123set -euo pipefail45if [[ "$(uname -s)" != Linux ]]; then6 printf 'bazzite_package_install_e2e=skipped (Linux required)\n'7 exit 08fi9if [[ "$(id -u)" -eq 0 ]]; then10 printf 'bazzite_package_install_e2e=skipped (non-root user required)\n'11 exit 012fi1314script_dir="$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"15repo_dir="$(CDPATH='' cd -- "$script_dir/../.." && pwd -P)"16installer="$repo_dir/scripts/install-bazzite-package.sh"17rollback="$repo_dir/scripts/rollback-bazzite-release.sh"18temp_parent="${TMPDIR:-/tmp}"19temp_parent="${temp_parent%/}"20temp_root="$(mktemp -d "$temp_parent/sigil-package-e2e.XXXXXX")"2122cleanup() {23 local status=$?24 trap - EXIT INT TERM HUP25 case "$temp_root" in26 "$temp_parent"/sigil-package-e2e.??????) rm -rf -- "$temp_root" ;;27 esac28 exit "$status"29}30trap cleanup EXIT INT TERM HUP3132make_payload() {33 local root="$1"34 local tag="$2"35 local commit="$3"36 local asset_name="sigil-$tag-linux-glibc2.17-x86_64.tar.gz"37 local release="$root/release"38 local true_binary39 true_binary="$(readlink -f /usr/bin/true 2>/dev/null || readlink -f /bin/true)"40 [[ -x "$true_binary" ]]4142 install -d -m 0700 \43 "$root" "$release/assets" "$release/docs" "$release/tools"44 install -m 0755 "$true_binary" "$release/sigil"45 install -m 0755 "$true_binary" "$release/sigil-host"46 install -m 0755 "$true_binary" "$release/sigil-probe"47 install -m 0755 "$rollback" "$release/tools/rollback-bazzite-release.sh"48 printf '[Service]\nExecStart=/fixture serve\n' >"$release/assets/sigil-host.service"49 printf 'audio fixture\n' >"$release/assets/50-sigil-spark-audio.conf"50 printf 'udev fixture\n' >"$release/assets/70-sigil-remote-input.rules"51 printf 'early uinput fixture\n' >"$release/assets/72-sigil-uinput.rules"52 printf 'final uinput fixture\n' >"$release/assets/99-sigil-uinput.rules"53 printf '# Activation fixture %s\n' "$tag" \54 >"$release/docs/sigil-host-activation.md"55 printf 'MIT\n' >"$release/LICENSE"56 chmod 0600 "$release/assets/50-sigil-spark-audio.conf"57 chmod 0644 \58 "$release/assets/70-sigil-remote-input.rules" \59 "$release/assets/72-sigil-uinput.rules" \60 "$release/assets/99-sigil-uinput.rules" \61 "$release/assets/sigil-host.service" \62 "$release/docs/sigil-host-activation.md" \63 "$release/LICENSE"6465 python3 - "$release/release-manifest.json" "$tag" "$commit" "$asset_name" <<'PY'66import json67import pathlib68import sys6970path, tag, commit, asset = sys.argv[1:]71manifest = {72 "format": 2,73 "product": "sigil-host",74 "primary_executable": "sigil",75 "compatibility_executable": "sigil-host",76 "version": tag[1:],77 "target": "x86_64-unknown-linux-gnu.2.17",78 "profile": "release",79 "features": ["in-process-gstreamer"],80 "demo_auth_bypass": False,81 "demo_direct_node": False,82 "git_commit": commit,83 "git_dirty": False,84 "cargo_lock_sha256": "b" * 64,85 "rust_toolchain_sha256": "c" * 64,86 "cargo_zigbuild": "cargo-zigbuild 0.23.0",87 "binary_provenance": "self-built-clean-head",88 "binary_provenance_verified": True,89 "release_tag": tag,90 "asset_name": asset,91 "release_kind": "product-candidate",92}93pathlib.Path(path).write_text(json.dumps(manifest, sort_keys=True, indent=2) + "\n")94PY95 chmod 0644 "$release/release-manifest.json"9697 : >"$release/SHA256SUMS"98 for relative in \99 sigil sigil-host sigil-probe \100 assets/50-sigil-spark-audio.conf \101 assets/70-sigil-remote-input.rules \102 assets/72-sigil-uinput.rules \103 assets/99-sigil-uinput.rules \104 assets/sigil-host.service \105 docs/sigil-host-activation.md \106 tools/rollback-bazzite-release.sh \107 LICENSE release-manifest.json108 do109 printf '%s %s\n' "$(sha256sum "$release/$relative" | awk '{print $1}')" \110 "$relative" >>"$release/SHA256SUMS"111 done112 chmod 0644 "$release/SHA256SUMS"113 sha256sum "$release/SHA256SUMS" | awk '{print $1}' >"$root/release-id"114 install -m 0755 "$installer" "$root/install-bazzite-package.sh"115 # Intentional literals form the package-owned wrapper fixture.116 # shellcheck disable=SC2016117 printf '%s\n' \118 '#!/usr/bin/env bash' \119 'set -euo pipefail' \120 'script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"' \121 'exec "$script_dir/install-bazzite-package.sh" --payload-dir "$script_dir" "$@"' \122 >"$root/stage-this-release.sh"123 chmod 0755 "$root/stage-this-release.sh"124 : >"$root/PACKAGE-SHA256SUMS"125 for relative in release-id install-bazzite-package.sh stage-this-release.sh release/SHA256SUMS; do126 printf '%s %s\n' "$(sha256sum "$root/$relative" | awk '{print $1}')" \127 "$relative" >>"$root/PACKAGE-SHA256SUMS"128 done129 chmod 0644 "$root/PACKAGE-SHA256SUMS"130}131132payload_a="$temp_root/payload-a"133payload_b="$temp_root/payload-b"134make_payload "$payload_a" v0.1.0 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa135make_payload "$payload_b" v0.1.1 bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb136release_a="$(<"$payload_a/release-id")"137release_b="$(<"$payload_b/release-id")"138[[ "$release_a" != "$release_b" ]]139140fake_bin="$temp_root/bin"141install -d -m 0700 "$fake_bin"142systemctl_log="$temp_root/systemctl.log"143# Intentional literals form the isolated systemctl recording shim.144# shellcheck disable=SC2016145printf '%s\n' \146 '#!/usr/bin/env bash' \147 'printf "%s\n" "$*" >>"$SIGIL_TEST_SYSTEMCTL_LOG"' \148 'exit 0' >"$fake_bin/systemctl"149printf '%s\n' '#!/usr/bin/env bash' 'exit 0' >"$fake_bin/systemd-analyze"150chmod 0755 "$fake_bin/systemctl" "$fake_bin/systemd-analyze"151152test_home="$temp_root/home"153install -d -m 0700 "$test_home"154run_installer() {155 env HOME="$test_home" PATH="$fake_bin:$PATH" \156 SIGIL_TEST_SYSTEMCTL_LOG="$systemctl_log" \157 "$installer" --payload-dir "$1"158}159160run_installer "$payload_a" >"$temp_root/install-a.log"161install_root="$test_home/.local/libexec/sigil-spark"162[[ "$(basename -- "$(readlink -f "$install_root/current")")" == "$release_a" ]]163[[ ! -e "$install_root/previous" && ! -L "$install_root/previous" ]]164grep -Fqx '# Activation fixture v0.1.0' \165 "$install_root/current/docs/sigil-host-activation.md"166grep -Fq "activation_guide=$install_root/current/docs/sigil-host-activation.md" \167 "$temp_root/install-a.log"168if grep -Fq 'fresh-bazzite-host.md' "$temp_root/install-a.log"; then169 