From d734011601ae1eecc0e3ae334b58d07e5b4d80d3 Mon Sep 17 00:00:00 2001 From: Christian Kolset Date: Tue, 11 Aug 2026 11:36:10 -0600 Subject: Finish multi-platform release restructuring (previous commit was incomplete) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit git add silently staged nothing from the previous attempt because one pathspec in that batch (scripts/release/repository, already moved) no longer existed — only the .gitignore-adjacent renames landed. This commit adds what was actually meant to go in: - core/updater.py: releases/download/updates-/ instead of a single shared updates/ tag. - labui.spec: bundles root.json from this platform's own tree. - scripts/release/repo_init.py, repo_release.py: auto-detect platform, operate inside scripts/release//. - .gitignore: per-platform ignore rules (previous commit only carried the file renames, not this). - docs/building.md, scripts/release/README.md: rewritten for the per-platform flow. - Also picks up pre-existing local TUF re-signing (new snapshot/ timestamp signatures, bumped expiry/version) that was sitting uncommitted before this restructuring started. Co-Authored-By: Claude Sonnet 5 --- .gitignore | 10 +- core/updater.py | 31 ++++-- docs/building.md | 50 +++++----- labui.spec | 13 ++- scripts/release/README.md | 106 ++++++++++++++------- scripts/release/repo_init.py | 59 +++++++++--- scripts/release/repo_release.py | 53 ++++++++--- .../release/win/repository/metadata/snapshot.json | 10 +- .../release/win/repository/metadata/targets.json | 23 ++++- .../release/win/repository/metadata/timestamp.json | 10 +- 10 files changed, 255 insertions(+), 110 deletions(-) diff --git a/.gitignore b/.gitignore index 838f2ca..efc3ac0 100644 --- a/.gitignore +++ b/.gitignore @@ -8,8 +8,14 @@ __pycache__/ build/ dist/ -# TUF release keystore (private signing keys) -# generated repository/ is republished to GitHub Releases, not tracked here +# TUF release keystore (private signing keys), one tree per platform +# (scripts/release/win/, scripts/release/linux/, scripts/release/mac/). +# Also covers the pre-migration flat layout (scripts/release/keystore/) — +# do not remove the flat rules below until that directory is confirmed +# migrated into scripts/release/win/. +scripts/release/*/keystore/ +scripts/release/*/repository/ +scripts/release/*/.tufup-repo-config scripts/release/keystore/ scripts/release/repository/ scripts/release/.tufup-repo-config diff --git a/core/updater.py b/core/updater.py index 471ef0b..bbd1bf9 100644 --- a/core/updater.py +++ b/core/updater.py @@ -7,11 +7,16 @@ is_frozen()); calling check_for_update()/apply_update() from a `python main.py` dev run raises, since there's no installed bundle for tufup to update. -Update metadata/targets are hosted on this repo's "updates" GitHub Release -— a fixed tag that never changes between app versions, unlike a normal -per-version release tag, because TUF's top-level metadata (timestamp.json, -snapshot.json, ...) must live at a stable URL the client always checks. -See scripts/release/README.md for the publishing side. +Update metadata/targets are hosted on this repo's "updates-" +GitHub Release — a fixed tag per platform (never changes between app +versions of that platform), because TUF's top-level metadata +(timestamp.json, snapshot.json, ...) must live at a stable URL the client +always checks. Separate tags per platform (not one shared "updates" tag) +because a Windows build and a Linux build of the same app version are +different byte-for-byte archives — TUF metadata filenames aren't +platform-prefixed, so they can't share one release without one platform's +metadata silently overwriting the other's. See scripts/release/README.md +for the publishing side. """ import sys @@ -23,7 +28,21 @@ from core.version import __version__ as CURRENT_VERSION APP_NAME = "labui" -_RELEASE_BASE_URL = "https://github.com/c-kolset/labUI-python/releases/download/updates/" + +def _platform_key() -> str: + """win / mac / linux — must match scripts/release// on the + publishing side and the "updates-" release