91 lines
3.5 KiB
Bash
Executable File
91 lines
3.5 KiB
Bash
Executable File
#!/bin/sh
|
|
# Build a deterministic, non-secret Windows test bundle for one harness run.
|
|
# It deliberately does not sign or publish artifacts; those are release gates.
|
|
set -eu
|
|
|
|
repo_root=$(CDPATH= cd -- "$(dirname -- "$0")/../.." && pwd)
|
|
|
|
usage() {
|
|
cat <<'EOF'
|
|
usage: scripts/windows/build-test-bundle --run-id ID --config FILE [--ca FILE] [--no-build] [--native-fixture]
|
|
|
|
Builds bin/rvbox.exe in the pinned Docker toolchain, then creates exactly:
|
|
.test-runs/ID/windows-bundle/{rvbox.exe,client.toml[,ca.pem],manifest.sha256}
|
|
|
|
The bundle is for the resettable native-test fixture only. The config must use
|
|
the target guest paths and the declared test nginx endpoint. Existing bundles
|
|
are refused rather than overwritten.
|
|
|
|
--native-fixture compiles the Windows executable with the rvbox_native_test
|
|
tag. That non-release binary alone accepts --test-fail-contexts, used only to
|
|
prove pre-launch elevation fallback order in the disposable VM.
|
|
EOF
|
|
}
|
|
|
|
fail() { printf '%s\n' "build-test-bundle: $*" >&2; exit 2; }
|
|
|
|
run_id=
|
|
config=
|
|
ca=
|
|
build=yes
|
|
native_fixture=no
|
|
while [ "$#" -gt 0 ]; do
|
|
case $1 in
|
|
--run-id) [ "$#" -ge 2 ] || fail "--run-id needs a value"; run_id=$2; shift 2 ;;
|
|
--config) [ "$#" -ge 2 ] || fail "--config needs a file"; config=$2; shift 2 ;;
|
|
--ca) [ "$#" -ge 2 ] || fail "--ca needs a PEM file"; ca=$2; shift 2 ;;
|
|
--no-build) build=no; shift ;;
|
|
--native-fixture) native_fixture=yes; shift ;;
|
|
--help|-h) usage; exit 0 ;;
|
|
*) fail "unknown argument $1" ;;
|
|
esac
|
|
done
|
|
|
|
case $run_id in
|
|
[a-z0-9]* ) ;;
|
|
* ) fail "run ID must start with lowercase alphanumeric" ;;
|
|
esac
|
|
case $run_id in
|
|
''|*[!a-z0-9-]*|????????????????????????????????????????????????????????????????*)
|
|
fail "run ID must match [a-z0-9][a-z0-9-]{0,63}"
|
|
;;
|
|
esac
|
|
[ -f "$config" ] && [ ! -L "$config" ] || fail "--config must be a regular non-symlink file"
|
|
if [ -n "$ca" ]; then [ -f "$ca" ] && [ ! -L "$ca" ] || fail "--ca must be a regular non-symlink file"; fi
|
|
|
|
if [ "$build" = yes ]; then "$repo_root/scripts/build" build; fi
|
|
if [ "$native_fixture" = yes ]; then
|
|
# Keep the server/rvc artifacts produced by scripts/build, but replace only
|
|
# the disposable test client with its explicitly tagged fixture build.
|
|
# No host Go toolchain is used. Strip symbol/DWARF tables because this
|
|
# disposable binary is transferred to the remote VM fixture; this does not
|
|
# change executable behavior or the tagged test boundary.
|
|
docker compose -f "$repo_root/deploy/compose.yaml" run --rm toolchain \
|
|
env GOOS=windows GOARCH=amd64 go build -trimpath -tags rvbox_native_test -ldflags '-H=windowsgui -s -w' -o bin/rvbox.exe ./cmd/rvbox
|
|
fi
|
|
binary=$repo_root/bin/rvbox.exe
|
|
[ -f "$binary" ] && [ ! -L "$binary" ] || fail "expected regular Windows binary at bin/rvbox.exe"
|
|
|
|
bundle=$repo_root/.test-runs/$run_id/windows-bundle
|
|
mkdir -p "$repo_root/.test-runs/$run_id"
|
|
if ! mkdir "$bundle"; then
|
|
fail "refusing to overwrite existing bundle $bundle"
|
|
fi
|
|
trap 'rmdir "$bundle" 2>/dev/null || true' INT TERM HUP
|
|
|
|
install -m 700 "$binary" "$bundle/rvbox.exe"
|
|
install -m 600 "$config" "$bundle/client.toml"
|
|
if [ -n "$ca" ]; then install -m 600 "$ca" "$bundle/ca.pem"; fi
|
|
|
|
commit=$(git -C "$repo_root" rev-parse HEAD)
|
|
{
|
|
printf 'run_id=%s\n' "$run_id"
|
|
printf 'git_commit=%s\n' "$commit"
|
|
printf 'native_fixture=%s\n' "$native_fixture"
|
|
(cd "$bundle" && sha256sum rvbox.exe client.toml ${ca:+ca.pem})
|
|
} >"$bundle/manifest.sha256"
|
|
chmod 600 "$bundle/manifest.sha256"
|
|
|
|
trap - INT TERM HUP
|
|
printf 'bundle=%s\n' "$bundle"
|