work"' EXIT INT TERM
+
+name=tezgah-$VERSION.tar.gz
+curl -fsSL "$base/$name" -o "$work/$name" \
+    || die "cannot fetch $name from $base"
+curl -fsSL "$base/$name.sha256" -o "$work/$name.sha256" \
+    || die "cannot fetch $name.sha256 from $base"
+
+want=$(sed -n '1s/[[:space:]].*//p' "$work/$name.sha256")
+got=$(sha256_of "$work/$name")
+[ -n "$want" ] || die "$name.sha256 carries no digest"
+[ "$want" = "$got" ] || die "checksum mismatch for $name: recorded $want, downloaded $got"
+echo "ok      verified $name ($got)"
+
+# The .sha256 comes from the same place as the tarball, so it proves the
+# download is whole, not where it was built. The release workflow attests the
+# tarball's build provenance (actions/attest-build-provenance); `gh` can check
+# that binding when it is installed. It is not a dependency, so its absence -
+# or a gh that cannot answer (signed out, offline) - is said plainly and the
+# upgrade goes on: the checksum above stays the gate. TEZGAH_GH names the gh to
+# run (tests point it at a stand-in, or at nothing).
+gh=${TEZGAH_GH:-gh}
+if command -v "$gh" >/dev/null 2>&1; then
+    if gh_out=$("$gh" attestation verify "$work/$name" --repo "$REPO" 2>&1); then
+        echo "ok      provenance verified: $name was built by $REPO's release workflow"
+    else
+        echo "WARN    provenance not verified: gh attestation verify $name --repo $REPO said: $(printf '%s\n' "$gh_out" | tail -n 1)"
+    fi
+else
+    echo "note    provenance not checked: gh is not on PATH (check by hand: gh attestation verify $name --repo $REPO)"
+fi
+
+mkdir -p "$PREFIX" || die "cannot create $PREFIX"
+dest=$PREFIX/$VERSION
+part=$PREFIX/.$VERSION.part.$$
+if [ -e "$dest" ]; then
+    echo "ok      kept $dest (already unpacked)"
+else
+    # Unpack beside the destination, then rename it into place: a failed or
+    # interrupted unpack leaves no half tree where a version is expected, and
+    # `current` is only touched after this point.
+    rm -rf "$part"
+    mkdir -p "$part" || die "cannot create $part"
+    tar -xzf "$work/$name" -C "$part" || { rm -rf "$part"; die "cannot unpack $name"; }
+    mv "$part" "$dest" || { rm -rf "$part"; die "cannot install into $dest"; }
+    echo "ok      unpacked $dest"
+fi
+
+# Read the old target before the flip, to report what a rollback would return to.
+old=$(readlink "$PREFIX/current" 2>/dev/null || true)
+# -n: an existing `current` is a symlink to a directory, and without it ln would
+# create the new link *inside* the tree it is meant to replace.
+ln -sfn "$dest" "$PREFIX/current" || die "cannot point $PREFIX/current at $VERSION"
+if [ -n "$old" ]; then
+    echo "ok      current -> $VERSION (was $old, still installed)"
+else
+    echo "ok      current -> $VERSION"
+fi