mirror of
https://github.com/anomalyco/hex.git
synced 2026-11-15 14:16:56 +08:00
Dax
8752c0f745
KDE's color-scheme portal describes window colors, so a mixed theme such as Breeze Twilight picked a black mark for a dark panel. Bump rune for TraySpec::icon_name, write anomaly.hex-symbolic.svg into the user's hicolor theme at startup, and serve that name beside the pixmap so Plasma 6, GNOME's AppIndicator extension, and Waybar draw the mark in their own text color. The icon keeps the old white/black default for hosts that don't recolor, and the installer removes only a marked file. Goldens follow the rune bump.
222 lines
10 KiB
Bash
Executable File
222 lines
10 KiB
Bash
Executable File
#!/bin/sh
|
|
# Runs .github/release/install-linux.sh against a fixture release service on
|
|
# loopback: install, receipt, uninstall, refused manifests and downloads,
|
|
# source installs, and symlink safety. Never touches the real user's systemd
|
|
# manager or data.
|
|
set -eu
|
|
|
|
root=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
|
|
for command in curl jq openssl python3 sha256sum; do
|
|
if ! command -v "$command" >/dev/null 2>&1; then
|
|
echo "Installer test requires $command." >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
case "$(uname -s) $(uname -m)" in
|
|
"Linux x86_64") target=linux-x64 ;;
|
|
"Linux aarch64") target=linux-arm64 ;;
|
|
*)
|
|
echo "Installer test requires x86_64 or aarch64 Linux." >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
if [ "$(id -u)" -eq 0 ]; then
|
|
echo "Installer test must run as an unprivileged user." >&2
|
|
exit 1
|
|
fi
|
|
|
|
temporary=$(mktemp -d)
|
|
mkdir -p "$temporary/bin"
|
|
printf '#!/bin/sh\nexit 0\n' > "$temporary/bin/systemctl"
|
|
chmod 755 "$temporary/bin/systemctl"
|
|
export PATH="$temporary/bin:$PATH"
|
|
server_pid=
|
|
cleanup() {
|
|
if [ -n "$server_pid" ]; then
|
|
kill "$server_pid" >/dev/null 2>&1 || true
|
|
wait "$server_pid" 2>/dev/null || true
|
|
fi
|
|
rm -rf "$temporary"
|
|
}
|
|
trap cleanup EXIT HUP INT TERM
|
|
|
|
server="$temporary/server"
|
|
installer="$temporary/install-linux.sh"
|
|
version=9.8.7
|
|
# A fixture signing key stands in for Anomaly's.
|
|
openssl genpkey -algorithm ed25519 -out "$temporary/signing.pem" 2>/dev/null
|
|
fixture_key=$(openssl pkey -in "$temporary/signing.pem" -pubout -outform DER | base64 | tr -d '\n')
