release: prepare Sandwich Hime v1 beta
Publish the sanitized Beta 1 source candidate with version-stable generated provenance, classroom/evaluation support boundaries, provisional macOS support, signed-source release policy, and an exact candidate preflight. Material implementation, drafting, and review were assisted by OpenAI Codex. Cole Speelman reviewed the public snapshot and accepts human responsibility for the contribution. Signed-off-by: Cole Speelman <crspeelman@gmail.com>
This commit is contained in:
+1
-1
@@ -7,7 +7,7 @@ These scripts are intentionally understandable shell and PowerShell rather than
|
||||
- `verify.sh` runs root and nested-module tests and vet, builds `himesan`, checks the compiler-owned golden output, and proves two generation passes leave the same bytes and unchanged modification times. Set `HIMESAN_RACE=1` for race tests.
|
||||
- `verify.ps1` provides the equivalent native Windows lane; pass `-Race` to include the race detector.
|
||||
- `check-licenses.sh` enforces the AGPL compiler / Apache runtime boundary and prevents generated application Go from inheriting an AGPL identifier.
|
||||
- `release-check.sh --version vX.Y.Z` is a clean-checkout technical preflight. Add `--public` and point `HIMESAN_RELEASE_EVIDENCE_DIR` at a human-reviewed evidence bundle for the public-launch gate. It never tags, pushes, publishes, or deploys.
|
||||
- `release-check.sh --version vX.Y.Z` is a clean-checkout technical preflight, including exact candidate-version and generated-provenance checks. Beta publication follows the narrower prerelease gates in `RELEASE.md`; release candidates and final v1 additionally use `--public` with a human-reviewed `HIMESAN_RELEASE_EVIDENCE_DIR`. The script never tags, pushes, publishes, or deploys.
|
||||
- `verify-public-install.sh --version vX.Y.Z` is a post-tag/publication check. It verifies exact `go-get=1` package routes and runs the documented compiler install and runtime get from fresh direct-fetch and public-proxy caches without interactive Git credentials.
|
||||
|
||||
The canonical Linux CI and release preflight also run bounded fuzz sessions for the parser/context compiler and Go-aware delimiter scanner. Seed-corpus execution remains part of ordinary `go test`; the bounded sessions are extra evidence, not a substitute for longer scheduled fuzzing before v1.
|
||||
|
||||
+107
-14
@@ -15,8 +15,9 @@ artifacts in the repository, pushes, or deploys.
|
||||
|
||||
--version Candidate compiler version. The corresponding runtime tag is
|
||||
sando/vX.Y.Z.
|
||||
--public Additionally require the human-reviewed launch evidence bundle
|
||||
named by HIMESAN_RELEASE_EVIDENCE_DIR.
|
||||
--public Require the human-reviewed RC/final launch evidence bundle named
|
||||
by HIMESAN_RELEASE_EVIDENCE_DIR. Canonical beta prereleases may
|
||||
run their narrower publication preflight without this flag.
|
||||
EOF
|
||||
}
|
||||
|
||||
@@ -45,8 +46,31 @@ while (( $# > 0 )); do
|
||||
esac
|
||||
done
|
||||
|
||||
if [[ ! "$version" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z]+([.-][0-9A-Za-z]+)*)?(\+[0-9A-Za-z]+([.-][0-9A-Za-z]+)*)?$ ]]; then
|
||||
printf 'error: --version must be a semantic version beginning with v\n' >&2
|
||||
if [[ ! "$version" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-([0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*))?$ ]]; then
|
||||
printf 'error: --version must be a canonical semantic version beginning with v (build metadata is not allowed)\n' >&2
|
||||
exit 2
|
||||
fi
|
||||
prerelease=${BASH_REMATCH[5]:-}
|
||||
if [[ "$prerelease" =~ (^|[.-])(0\.)?[0-9]{14}-[0-9a-f]{12,}$ ]]; then
|
||||
printf 'error: --version must be a signed release tag, not a Go pseudo-version\n' >&2
|
||||
exit 2
|
||||
fi
|
||||
if [[ -n "$prerelease" ]]; then
|
||||
IFS=. read -r -a prerelease_identifiers <<<"$prerelease"
|
||||
for identifier in "${prerelease_identifiers[@]}"; do
|
||||
if [[ "$identifier" =~ ^[0-9]+$ && "$identifier" =~ ^0[0-9]+$ ]]; then