printf 'FAIL: package installer delegated activation to the lab runbook\n' >&2170 exit 1171fi172173run_installer "$payload_a" >"$temp_root/repeat-a.log"174[[ "$(basename -- "$(readlink -f "$install_root/current")")" == "$release_a" ]]175[[ ! -e "$install_root/previous" && ! -L "$install_root/previous" ]]176177identity="$test_home/.local/share/sigil-spark/identity/host.key"178config="$test_home/.config/sigil-spark/host.toml"179install -d -m 0700 "$(dirname -- "$identity")" "$(dirname -- "$config")"180printf 'identity fixture\n' >"$identity"181printf 'config fixture\n' >"$config"182chmod 0600 "$identity" "$config"183identity_sha="$(sha256sum "$identity" | awk '{print $1}')"184config_sha="$(sha256sum "$config" | awk '{print $1}')"185186run_installer "$payload_b" >"$temp_root/install-b.log"187[[ "$(basename -- "$(readlink -f "$install_root/current")")" == "$release_b" ]]188[[ "$(basename -- "$(readlink -f "$install_root/previous")")" == "$release_a" ]]189grep -Fqx '# Activation fixture v0.1.1' \190 "$install_root/current/docs/sigil-host-activation.md"191[[ "$(sha256sum "$identity" | awk '{print $1}')" == "$identity_sha" ]]192[[ "$(sha256sum "$config" | awk '{print $1}')" == "$config_sha" ]]193194env HOME="$test_home" PATH="$fake_bin:$PATH" \195 SIGIL_TEST_SYSTEMCTL_LOG="$systemctl_log" \196 "$test_home/.local/bin/sigil-spark-host-rollback" >"$temp_root/rollback.log"197[[ "$(basename -- "$(readlink -f "$install_root/current")")" == "$release_a" ]]198[[ "$(basename -- "$(readlink -f "$install_root/previous")")" == "$release_b" ]]199[[ "$(sha256sum "$identity" | awk '{print $1}')" == "$identity_sha" ]]200[[ "$(sha256sum "$config" | awk '{print $1}')" == "$config_sha" ]]201202if grep -Eq '(^|[[:space:]])(start|restart|enable)([[:space:]]|$)' "$systemctl_log"; then203 printf 'FAIL: installer or rollback implicitly changed service activation\n' >&2204 sed -n '1,120p' "$systemctl_log" >&2205 exit 1206fi207grep -Fq -- '--user daemon-reload' "$systemctl_log"208209hostile_payload="$temp_root/hostile-payload"210cp -R "$payload_a" "$hostile_payload"211printf 'unexpected\n' >"$hostile_payload/unexpected"212hostile_home="$temp_root/hostile-home"213install -d -m 0700 "$hostile_home"214if env HOME="$hostile_home" PATH="$fake_bin:$PATH" \215 SIGIL_TEST_SYSTEMCTL_LOG="$systemctl_log" \216 "$installer" --payload-dir "$hostile_payload" >"$temp_root/hostile.log" 2>&1217then218 printf 'FAIL: unexpected payload file was accepted\n' >&2219 exit 1220fi221grep -Fq 'does not match the runtime allowlist' "$temp_root/hostile.log"222[[ ! -e "$hostile_home/.local/libexec/sigil-spark" ]]223224unsafe_home="$temp_root/unsafe-home"225install -d -m 0700 "$unsafe_home" "$temp_root/outside-local"226ln -s "$temp_root/outside-local" "$unsafe_home/.local"227if env HOME="$unsafe_home" PATH="$fake_bin:$PATH" \228 SIGIL_TEST_SYSTEMCTL_LOG="$systemctl_log" \229 "$installer" --payload-dir "$payload_a" >"$temp_root/unsafe-home.log" 2>&1230then231 printf 'FAIL: symlink install root was accepted\n' >&2232 exit 1233fi234grep -Fq 'unsafe install directory' "$temp_root/unsafe-home.log"235236printf 'bazzite_package_install_e2e=ok\n'