Privatae
48 lines
2.3 KiB
Bash
Executable File
48 lines
2.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Build every release binary into client-go/dist, the same way every time.
|
|
#
|
|
# deploy/build.sh <version>
|
|
#
|
|
# publish.sh calls this to make a release, and verify-release.sh calls it to
|
|
# rebuild one and compare. They share this file so the two can never build
|
|
# differently.
|
|
#
|
|
# What makes two builds of the same commit byte-identical:
|
|
# - the toolchain image is pinned by digest, not by tag. A tag moves when a
|
|
# new Go patch release is pushed, and a different compiler writes different
|
|
# bytes.
|
|
# - GOTOOLCHAIN=local, so go.mod cannot make the build fetch another compiler.
|
|
# - -trimpath, so no path from the machine that built it lands in the binary.
|
|
# - -buildvcs=false, so no VCS state is stamped in (only client-go is mounted,
|
|
# but this says so instead of relying on it).
|
|
# - -mod=readonly with go.sum, so every module is the one go.sum names.
|
|
# - CGO_ENABLED=0, so no system C library is linked.
|
|
# The version is the only thing passed in, and it is the same for everyone who
|
|
# builds that release.
|
|
set -euo pipefail
|
|
HERE="$(cd "$(dirname "$0")/.." && pwd)"
|
|
VER="${1:?usage: deploy/build.sh <version>}"
|
|
|
|
# golang:1.26.10-alpine3.24, the multi-arch index digest below (go1.26.10).
|
|
# Move it deliberately, in its own commit, and a release built after that
|
|
# commit is rebuilt with the new one.
|
|
GO_IMAGE="golang@sha256:27f2d3b83cfc5803c8078f8e730af0f7c431bf067afaec8f60a36fb763187cba"
|
|
|
|
# The module cache is only a download cache: go.sum checks everything read from
|
|
# it. It is kept between runs so a rebuild does not fetch every module again.
|
|
MODCACHE="${GOMODCACHE_DIR:-$HOME/go/pkg/mod}"
|
|
mkdir -p "$MODCACHE"
|
|
|
|
# --user: the files in dist/ belong to whoever ran this, not to root, so a
|
|
# non-root checkout can clean up after itself.
|
|
docker run --rm --user "$(id -u):$(id -g)" -e HOME=/tmp -e GOCACHE=/tmp/gocache \
|
|
-v "$HERE/client-go":/src -v "$MODCACHE":/go/pkg/mod -w /src \
|
|
-e CGO_ENABLED=0 -e GOTOOLCHAIN=local -e GOFLAGS="-mod=readonly -trimpath -buildvcs=false" \
|
|
-e VER="$VER" "$GO_IMAGE" sh -c '
|
|
rm -rf /src/dist && mkdir -p /src/dist
|
|
for t in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64 windows/amd64 windows/arm64; do
|
|
os=${t%/*}; arch=${t#*/}; ext=""; [ "$os" = windows ] && ext=".exe"
|
|
GOOS=$os GOARCH=$arch go build -ldflags "-X main.clientVersion=$VER" \
|
|
-o /src/dist/privatae-bastion-$os-$arch$ext .
|
|
done'
|