Release artifacts

Signed-off-by: Akihiro Suda <[email protected]>

Author: AkihiroSuda

.github/workflows/release.yml

@@ -0,0 +1,63 @@
+# Forked from https://github.com/reproducible-containers/repro-get/blob/v0.2.1/.github/workflows/release.yml
+# Forked from https://github.com/containerd/nerdctl/blob/v0.8.1/.github/workflows/release.yml
+# Apache License 2.0
+
+name: Release
+on:
+  push:
+    branches:
+      - 'master'
+    tags:
+      - 'v*'
+  pull_request:
+    branches:
+      - 'master'
+jobs:
+  release:
+    runs-on: macos-11
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          # https://github.com/reproducible-containers/repro-get/issues/3
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
+      - name: "Install dependencies"
+        # coreutils:  For `gtouch -d @${SOURCE_DATE_EPOCH}`
+        # diffoscope: For `make test.repro`
+        run: brew install coreutils diffoscope
+      - name: "Test reproducibility"
+        run: |
+          make test.repro
+          git clean -xfd
+      - name: "Make artifacts"
+        run: make artifacts
+      - name: "SHA256SUMS"
+        run: |
+          cat _artifacts/SHA256SUMS
+      - name: "The sha256sum of the SHA256SUMS file"
+        run: |
+          (cd _artifacts; shasum -a 256 SHA256SUMS)
+      - name: "Prepare the release note"
+        run: |
+          tag="${GITHUB_REF##*/}"
+          shasha=$(shasum -a 256 _artifacts/SHA256SUMS | awk '{print $1}')
+          cat <<-EOF | tee /tmp/release-note.txt
+          ${tag}
+
+          (Changes to be documented)
+          - - -
+          The binaries were built automatically on GitHub Actions.
+          The build log is available for 90 days: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
+
+          The sha256sum of the SHA256SUMS file itself is \`${shasha}\` .
+          EOF
+      - name: "Create release"
+        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          tag="${GITHUB_REF##*/}"
+          asset_flags=()
+          for f in _artifacts/*; do asset_flags+=("-a" "$f"); done
+          hub release create "${asset_flags[@]}" -F /tmp/release-note.txt --draft "${tag}"

.gitignore

@@ -1,3 +1,4 @@
 /socket_vmnet
 /socket_vmnet_client
 *.o
+_artifacts*

Makefile

@@ -1,9 +1,19 @@
 # PREFIX should be only writable by the root to avoid privilege escalation with launchd or sudo
 PREFIX ?= /opt/socket_vmnet
 
+export SOURCE_DATE_EPOCH ?= $(shell git log -1 --pretty=%ct)
+# https://reproducible-builds.org/docs/archives/
+TAR ?= gtar --sort=name --mtime="@$(SOURCE_DATE_EPOCH)" --owner=0 --group=0 --numeric-owner --pax-option=exthdr.name=%d/PaxHeaders/%f,delete=atime,delete=ctime
+TOUCH ?= gtouch -d @$(SOURCE_DATE_EPOCH)
+# Not necessary to use GNU's gzip
+GZIP ?= gzip -9 -n
+DIFFOSCOPE ?= diffoscope
+STRIP ?= strip
+
 CFLAGS ?= -O3
 
 VERSION ?= $(shell git describe --match 'v[0-9]*' --dirty='.m' --always --tags)
+VERSION_TRIMMED := $(VERSION:v%=%)
 
 CFLAGS += -DVERSION=\"$(VERSION)\"
 
@@ -37,8 +47,10 @@ socket_vmnet_client: $(patsubst %.c, %.o, $(wildcard client/*.c))
 
 install.bin: socket_vmnet socket_vmnet_client
 	mkdir -p "$(DESTDIR)/$(PREFIX)/bin"
-	install socket_vmnet "$(DESTDIR)/$(PREFIX)/bin/socket_vmnet"
-	install socket_vmnet_client "$(DESTDIR)/$(PREFIX)/bin/socket_vmnet_client"
+	cp -a socket_vmnet "$(DESTDIR)/$(PREFIX)/bin/socket_vmnet"
+	cp -a socket_vmnet_client "$(DESTDIR)/$(PREFIX)/bin/socket_vmnet_client"
+	$(STRIP) "$(DESTDIR)/$(PREFIX)/bin/socket_vmnet"
+	$(STRIP) "$(DESTDIR)/$(PREFIX)/bin/socket_vmnet_client"
 
 install.doc: README.md LICENSE launchd etc_sudoers.d
 	mkdir -p "$(DESTDIR)/$(PREFIX)/share/doc/socket_vmnet"
@@ -90,3 +102,37 @@ uninstall: uninstall.launchd.plist uninstall.doc uninstall.bin uninstall.run
 .PHONY: clean
 clean:
 	rm -f socket_vmnet socket_vmnet_client *.o client/*.o
+
+define make_artifacts
+	$(MAKE) clean
+	rm -rf _artifacts/$(1)
+	$(MAKE) ARCH=$(1) DESTDIR=_artifacts/$(1) install.bin install.doc
+	file -bp _artifacts/$(1)/$(PREFIX)/bin/socket_vmnet | grep -q "Mach-O 64-bit executable $(1)"
+	$(TAR) -C _artifacts/$(1) -cf _artifacts/socket_vmnet-$(VERSION_TRIMMED)-$(1).tar ./
+	$(GZIP) _artifacts/socket_vmnet-$(VERSION_TRIMMED)-$(1).tar
+	rm -rf _artifacts/$(1)
+	$(MAKE) clean
+endef
+
+.PHONY: artifacts
+artifacts:
+	rm -rf _artifacts
+	$(call make_artifacts,x86_64)
+	$(call make_artifacts,arm64)
+	sw_vers | tee _artifacts/build-env.txt
+	echo --- >> _artifacts/build-env.txt
+	pkgutil --pkg-info=com.apple.pkg.CLTools_Executables | tee -a _artifacts/build-env.txt
+	echo --- >> _artifacts/build-env.txt
+	$(CC) --version | tee -a _artifacts/build-env.txt
+	(cd _artifacts ; shasum -a 256 *) > SHA256SUMS
+	mv SHA256SUMS _artifacts/SHA256SUMS
+	$(TOUCH) _artifacts/* _artifacts
+
+.PHONY: test.repro
+test.repro:
+	rm -rf _artifacts.0 _artifacts.1
+	$(MAKE) artifacts
+	mv _artifacts _artifacts.0
+	$(MAKE) artifacts
+	mv _artifacts _artifacts.1
+	$(DIFFOSCOPE) _artifacts.0/ _artifacts.1/