Add schist-bin, the Schist image editor, to the fast ring (#293)
Schist is a layered image editor with PSD, Affinity and camera raw support, developed by Infrawrench and packaged by its upstream author. The package re-wraps the pacman-format payloads Schist's release workflow publishes for x86_64 and aarch64, so the builder does no compiling, and both assets are pinned by SHA-256. Releases are tracked declaratively through the GitHub upstream provider, which gains a "digests": true mode here: a vendor that publishes no checksum manifest can have each asset's SHA-256 read from the digest GitHub's release API reports, so the sync never downloads the artifacts. Exactly one of "checksums" or "digests" must be set, and the provider enforces that itself because scheduled runs reach it without the metadata validator. Fresh releases wait 24 hours before the scheduled sync picks them up, as mise-bin already does. vulkan-driver is an optional dependency rather than a hard one: makepkg -s would otherwise satisfy the virtual package with nvidia-utils in the build container, and Omarchy installs a Vulkan driver per machine. Co-authored-by: David Heinemeier Hansson <david@hey.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
6 files changed
+208
-24
No files matched your search
+95
-4
@@ -19,8 +19,8 @@ Usage: $0 [PACKAGE...]
|
||||
Update packages that track an upstream vendor release feed instead of the AUR.
|
||||
|
||||
Packages opt in declaratively through "upstream" in .omarchy/package.json.
|
||||
Providers cover GitHub Releases with checksum manifests, semver-shaped git
|
||||
tags whose source URLs can be hashed, and npm dist-tags. See README.md for the
|
||||
Providers cover GitHub Releases with checksum manifests or API asset digests,
|
||||
semver-shaped git tags whose source URLs can be hashed, and npm dist-tags. See README.md for the
|
||||
schemas. Anything outside those conventions may provide
|
||||
pkgbuilds/<package>/.omarchy/upstream.sh, a hook that reports JSON on stdout:
|
||||
|
||||
@@ -466,8 +466,8 @@ sync_package() {
|
||||
# paths. Covers release selection (fallback past quarantined releases,
|
||||
# draft/prerelease filtering, bypass, unchanged version), failure paths
|
||||
# (unusable tags/timestamps, missing checksums), checksum template mapping
|
||||
# for both architectures, the min_release_age backstop, the duration parser,
|
||||
# and manifest validation.
|
||||
# for both architectures, release API digests, the min_release_age backstop,
|
||||
# the duration parser, and manifest validation.
|
||||
cmd_self_test() {
|
||||
local failures=0
|
||||
|
||||
@@ -567,6 +567,76 @@ EOF
|
||||
rc=0; github_upstream_release "$pkg" 86400 >/dev/null 2>&1 || rc=$?
|
||||
check "missing aarch64 checksum fails the sync" "1" "$rc"
