v29.4-roots.3 · Commit 7: [PATCH 07/30] release: establish Roots maintenance and assurance
ci/release/archive.py
Before: /dev/null · After: ci/release/archive.py
File metadata
new file mode 100755 index 0000000000000000000000000000000000000000..6e2091bb7b68ac6c05297ecf5f7d3c2b5ad7766f
Download original patch · Release notes
Diff rows 1–99 of 99. Line numbers refer to the original before/after files.
+ Added− RemovedUnmarked lines are context.
Scroll the code area horizontally to read long lines. The two line-number columns refer to before and after.
ci/release/archive.py
ADDED
|
@@ -0,0 +1,99 @@
|
|
|
1
|
+
#!/usr/bin/env python3
|
|
2
|
+
# Copyright (c) 2026-present The Bitcoin Roots developers
|
|
3
|
+
# Distributed under the MIT software license, see the accompanying
|
|
4
|
+
# file COPYING or http://www.opensource.org/licenses/mit-license.php.
|
|
5
|
+
|
|
6
|
+
import argparse
|
|
7
|
+
import os
|
|
8
|
+
from pathlib import Path
|
|
9
|
+
import re
|
|
10
|
+
import sys
|
|
11
|
+
import tarfile
|
|
12
|
+
import zipfile
|
|
13
|
+
|
|
14
|
+
|
|
15
|
+
VERSION_TAG_RE = re.compile(r"^v[0-9]+\.[0-9]+(?:\.[0-9]+|rc[0-9]+)?-roots\.[1-9][0-9]*$")
|
|
16
|
+
GIT_SHA_RE = re.compile(r"^[0-9A-Fa-f]{12,64}$")
|
|
17
|
+
|
|
18
|
+
|
|
19
|
+
def archive_root_name(release_tag, git_sha):
|
|
20
|
+
if release_tag:
|
|
21
|
+
if not VERSION_TAG_RE.fullmatch(release_tag):
|
|
22
|
+
raise ValueError(f"Invalid Roots release tag: {release_tag}")
|
|
23
|
+
version = release_tag.removeprefix("v")
|
|
24
|
+
else:
|
|
25
|
+
if not GIT_SHA_RE.fullmatch(git_sha):
|
|
26
|
+
raise ValueError("GITHUB_SHA must contain at least 12 hexadecimal characters")
|
|
27
|
+
version = f"git-{git_sha[:12].lower()}"
|
|
28
|
+
return f"bitcoin-roots-{version}"
|
|
29
|
+
|
|
30
|
+
|
|
31
|
+
def archive_members(archive):
|
|
32
|
+
if archive.name.endswith(".tar.gz"):
|
|
33
|
+
with tarfile.open(archive, mode="r:gz") as package:
|
|
34
|
+
return package.getmembers()
|
|
35
|
+
if archive.suffix == ".zip":
|
|
36
|
+
with zipfile.ZipFile(archive) as package:
|
|
37
|
+
return package.infolist()
|
|
38
|
+
raise ValueError(f"Unsupported release archive: {archive.name}")
|
|
39
|
+
|
|
40
|
+
|
|
41
|
+
def validate_archive_root(archive, expected_root):
|
|
42
|
+
members = archive_members(archive)
|
|
43
|
+
if not members:
|
|
44
|
+
raise ValueError(f"Release archive is empty: {archive.name}")
|
|
45
|
+
|
|
46
|
+
has_payload = False
|
|
47
|
+
for member in members:
|
|
48
|
+
name = member.name if isinstance(member, tarfile.TarInfo) else member.filename
|
|
49
|
+
normalized = name.rstrip("/")
|
|
50
|
+
if not normalized:
|
|
51
|
+
continue
|
|
52
|
+
parts = normalized.split("/")
|
|
53
|
+
if "\\" in normalized or any(part in {"", ".", ".."} for part in parts):
|
|
54
|
+
raise ValueError(f"Unsafe path in {archive.name}: {name}")
|
|
55
|
+
if isinstance(member, tarfile.TarInfo):
|
|
56
|
+
if not (member.isfile() or member.isdir()):
|
|
57
|
+
raise ValueError(f"Unsupported archive member in {archive.name}: {name}")
|
|
58
|
+
is_regular_file = member.isfile()
|
|
59
|
+
else:
|
|
60
|
+
member_type = (member.external_attr >> 16) & 0o170000
|
|
61
|
+
if member_type not in {0, 0o100000, 0o40000}:
|
|
62
|
+
raise ValueError(f"Unsupported archive member in {archive.name}: {name}")
|
|
63
|
+
is_regular_file = not member.is_dir()
|
|
64
|
+
if parts[0] != expected_root:
|
|
65
|
+
raise ValueError(
|
|
66
|
+
f"Expected root directory {expected_root} in {archive.name}, found: {name}"
|
|
67
|
+
)
|
|
68
|
+
has_payload |= len(parts) > 1 and is_regular_file
|
|
69
|
+
|
|
70
|
+
if not has_payload:
|
|
71
|
+
raise ValueError(f"Release archive has no files below {expected_root}: {archive.name}")
|
|
72
|
+
|
|
73
|
+
|
|
74
|
+
def main():
|
|
75
|
+
parser = argparse.ArgumentParser()
|
|
76
|
+
subparsers = parser.add_subparsers(dest="command", required=True)
|
|
77
|
+
|
|
78
|
+
root_parser = subparsers.add_parser("root-name")
|
|
79
|
+
root_parser.add_argument("--tag", default=os.environ.get("RELEASE_TAG", ""))
|
|
80
|
+
root_parser.add_argument("--sha", default=os.environ.get("GITHUB_SHA", ""))
|
|
81
|
+
|
|
82
|
+
validate_parser = subparsers.add_parser("validate")
|
|
83
|
+
validate_parser.add_argument("archive", type=Path)
|
|
84
|
+
validate_parser.add_argument("expected_root")
|
|
85
|
+
|
|
86
|
+
args = parser.parse_args()
|
|
87
|
+
try:
|
|
88
|
+
if args.command == "root-name":
|
|
89
|
+
print(archive_root_name(args.tag, args.sha))
|
|
90
|
+
else:
|
|
91
|
+
validate_archive_root(args.archive, args.expected_root)
|
|
92
|
+
except (OSError, ValueError, tarfile.TarError, zipfile.BadZipFile) as error:
|
|
93
|
+
print(error, file=sys.stderr)
|
|
94
|
+
return 1
|
|
95
|
+
return 0
|
|
96
|
+
|
|
97
|
+
|
|
98
|
+
if __name__ == "__main__":
|
|
99
|
+
sys.exit(main())
|