|
|
# The fixture service is plain HTTP on loopback.
|
|
sed \
|
|
-e "s/--proto '=https'/--proto '=http,https'/g" \
|
|
-e "s/--proto-redir '=https'/--proto-redir '=http,https'/g" \
|
|
-e 's|^ https://\*) ;;$| http://127.0.0.1:*\|https://*) ;;|' \
|
|
-e "s|^signing_key=.*|signing_key=$fixture_key|" \
|
|
"$root/.github/release/install-linux.sh" > "$installer"
|
|
|
|
unsigned="$temporary/hex"
|
|
printf '#!/bin/sh\necho "hex %s"\n' "$version" > "$unsigned"
|
|
chmod 755 "$unsigned"
|
|
sha256=$(sha256sum "$unsigned" | awk '{ print $1 }')
|
|
bytes=$(wc -c < "$unsigned" | tr -d ' ')
|
|
file="hex-$version-$target"
|
|
mkdir -p "$server/release/hex/desktop" "$server/release/hex/files/$sha256"
|
|
cp "$unsigned" "$server/release/hex/files/$sha256/$file"
|
|
printf 'anomaly.hex.linux-artifact.v1\n%s\n' "$sha256" > "$temporary/signed"
|
|
openssl pkeyutl -sign -rawin -inkey "$temporary/signing.pem" -in "$temporary/signed" -out "$temporary/hex.sig"
|
|
signature_sha256=$(sha256sum "$temporary/hex.sig" | awk '{ print $1 }')
|
|
mkdir -p "$server/release/hex/files/$signature_sha256"
|
|
cp "$temporary/hex.sig" "$server/release/hex/files/$signature_sha256/hex.sig"
|
|
jq -n --arg version "$version" --arg target "$target" --arg url "/release/hex/files/$sha256/$file" --arg sha256 "$sha256" --argjson size "$bytes" \
|
|
--arg sig_url "/release/hex/files/$signature_sha256/hex.sig" --arg sig_sha256 "$signature_sha256" \
|
|
'{schema: 1, app: "hex", artifact: "desktop", channel: "stable", sequence: 1,
|
|
published_at: "2026-10-24T00:00:00Z",
|
|
release: {version: $version, rollout_percent: 100, revoked_versions: [],
|
|
targets: {($target): {url: $url, size: $size, sha256: $sha256},
|
|
($target + "-sig"): {url: $sig_url, size: 64, sha256: $sig_sha256}},
|
|
distributions: [{kind: "direct"}]}}' > "$server/release/hex/desktop/stable.json"
|
|
cp "$server/release/hex/desktop/stable.json" "$temporary/manifest.json"
|
|
|
|
port=$((38000 + ($$ % 1000)))
|
|
python3 -m http.server "$port" --bind 127.0.0.1 --directory "$server" \
|
|
> "$temporary/server.log" 2>&1 &
|
|
server_pid=$!
|
|
attempt=0
|
|
until curl --fail --silent "http://127.0.0.1:$port/release/hex/desktop/stable.json" >/dev/null; do
|
|
attempt=$((attempt + 1))
|
|
if [ "$attempt" -ge 20 ]; then
|
|
echo "Fixture server did not start." >&2
|
|
exit 1
|
|
fi
|
|
sleep 0.1
|
|
done
|
|
|
|
home="$temporary/home"
|
|
export XDG_DATA_HOME="$home/.local/share"
|
|
export XDG_CONFIG_HOME="$home/.config"
|
|
install_dir="$home/.local/bin"
|
|
support_dir="$home/.local/share/hex"
|
|
mkdir -p "$support_dir"
|
|
printf 'preserve me\n' > "$support_dir/settings.json"
|
|
|
|
install() {
|
|
HOME="$home" HEX_INSTALL_DIR="$install_dir" HEX_APPLICATION_SUPPORT_DIR="$support_dir" \
|
|
HEX_RELEASE_BASE_URL="http://127.0.0.1:$port/release" sh "$installer" "$@"
|
|
}
|
|
|
|
# Refuses a manifest, then checks that nothing was installed.
|
|
refuses() {
|
|
if install > "$temporary/refused.log" 2>&1; then
|
|
echo "Installer accepted $1." >&2
|
|
exit 1
|
|
fi
|
|
test ! -e "$install_dir/hex"
|
|
test ! -e "$support_dir/versions"
|
|
cp "$temporary/manifest.json" "$server/release/hex/desktop/stable.json"
