| … | … | @@ -1,190 +1,40 @@ |
| 1 | 1 | #!/usr/bin/env bash |
| 2 | | # Release PearBrowser desktop to the production pear:// channel. |
| 2 | # PearBrowser v3 native-release preflight. |
| 3 | 3 | # |
| 4 | | # Uses the deprecated `pear release` for now — still works in Pear |
| 5 | | # runtime v2.x. The new replacement is multi-publisher multisig |
| 6 | | # (`pear provision` + `pear multisig {request,sign,verify,commit}`), |
| 7 | | # which is overkill for a solo publisher. Switch to the multisig flow |
| 8 | | # if/when: |
| 9 | | # 1. `pear release` is actually removed (not just deprecated), OR |
| 10 | | # 2. We add co-signers (genuine quorum security) |
| 11 | | # Until then, simpler is better. |
| 12 | | # |
| 13 | | # Usage: |
| 14 | | # ./scripts/release-prod.sh # full release: stage → release → pin → verify |
| 15 | | # ./scripts/release-prod.sh --no-pin # skip pin + verify (for dry-run / hotfix tests) |
| 16 | | # |
| 17 | | # After publishing, the script automatically pins the new length on |
| 18 | | # HiveRelay, then confirms the release is actually reachable. Caveat: |
| 19 | | # verify-pin.js (a fresh-peer round-trip) CANNOT pass when run on the |
| 20 | | # publisher machine — this box's durable seeder announces the drive from |
| 21 | | # behind a NAT (`firewalled true`), and Hyperswarm can't holepunch a peer |
| 22 | | # to itself; the relays only DIAL the seeder for this heavy-history key, |
| 23 | | # they don't announce it as servers. So on the publisher box the script |
| 24 | | # confirms reachability via the durable seeder's own log instead (restarts |
| 25 | | # the seeder at the new length, checks it announced + has live remote |
| 26 | | # peers). verify-pin still runs first and short-circuits to success when |
| 27 | | # invoked from a remote host / CI (where it genuinely can pass). |
| 4 | # This command intentionally has no publication authority. The v2 staged-drive |
| 5 | # publisher was removed: a remote Pear link is neither a desktop installer nor |
| 6 | # a valid update target for the embedded runtime. A release operator must build |
| 7 | # a native package, create and sign its AppRelease v2 record, publish through |
| 8 | # the approved release workflow, then attach independent availability evidence. |
| 28 | 9 | |
| 29 | 10 | set -euo pipefail |
| 30 | 11 | cd "$(dirname "$0")/.." |
| 31 | 12 | |
| 32 | | SKIP_PIN=0 |
| 33 | | for arg in "$@"; do |
| 34 | | if [[ "$arg" == "--no-pin" ]]; then SKIP_PIN=1; fi |
| 35 | | done |
| 36 | | |
| 37 | | PROD_LINK=$(node -p "require('./pear.json').links.production") |
| 38 | | |
| 39 | | if [[ -z "$PROD_LINK" ]]; then |
| 40 | | echo "✗ Missing production link in pear.json" >&2 |
| 41 | | exit 1 |
| 42 | | fi |
| 43 | | |
| 44 | | strip_ansi() { |
| 45 | | sed -E $'s/\x1B\\[[0-9;?]*[[:alpha:]]//g' |
| 46 | | } |
| 47 | | |
| 48 | | echo "▸ production link: $PROD_LINK" |
| 49 | | echo |
| 50 | | |
| 51 | | PREV_LEN=$(pear info "$PROD_LINK" 2>/dev/null | grep -E "^\s*release\s" | awk '{print $2}') |
| 52 | | echo "▸ previous released length: $PREV_LEN" |
| 53 | | echo |
| 54 | | |
| 55 | | # ── 1. stage ────────────────────────────────────────────── |
| 56 | | echo "============================================================" |
| 57 | | echo " 1/2 pear stage" |
| 58 | | echo "============================================================" |
| 59 | | # --purge is important: Pear drives are append-only, so adding a file to the |
| 60 | | # stage ignore list only prevents future adds. It does not remove a file that |
| 61 | | # was staged in an older release unless we explicitly purge ignored paths. |
| 62 | | STAGE_OUT=$(pear stage --purge "$PROD_LINK" . 2>&1) |
| 63 | | STAGE_CLEAN=$(printf '%s\n' "$STAGE_OUT" | strip_ansi) |
| 64 | | printf '%s\n' "$STAGE_CLEAN" | tail -8 |
| 65 | | # Parse the staged length. Newer Pear prints "Latest length: N" (not the older |
