|
1 | 1 | #!/usr/bin/env bash |
2 | 2 | set -euo pipefail |
3 | 3 |
|
4 | | -LATEST_BRIOCHE_VERSION="v0.1.5" |
5 | | -SEMVER_REGEX='^v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:\.(?:0|[1-9]\d*))?(?:-(?:(?:[0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+(?:[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$' |
6 | | - |
7 | | -# Based on the official install script here: |
8 | | -# https://github.com/brioche-dev/brioche.dev/blob/main/public/install.sh |
9 | | - |
10 | | -validate_inputs() { |
11 | | - # Validate environment variables |
12 | | - if [ -z "${GITHUB_PATH:-}" -o -z "${GITHUB_ACTION_PATH:-}" ]; then |
13 | | - echo '::error::$GITHUB_PATH or $GITHUB_ACTION_PATH not set! This script should be run in GitHub Actions' |
14 | | - exit 1 |
15 | | - fi |
16 | | - if [ -z "${HOME:-}" ]; then |
17 | | - echo '::error::$HOME must be set' |
18 | | - exit 1 |
19 | | - fi |
20 | | - if [ -z "${install_dir:-}" -o -z "${version:-}" -o -z "${install_apparmor:-}" ]; then |
21 | | - echo '::error::$install_dir, $version, and $install_apparmor must be set' |
22 | | - exit 1 |
23 | | - fi |
24 | | - |
25 | | - # Validate version constraints: |
26 | | - # - Only semver versions are allowed for version |
27 | | - # - Only values `stable`, `nightly` are allowed for release channel |
28 | | - case "$version" in |
29 | | - v*) |
30 | | - if [[ ! $version =~ $SEMVER_REGEX ]]; then |
31 | | - echo "::error::version must be a valid semver" |
32 | | - exit 1 |
33 | | - fi |
34 | | - ;; |
35 | | - stable|nightly) |
36 | | - ;; |
37 | | - *) |
38 | | - echo "::error::version must be either 'stable', 'nightly' or a semver" |
39 | | - exit 1 |
40 | | - ;; |
41 | | - esac |
42 | | -} |
| 4 | +# Validate environment variables |
| 5 | +if [ -z "${GITHUB_PATH:-}" ] || [ -z "${GITHUB_ACTION_PATH:-}" ]; then |
| 6 | + echo '::error::$GITHUB_PATH or $GITHUB_ACTION_PATH not set! This script should be run in GitHub Actions' |
| 7 | + exit 1 |
| 8 | +fi |
| 9 | +if [ -z "${HOME:-}" ]; then |
| 10 | + echo '::error::$HOME must be set' |
| 11 | + exit 1 |
| 12 | +fi |
| 13 | + |
| 14 | +# Set BRIOCHE_INSTALL_BIN_DIR using 'install-bin-dir' (expanding $HOME) |
| 15 | +if [ -n "${install_bin_dir:-}" ]; then |
| 16 | + export BRIOCHE_INSTALL_BIN_DIR="${install_bin_dir/'$HOME'/$HOME}" |
| 17 | +elif [ -n "${install_dir:-}" ]; then |
| 18 | + # If the deprecated 'install-dir' is set, use it to set the install bin dir. |
| 19 | + # For backwards compatibility, we also expand env vars using `envsubst`. |
43 | 20 |
|
44 | | -install_brioche() { |
45 | | - # If `install_dir` contains a `$` character, then try to expand env vars |
46 | 21 | case "$install_dir" in |
47 | 22 | *'$'* ) |
48 | 23 | # Ensure the `envsubst` command exists |
@@ -71,126 +46,49 @@ install_brioche() { |
71 | 46 | ;; |
72 | 47 | esac |
73 | 48 |
|
74 | | - # Get the OS and architecture-specific config, such as download URL and AppArmor config |
75 | | - case "$OSTYPE" in |
76 | | - linux*) |
77 | | - # aarch64 is not currently supported on stable |
78 | | - case "$(uname -m) $version" in |
79 | | - "x86_64 v"*) |
80 | | - brioche_url="https://releases.brioche.dev/$version/x86_64-linux/brioche" |
81 | | - ;; |
82 | | - "x86_64 stable") |
83 | | - brioche_url="https://releases.brioche.dev/$LATEST_BRIOCHE_VERSION/x86_64-linux/brioche" |