|
|
}
|
|
|
|
# Earlier installs named Hex's entries hex.desktop; installing replaces them.
|
|
mkdir -p "$home/.local/share/applications" "$home/.config/autostart"
|
|
printf '[Desktop Entry]\nX-Hex-Managed=true\n' > "$home/.local/share/applications/hex.desktop"
|
|
printf '[Desktop Entry]\nX-Hex-Managed=true\n' > "$home/.config/autostart/hex.desktop"
|
|
|
|
install
|
|
test -L "$install_dir/hex"
|
|
test ! -e "$home/.local/share/applications/hex.desktop"
|
|
test ! -e "$home/.config/autostart/hex.desktop"
|
|
grep -Fxq 'StartupWMClass=anomaly.hex' "$home/.local/share/applications/anomaly.hex.desktop"
|
|
grep -Fxq 'Icon=anomaly.hex' "$home/.local/share/applications/anomaly.hex.desktop"
|
|
test "$("$install_dir/hex" --version)" = "hex $version"
|
|
grep -Fq 'X-Hex-Managed=true' "$home/.local/share/applications/anomaly.hex.desktop"
|
|
grep -Fq 'X-Hex-Managed=true' "$home/.config/autostart/anomaly.hex.desktop"
|
|
grep -Fq '" start' "$home/.config/autostart/anomaly.hex.desktop"
|
|
grep -Fq '# X-Hex-Managed=true' "$home/.config/systemd/user/hex.service"
|
|
grep -Fq '" service' "$home/.config/systemd/user/hex.service"
|
|
grep -Fxq 'Type=notify' "$home/.config/systemd/user/hex.service"
|
|
grep -Fxq 'NotifyAccess=main' "$home/.config/systemd/user/hex.service"
|
|
grep -Fxq "Exec=\"$install_dir/hex\"" "$home/.local/share/applications/anomaly.hex.desktop"
|
|
grep -Fxq "Exec=\"$install_dir/hex\" quit" "$home/.local/share/applications/anomaly.hex.desktop"
|
|
grep -Fxq "EnvironmentFile=-$support_dir/session.env" "$home/.config/systemd/user/hex.service"
|
|
test ! -e "$support_dir/versions/$version/source-build"
|
|
test "$(jq -c . "$support_dir/install.json")" = \
|
|
"$(jq -cn --arg root "$support_dir" '{app: "hex", artifact: "desktop", channel: "stable", method: "direct", root: $root}')"
|
|
|
|
mkdir -p "$home/.local/share/icons/hicolor/48x48/apps" "$home/.local/share/icons/hicolor/64x64/apps" \
|
|
"$home/.local/share/icons/hicolor/scalable/apps"
|
|
printf 'png X-Hex-Managed=true' > "$home/.local/share/icons/hicolor/48x48/apps/anomaly.hex.png"
|
|
printf 'mine' > "$home/.local/share/icons/hicolor/64x64/apps/anomaly.hex.png"
|
|
printf '<svg>X-Hex-Managed=true</svg>' > "$home/.local/share/icons/hicolor/scalable/apps/anomaly.hex-symbolic.svg"
|
|
# The Background portal's own autostart entry for Hex counts as Hex's.
|
|
portal_entry() {
|
|
printf '[Desktop Entry]\nType=Application\nName=Hex\nX-XDP-Autostart=anomaly.hex\nExec=%s start\n' "$install_dir/hex" > "$home/.config/autostart/anomaly.hex.desktop"
|
|
}
|
|
portal_entry
|
|
install > /dev/null
|
|
portal_entry
|
|
install uninstall
|
|
test ! -e "$home/.config/autostart/anomaly.hex.desktop"
|
|
test ! -e "$home/.local/share/icons/hicolor/48x48/apps/anomaly.hex.png"
|
|
test -f "$home/.local/share/icons/hicolor/64x64/apps/anomaly.hex.png"
|
|
test ! -e "$home/.local/share/icons/hicolor/scalable/apps/anomaly.hex-symbolic.svg"
|
|
test ! -e "$install_dir/hex"
|
|
test ! -e "$support_dir/versions"
|
|
test ! -e "$support_dir/install.json"
|
|
test ! -e "$home/.config/systemd/user/hex.service"
|
|
test ! -e "$home/.local/share/applications/anomaly.hex.desktop"
|
|
test ! -e "$home/.config/autostart/anomaly.hex.desktop"
|
|
test -f "$support_dir/settings.json"