tag.""" + if sys.platform.startswith("win"): + return "win" + if sys.platform == "darwin": + return "mac" + return "linux" + + +_RELEASE_BASE_URL = ( + f"https://github.com/c-kolset/labUI-python/releases/download/" + f"updates-{_platform_key()}/" +) METADATA_BASE_URL = _RELEASE_BASE_URL TARGET_BASE_URL = _RELEASE_BASE_URL diff --git a/docs/building.md b/docs/building.md index e20bcd3..bdf9ed0 100644 --- a/docs/building.md +++ b/docs/building.md @@ -2,6 +2,8 @@ Produces a standalone `dist/LabUI/` directory (onedir, not onefile — required for tufup's per-file update patching). +PyInstaller does not cross-compile — build on the same OS you're targeting. For Windows, build on Windows. For Linux, build on Linux (WSL2 works fine if your day-to-day machine is Windows — it produces a real Linux ELF binary, no cross-compilation involved). Each OS gets its own independent TUF signing setup (see below) and its own release tag, since a Windows build and a Linux build of the same version are different byte-for-byte archives. + ## Prerequisites Python 3.10+ and the dev requirements: @@ -13,26 +15,26 @@ pip install -r requirements-dev.txt `requirements-dev.txt` adds PyInstaller and tufup on top of the runtime deps. -## First-time setup — TUF repository +## First-time setup — TUF repository (once per platform) -Skip this if the `scripts/release/keystore/` directory already exists (i.e. someone else on the team has already initialised the repo and shared the keystore out-of-band). +Skip this for a given platform if `scripts/release//keystore/` already exists (i.e. someone else on the team has already initialised that platform's repo and shared the keystore out-of-band). `` is `win`, `linux`, or `mac` — `repo_init.py` picks it automatically based on the OS you run it on. ```bash python scripts/release/repo_init.py ``` -This generates: +This generates, under `scripts/release//`: -- `scripts/release/keystore/` — private + public keys for the TUF root/targets/snapshot/timestamp roles. **Back this up somewhere private outside the repo. Losing the root key means existing installs can never receive trusted updates.** -- `scripts/release/repository/` — initial signed TUF metadata, including `root.json`. +- `keystore/` — private + public keys for the TUF root/targets/snapshot/timestamp roles for *this platform*. **Back this up somewhere private outside the repo. Losing a platform's root key means that platform's existing installs can never receive trusted updates again** (other platforms are unaffected — keys are fully independent per platform). +- `repository/` — initial signed TUF metadata for this platform, including `root.json`. -After init, build once more so the freshly-generated `root.json` gets bundled into the app (the `.spec` file only includes it if it already exists): +After init, build once more so the freshly-generated `root.json` gets bundled into the app (the `.spec` file only includes it if it already exists, and reads it from this same platform's tree): ```bash pyinstaller labui.spec ``` -## Building a release +## Building a release (repeat per platform, on that platform) ### 1. Bump the version @@ -42,7 +44,7 @@ Edit `core/version.py`: __version__ = "1.2.3" ``` -This single value is read by the auto-updater at runtime (`core/updater.py`) and by the release script when signing the new target. +This single value is read by the auto-updater at runtime (`core/updater.py`) and by the release script when signing the new target. Use the same version number across all platforms for one release, even though each is built/signed/published as a separate step. ### 2. Build the executable @@ -50,11 +52,11 @@ This single value is read by the auto-updater at runtime (`core/updater.py`) and pyinstaller labui.spec ``` -Output: `dist/LabUI/LabUI` (Linux/macOS) or `dist/LabUI/LabUI.exe` (Windows). +Output: `dist/LabUI/LabUI` (Linux/macOS) or `dist/LabUI/LabUI.exe` (Windows) — whichever OS you're currently running on. The build bundles: - `ui/style_dark.qss` and `ui/style_light.qss` -- `scripts/release/repository/metadata/root.json` (if