diff --git a/.github/RELEASE_NOTES.md b/.github/RELEASE_NOTES.md index 0155249..5a5e2a8 100644 --- a/.github/RELEASE_NOTES.md +++ b/.github/RELEASE_NOTES.md @@ -1,10 +1,10 @@ -**deed** is a command line for nostr, built in Zig. It runs on macOS, Linux and Windows, on both Intel and ARM. The Linux binaries are statically linked, so there is no glibc version to satisfy. The macOS binaries are **ad-hoc signed, not notarized**, which means a download that came through a browser needs `xattr -dr com.apple.quarantine` before it will run. The Windows builds are zips holding `deed.exe`, which is not code-signed. +**deed** is a command line for nostr, built in Zig. It runs on macOS and Linux, on both Intel and ARM, and on Windows. The Linux binaries are statically linked, so there is no glibc version to satisfy. The macOS binaries are **ad-hoc signed, not notarized**, which means a download that came through a browser needs `xattr -dr com.apple.quarantine` before it will run. The Windows builds are zips holding `deed.exe`, which is not code-signed. Every artifact below is published with a `.sha256` beside it, so the download can be checked against a digest that was written by the same job that built it. -### What's new in v0.4.0 +### What's new in v0.4.1 -**deed runs on Windows.** Each release now carries a zip for x86_64 and one for ARM, holding `deed.exe`, with a `.sha256` beside each. The nostr library underneath builds and passes its tests on Windows too, including the read deadline that `req` and `fetch --timeout` rely on. +**deed runs on Windows.** Each release now carries a zip for x86_64 holding `deed.exe`, with a `.sha256` beside it. Windows on ARM runs it too, under the system's x86_64 emulation; a native ARM build is not shipped yet because it crashes at startup. The nostr library underneath builds and passes its tests on Windows too, including the read deadline that `req` and `fetch --timeout` rely on. **A new store's directories are made for you, and a store that will not open says why.** `--store ~/.deed/db` used to need `~/.deed` to exist already, and a store that failed to open printed only an error name. deed now creates the missing directories and names the reason: no permission, not a store, or a directory where the file should be. `--local` only reads, so it never creates an empty store at a mistyped path. diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cab975a..84de521 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -72,9 +72,13 @@ jobs: # Asking only whether the script parses would pass on an installer that # downloads the wrong file or verifies nothing. - name: The installer installs a release, and it runs + env: + GH_TOKEN: ${{ github.token }} run: | set -euo pipefail - tag="$(git tag --sort=-v:refname --list 'v*' | head -1)" + # The newest PUBLISHED release, not the newest tag: a tag whose + # release is still a draft has nothing a reader could download. + tag="$(gh release list --repo "$GITHUB_REPOSITORY" --exclude-drafts --exclude-pre-releases --limit 1 --json tagName --jq '.[0].tagName // empty')" if [ -z "$tag" ]; then echo "no release tag exists yet, so the installer was NOT exercised" >&2 exit 1 @@ -92,9 +96,12 @@ jobs: # refused and must install nothing, because a checksum that is checked and # then ignored is worse than none: it reads as a promise. - name: A download that does not verify is refused + env: + GH_TOKEN: ${{ github.token }} run: | set -euo pipefail - tag="$(git tag --sort=-v:refname --list 'v*' | head -1)" + tag="$(gh release list --repo "$GITHUB_REPOSITORY" --exclude-drafts --exclude-pre-releases --limit 1 --json tagName --jq '.