|
||||
printf 'error: numeric prerelease identifiers must not contain leading zeroes: %s\n' "$identifier" >&2
|
||||
exit 2
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
beta_release=0
|
||||
if [[ "$prerelease" == beta || "$prerelease" == beta.* ]]; then
|
||||
beta_release=1
|
||||
fi
|
||||
if (( public_release == 0 && beta_release == 0 )); then
|
||||
printf 'error: RC and final release preflights require --public and the human-reviewed evidence bundle\n' >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
@@ -90,6 +114,73 @@ for tag in "$version" "$runtime_tag"; do
|
||||
fi
|
||||
done
|
||||
|
||||
artifact_dir=$(mktemp -d "${TMPDIR:-/tmp}/himesan-release-check.XXXXXXXX")
|
||||
cleanup() {
|
||||
if [[ -n "${artifact_dir:-}" && -d "$artifact_dir" ]]; then
|
||||
rm -rf -- "$artifact_dir"
|
||||
fi
|
||||
}
|
||||
trap cleanup EXIT HUP INT TERM
|
||||
|
||||
compiler_linker_flags="-X gamertan.com/sandwich-hime/internal/version.Compiler=$version"
|
||||
candidate_binary="$artifact_dir/himesan-candidate"
|
||||
|
||||
printf '\n==> exact release candidate identity\n'
|
||||
go build -trimpath -ldflags "$compiler_linker_flags" -o "$candidate_binary" ./cmd/himesan
|
||||
candidate_go_version=$(go env GOVERSION)
|
||||
expected_human_version="himesan $version (runtime ABI sando.v1, $candidate_go_version)"
|
||||
actual_human_version=$("$candidate_binary" version)
|
||||
if [[ "$actual_human_version" != "$expected_human_version" ]]; then
|
||||
printf 'error: candidate human version mismatch\nexpected: %s\nactual: %s\n' \
|
||||
"$expected_human_version" "$actual_human_version" >&2
|
||||
exit 1
|
||||
fi
|
||||
expected_json_version=$(printf '{"compiler":"%s","runtime_abi":"sando.v1","go":"%s"}' "$version" "$candidate_go_version")
|
||||
actual_json_version=$("$candidate_binary" version --json)
|
||||
if [[ "$actual_json_version" != "$expected_json_version" ]]; then
|
||||
printf 'error: candidate JSON version mismatch\nexpected: %s\nactual: %s\n' \
|
||||
"$expected_json_version" "$actual_json_version" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
file_mtime() {
|
||||
if stat --printf='%y' "$1" >/dev/null 2>&1; then
|
||||
stat --printf='%y' "$1"
|
||||
else
|
||||
stat -f '%m' "$1"
|
||||
fi
|
||||
}
|
||||
|
||||
printf '\n==> candidate generated-output provenance compatibility\n'
|
||||
golden_source=internal/compiler/testdata/golden/basic.sando
|
||||
golden_output="$golden_source.go"
|
||||
if ! grep -Fqx '// himesan:compiler 0.1.0-dev' "$golden_output"; then
|
||||
printf 'error: golden fixture no longer provides development-to-release provenance coverage: %s\n' "$golden_output" >&2
|
||||
exit 1
|
||||
fi
|
||||
golden_hash_before=$(git hash-object "$golden_output")
|
||||
golden_mtime_before=$(file_mtime "$golden_output")
|
||||
check_summary=$("$candidate_binary" check "$golden_source")
|
||||
if [[ "$check_summary" != 'checked 1 .sando files: 1 current' ]]; then
|
||||
printf 'error: candidate did not consider the development-produced golden current: %s\n' "$check_summary" >&2
|
||||
exit 1
|
||||
fi
|
||||
for pass in 1 2; do
|
||||
generate_summary=$("$candidate_binary" generate "$golden_source")
|
||||
if [[ "$generate_summary" != 'generated 0, unchanged 1 (1 .sando files)' ]]; then
|
||||
printf 'error: candidate generation pass %d reported unexpected changes: %s\n' "$pass" "$generate_summary" >&2
|
||||
exit 1
|
||||
fi
|
||||
if [[ "$(git hash-object "$golden_output")" != "$golden_hash_before" ]]; then
|
||||
printf 'error: candidate generation pass %d changed golden bytes\n' "$pass" >&2
|
||||
exit 1
|
||||
fi
|
||||
if [[ "$(file_mtime "$golden_output")" != "$golden_mtime_before" ]]; then
|
||||
printf 'error: candidate generation pass %d changed the golden mtime\n' "$pass" >&2
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
./scripts/check-licenses.sh
|
||||
HIMESAN_RACE=1 ./scripts/verify.sh
|
||||
|
||||
@@ -104,14 +195,6 @@ go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./...