present — enables trusted updates on fresh installs) +- `scripts/release//repository/metadata/root.json` (if present — enables trusted updates on fresh installs; `` auto-detected from the OS running PyInstaller) Plugins are **not bundled**. They are installed at runtime by the user via **Settings → Plugins → Install Plugin…**. Installed plugins and their enabled state live in `~/.labui/plugins/`. Plugin pip dependencies (for machines without Python) land in `~/.labui/plugin_packages/`, which is added to `sys.path` at startup. @@ -64,30 +66,32 @@ Plugins are **not bundled**. They are installed at runtime by the user via **Set python scripts/release/repo_release.py ``` -Creates and signs `scripts/release/repository/targets/labui-.tar.gz` and updates the TUF metadata files in `scripts/release/repository/metadata/`. +Creates and signs `scripts/release//repository/targets/labui-.tar.gz` and updates the TUF metadata files in `scripts/release//repository/metadata/`. ### 4. Publish to GitHub -Upload every file from `scripts/release/repository/metadata/` and `scripts/release/repository/targets/` to the GitHub Release tagged **`updates`** (fixed tag — not a version tag), replacing any same-named files already there. +Upload every file from `scripts/release//repository/metadata/` and `scripts/release//repository/targets/` to the GitHub Release tagged **`updates-`** (e.g. `updates-win`, `updates-linux` — fixed tag per platform, not a version tag), replacing any same-named files already there. + +The app's updater always points at `.../releases/download/updates-/` (platform auto-detected at runtime by `core.updater._platform_key()`), so each platform's tag must stay constant across versions. Don't share one tag across platforms — TUF metadata filenames (`root.json`, `timestamp.json`, ...) aren't platform-prefixed, so one platform's publish would silently overwrite the other's trust root. -The app's updater always points at `.../releases/download/updates/`, so the tag must stay constant across versions. +A bare `LabUI.exe` does **not** belong on the `updates-` release — the updater only looks for the TUF metadata + target archive described above; a loose exe there does nothing. -Optionally create a separate human-facing release with a changelog under a version tag (e.g. `v1.2.3`). +Optionally create a separate human-facing release with a changelog under a version tag (e.g. `v1.2.3`) for people downloading the app for the first time (TUF only handles *updating* an already-installed copy). Since the build is onedir, zip the whole `dist/LabUI/` folder for that release rather than attaching the bare exe — the exe alone won't run without its sibling files. If you support multiple platforms, attach one zip per platform to that same version-tagged release. ### 5. Verify -Launch a previous installed version → Settings → Check for Updates → confirm it finds and applies the new version. +Launch a previous installed version of this platform → Settings → Check for Updates → confirm it finds and applies the new version. ## Re-signing expired metadata -TUF metadata expires even with no new release (`root`: 365 days, others: 90 days). If metadata goes stale before the next release, clients reject it. Re-sign: +TUF metadata expires even with no new release (`root`: 365 days, others: 90 days) — independently per platform. If metadata goes stale before the next release for a given platform, that platform's clients reject it. Re-sign: ```bash -python -m tufup sign snapshot scripts/release/keystore -python -m tufup sign timestamp scripts/release/keystore +python -m tufup sign snapshot scripts/release//keystore +python -m tufup sign timestamp scripts/release//keystore ``` -Run from the repo root. Re-upload the resulting files to the `updates` release. +Run from the repo root, substituting the actual platform directory. Re-upload the resulting files to that platform's `updates-` release. ## What's bundled vs. external @@ -98,8 +102,8 @@ Run from the repo root. Re-upload the resulting files to the `updates` release. | QSS