[0].tagName // empty')" + [ -n "$tag" ] || { echo "no published release to tamper with" >&2; exit 1; } work="$RUNNER_TEMP/tamper" mkdir -p "$work" case "$(uname -s)" in diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8807e33..95e13b8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -82,14 +82,13 @@ jobs: v="${{ steps.version.outputs.version }}" mkdir -p dist - for target in aarch64-macos-none x86_64-macos-none x86_64-linux-musl aarch64-linux-musl x86_64-windows-gnu aarch64-windows-gnu; do + for target in aarch64-macos-none x86_64-macos-none x86_64-linux-musl aarch64-linux-musl x86_64-windows-gnu; do case "$target" in aarch64-macos-none) name=macos-aarch64 ;; x86_64-macos-none) name=macos-x86_64 ;; x86_64-linux-musl) name=linux-x86_64 ;; aarch64-linux-musl) name=linux-aarch64 ;; x86_64-windows-gnu) name=windows-x86_64 ;; - aarch64-windows-gnu) name=windows-aarch64 ;; esac rm -rf "out-$target" @@ -226,8 +225,6 @@ jobs: include: - runner: windows-latest asset: windows-x86_64 - - runner: windows-11-arm - asset: windows-aarch64 runs-on: ${{ matrix.runner }} defaults: run: @@ -292,11 +289,10 @@ jobs: "deed-$v-linux-x86_64.tar.gz" "deed-$v-linux-x86_64.tar.gz.sha256" \ "deed-$v-macos-aarch64.tar.gz" "deed-$v-macos-aarch64.tar.gz.sha256" \ "deed-$v-macos-x86_64.tar.gz" "deed-$v-macos-x86_64.tar.gz.sha256" \ - "deed-$v-windows-aarch64.zip" "deed-$v-windows-aarch64.zip.sha256" \ "deed-$v-windows-x86_64.zip" "deed-$v-windows-x86_64.zip.sha256" | sort)" actual="$(ls dist | sort)" diff <(printf '%s\n' "$expected") <(printf '%s\n' "$actual") \ - || { echo "the release assets are not the twelve expected files" >&2; exit 1; } + || { echo "the release assets are not the ten expected files" >&2; exit 1; } for f in dist/*; do [ -s "$f" ] || { echo "$f is empty" >&2; exit 1; } @@ -309,9 +305,9 @@ jobs: done # A glob that matched nothing would leave the loop body unrun and the # step green, having verified precisely nothing. - [ "$checked" = "6" ] || { echo "verified $checked checksums, expected 6" >&2; exit 1; } + [ "$checked" = "5" ] || { echo "verified $checked checksums, expected 5" >&2; exit 1; } - echo "twelve assets, all present, none empty, every digest matching" + echo "ten assets, all present, none empty, every digest matching" - name: Lift the draft, then read the page back env: @@ -327,6 +323,6 @@ jobs: # Read the list again from the published release. What was checked in # the step above was the draft, and this is the page a reader opens. count="$(gh release view "$GITHUB_REF_NAME" --json assets --jq '.assets | length')" - [ "$count" = "12" ] || { echo "the published release carries $count assets, expected 12" >&2; exit 1; } + [ "$count" = "10" ] || { echo "the published release carries $count assets, expected 10" >&2; exit 1; } echo "published $GITHUB_REF_NAME" diff --git a/README.md b/README.md index 1356370..fa61ae6 100644 --- a/README.md +++ b/README.md @@ -19,7 +19,7 @@ For macOS and Linux, Intel and ARM; Windows is [below](#windows). It works out w The script is short and worth reading before you pipe anything into bash. If you would rather do it yourself: ```sh -VERSION=0.4.0 +VERSION=0.4.1 PLATFORM=macos-aarch64 # or macos-x86_64, linux-x86_64, linux-aarch64 BASE=https://github.com/zig-nostr/deed/releases/download/v$VERSION @@ -40,7 +40,7 @@ xattr -dr com.apple.quarantine deed ### Windows -Windows takes a zip rather than the script. Download `deed--windows-x86_64.zip` (or `windows-aarch64` on an ARM machine) and the `.sha256` beside it from the [releases page](https://github.com/zig-nostr/deed/releases), then in PowerShell, from the folder they are in: +Windows takes a zip rather than the script. Download `deed--windows-x86_64.zip` and the `.sha256` beside it from the [releases page](https://github.com/zig-nostr/deed/releases), then in PowerShell, from the folder they are in: ```powershell $zip = (Get-Item deed-*-windows-*.zip).Name diff --git a/build.zig.zon b/build.zig.zon index 853f69e..0c51c80 100644 --- a/build.zig.zon +++ b/build.zig.zon @@ -1,6 +1,6 @@ .{ .name = .deed, - .version = "0.4.0", + .version = "0.4.1", .fingerprint = 0x89498c2094a1a4a3, .minimum_zig_version = "0.16.0", .dependencies = .{ diff --git a/src/main.zig b/src/main.zig index 6b28a4c..e3850ed 100644 --- a/src/main.zig +++ b/src/main.zig @@ -16,7 +16,7 @@ const cmd_publish = @import("cmd_publish.zig"); const cmd_req = @import("cmd_req.zig"); const cmd_verify = @import("cmd_verify.zig"); -pub const version = "0.4.0"; +pub const version = "0.4.1"; const usage = \\deed: the nostr command line