|
||||
go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./...
|
||||
)
|
||||
|
||||
artifact_dir=$(mktemp -d "${TMPDIR:-/tmp}/himesan-release-check.XXXXXXXX")
|
||||
cleanup() {
|
||||
if [[ -n "${artifact_dir:-}" && -d "$artifact_dir" ]]; then
|
||||
rm -rf -- "$artifact_dir"
|
||||
fi
|
||||
}
|
||||
trap cleanup EXIT HUP INT TERM
|
||||
|
||||
printf '\n==> cross-compiling release binary smoke set\n'
|
||||
for target in \
|
||||
linux/amd64 \
|
||||
@@ -127,7 +210,8 @@ for target in \
|
||||
extension='.exe'
|
||||
fi
|
||||
CGO_ENABLED=0 GOOS="$target_os" GOARCH="$target_arch" \
|
||||
go build -trimpath -o "$artifact_dir/himesan-$target_os-$target_arch$extension" ./cmd/himesan
|
||||
go build -trimpath -ldflags "$compiler_linker_flags" \
|
||||
-o "$artifact_dir/himesan-$target_os-$target_arch$extension" ./cmd/himesan
|
||||
done
|
||||
|
||||
for required in \
|
||||
@@ -158,9 +242,18 @@ if (( public_release == 1 )); then
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ -n "$(git status --porcelain=v1 --untracked-files=all)" ]]; then
|
||||
printf 'error: release preflight left tracked changes or untracked artifacts in the canonical checkout\n' >&2
|
||||
git status --short >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if (( public_release == 1 )); then
|
||||
printf '\nHuman review is still required; evidence presence is not automatic approval.\n'
|
||||
else
|
||||
printf '\nTechnical preflight passed. Public launch remains blocked until --public evidence review passes.\n'
|
||||
printf '\nBeta technical publication preflight passed. This does not establish RC/final launch evidence or production stability.\n'
|
||||
fi
|
||||
|
||||
printf 'No tag, push, publication, or deployment was performed for %s / %s.\n' "$version" "$runtime_tag"
|
||||
|
||||
@@ -33,10 +33,24 @@ while (( $# > 0 )); do
|
||||
esac
|
||||
done
|
||||
|
||||
if [[ ! "$version" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z]+([.-][0-9A-Za-z]+)*)?(\+[0-9A-Za-z]+([.-][0-9A-Za-z]+)*)?$ ]]; then
|
||||
printf 'error: --version must be a semantic version beginning with v\n' >&2
|
||||
if [[ ! "$version" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-([0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*))?$ ]]; then
|
||||
printf 'error: --version must be a canonical semantic version beginning with v (build metadata is not allowed)\n' >&2
|
||||
exit 2
|
||||
fi
|
||||
prerelease=${BASH_REMATCH[5]:-}
|
||||
if [[ "$prerelease" =~ (^|[.-])(0\.)?[0-9]{14}-[0-9a-f]{12,}$ ]]; then
|
||||
printf 'error: --version must identify a signed release tag, not a Go pseudo-version\n' >&2
|
||||
exit 2
|
||||
fi
|
||||
if [[ -n "$prerelease" ]]; then
|
||||
IFS=. read -r -a prerelease_identifiers <<<"$prerelease"
|
||||
for identifier in "${prerelease_identifiers[@]}"; do
|
||||
if [[ "$identifier" =~ ^0[0-9]+$ ]]; then
|
||||
printf 'error: numeric prerelease identifiers must not contain leading zeroes: %s\n' "$identifier" >&2
|
||||
exit 2
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
for command_name in curl go git false; do
|
||||
command -v "$command_name" >/dev/null 2>&1 || {
|
||||
|
||||
Reference in New Issue
Block a user