|
||||
|
||||
# A vendor publishing no manifest: checksums come from the digests the
|
||||
# release API reports per asset, with nothing fetched beyond the feed.
|
||||
echo "Release API digests:"
|
||||
local digpkg="$TEMP_DIR/selftest-digests"
|
||||
mkdir -p "$digpkg/.omarchy"
|
||||
printf 'pkgver=1.0.0\npkgrel=1\n' > "$digpkg/PKGBUILD"
|
||||
cat > "$digpkg/.omarchy/package.json" <<'EOF'
|
||||
{
|
||||
"source": "local",
|
||||
"upstream": {
|
||||
"github": "example/tool",
|
||||
"digests": true,
|
||||
"assets": {
|
||||
"x86_64": "tool-{pkgver}-1-x86_64.pkg.tar.zst",
|
||||
"aarch64": "tool-{pkgver}-1-aarch64.pkg.tar.zst"
|
||||
}
|
||||
}
|
||||
}
|
||||
EOF
|
||||
FIXTURE_RELEASES=$(jq -n --arg old "$old2d" --arg x "$sum_x19" --arg a "$sum_a19" '[
|
||||
{tag_name: "v1.9.0", published_at: $old, draft: false, prerelease: false, assets: [
|
||||
{name: "tool-1.9.0-1-x86_64.pkg.tar.zst", digest: ("sha256:" + $x)},
|
||||
{name: "tool-1.9.0-1-aarch64.pkg.tar.zst", digest: ("sha256:" + $a)},
|
||||
{name: "tool-1.9.0-1-x86_64.rpm", digest: "sha256:0000000000000000000000000000000000000000000000000000000000000000"}
|
||||
]}
|
||||
]')
|
||||
FIXTURE_CHECKSUMS="manifest must not be consulted"
|
||||
out=$(github_upstream_release "$digpkg" 0 2>/dev/null) || out="<error>"
|
||||
check "x86_64 checksum via the asset digest" "$sum_x19" "$(jq -r '.sha256sums.x86_64[0] // "<none>"' <<<"$out")"
|
||||
check "aarch64 checksum via the asset digest" "$sum_a19" "$(jq -r '.sha256sums.aarch64[0] // "<none>"' <<<"$out")"
|
||||
|
||||
FIXTURE_RELEASES=$(jq -n --arg old "$old2d" --arg x "$sum_x19" '[
|
||||
{tag_name: "v1.9.0", published_at: $old, draft: false, prerelease: false, assets: [
|
||||
{name: "tool-1.9.0-1-x86_64.pkg.tar.zst", digest: ("sha256:" + $x)},
|
||||
{name: "tool-1.9.0-1-aarch64.pkg.tar.zst"}
|
||||
]}
|
||||
]')
|
||||
rc=0; github_upstream_release "$digpkg" 0 >/dev/null 2>&1 || rc=$?
|
||||
check "asset without a digest fails the sync" "1" "$rc"
|
||||
|
||||
FIXTURE_RELEASES=$(jq -n --arg old "$old2d" --arg x "$sum_x19" '[
|
||||
{tag_name: "v1.9.0", published_at: $old, draft: false, prerelease: false, assets: [
|
||||
{name: "tool-1.9.0-1-x86_64.pkg.tar.zst", digest: ("sha256:" + $x)},
|
||||
{name: "tool-1.9.0-2-aarch64.pkg.tar.zst", digest: ("sha256:" + $x)}
|
||||
]}
|
||||
]')
|
||||
rc=0; github_upstream_release "$digpkg" 0 >/dev/null 2>&1 || rc=$?
|
||||
check "asset re-cut under another release number fails the sync" "1" "$rc"
|
||||
|
||||
FIXTURE_RELEASES=$(jq -n --arg old "$old2d" --arg x "$sum_x19" --arg a "$sum_a19" '[
|
||||
{tag_name: "v1.9.0", published_at: $old, draft: false, prerelease: false, assets: [
|
||||
{name: "tool-1.9.0-1-x86_64.pkg.tar.zst", digest: $x},
|
||||
{name: "tool-1.9.0-1-aarch64.pkg.tar.zst", digest: ("sha256:" + $a)}
|
||||
]}
|
||||
]')
|
||||
rc=0; github_upstream_release "$digpkg" 0 >/dev/null 2>&1 || rc=$?
|
||||
check "digest without the sha256: prefix fails the sync" "1" "$rc"
|
||||
|
||||
# The provider enforces the declaration shape itself: scheduled runs reach
|
||||
# it without validate_package_metadata.
|
||||
jq '.upstream.checksums = "SHASUMS256.txt"' "$digpkg/.omarchy/package.json" > "$digpkg/both.json"
|
||||
cp "$digpkg/.omarchy/package.json" "$digpkg/good.json"
|
||||
cp "$digpkg/both.json" "$digpkg/.omarchy/package.json"
|
||||
rc=0; github_upstream_release "$digpkg" 0 >/dev/null 2>&1 || rc=$?
