123set -euo pipefail45script_dir="$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"6repo_dir="$(CDPATH='' cd -- "$script_dir/../.." && pwd -P)"7contract_file="$repo_dir/release/sigil-target-contract.txt"8expected_contract="linux-glibc2.17-x86_64"910[[ -f "$contract_file" && ! -L "$contract_file" ]] \11 || {12 printf 'Sigil target contract file is missing or unsafe\n' >&213 exit 114 }15[[ "$(wc -l <"$contract_file" | tr -d ' ')" == 1 ]] \16 || {17 printf 'Sigil target contract file must contain exactly one line\n' >&218 exit 119 }20[[ "$(<"$contract_file")" == "$expected_contract" ]] \21 || {22 printf 'Sigil target contract does not match the approved build ABI\n' >&223 exit 124 }2526required_consumers=(27 .github/workflows/portal-release.yml28 .github/workflows/sigil-release.yml29 AGENTS.md30 README.md31 docs/fresh-bazzite-host.md32 docs/public-alpha-uat.md33 docs/public-release-delivery.md34 scripts/install-bazzite-package.sh35 scripts/package-bazzite-release.sh36 scripts/public-alpha-uat.sh37 scripts/sign-bazzite-release.sh38 scripts/verify-sigil-bootstrap.py39 scripts/verify-sigil-release.sh40 website/install-sigil41)42for relative in "${required_consumers[@]}"; do43 grep -Fq "$expected_contract" "$repo_dir/$relative" || {44 printf 'Sigil release target contract is missing from %s\n' "$relative" >&245 exit 146 }47done4849# The old distro suffix may remain only in immutable Bazzite hardware-UAT50# evidence and in the explicit migration note. It must never return as a51# product release asset identity.52while IFS=: read -r relative _ line; do53 relative="${relative#./}"54 case "$relative:$line" in55 .github/workflows/sigil-hardware-uat.yml:*sigil-hardware-uat-*-bazzite-x86_64.tar.gz*) ;;56 docs/hardware-uat/*:*sigil-hardware-uat-*-bazzite-x86_64.tar.gz*) ;;57 scripts/run-bazzite-hardware-uat.sh:*sigil-hardware-uat-*-bazzite-x86_64.tar.gz*) ;;58 docs/public-release-delivery.md:*candidates*using*bazzite-x86_64*) ;;59 *)60 printf 'legacy distro identity leaked outside its allowlist: %s: %s\n' \61 "$relative" "$line" >&262 exit 163 ;;64 esac65done < <(66 cd "$repo_dir"67 rg -n --hidden --glob '!.git/**' --glob '!target/**' \68 --glob '!scripts/tests/sigil-release-target-contract.sh' \69 --fixed-strings 'bazzite-x86_64' .70)7172printf 'sigil_release_target_contract_tests=ok\n'