|
|
Phase 5, settled as build scripts rather than CI:
make release tests, then a fresh static-musl tarball
make publish render the site, upload, and verify against the live URL
publish.sh is deliberately dumb -- rsync, then ask the live site whether it
agrees (status codes plus a re-downloaded checksum) -- but it has two guard
rails that matter:
- it refuses to republish a version whose bytes differ from what is already
live. /releases/ is cached for a year, so the same URL serving two different
tarballs would be undebuggable. Bump VERSION instead.
- artifacts upload before latest.json, so the pointer never names a file that
is not downloadable yet.
site/install.sh is POSIX sh and short on purpose, because people are being asked
to pipe it into a shell. It reads latest.json, downloads the versioned artifact,
VERIFIES ITS SHA256, and only then unpacks and runs the bundled installer.
Refusal was tested for real by serving a doctored latest.json: it stops with a
checksum mismatch and installs nothing.
Verified end to end from the public URL, in a throwaway HOME with node, npm,
bun, cargo and rustc replaced by poison stubs:
curl -fsSL https://sl0ppi.sl0p.foo/install.sh | sh
sl0ppij --version -> 0.45.0+sl0p1
pi --version -> 0.84.1
sl0ppi doctor -> all good
The vhost itself is committed in the sl0pday repo, where that box's nginx config
lives.
|