theme files | Yes | copied from `ui/` | | Plugins | No | installed by users into `~/.labui/plugins/` at runtime | | Plugin pip deps | No | installed into `~/.labui/plugin_packages/` or vendored inside plugin zip | -| `root.json` | Yes (if present) | TUF trust bootstrap | -| `nidaqmx` | No | optional; NI runtime must be installed separately | +| `root.json` | Yes (if present) | TUF trust bootstrap, this platform's own copy | +| `nidaqmx` | No | optional; NI runtime is Windows-only, must be installed separately | | `opencv-python` | No | optional; only needed if a plugin requires it (vendor it in the plugin zip) | ## Troubleshooting @@ -110,4 +114,6 @@ Run from the repo root. Re-upload the resulting files to the `updates` release. **Plugin dependency not importable after pip install** — the user may need to restart the app so `~/.labui/plugin_packages/` is injected into `sys.path` (this happens in `main.py` at startup). -**`root.json` not bundled** — run `repo_init.py` first (see First-time setup), then rebuild. +**`root.json` not bundled** — run `repo_init.py` first (see First-time setup), then rebuild, on this same platform. + +**Updates work on one platform but not another** — check each platform published to its own `updates-` tag, not a shared `updates` tag, and that `core.updater._platform_key()`'s mapping (`win`/`mac`/else-`linux`) matches the directory names under `scripts/release/`. diff --git a/labui.spec b/labui.spec index 8468909..71d50dd 100644 --- a/labui.spec +++ b/labui.spec @@ -17,13 +17,24 @@ root_dir = Path(SPECPATH) # root.json is generated by scripts/release/repo_init.py — bundle it once it # exists so a fresh install can bootstrap tufup trust without an insecure # first fetch. Skip silently before that's ever been run (e.g. first build). +# Read from this platform's own repo tree (scripts/release//) — +# must match core.updater._platform_key()'s mapping, since a build only ever +# bundles its own platform's root.json. +def _platform_key(): + if sys.platform.startswith("win"): + return "win" + if sys.platform == "darwin": + return "mac" + return "linux" + datas = [ (str(root_dir / "ui" / "style_dark.qss"), "ui"), (str(root_dir / "ui" / "style_light.qss"), "ui"), (str(root_dir / "ui" / "style.qss"), "ui"), (str(root_dir / "plugins"), "plugins"), ] -_root_json = root_dir / "scripts" / "release" / "repository" / "metadata" / "root.json" +_root_json = (root_dir / "scripts" / "release" / _platform_key() + / "repository" / "metadata" / "root.json") if _root_json.exists(): datas.append((str(_root_json), "repository/metadata")) diff --git a/scripts/release/README.md b/scripts/release/README.md index 54c9086..9d8e85f 100644 --- a/scripts/release/README.md +++ b/scripts/release/README.md @@ -1,61 +1,97 @@ -# Release process (manual, local signing) +# Release process (manual, local signing, per platform) -All TUF signing keys stay on your machine, in `./keystore` (gitignored — never -commit it). Nothing here touches CI or GitHub Secrets. +All TUF signing keys stay on your machine, one keystore per platform, in +`.//keystore` (gitignored — never commit it). Nothing here touches +CI or GitHub Secrets — Linux/macOS builds and signing should also happen +locally (a Linux build machine, or WSL2 on Windows works fine — PyInstaller +doesn't cross-compile, so you must actually run the build on the target OS). -## One-time setup +`` is `win`, `mac`, or `linux` — whichever `python` is currently +running on (`core.updater._platform_key()` / the matching helper in +`repo_init.py`/`repo_release.py` decide this automatically; you never pass +it explicitly). Each platform gets a fully independent tree: +``` +scripts/release/ + win/{keystore,repository}/ + linux/{keystore,repository}/ + mac/{keystore,repository}/ +``` +Why fully separate rather than shared: a Windows build and a Linux build of +the same app version are different byte-for-byte archives, and TUF's +metadata filenames (`root.json`, `timestamp.json`, ...) aren't +platform-prefixed — sharing one repo/release between platforms means