gamertan
9d9fc83dd0
Export the reviewed allowlisted snapshot from private source commit 8aab3db43f35e6a49aa497f45d73701b13fc9f32 and tree 992132ea4703437dc13ffdbb04a077816c02caf9. This includes routed singleton continuity, deployment evidence, strict schema-2 configuration, restricted transport, and the independently compilable public-tree guard. AI-Assisted: OpenAI Codex Signed-off-by: Cole Speelman <crspeelman@gmail.com>
31 lines
1.3 KiB
Bash
Executable File
31 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
set -euo pipefail
|
|
root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
|
|
allow=$root/scripts/public-snapshot.allow
|
|
LC_ALL=C sort -c "$allow"
|
|
[[ $(LC_ALL=C sort "$allow" | uniq -d | wc -l) -eq 0 ]]
|
|
mapfile -t files <"$allow"
|
|
[[ ${#files[@]} -gt 0 ]]
|
|
for file in "${files[@]}"; do
|
|
[[ -n $file && $file != /* && $file != *..* && $file != .gitea/* && $file != .github/* ]]
|
|
git -C "$root" cat-file -e "HEAD:$file"
|
|
done
|
|
work=$(mktemp -d)
|
|
trap 'rm -rf -- "$work"' EXIT
|
|
mkdir -m 0700 "$work/tree"
|
|
git -C "$root" archive HEAD -- "${files[@]}" | tar -xf - -C "$work/tree"
|
|
test ! -e "$work/tree/.git"
|
|
test ! -e "$work/tree/.gitea"
|
|
test ! -e "$work/tree/.github"
|
|
private_pattern='/home/[[:alnum:]_.-]+/|BEGIN (RSA|OPENSSH|EC) PRIVATE KEY|gitea[-_]api[[:alnum:]_.-]*token'
|
|
if (cd "$work/tree" && rg -n --hidden --glob '!scripts/export-public.sh' --glob '!scripts/check-public-tree.sh' "$private_pattern" .); then
|
|
echo "private material found in public tree" >&2
|
|
exit 1
|
|
fi
|
|
(cd "$work/tree" && ./scripts/check-licenses.sh)
|
|
(cd "$work/tree" && GOWORK=off go test -count=1 ./...)
|
|
(cd "$work/tree" && GOWORK=off go vet ./...)
|
|
(cd "$work/tree" && GOWORK=off CGO_ENABLED=0 go build -buildvcs=false -mod=readonly -trimpath -o "$work/tend" ./cmd/tend)
|
|
echo "public tree compiles independently"
|