84 | | - ;; |
85 | | - "x86_64 nightly") |
86 | | - brioche_url="https://development-content.brioche.dev/github.com/brioche-dev/brioche/branches/main/brioche-x86_64-linux.tar.xz" |
87 | | - ;; |
88 | | - "aarch64 nightly") |
89 | | - brioche_url="https://development-content.brioche.dev/github.com/brioche-dev/brioche/branches/main/brioche-aarch64-linux.tar.xz" |
90 | | - ;; |
91 | | - *) |
92 | | - echo "::error::Sorry, Brioche isn't currently supported on your architecture" |
93 | | - echo " Detected architecture: $(uname -m)" |
94 | | - exit 1 |
95 | | - ;; |
96 | | - esac |
97 | | - |
98 | | - case "$install_apparmor" in |
99 | | - auto) |
100 | | - # Detect if we should install an AppArmor profile. AppArmor 4.0 |
101 | | - # introduced new features to restrict unprivileged user |
102 | | - # namespaces, which Ubuntu 23.10 enforces by default. The |
103 | | - # Brioche AppArmor policy is meant to lift this restriction |
104 | | - # for sandboxed builds, which we only need to do on AppArmor 4+. |
105 | | - # So, we only install the policy if AppArmor is enabled and |
106 | | - # we find the config file for AppArmor abi 4.0. |
107 | | - if type aa-enabled >/dev/null && aa-enabled -q && [ -e /etc/apparmor.d/abi/4.0 ]; then |
108 | | - should_install_apparmor=1 |
109 | | - else |
110 | | - should_install_apparmor= |
111 | | - fi |
112 | | - ;; |
113 | | - true) |
114 | | - should_install_apparmor=1 |
115 | | - ;; |
116 | | - false) |
117 | | - should_install_apparmor= |
118 | | - ;; |
119 | | - *) |
120 | | - echo "::error::Invalid value for \$install_apparmor: $install_apparmor" |
121 | | - exit 1 |
122 | | - ;; |
123 | | - esac |
124 | | - ;; |
125 | | - *) |
126 | | - echo "::error::Sorry, Brioche isn't currently supported on your operating system" |
127 | | - echo " Detected OS: $OSTYPE" |
128 | | - exit 1 |
129 | | - ;; |
130 | | - esac |
131 | | - |
132 | | - # Create a temporary directory |
133 | | - echo "::group::Setting up temporary directory" |
134 | | - brioche_temp="$(mktemp -d -t brioche-XXXX)" |
135 | | - trap 'rm -rf -- "$brioche_temp"' EXIT |
136 | | - echo "Temporary directory created at $brioche_temp" |
137 | | - echo "::endgroup::" |
138 | | - |
139 | | - echo "::group::Downloading Brioche" |
140 | | - echo "Downloading from $brioche_url" |
141 | | - curl --proto '=https' --tlsv1.2 -fL "$brioche_url" -o "$brioche_temp/brioche" |
142 | | - echo "Download complete" |
143 | | - echo "::endgroup::" |
144 | | - |
145 | | - echo "::group::Installing Brioche" |
146 | | - |
147 | | - if [ "$version" = "nightly" ]; then\ |
148 | | - unpack_dir="$HOME/.local/libexec/brioche" |
149 | | - |
150 | | - rm -rf "$unpack_dir/nightly" |
151 | | - mkdir -p "$unpack_dir/nightly" |
152 | | - tar -xJf "$brioche_temp/brioche" --strip-components=1 -C "$unpack_dir/nightly" |
153 | | - |
154 | | - ln -sf nightly "$unpack_dir/current" |
| 49 | + export BRIOCHE_INSTALL_BIN_DIR="${install_bin_dir/'$HOME'/$HOME}" |
| 50 | +fi |
155 | 51 |
|
156 | | - symlink_target="$unpack_dir/current/bin/brioche" |
157 | | - mkdir -p "$install_dir" |
158 | | - ln -sfr "$symlink_target" "$install_dir/brioche" |
| 52 | +# Set BRIOCHE_INSTALL_ROOT using 'install-root' (expanding $HOME) |
| 53 | +if [ -n "${install_root:-}" ]; then |
