1 files changed, 57 insertions, 0 deletions
diff --git a/scripts/release/repo_init.py b/scripts/release/repo_init.py
new file mode 100644
index 0000000..04c3579
--- /dev/null
+++ b/scripts/release/repo_init.py
@@ -0,0 +1,57 @@
+"""
+scripts/release/repo_init.py
+
+Run ONCE, ever, by the maintainer, locally. Generates the TUF signing keys
+and the initial repository metadata (including root.json, which later gets
+bundled into the app via labdaq.spec).
+
+Running this again after the repo already exists is safe (tufup skips
+re-creating keys/roles that already exist) but there is normally no reason
+to run it more than once per project.
+
+Keys land in ./keystore — never commit that directory (already gitignored).
+Back it up somewhere safe and private; losing the root key means you can
+never publish another trusted update to existing installs.
+"""
+
+import os
+from pathlib import Path
+
+from tufup.repo import Repository, RolesDict
+
+# Run from this script's own directory — tufup's config file (.tufup-repo-config)
+# and all repo_dir/keys_dir paths are resolved relative to the current working
+# directory, so invocation location must be consistent every time.
+os.chdir(Path(__file__).resolve().parent)
+
+APP_NAME = "labdaq"
+
+# tufup-example's 1-day timestamp / 7-day snapshot defaults assume an
+# automated CI worker re-signs on a schedule. We're signing manually
+# (see README.md in this directory), so use longer, human-manageable
+# expirations instead. Whichever of these lapses first is the cadence
+# you need to re-sign at, even between actual app releases.
+EXPIRATION_DAYS = RolesDict(root=365, targets=90, snapshot=90, timestamp=90)
+
+
+def main():
+    # Not using app_version_attr here: tufup's setuptools-based attribute
+    # reader resolves dotted paths relative to the current working directory,
+    # which we deliberately pin to this script's own directory below (tufup's
+    # own config-file/relative-path handling expects that) — the two
+    # assumptions conflict. repo_release.py passes the version explicitly
+    # instead, which sidesteps this entirely.
+    repo = Repository(
+        app_name=APP_NAME,
+        repo_dir=Path("repository"),
+        keys_dir=Path("keystore"),
+        expiration_days=EXPIRATION_DAYS,
+    )
+    repo.initialize()
+    repo.save_config()
+    print(f"Initialized tufup repo for '{APP_NAME}' in ./repository, keys in ./keystore")
+    print("Back up ./keystore now, somewhere private and durable. It is gitignored on purpose.")
+
+
+if __name__ == "__main__":
+    main()