From 906df3badc311ac993a7c95589536edacd4220ac Mon Sep 17 00:00:00 2001 From: Lukasz Kasprzak Date: Fri, 21 Aug 2026 10:36:00 +0200 Subject: build: verify the upload instead of assuming it release-tarball chained its steps with ';', so a failed scp or ssh still reached the final echo and it announced a publication that had not happened -- the file was never in the docroot. Every step is now chained with && and the result is checked over HTTP before anything is claimed: the URL must respond and the bytes must untar. Also passes -o ClearAllForwardings=yes, since the i2p port forwards in the ssh config fail when another session holds them and their noise buries real errors. --- Makefile | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) (limited to 'Makefile') diff --git a/Makefile b/Makefile index 6fe82dc..d82d320 100644 --- a/Makefile +++ b/Makefile @@ -22,7 +22,7 @@ MAN5DIR := $(PREFIX)/share/man/man5 # over documenting the dune commands. DUNE := opam exec -- -.PHONY: release-tarball help build test check check-schema check-templates check-citations install uninstall reinstall clean fmt man doc release +.PHONY: release-tarball verify-tarball help build test check check-schema check-templates check-citations install uninstall reinstall clean fmt man doc release help: ## show this help @grep -hE '^[a-z-]+:.*##' $(MAKEFILE_LIST) | sed -E 's/:.*## /\t/' | sort @@ -161,6 +161,9 @@ install: build ## install binary, calendar data, language tables, templates, sch RELEASE_HOST ?= vps-mail-i2p RELEASE_DIR ?= /usr/local/www/cgit RELEASE_NAME ?= colitur-latest.tar.gz +# Your ssh config forwards i2p ports; those fail when a session already holds +# them and the noise hides real errors. This target needs none of them. +SSHOPT ?= -o ClearAllForwardings=yes release-tarball: ## upload the current tag's tarball as the single published download @v=$$(git describe --tags --abbrev=0 2>/dev/null) || \ @@ -170,12 +173,25 @@ release-tarball: ## upload the current tag's tarball as the single published dow git describe --tags --exact-match >/dev/null 2>&1 || \ echo "note: HEAD is ahead of $$v; publishing the tag, not HEAD" >&2; \ echo "packaging $$v"; \ - git archive --format=tar.gz --prefix=colitur-$${v#v}/ -o /tmp/$(RELEASE_NAME) "$$v"; \ - scp -q /tmp/$(RELEASE_NAME) $(RELEASE_HOST):/tmp/$(RELEASE_NAME); \ - ssh $(RELEASE_HOST) "doas install -m 644 /tmp/$(RELEASE_NAME) $(RELEASE_DIR)/$(RELEASE_NAME) && rm -f /tmp/$(RELEASE_NAME)"; \ - rm -f /tmp/$(RELEASE_NAME); \ + git archive --format=tar.gz --prefix=colitur-$${v#v}/ -o /tmp/$(RELEASE_NAME) "$$v" && \ + scp -q $(SSHOPT) /tmp/$(RELEASE_NAME) $(RELEASE_HOST):/tmp/$(RELEASE_NAME) && \ + ssh $(SSHOPT) $(RELEASE_HOST) \ + "doas install -m 644 /tmp/$(RELEASE_NAME) $(RELEASE_DIR)/$(RELEASE_NAME) && rm -f /tmp/$(RELEASE_NAME)" && \ + rm -f /tmp/$(RELEASE_NAME) && \ + $(MAKE) -s verify-tarball && \ echo "published $$v to https://git.labunix.xyz/$(RELEASE_NAME)" +# Chained with && throughout, and the upload is VERIFIED over HTTP before +# anything claims success: the first version of this target used ';' and +# cheerfully printed "published" after the upload had failed and the file +# was not there at all. +verify-tarball: ## check the published tarball is actually downloadable + @curl -fsI https://git.labunix.xyz/$(RELEASE_NAME) >/dev/null || \ + { echo "verify-tarball: $(RELEASE_NAME) is not downloadable" >&2; exit 1; } + @curl -fsS https://git.labunix.xyz/$(RELEASE_NAME) | tar tz >/dev/null || \ + { echo "verify-tarball: published file is not a valid tarball" >&2; exit 1; } + @echo "verify-tarball: ok" + uninstall: ## remove everything install put into PREFIX -$(DUNE) dune uninstall --prefix $(PREFIX) rm -f $(MANDIR)/colitur.1 $(MAN5DIR)/colitur-overlay.5 $(MAN5DIR)/colitur-templates.5 $(MAN5DIR)/colitur-config.5 -- cgit v1.3