build: verify the upload instead of assuming it

release-tarball chained its steps with ';', so a failed scp or ssh still
reached the final echo and it announced a publication that had not
happened -- the file was never in the docroot. Every step is now chained
with && and the result is checked over HTTP before anything is claimed:
the URL must respond and the bytes must untar.

Also passes -o ClearAllForwardings=yes, since the i2p port forwards in
the ssh config fail when another session holds them and their noise
buries real errors.

1 files changed, 21 insertions, 5 deletions

diff --git a/Makefile b/Makefile
index 6fe82dc..d82d320 100644
--- a/Makefile
+++ b/Makefile
@@ -22,7 +22,7 @@ MAN5DIR  := $(PREFIX)/share/man/man5
 # over documenting the dune commands.
 DUNE := opam exec --
 
-.PHONY: release-tarball help build test check check-schema check-templates check-citations install uninstall reinstall clean fmt man doc release
+.PHONY: release-tarball verify-tarball help build test check check-schema check-templates check-citations install uninstall reinstall clean fmt man doc release
 help: ## show this help
 	@grep -hE '^[a-z-]+:.*##' $(MAKEFILE_LIST) | sed -E 's/:.*## /\t/' | sort
 
@@ -161,6 +161,9 @@ install: build ## install binary, calendar data, language tables, templates, sch
 RELEASE_HOST ?= vps-mail-i2p
 RELEASE_DIR  ?= /usr/local/www/cgit
 RELEASE_NAME ?= colitur-latest.tar.gz
+# Your ssh config forwards i2p ports; those fail when a session already holds
+# them and the noise hides real errors. This target needs none of them.
+SSHOPT       ?= -o ClearAllForwardings=yes
 
 release-tarball: ## upload the current tag's tarball as the single published download
 	@v=$$(git describe --tags --abbrev=0 2>/dev/null) || \
@@ -170,12 +173,25 @@ release-tarball: ## upload the current tag's tarball as the single published dow
 	git describe --tags --exact-match >/dev/null 2>&1 || \
 	  echo "note: HEAD is ahead of $$v; publishing the tag, not HEAD" >&2; \
 	echo "packaging $$v"; \
-	git archive --format=tar.gz --prefix=colitur-$${v#v}/ -o /tmp/$(RELEASE_NAME) "$$v"; \
-	scp -q /tmp/$(RELEASE_NAME) $(RELEASE_HOST):/tmp/$(RELEASE_NAME); \
-	ssh $(RELEASE_HOST) "doas install -m 644 /tmp/$(RELEASE_NAME) $(RELEASE_DIR)/$(RELEASE_NAME) && rm -f /tmp/$(RELEASE_NAME)"; \
-	rm -f /tmp/$(RELEASE_NAME); \
+	git archive --format=tar.gz --prefix=colitur-$${v#v}/ -o /tmp/$(RELEASE_NAME) "$$v" && \
+	scp -q $(SSHOPT) /tmp/$(RELEASE_NAME) $(RELEASE_HOST):/tmp/$(RELEASE_NAME) && \
+	ssh $(SSHOPT) $(RELEASE_HOST) \
+	  "doas install -m 644 /tmp/$(RELEASE_NAME) $(RELEASE_DIR)/$(RELEASE_NAME) && rm -f /tmp/$(RELEASE_NAME)" && \
+	rm -f /tmp/$(RELEASE_NAME) && \
+	$(MAKE) -s verify-tarball && \
 	echo "published $$v to https://git.labunix.xyz/$(RELEASE_NAME)"
 
+# Chained with && throughout, and the upload is VERIFIED over HTTP before
+# anything claims success: the first version of this target used ';' and
+# cheerfully printed "published" after the upload had failed and the file
+# was not there at all.
+verify-tarball: ## check the published tarball is actually downloadable
+	@curl -fsI https://git.labunix.xyz/$(RELEASE_NAME) >/dev/null || \
+	  { echo "verify-tarball: $(RELEASE_NAME) is not downloadable" >&2; exit 1; }
+	@curl -fsS https://git.labunix.xyz/$(RELEASE_NAME) | tar tz >/dev/null || \
+	  { echo "verify-tarball: published file is not a valid tarball" >&2; exit 1; }
+	@echo "verify-tarball: ok"
+
 uninstall: ## remove everything install put into PREFIX
 	-$(DUNE) dune uninstall --prefix $(PREFIX)
 	rm -f $(MANDIR)/colitur.1 $(MAN5DIR)/colitur-overlay.5 $(MAN5DIR)/colitur-templates.5 $(MAN5DIR)/colitur-config.5