mirror of
https://github.com/openclaw/openclaw.git
synced 2026-09-11 19:10:24 +00:00
299ea7c393
* fix(scripts): use system Bash for macOS tooling and owned Mach-O fixtures Pin native entrypoints and package commands to /bin/bash, guard portable heredoc callers on Darwin, and preserve Bash 3.2 boolean parsing. Streamed installers explain how to use system Bash when their input cannot be replayed. Generate deterministic x86_64, arm64, and arm64e framework fixtures instead of borrowing /bin/ls. Preserve the existing framework pipeline repair from #141056 and verify merged slice bytes. * fix(scripts): keep guarded portable scripts bash 3.2 compatible * fix(scripts): keep macOS Bash CI coverage green Distinguish sourced installer returns from stdin exits without ShellCheck unreachable-code warnings. Retain the shebang regression suite in changed-target routing, and repartition hosted tooling tails toward 50-second groups within the existing 150-second budget and 80-job cap. Validation: 635 interpreter and routing tests plus 53 planner tests passed; ShellCheck, targeted lint, formatting, and fresh Codex review passed. The broader local changed-file check hit an unrelated existing dependency graph crossing through extensions/reef/node_modules/@noble/hashes; exact-head hosted CI remains required. * docs(install): use system Bash in install and recovery commands Align macOS-facing copy-and-paste commands and emitted installer guidance with the supported streamed interpreter. This addresses the remaining installer-command review finding without changing the PR body. Validation: streamed help for both installers, install.sh dry-run, 16 selected fresh-install and upgrade lifecycle tests, formatting, diff check, and fresh Codex review passed. Landing remains blocked by unrelated provider-transport integration CI failure caused by an unchanged incomplete plugin-registry mock. * fix(scripts): preserve streamed installs and CI packing Keep public installer commands portable while replaying Darwin Bash 5.3+ stdin under system Bash through an immediately unlinked private temp file. Retain actionable sourced-install rejection and the SC2317-safe check. Restore the original CI packing policy and move the Bash policy scan into its existing macOS tooling owner without adding a routed test file. Validation: real Homebrew Bash streamed help and cleanup; 642 scan/routing tests; 23 selected installer tests under both PATH orders; planner cap and coverage tests; 139 Bash syntax checks; ShellCheck; 1,135 changed-gate tests; focused lint/changed-check repair; fresh Codex review with no P0/P1 findings.
55 lines
2.3 KiB
Bash
55 lines
2.3 KiB
Bash
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
ROOT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
|
|
MANIFEST="$ROOT_DIR/scripts/lib/cloudflared-macos.json"
|
|
ARCH="${1:-}"
|
|
DESTINATION="${2:-}"
|
|
if [[ "$#" != 2 || ( "$ARCH" != arm64 && "$ARCH" != x86_64 ) || -z "$DESTINATION" || "$DESTINATION" == -* ]]; then
|
|
echo "Usage: scripts/stage-cloudflared-macos.sh <arm64|x86_64> <resource-directory>" >&2
|
|
exit 2
|
|
fi
|
|
read -r VERSION ASSET ARCHIVE_SHA LICENSE_SHA < <(node - "$MANIFEST" "$ARCH" <<'JS'
|
|
const manifest = require(process.argv[2]);
|
|
const artifact = manifest.artifacts[process.argv[3]];
|
|
console.log(manifest.version, artifact.asset, artifact.sha256, manifest.licenseSha256);
|
|
JS
|
|
)
|
|
CACHE_DIR="$ROOT_DIR/apps/macos/.build/cloudflared/$VERSION"
|
|
mkdir -p "$CACHE_DIR"
|
|
WORK="$(mktemp -d "${TMPDIR:-/tmp}/openclaw-cloudflared.XXXXXX")"
|
|
trap 'rm -rf "$WORK"' EXIT
|
|
|
|
verified_download() {
|
|
local name="$1" expected="$2" url="$3" actual
|
|
if [[ -f "$CACHE_DIR/$name" && ! -L "$CACHE_DIR/$name" ]]; then
|
|
actual="$(shasum -a 256 "$CACHE_DIR/$name" | awk '{print $1}')"
|
|
[[ "$actual" != "$expected" ]] || return 0
|
|
fi
|
|
curl --fail --location --proto '=https' --proto-redir '=https' \
|
|
--connect-timeout 15 --max-time 180 --retry 3 --retry-delay 2 \
|
|
--output "$WORK/$name" "$url"
|
|
actual="$(shasum -a 256 "$WORK/$name" | awk '{print $1}')"
|
|
if [[ "$actual" != "$expected" ]]; then
|
|
echo "ERROR: cloudflared $name sha256 mismatch" >&2
|
|
return 1
|
|
fi
|
|
mv -f "$WORK/$name" "$CACHE_DIR/$name"
|
|
}
|
|
|
|
verified_download "$ASSET" "$ARCHIVE_SHA" \
|
|
"https://github.com/cloudflare/cloudflared/releases/download/$VERSION/$ASSET"
|
|
verified_download LICENSE "$LICENSE_SHA" \
|
|
"https://raw.githubusercontent.com/cloudflare/cloudflared/$VERSION/LICENSE"
|
|
# Select only the published executable; never extract arbitrary archive paths.
|
|
tar -xzf "$CACHE_DIR/$ASSET" -C "$WORK" cloudflared
|
|
if [[ ! -f "$WORK/cloudflared" || -L "$WORK/cloudflared" || "$(/usr/bin/lipo -archs "$WORK/cloudflared")" != "$ARCH" ]]; then
|
|
echo "ERROR: cloudflared archive did not contain the expected $ARCH executable" >&2
|
|
exit 1
|
|
fi
|
|
mkdir -p "$DESTINATION/$ARCH"
|
|
cp "$WORK/cloudflared" "$DESTINATION/$ARCH/cloudflared"
|
|
chmod 0755 "$DESTINATION/$ARCH/cloudflared"
|
|
cp "$MANIFEST" "$DESTINATION/manifest.json"
|
|
cp "$CACHE_DIR/LICENSE" "$DESTINATION/LICENSE"
|
|
echo "Staged cloudflared $VERSION ($ARCH)"
|