123set -euo pipefail45script_dir="$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"6repo_dir="$(CDPATH='' cd -- "$script_dir/../.." && pwd -P)"7temp_parent="${TMPDIR:-/tmp}"8temp_parent="${temp_parent%/}"9temp_root="$(mktemp -d "$temp_parent/sigil-product-contract.XXXXXX")"1011cleanup() {12 local status=$?13 trap - EXIT INT TERM HUP14 case "$temp_root" in15 "$temp_parent"/sigil-product-contract.??????) rm -rf -- "$temp_root" ;;16 esac17 exit "$status"18}19trap cleanup EXIT INT TERM HUP2021fixture_repo="$temp_root/repo"22install -d -m 0700 "$fixture_repo/scripts" "$fixture_repo/crates/sigil-host" "$temp_root/bin" "$temp_root/output"23for path in \24 scripts/package-bazzite-release.sh \25 scripts/install-bazzite-package.sh \26 scripts/rollback-bazzite-release.sh \27 scripts/sigil-host.service \28 scripts/50-sigil-spark-audio.conf \29 scripts/70-sigil-remote-input.rules \30 scripts/72-sigil-uinput.rules \31 scripts/99-sigil-uinput.rules \32 release/sigil-target-contract.txt \33 docs/sigil-host-activation.md \34 crates/sigil-host/Cargo.toml \35 Cargo.lock rust-toolchain.toml LICENSE36do37 install -d -m 0700 "$(dirname -- "$fixture_repo/$path")"38 install -m "$(stat -c '%a' "$repo_dir/$path" 2>/dev/null || stat -f '%Lp' "$repo_dir/$path")" \39 "$repo_dir/$path" "$fixture_repo/$path"40done4142# Intentional literals form isolated cargo command fixtures.43# shellcheck disable=SC201644printf '%s\n' \45 '#!/usr/bin/env bash' \46 'set -euo pipefail' \47 'test "${1:-}" = zigbuild' \48 'test "${PKG_CONFIG_ALLOW_CROSS:-}" = 1' \49 'test "${PKG_CONFIG_ALLOW_SYSTEM_LIBS:-}" = 1' \50 'case " $* " in *" --no-default-features "*) ;; *) exit 63 ;; esac' \51 'case " $* " in *" --features in-process-gstreamer "*) ;; *) exit 64 ;; esac' \52 'case " $* " in *"demo-auth-bypass"*) exit 65 ;; esac' \53 'output="$CARGO_TARGET_DIR/x86_64-unknown-linux-gnu/release"' \54 'install -d -m 0700 "$output"' \55 'printf "#!/usr/bin/env bash\\nexit 0\\n" >"$output/sigil"' \56 'cp "$output/sigil" "$output/sigil-probe"' \57 'chmod 0755 "$output/sigil" "$output/sigil-probe"' \58 >"$temp_root/bin/cargo"59printf '%s\n' '#!/usr/bin/env bash' 'printf "cargo-zigbuild 0.23.0\n"' \60 >"$temp_root/bin/cargo-zigbuild"61chmod 0755 "$temp_root/bin/cargo" "$temp_root/bin/cargo-zigbuild"6263git -C "$fixture_repo" init -q64git -C "$fixture_repo" config user.name 'Sigil Release Test'65git -C "$fixture_repo" config user.email 'release-test@invalid.example'66git -C "$fixture_repo" add .67git -C "$fixture_repo" commit -qm 'fixture release'68git -C "$fixture_repo" tag v0.1.069source_commit="$(git -C "$fixture_repo" rev-parse HEAD)"7071archive="$temp_root/output/sigil-v0.1.0-linux-glibc2.17-x86_64.tar.gz"72PATH="$temp_root/bin:$PATH" "$fixture_repo/scripts/package-bazzite-release.sh" \73 --release-tag v0.1.0 --output "$archive" >"$temp_root/product.log"74grep -Fq 'publisher_signature=pending-offline' "$temp_root/product.log"75packaged_input_rules="$temp_root/output/70-sigil-remote-input.rules"76tar -xOzf "$archive" payload/release/assets/70-sigil-remote-input.rules \77 >"$packaged_input_rules"78cmp -s "$repo_dir/scripts/70-sigil-remote-input.rules" "$packaged_input_rules" \79 || {80 printf 'packaged virtual-input rules differ from the frozen source ABI\n' >&281 exit 182 }83"$repo_dir/scripts/verify-sigil-release.sh" \84 --tag v0.1.0 --archive "$archive" --source-commit "$source_commit" --candidate \85 | grep -Fq 'sigil_release_verification=ok'8687# Exercise the offline boundary with a recording Minisign fixture. The archive88# and provenance validation are production code; only cryptography is stubbed.89# shellcheck disable=SC201690printf '%s\n' \91 '#!/usr/bin/env bash' \92 'signature=""' \93 'signing=false' \94 'while test "$#" -gt 0; do' \95 ' case "$1" in -S) signing=true ;; -x) signature="$2"; shift ;; esac' \96 ' shift' \97 'done' \98 'if $signing; then printf "fixture signature\\n" >"$signature"; fi' \99 'exit 0' >"$temp_root/bin/minisign"100chmod 0755 "$temp_root/bin/minisign"101secret_key="$temp_root/offline.key"102public_key="$temp_root/sigil-minisign.pub"103printf 'fixture secret\n' >"$secret_key"104chmod 0600 "$secret_key"105printf '%s\n%s\n' 'untrusted comment: fixture public key' \106 'RWAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' >"$public_key"107PATH="$temp_root/bin:$PATH" "$repo_dir/scripts/sign-bazzite-release.sh" \108 --tag v0.1.0 \109 --archive "$archive" \110 --source-commit "$source_commit" \111 --minisign-key "$secret_key" \112 --public-key-file "$public_key" \113 | grep -Fq 'offline_signing=ok'114[[ -f "$archive.minisig" ]]115116assert_rejected() {117 local name="$1"118 local expected="$2"119 local tag="$3"120 local output_dir="$temp_root/$name"121 install -d -m 0700 "$output_dir"122 local output="$output_dir/sigil-$tag-linux-glibc2.17-x86_64.tar.gz"123 local log="$output_dir/rejected.log"124 if PATH="$temp_root/bin:$PATH" "$fixture_repo/scripts/package-bazzite-release.sh" \125 --release-tag "$tag" --output "$output" >"$log" 2>&1126 then127 printf 'FAIL: %s unexpectedly succeeded\n' "$name" >&2128 exit 1129 fi130 grep -Fq "$expected" "$log" || {131 printf 'FAIL: %s did not report %s\n' "$name" "$expected" >&2132 sed -n '1,120p' "$log" >&2133 exit 1134 }135}136137printf 'dirty\n' >"$fixture_repo/dirty-file"138assert_rejected dirty-source 'worktree is dirty' v0.1.0139git -C "$fixture_repo" add dirty-file140git -C "$fixture_repo" commit -qm 'new untagged source'141assert_rejected tag-head-mismatch 'must resolve exactly to clean HEAD' v0.1.0142git -C "$fixture_repo" tag v0.1.1143assert_rejected tag-version-mismatch 'does not match Sigil version v0.1.0' v0.1.1144145printf 'package_bazzite_product_contract_tests=ok\n'