|
|
|
|
# The dev channel: its manifest, its receipt.
|
|
jq '.channel = "dev"' "$temporary/manifest.json" > "$server/release/hex/desktop/dev.json"
|
|
HOME="$home" HEX_INSTALL_DIR="$install_dir" HEX_APPLICATION_SUPPORT_DIR="$support_dir" \
|
|
HEX_RELEASE_BASE_URL="http://127.0.0.1:$port/release" HEX_INSTALL_CHANNEL=dev sh "$installer" > /dev/null
|
|
test "$(jq -r .channel "$support_dir/install.json")" = dev
|
|
# A user's own symbolic tray icon is not Hex's to remove.
|
|
printf '<svg>mine</svg>' > "$home/.local/share/icons/hicolor/scalable/apps/anomaly.hex-symbolic.svg"
|
|
install uninstall
|
|
test -f "$home/.local/share/icons/hicolor/scalable/apps/anomaly.hex-symbolic.svg"
|
|
|
|
jq '.app = "other"' "$temporary/manifest.json" > "$server/release/hex/desktop/stable.json"
|
|
refuses "another app's manifest"
|
|
jq '.release.targets = {}' "$temporary/manifest.json" > "$server/release/hex/desktop/stable.json"
|
|
refuses "a release without a $target build"
|
|
jq --arg target "$target" '.release.targets[$target].url = "https://example.com/hex"' "$temporary/manifest.json" > "$server/release/hex/desktop/stable.json"
|
|
refuses "a file outside the service"
|
|
jq --arg target "$target-sig" 'del(.release.targets[$target])' "$temporary/manifest.json" > "$server/release/hex/desktop/stable.json"
|
|
refuses "a release without a signature"
|
|
# A manifest naming other bytes with their own SHA-256: only the signature
|
|
# catches it.
|
|
printf '#!/bin/sh\necho "hex %s"\n#evil\n' "$version" > "$temporary/evil"
|
|
evil_sha256=$(sha256sum "$temporary/evil" | awk '{ print $1 }')
|
|
mkdir -p "$server/release/hex/files/$evil_sha256"
|
|
cp "$temporary/evil" "$server/release/hex/files/$evil_sha256/$file"
|
|
jq --arg target "$target" --arg sha256 "$evil_sha256" --arg url "/release/hex/files/$evil_sha256/$file" \
|
|
--argjson size "$(wc -c < "$temporary/evil" | tr -d ' ')" \
|
|
'.release.targets[$target] = {url: $url, size: $size, sha256: $sha256}' "$temporary/manifest.json" > "$server/release/hex/desktop/stable.json"
|
|
refuses "an executable the release key did not sign"
|
|
printf 'X' | dd of="$server/release/hex/files/$sha256/$file" bs=1 seek=0 conv=notrunc >/dev/null 2>&1
|
|
refuses "a same-size corrupted download"
|
|
|
|
HOME="$home" HEX_INSTALL_DIR="$install_dir" HEX_APPLICATION_SUPPORT_DIR="$support_dir" \
|
|
HEX_INSTALL_ARTIFACT="$unsigned" HEX_INSTALL_VERSION="$version" HEX_INSTALL_SOURCE=1 \
|
|
sh "$installer"
|
|
test "$("$install_dir/hex" --version)" = "hex $version"
|
|
test -e "$support_dir/versions/$version/source-build"
|
|
test ! -e "$support_dir/install.json"
|
|
install uninstall
|
|
|
|
important="$temporary/important"
|
|
support_link="$temporary/support-link"
|
|
mkdir -p "$important/versions"
|
|
touch "$important/versions/preserve"
|
|
ln -s "$important" "$support_link"
|
|
if HOME="$home" HEX_INSTALL_DIR="$install_dir" HEX_APPLICATION_SUPPORT_DIR="$support_link" \
|
|
sh "$installer" uninstall > "$temporary/symlink.log" 2>&1
|
|
then
|
|
echo "Uninstaller accepted a managed support symlink." >&2
|
|
exit 1
|
|
fi
|
|
test -f "$important/versions/preserve"
|
|
|
|
echo "Linux release installer smoke test passed."
|