one +platform's publish silently overwrites the other's trust root and metadata. + +## One-time setup (repeat once per platform, on that platform) ``` pip install -r requirements-dev.txt python scripts/release/repo_init.py ``` -Generates `scripts/release/keystore/` (private + public keys for the -root/targets/snapshot/timestamp TUF roles) and `scripts/release/repository/` -(initial signed metadata, including `root.json`). +Generates `scripts/release//keystore/` (private + public keys for +the root/targets/snapshot/timestamp TUF roles) and +`scripts/release//repository/` (initial signed metadata, including +`root.json`). -**Back up `keystore/` immediately, somewhere private and durable outside this -repo.** Losing the root key means you can never publish a trusted update to -existing installs again — they'd all need a fresh, non-updating reinstall. +**Back up `/keystore/` immediately, somewhere private and durable +outside this repo — one backup per platform.** Losing a platform's root key +means you can never publish a trusted update to that platform's existing +installs again — they'd all need a fresh, non-updating reinstall. Losing one +platform's key doesn't affect the others (that's the point of keeping them +separate). Rebuild once more (`pyinstaller labui.spec`) after this step, so the freshly-generated `root.json` gets bundled into the app (see the `.spec` -file's `_root_json` check — it only bundles the file if it already exists). +file's `_root_json` check — it only bundles the file if it already exists, +and it reads from *this platform's* tree). -## Every release +## Every release (repeat once per platform, on that platform) -1. Bump `__version__` in `core/version.py`. -2. `pyinstaller labui.spec` → produces `dist/LabUI/`. +1. Bump `__version__` in `core/version.py` (same version number across all + platforms for a given release, even though each is signed/published + separately). +2. `pyinstaller labui.spec` → produces `dist/LabUI/` for *this* OS. 3. `python scripts/release/repo_release.py` → creates+signs - `scripts/release/repository/targets/labui-.tar.gz` and updates - the metadata files in `scripts/release/repository/metadata/`. -4. Create (first time) or reuse the GitHub Release tagged **`updates`** on - this repo, and upload every file from `scripts/release/repository/metadata/` - and `scripts/release/repository/targets/` as release assets, **replacing** - any same-named files already there. - - This tag is fixed on purpose — the app's `metadata_base_url` always - points at `https://github.com///releases/download/updates/`. + `scripts/release//repository/targets/labui-.tar.gz` + and updates the metadata files in + `scripts/release//repository/metadata/`. +4. Create (first time) or reuse the GitHub Release tagged + **`updates-`** (e.g. `updates-win`, `updates-linux`) on this + repo, and upload every file from + `scripts/release//repository/metadata/` and + `scripts/release//repository/targets/` as release assets, + **replacing** any same-named files already there. + - Each platform's tag is fixed on purpose — the app's + `metadata_base_url` (computed by `core.updater._platform_key()`) + always points at + `https://github.com///releases/download/updates-/`. A normal per-version-tagged release would give every version a different URL, which breaks TUF's requirement that top-level metadata - (`timestamp.json`, `snapshot.json`, ...) live at a stable location. + live at a stable location — and a *shared* tag across platforms would + break the platform-isolation described above. - Cut a normal, separately-tagged human-facing release too if you want a - changelog/download page — this doesn't have to be the same release. -5. Test: launch a previous installed version, Settings → Check for Updates, - confirm it finds and applies the new version. + changelog/download page (e.g. `v1.2.3`, one release with per-platform + zip assets attached) — this doesn't have to be the same release as the + `updates-*` ones, and normally shouldn't be (see `docs/building.md`). +5. Test: launch a previous