OmarchybotandCodex XHigh
6d02625f7f
The release script computed the ISO's sha256 and echoed it to the releaser's terminal, where nobody downloading the ISO could ever see it, and the uploader shipped the ISO and its signature but nothing to check the download against. So "verify your download" was not advice anyone could act on. That matters more for this ISO than for most. The offline pacman mirror lives inside the airootfs and is stored uncompressed, and the installer bind-mounts it onto the target's package cache, so pacstrap reads packages straight off the medium. A flipped block there meets no decompressor and no squashfs block checksum on the way; pacman's integrity check is the first thing in the chain to notice, minutes into the install, as "invalid or corrupted package" against a package name that says nothing about the download. The sidecar names the ISO alone rather than the build path, so it verifies from whatever directory it was downloaded into. A release that cannot write it stops, because the sidecar left over from the previous release reads as a checksum for this one. The uploader now tallies every copy instead of letting the last one decide the exit status, and warns when there is no checksum to publish. Co-authored-by: Codex XHigh <codex@openai.com>
34 lines
958 B
Bash
Executable File
34 lines
958 B
Bash
Executable File
#!/bin/bash
|
|
|
|
if [ $# -eq 0 ]; then
|
|
echo "Usage: omarchy-iso-upload [release/omarchy.iso]"
|
|
exit 1
|
|
fi
|
|
|
|
if [[ ! -f ~/.config/rclone/rclone.conf ]]; then
|
|
echo "You must first configure rclone with the R2 credentials: omarchy-iso-rclone-config"
|
|
exit 1
|
|
fi
|
|
|
|
# Every copy reports, and one failure fails the upload. Without the tally the
|
|
# last copy decides the exit status, so a signature that never made it is
|
|
# hidden by a checksum that did.
|
|
status=0
|
|
|
|
rclone copy "$1" Omarchy:omarchy/ -P || status=1
|
|
|
|
# The signature and the checksum are only worth anything to someone who can
|
|
# reach them beside the ISO, so they go up in the same run rather than a step
|
|
# a release can finish without.
|
|
for sidecar in "$1.sig" "$1.sha256"; do
|
|
if [[ -f $sidecar ]]; then
|
|
rclone copy "$sidecar" Omarchy:omarchy/ -P || status=1
|
|
fi
|
|
done
|
|
|
|
if [[ ! -f $1.sha256 ]]; then
|
|
echo "Warning: no $1.sha256 to publish, so nobody can verify this download" >&2
|
|
fi
|
|
|
|
exit $status
|