|
||||
check "provider rejects checksums and digests together" "1" "$rc"
|
||||
jq '.upstream.digests = "true"' "$digpkg/good.json" > "$digpkg/.omarchy/package.json"
|
||||
rc=0; github_upstream_release "$digpkg" 0 >/dev/null 2>&1 || rc=$?
|
||||
check "provider rejects a non-boolean digests" "1" "$rc"
|
||||
cp "$digpkg/good.json" "$digpkg/.omarchy/package.json"
|
||||
|
||||
echo "Quarantine backstop:"
|
||||
local rel st
|
||||
rel=$(jq -n --arg p "$old2d" '{pkgver: "1.9.0", published_at: $p, sha256sums: {}}')
|
||||
@@ -619,6 +689,27 @@ EOF
|
||||
echo '{"source": "local", "upstream": {"github": "example/tool"}}' > "$agepkg/.omarchy/package.json"
|
||||
vst=0; validate_package_metadata "$agepkg" >/dev/null || vst=$?
|
||||
check "upstream without checksums/assets is rejected" "1" "$vst"
|
||||
echo '{"source": "local", "upstream": {"github": "example/tool", "checksums": "SHASUMS256.txt", "digests": true, "assets": {"x86_64": "a"}}}' > "$agepkg/.omarchy/package.json"
|
||||
vst=0; validate_package_metadata "$agepkg" >/dev/null || vst=$?
|
||||
check "upstream with both checksums and digests is rejected" "1" "$vst"
|
||||
echo '{"source": "local", "upstream": {"github": "example/tool", "digests": "yes", "assets": {"x86_64": "a"}}}' > "$agepkg/.omarchy/package.json"
|
||||
vst=0; validate_package_metadata "$agepkg" >/dev/null || vst=$?
|
||||
check "non-boolean digests is rejected" "1" "$vst"
|
||||
echo '{"source": "local", "upstream": {"github": "example/tool", "checksums": false, "digests": true, "assets": {"x86_64": "a"}}}' > "$agepkg/.omarchy/package.json"
|
||||
vst=0; validate_package_metadata "$agepkg" >/dev/null || vst=$?
|
||||
check "checksums: false alongside digests is rejected" "1" "$vst"
|
||||
echo '{"source": "local", "upstream": {"github": "example/tool", "checksums": "SUMS", "digests": null, "assets": {"x86_64": "a"}}}' > "$agepkg/.omarchy/package.json"
|
||||
vst=0; validate_package_metadata "$agepkg" >/dev/null || vst=$?
|
||||
check "digests: null is rejected" "1" "$vst"
|
||||
echo '{"source": "local", "upstream": {"github": "example/tool", "checksums": "SUMS", "digests": false, "assets": {"x86_64": "a"}}}' > "$agepkg/.omarchy/package.json"
|
||||
vst=0; validate_package_metadata "$agepkg" >/dev/null || vst=$?
|
||||
check "digests: false beside a checksums manifest is accepted" "0" "$vst"
|
||||
echo '{"source": "local", "upstream": {"github": "example/tool", "digests": false, "assets": {"x86_64": "a"}}}' > "$agepkg/.omarchy/package.json"
|
||||
vst=0; validate_package_metadata "$agepkg" >/dev/null || vst=$?
|
||||
check "digests: false alone is rejected" "1" "$vst"
|
||||
cp "$digpkg/.omarchy/package.json" "$agepkg/.omarchy/package.json"
|
||||
vst=0; validate_package_metadata "$agepkg" >/dev/null || vst=$?
|
||||
check "the digests declaration shape is accepted" "0" "$vst"
|
||||
echo '{"source":"local","upstream":{"github":"example/tool","git_tags":"https://example/tool.git","checksums":"sums","assets":{"any":"tool"}}}' > "$agepkg/.omarchy/package.json"
|
||||
vst=0; validate_package_metadata "$agepkg" >/dev/null || vst=$?
|
||||
check "multiple provider types are rejected" "1" "$vst"
|
||||
|
||||
Reference in new issue
Block a user