installed version of *this platform*, + Settings → Check for Updates, confirm it finds and applies the new + version. ## Re-signing without a new release Metadata expires even if nothing changed (`expiration_days` in -`repo_init.py`: root 365 days, targets/snapshot/timestamp 90 days). If you -haven't shipped a release before targets/snapshot/timestamp expire, clients -will start rejecting the metadata as stale. Re-sign with: +`repo_init.py`: root 365 days, targets/snapshot/timestamp 90 days) — +per platform, independently. If you haven't shipped a release for a given +platform before its targets/snapshot/timestamp expire, that platform's +clients will start rejecting the metadata as stale. Re-sign: ``` -python -m tufup sign snapshot scripts/release/keystore -python -m tufup sign timestamp scripts/release/keystore +python -m tufup sign snapshot scripts/release//keystore +python -m tufup sign timestamp scripts/release//keystore ``` -(run from the repo root; adjust the key directory path if you invoke this -from elsewhere) and re-upload the resulting files to the `updates` release. -Set a calendar reminder — there is no automation for this on purpose (manual -signing was a deliberate choice, not an oversight). +(run from the repo root; substitute the actual platform directory) and +re-upload the resulting files to that platform's `updates-` +release. Set a calendar reminder per platform — there is no automation for +this on purpose (manual signing was a deliberate choice, not an oversight). diff --git a/scripts/release/repo_init.py b/scripts/release/repo_init.py index ccbfe17..c0360c0 100644 --- a/scripts/release/repo_init.py +++ b/scripts/release/repo_init.py @@ -1,28 +1,55 @@ """ scripts/release/repo_init.py -Run ONCE, ever, by the maintainer, locally. Generates the TUF signing keys -and the initial repository metadata (including root.json, which later gets -bundled into the app via labui.spec). +Run ONCE PER PLATFORM, by the maintainer, locally, on a machine running that +platform (no cross-compiling — build and sign Windows releases on Windows, +Linux releases on Linux/WSL2, etc.). Generates that platform's TUF signing +keys and initial repository metadata (including root.json, which later gets +bundled into that platform's build via labui.spec). -Running this again after the repo already exists is safe (tufup skips -re-creating keys/roles that already exist) but there is normally no reason -to run it more than once per project. +Every platform gets its own keystore/repository tree, under +scripts/release// — Windows and Linux builds of the same version +are different byte-for-byte archives, and TUF's metadata filenames +(root.json, timestamp.json, ...) aren't platform-prefixed, so they can't +share one repo/release without one platform silently overwriting the +other's trust root and metadata. -Keys land in ./keystore — never commit that directory (already gitignored). -Back it up somewhere safe and private; losing the root key means you can -never publish another trusted update to existing installs. +Running this again after a platform's repo already exists is safe (tufup +skips re-creating keys/roles that already exist) but there is normally no +reason to run it more than once per platform. + +Keys land in .//keystore — never commit that directory (already +gitignored). Back it up somewhere safe and private, once per platform; +losing a platform's root key means you can never publish another trusted +update to that platform's existing installs. """ import os +import sys from pathlib import Path from tufup.repo import Repository, RolesDict -# Run from this script's own directory — tufup's config file (.tufup-repo-config) -# and all repo_dir/keys_dir paths are resolved relative to the current working -# directory, so invocation location must be consistent every time. -os.chdir(Path(__file__).resolve().parent) + +def _platform_key() -> str: + """win / mac / linux — must match core.updater._platform_key() and the + "updates-" release tag on the publishing side.""" + if sys.platform.startswith("win"): + return "win" + if sys.platform == "darwin": + return "mac" + return "linux" + + +PLATFORM = _platform_key() + +# Run from this script's own platform subdirectory — tufup's config file +# (.tufup-repo-config) and all repo_dir/keys_dir paths are resolved relative +# to the current working directory, so invocation location must be +# consistent every time. +_PLATFORM_DIR = Path(__file__).resolve().parent / PLATFORM +_PLATFORM_DIR.mkdir(parents=True, exist_ok=True) +os.chdir(_PLATFORM_DIR) APP_NAME = "labui" @@ -49,8 +76,10 @@ def main(): ) repo.initialize() repo.save_config() - print(f"Initialized tufup repo for '{APP_NAME}' in ./repository, keys in ./keystore") - print("Back up ./keystore now, somewhere private and durable. It is gitignored on purpose.") + print(f"Initialized tufup repo for '{APP_NAME}' ({PLATFORM}) in " + f"{_PLATFORM_DIR / 'repository'}, keys in {_PLATFORM_DIR / 'keystore'}") + print(f"Back up {_PLATFORM_DIR / 'keystore'} now, somewhere private and " + f"durable. It is gitignored on purpose.") if __name__ == "__main__": diff --git a/scripts/release/repo_release.py b/scripts/release/repo_release.py index d50e458..7e4c382 100644 --- a/scripts/release/repo_release.py +++ b/scripts/release/repo_release.py @@ -1,18 +1,23 @@ """ scripts/release/repo_release.py -Run after every `pyinstaller labui.spec` build, from anywhere (paths are -made absolute below before the working directory changes). Packages the -freshly built dist/LabUI bundle as a new signed tufup target. +Run after every `pyinstaller labui.spec` build, on the same platform that +build was produced on (no cross-compiling — this packages whatever +dist/LabUI/ currently contains, which is only correct for the OS the build +just ran on). Packages the freshly built dist/LabUI bundle as a new signed +tufup target, in that platform's own repo tree. Prerequisites: - - repo_init.py has been run once already (./repository and ./keystore exist) + - repo_init.py has been run once already for this platform + (.//repository and .//keystore exist) - core/version.py has been bumped to the new version - - dist/LabUI/ exists (pyinstaller labui.spec has just been run) + - dist/LabUI/ exists (pyinstaller labui.spec has just been run, on this + same machine/OS) After this completes, see README.md in this directory for how to publish -the updated ./repository/metadata and ./repository/targets files to the -"updates" GitHub Release. +the updated .//repository/metadata and +.//repository/targets files to the "updates-" GitHub +Release. """ import os @@ -23,8 +28,21 @@ _THIS_DIR = Path(__file__).resolve().parent _REPO_ROOT = _THIS_DIR.parent.parent _DIST_DIR = _REPO_ROOT / "dist" / "LabUI" + +def _platform_key() -> str: + """win / mac / linux — must match core.updater._platform_key() and the + "updates-" release tag on the publishing side.""" + if sys.platform.startswith("win"): + return "win" + if sys.platform == "darwin": + return "mac" + return "linux" + + +PLATFORM = _platform_key() + # Import core.version before changing cwd — needs the repo root on sys.path, -# which won't be true anymore once we chdir into scripts/release below. +# which won't be true anymore once we chdir into scripts/release/. sys.path.insert(0, str(_REPO_ROOT)) from core.version import __version__ as APP_VERSION @@ -32,19 +50,25 @@ from tufup.repo import Repository # tufup's config file / relative repo_dir / keys_dir all resolve against cwd # (same reasoning as repo_init.py) — pin it here too, for the same reason. -os.chdir(_THIS_DIR) +_PLATFORM_DIR = _THIS_DIR / PLATFORM +os.chdir(_PLATFORM_DIR) def main(): if not _DIST_DIR.is_dir(): raise SystemExit( f"{_DIST_DIR} not found — run `pyinstaller labui.spec` from the " - f"repo root first." + f"repo root first, on this same machine/OS." + ) + if not (_PLATFORM_DIR / "repository").is_dir(): + raise SystemExit( + f"{_PLATFORM_DIR / 'repository'} not found — run " + f"`python repo_init.py` once for this platform first." ) repo = Repository.from_config() - changelog = input(f"One-line changelog for v{APP_VERSION} (optional): ").strip() + changelog = input(f"One-line changelog for v{APP_VERSION} ({PLATFORM}, optional): ").strip() custom_metadata = {"changelog": changelog} if changelog else None repo.add_bundle( @@ -55,9 +79,10 @@ def main(): ) repo.publish_changes(private_key_dirs=[Path("keystore")]) - print(f"Signed and published v{APP_VERSION} to ./repository") - print("Next: upload ./repository/metadata/* and ./repository/targets/* " - "to the 'updates' GitHub Release — see README.md in this directory.") + print(f"Signed and published v{APP_VERSION} ({PLATFORM}) to {_PLATFORM_DIR / 'repository'}") + print(f"Next: upload {_PLATFORM_DIR / 'repository' / 'metadata'}/* and " + f"{_PLATFORM_DIR / 'repository' / 'targets'}/* to the " + f"'updates-{PLATFORM}' GitHub Release — see README.md in this directory.") if __name__ == "__main__": diff --git a/scripts/release/win/repository/metadata/snapshot.json b/scripts/release/win/repository/metadata/snapshot.json index 03821d1..7f786ce 100755 --- a/scripts/release/win/repository/metadata/snapshot.json +++ b/scripts/release/win/repository/metadata/snapshot.json @@ -1,19 +1,19 @@ { "signatures": [ { - "keyid": "40e5301cd4b92e4a9c2e63dcca99ffa4a5627c25ac6c254f272bb52c9a076cfc", - "sig": "bd89d38c63ddee6537276a13657a2716a1a88346421a8d51db9fa8c12b9dc6b0db57a48bbab616930b6aaaa91c4a12a54909cd9722e07b23632638d68bd08307" + "keyid": "11ff37b04d2667afcf5fb55111a279eff51bced328b4bfa5941c6a3fb711b9c8", + "sig": "770524d7bd070160a6c5313b26d37e02a28155485f07850edb186173c5dccc3d9c3299756d28db91f6b5bc34e0459059c15d0a6de64ed5616f28bf326e78a70d" } ], "signed": { "_type": "snapshot", - "expires": "2026-10-30T23:55:23Z", + "expires": "2026-11-09T16:56:54Z", "meta": { "targets.json": { - "version": 1 + "version": 2 } }, "spec_version": "1.0.31", - "version": 1 + "version": 2 } } \ No newline at end of file diff --git a/scripts/release/win/repository/metadata/targets.json b/scripts/release/win/repository/metadata/targets.json index 6296ebe..9d3a6e3 100755 --- a/scripts/release/win/repository/metadata/targets.json +++ b/scripts/release/win/repository/metadata/targets.json @@ -1,15 +1,28 @@ { "signatures": [ { - "keyid": "998b28525eec351c6cdd16d6da3854876e84ab450595feac782ae83d3a8226d6", - "sig": "88ebf0eac3bea958b3d5d99e713a2af1a8e6d230c414bca1b22f1bf64ce2a8734b3db5eaa80dcc9fdd31c1954864af2828c122bf6d4354b1a06136e478e6d00d" + "keyid": "c62514af706a204d4361859fcd0d329fafaafa8bddf220f6c7ded062bb89dae3", + "sig": "d1cfb13f05faf542312c6a1f172571524a397883128c8c9b50ddd684918060272885eebb017972b09ca1a8cac0ad13ddd85b6b2e6f901ff9681416f86a101201" } ], "signed": { "_type": "targets", - "expires": "2026-10-30T23:55:23Z", + "expires": "2026-11-09T16:56:54Z", "spec_version": "1.0.31", - "targets": {}, - "version": 1 + "targets": { + "labui-0.0.1.tar.gz": { + "custom": { + "tufup": { + "required": false + }, + "user": null + }, + "hashes": { + "sha256": "af8aca1e68c7b6956e39784a91c7e4be21e9413b0c884da90aa58aa1e6a0609a" + }, + "length": 98530091 + } + }, + "version": 2 } } \ No newline at end of file diff --git a/scripts/release/win/repository/metadata/timestamp.json b/scripts/release/win/repository/metadata/timestamp.json index 12227b6..ac8d542 100755 --- a/scripts/release/win/repository/metadata/timestamp.json +++ b/scripts/release/win/repository/metadata/timestamp.json @@ -1,19 +1,19 @@ { "signatures": [ { - "keyid": "4edf46a4cf08f9b2c59cbe9a435024a8498ce68cc63208f1fbb8b69e74768d42", - "sig": "b11ee59ed85d21b52d25e676a98232c9d63813ac5236493c11d47264065647933f1c28bc9748f8c880174a3ab3bcb27f6786c1c4a596ef80b70fc11b40f9f002" + "keyid": "f3be485915439ccd39ed098391dc89529286dfa7e4aa131585848df1ba2ce589", + "sig": "31a93117aeacbd53c276f7520f4ac6f7fce8427977e11e50dffb71062dc4c92cc3fe7364071067ab948c1686116af73afa05795af3c74bd603a60564b49a340d" } ], "signed": { "_type": "timestamp", - "expires": "2026-10-30T23:55:23Z", + "expires": "2026-11-09T16:56:54Z", "meta": { "snapshot.json": { - "version": 1 + "version": 2 } }, "spec_version": "1.0.31", - "version": 1 + "version": 2 } } \ No newline at end of file -- cgit v1.2.3