| 66 | | # "Latest: N"), so accept both. A miss here is NOT fatal — the release step |
| 67 | | # below re-reads the authoritative released length — so fall back to pear info |
| 68 | | # and continue rather than aborting the whole release on a cosmetic parse change. |
| 69 | | NEW_LEN=$(printf '%s\n' "$STAGE_CLEAN" | awk '/Latest length:/ {print $3; exit} /Latest:/ {print $2; exit}') |
| 70 | | if [[ -z "$NEW_LEN" ]]; then |
| 71 | | NEW_LEN=$(pear info "$PROD_LINK" 2>/dev/null | awk '/^[[:space:]]*length[[:space:]]/ {print $2; exit}') |
| 72 | | echo "▸ (staged length not in stage output — read from pear info: ${NEW_LEN:-unknown})" |
| 73 | | fi |
| 74 | | echo |
| 75 | | echo "▸ new staged length: ${NEW_LEN:-unknown}" |
| 76 | | echo |
| 77 | | |
| 78 | | # ── 2. release ──────────────────────────────────────────── |
| 79 | | echo "============================================================" |
| 80 | | echo " 2/2 pear release (deprecated path, still works)" |
| 81 | | echo "============================================================" |
| 82 | | RELEASE_OUT=$(pear release "$PROD_LINK" . 2>&1) |
| 83 | | RELEASE_CLEAN=$(printf '%s\n' "$RELEASE_OUT" | strip_ansi) |
| 84 | | printf '%s\n' "$RELEASE_CLEAN" | tail -5 |
| 85 | | RELEASE_LEN=$(printf '%s\n' "$RELEASE_CLEAN" | awk '/Latest length:/ {print $3; exit}') |
| 86 | | if [[ -n "$RELEASE_LEN" ]]; then |
| 87 | | NEW_LEN="$RELEASE_LEN" |
| 88 | | fi |
| 89 | | echo |
| 90 | | |
| 91 | | echo "✅ Released $PROD_LINK" |
| 92 | | echo " length $PREV_LEN → $NEW_LEN" |
| 93 | | echo |
| 13 | if [[ "${1:-}" == "--help" ]]; then |
| 14 | cat <<'EOF' |
| 15 | Usage: ./scripts/release-prod.sh |
| 94 | 16 | |
| 95 | | if [[ "$SKIP_PIN" == "1" ]]; then |
| 96 | | echo "▸ --no-pin given, skipping pin + verification" |
| 97 | | echo " manually: node scripts/pin-self-on-hiverelay.js" |
| 98 | | echo " node scripts/verify-pin.js --expect $NEW_LEN --hiverelay" |
| 17 | Runs local native-release preflight only. It never stages, publishes, seeds, |
| 18 | or modifies a remote release. Use the human-gated v3 release workflow after |
| 19 | this command reports success. |
| 20 | EOF |
| 99 | 21 | exit 0 |
| 100 | 22 | fi |
| 101 | 23 | |
| 102 | | # ── 3. pin on HiveRelay backbone ────────────────────────── |
| 103 | | echo "============================================================" |
| 104 | | echo " 3/4 pin on HiveRelay (refresh 365-day TTL)" |
| 105 | | echo "============================================================" |
| 106 | | node scripts/pin-self-on-hiverelay.js |
| 107 | | echo |
| 108 | | |
| 109 | | # ── 4. verify the pin actually serves the new length ────── |
| 110 | | echo "============================================================" |
| 111 | | echo " 4/4 verify content is reachable from the network" |
| 112 | | echo "============================================================" |
| 113 | | |
| 114 | | SEED_LABEL="com.pearbrowser.seed" |
| 115 | | SEED_LOG="$HOME/Library/Logs/pearbrowser-seed.log" |
| 24 | echo "PearBrowser v3 native-release preflight" |
| 25 | echo "This command has no publication authority." |
| 116 | 26 | |
| 117 | | # Confirm reachability via the local durable seeder's log. Returns 0 if the |
| 118 | | # seeder re-announced this drive at the new length AND has ≥1 live remote |
| 119 | | # peer — the only confirmation that actually works on the publisher box, |
| 120 | | # where verify-pin can't holepunch to the firewalled local seeder. |
| 121 | | confirm_via_seed_log() { |
| 122 | | launchctl print "gui/$(id -u)/$SEED_LABEL" >/dev/null 2>&1 || return 1 |
| 123 | | echo " ▸ this box runs the durable seeder — confirming via its log" |
| 124 | | # rotate the log so we read a FRESH announce, then restart the seeder so |
| 125 | | # it re-opens the drive at $NEW_LEN and re-announces on the swarm |
| 126 | | [[ -f "$SEED_LOG" ]] && mv "$SEED_LOG" "$SEED_LOG.prev" 2>/dev/null |