| 54 | + # Replace '$HOME' with $HOME |
| 55 | + export BRIOCHE_INSTALL_ROOT="${install_root/'$HOME'/$HOME}" |
| 56 | +fi |
159 | 57 |
|
160 | | - echo "Installation complete! Brioche installed to $install_dir/brioche (symlink to $unpack_dir/current/bin/brioche)" |
161 | | - else |
162 | | - mkdir -p "$install_dir" |
163 | | - chmod +x "$brioche_temp/brioche" |
164 | | - mv "$brioche_temp/brioche" "$install_dir/brioche" |
| 58 | +# Set other installer options |
| 59 | +export BRIOCHE_INSTALL_VERSION="${version:-}" |
| 60 | +export BRIOCHE_INSTALL_APPARMOR_CONFIG="${install_apparmor:-auto}" |
| 61 | +export BRIOCHE_INSTALL_CONTEXT='github-actions' |
165 | 62 |
|
166 | | - echo "Installation complete! Brioche installed to $install_dir/brioche" |
167 | | - fi |
| 63 | +echo "::group::Fetching latest Brioche installer version..." |
168 | 64 |
|
169 | | - echo "::endgroup::" |
| 65 | +# Get the current version number of the installer |
| 66 | +installer_version=$(curl --proto '=https' --tlsv1.2 -fL 'https://installer.brioche.dev/channels/stable/latest-version.txt') |
| 67 | +echo |
| 68 | +echo "Latest brioche-installer version is: $installer_version" |
170 | 69 |
|
171 | | - echo '::group::Updating $PATH' |
| 70 | +echo "::endgroup::" |
172 | 71 |
|
173 | | - # Add Brioche's install directory, plus the installation directory for |
174 | | - # installed packages |
175 | | - new_paths=("$install_dir" "$HOME/.local/share/brioche/installed/bin") |
176 | | - for new_path in "${new_paths[@]}"; do |
177 | | - echo "$new_path" >> "$GITHUB_PATH" |
178 | | - echo "Added to \$PATH: $new_path" |
179 | | - done |
| 72 | +echo "::group::Downloading Brioche installer $installer_version..." |
180 | 73 |
|
181 | | - echo '::endgroup' |
| 74 | +# Create a temporary directory |
| 75 | +brioche_temp="$(mktemp -d -t brioche-installer-XXXX)" |
| 76 | +trap 'rm -rf -- "$brioche_temp"' EXIT |
| 77 | +echo "Temporary directory created at $brioche_temp" |
182 | 78 |
|
183 | | - if [ -n "$should_install_apparmor" ]; then |
184 | | - echo "::group::Installing AppArmor config" |
| 79 | +# Download the install script and signature |
| 80 | +curl -o "$brioche_temp/install.sh" --proto '=https' --tlsv1.2 -fL "https://installer.brioche.dev/${installer_version}/install.sh" |
| 81 | +curl -o "$brioche_temp/install.sh.sig" --proto '=https' --tlsv1.2 -fL "https://installer.brioche.dev/${installer_version}/install.sh.sig" |
185 | 82 |
|
186 | | - BRIOCHE_INSTALL_PATH="$(realpath "$install_dir/brioche")" |
187 | | - export BRIOCHE_INSTALL_PATH |
188 | | - cat "$GITHUB_ACTION_PATH/apparmor.d/brioche-gh-actions.tpl" | envsubst | sudo tee /etc/apparmor.d/brioche-gh-actions |
189 | | - sudo apparmor_parser -r /etc/apparmor.d/brioche-gh-actions |
| 83 | +# Validate the signature |
| 84 | +ssh-keygen -Y verify \ |
| 85 | + -s "$brioche_temp/install.sh.sig" \ |
| 86 | + |
| 87 | + -f <(echo '[email protected] ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPrPgnmFyVoPP+tLPmF9lkth3BwVQx9rqlyyxkUDWkqe') \ |
| 88 | + |
| 89 | + < "$brioche_temp/install.sh" |
190 | 90 |
|
191 | | - echo "::endgroup" |
192 | | - fi |
193 | | -} |
| 91 | +echo "::endgroup::" |
194 | 92 |
|
195 | | -validate_inputs |
196 | | -install_brioche |
| 93 | +# Run the installer |
| 94 | +sh "$brioche_temp/install.sh" |
0 commit comments