| 127 | | launchctl kickstart -k "gui/$(id -u)/$SEED_LABEL" >/dev/null 2>&1 || return 1 |
| 128 | | local i peers |
| 129 | | for i in $(seq 1 12); do # up to ~60s for boot + announce + peers |
| 130 | | sleep 5 |
| 131 | | [[ -f "$SEED_LOG" ]] || continue |
| 132 | | grep -q '\^_\^ announced' "$SEED_LOG" 2>/dev/null || continue |
| 133 | | peers=$(grep -Eo '[0-9]+ peers' "$SEED_LOG" 2>/dev/null | awk '{print $1}' | sort -n | tail -1) |
| 134 | | if [[ -n "$peers" && "$peers" -ge 1 ]]; then |
| 135 | | echo " ✓ seeder announced + $peers live remote peer(s) pulling from it" |
| 136 | | return 0 |
| 137 | | fi |
| 138 | | done |
| 139 | | echo " ✗ seeder did not announce / no peers within 60s" |
| 140 | | return 1 |
| 141 | | } |
| 27 | npm run check:release-evidence |
| 28 | npm run check:native-signing |
| 29 | npm run check:linux-appimage-metadata |
| 142 | 30 | |
| 143 | | # (a) Try the real fresh-peer round-trip once. Passes from a remote host / |
| 144 | | # CI (and short-circuits the whole step). On the publisher box it sees |
| 145 | | # "no peers" — expected, not a real outage — so we fall through to (b). |
| 146 | | echo " ▸ fresh-peer verify (verify-pin.js --expect $NEW_LEN --hiverelay)..." |
| 147 | | if node scripts/verify-pin.js --expect "$NEW_LEN" --hiverelay; then |
| 148 | | echo |
| 149 | | echo "🎉 Release complete and verified end-to-end (fresh remote peer)." |
| 150 | | echo " Anyone running 'pear run $PROD_LINK' will get length $NEW_LEN." |
| 151 | | exit 0 |
| 152 | | fi |
| 153 | | |
| 154 | | # (b) Co-located false negative — confirm via the durable seeder instead. |
| 155 | | echo |
| 156 | | echo " ▸ no peers from here (expected on the publisher box: the seeder is" |
| 157 | | echo " firewalled, so a same-NAT verify can't holepunch to it)" |
| 158 | | if confirm_via_seed_log; then |
| 159 | | echo |
| 160 | | echo "🎉 Release complete — served live by the durable seeder." |
| 161 | | echo " verify-pin can only PASS from a different machine/network; run" |
| 162 | | echo " 'node scripts/verify-pin.js --expect $NEW_LEN --hiverelay' elsewhere to" |
| 163 | | echo " double-check externally." |
| 164 | | echo " Anyone running 'pear run $PROD_LINK' will get length $NEW_LEN." |
| 165 | | exit 0 |
| 166 | | fi |
| 31 | cat <<'EOF' |
| 167 | 32 | |
| 168 | | # (c) Not the publisher box (no local seeder) — genuine propagation wait. |
| 169 | | # Relays may still be downloading the new blobs; retry patiently. |
| 170 | | echo " ▸ no local seeder to confirm against — retrying fresh-peer verify" |
| 171 | | echo " (up to 10 min, every 90s)" |
| 172 | | ATTEMPT=0 |
| 173 | | MAX_ATTEMPTS=7 # 7 * 90s ≈ 10 min |
| 174 | | until node scripts/verify-pin.js --expect "$NEW_LEN" --hiverelay; do |
| 175 | | ATTEMPT=$((ATTEMPT + 1)) |
| 176 | | if [[ $ATTEMPT -ge $MAX_ATTEMPTS ]]; then |
| 177 | | echo |
| 178 | | echo "✗ Release succeeded but blobs not yet reachable from a fresh peer." |
| 179 | | echo " The drive IS published — re-run \`node scripts/verify-pin.js --expect $NEW_LEN --hiverelay\`" |
| 180 | | echo " in 10–20 min. If it keeps failing, relays may need a higher maxStorage" |
| 181 | | echo " cap (see scripts/pin-self-on-hiverelay.js SEED_OPTS)." |
| 182 | | exit 2 |
| 183 | | fi |
| 184 | | echo " ↻ retry $ATTEMPT/$MAX_ATTEMPTS in 90s..." |
| 185 | | sleep 90 |
| 186 | | done |
| 33 | Preflight complete. Before promotion, an approved operator must provide: |
| 34 | 1. a signed native package for the target platform; |
| 35 | 2. a verified AppRelease v2 record and compatible local worker entrypoint; |
| 36 | 3. independent HiveRelay availability evidence; and |
| 37 | 4. clean-install, upgrade, rollback, and data-continuity evidence. |
| 187 | 38 | |
| 188 | | echo |
| 189 | | echo "🎉 Release complete and verified end-to-end." |
| 190 | | echo " Anyone running 'pear run $PROD_LINK' will get length $NEW_LEN." |
| 39 | No release was staged or published. |
| 40 | EOF |