204 lines
7.1 KiB
Bash
204 lines
7.1 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
GO_REQUIRED="${GO_REQUIRED:-1.21.13}"
|
|
BUN_REQUIRED="${BUN_REQUIRED:-1.1.45}"
|
|
NODE_REQUIRED="${NODE_REQUIRED:-20.19.0}"
|
|
PNPM_REQUIRED="${PNPM_REQUIRED:-9.15.9}"
|
|
TOOLCHAIN_DIR="${TOOLCHAIN_DIR:-$ROOT_DIR/.toolchain}"
|
|
VERIFY_TOOLCHAIN_CHECKSUMS="${VERIFY_TOOLCHAIN_CHECKSUMS:-false}"
|
|
GO_ARCHIVE_SHA256="${GO_ARCHIVE_SHA256:-}"
|
|
NODE_ARCHIVE_SHA256="${NODE_ARCHIVE_SHA256:-}"
|
|
BUN_ARCHIVE_SHA256="${BUN_ARCHIVE_SHA256:-}"
|
|
|
|
verify_archive_sha256() {
|
|
local archive="$1"
|
|
local expected="$2"
|
|
local label="$3"
|
|
|
|
if [ "$VERIFY_TOOLCHAIN_CHECKSUMS" != "true" ]; then
|
|
return 0
|
|
fi
|
|
|
|
[ -n "$expected" ] || fail "missing expected SHA256 for $label (set ${label}_SHA256 env)"
|
|
local actual
|
|
actual="$(sha256sum "$archive" | awk '{print $1}')"
|
|
[ "$actual" = "$expected" ] || fail "$label sha256 mismatch: expected $expected, got $actual"
|
|
}
|
|
|
|
require_linux_debian13_amd64() {
|
|
[ "$(uname -s)" = "Linux" ] || fail "production builder supports only Linux Debian 13 amd64"
|
|
|
|
local arch
|
|
arch="$(uname -m)"
|
|
[ "$arch" = "x86_64" ] || [ "$arch" = "amd64" ] || fail "production builder supports only amd64, got: $arch"
|
|
|
|
[ -f /etc/os-release ] || fail "missing /etc/os-release"
|
|
# shellcheck disable=SC1091
|
|
. /etc/os-release
|
|
[ "${ID:-}" = "debian" ] || fail "production builder supports only Debian 13, got: ${ID:-unknown}"
|
|
[ "${VERSION_ID:-}" = "13" ] || fail "production builder supports only Debian 13, got version: ${VERSION_ID:-unknown}"
|
|
}
|
|
|
|
apt_install_missing() {
|
|
local missing=()
|
|
local pkg
|
|
for pkg in "$@"; do
|
|
if ! dpkg-query -W -f='${Status}' "$pkg" 2>/dev/null | grep -q 'install ok installed'; then
|
|
missing+=("$pkg")
|
|
fi
|
|
done
|
|
|
|
if [ "${#missing[@]}" -eq 0 ]; then
|
|
return 0
|
|
fi
|
|
|
|
log_info "Installing missing build packages: ${missing[*]}"
|
|
if [ "$(id -u)" = "0" ]; then
|
|
apt-get update
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "${missing[@]}"
|
|
elif command -v sudo >/dev/null 2>&1; then
|
|
sudo apt-get update
|
|
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "${missing[@]}"
|
|
else
|
|
fail "missing packages (${missing[*]}) and neither root nor sudo is available"
|
|
fi
|
|
}
|
|
|
|
ensure_build_dependencies() {
|
|
apt_install_missing \
|
|
ca-certificates curl unzip tar xz-utils git build-essential pkg-config \
|
|
bash coreutils findutils grep sed gawk openssl
|
|
|
|
require_tool curl
|
|
require_tool tar
|
|
require_tool xz
|
|
require_tool unzip
|
|
require_tool sha256sum
|
|
require_tool find
|
|
require_tool install
|
|
require_tool sort
|
|
require_tool xargs
|
|
require_tool grep
|
|
require_tool sed
|
|
}
|
|
|
|
go_version() {
|
|
"$1" version | sed -E 's/^go version go([0-9.]+).*/\1/'
|
|
}
|
|
|
|
ensure_go() {
|
|
local managed="$TOOLCHAIN_DIR/go/bin/go"
|
|
local go_mode=""
|
|
if [ -x "$managed" ] && [ "$(go_version "$managed")" = "$GO_REQUIRED" ]; then
|
|
GO_BIN="$managed"
|
|
go_mode="managed"
|
|
elif command -v go >/dev/null 2>&1 && [ "$(go_version "$(command -v go)")" = "$GO_REQUIRED" ]; then
|
|
GO_BIN="$(command -v go)"
|
|
go_mode="global"
|
|
else
|
|
log_info "Installing Go $GO_REQUIRED into $TOOLCHAIN_DIR/go"
|
|
mkdir -p "$TOOLCHAIN_DIR/downloads"
|
|
local archive="$TOOLCHAIN_DIR/downloads/go${GO_REQUIRED}.linux-amd64.tar.gz"
|
|
download_file "https://go.dev/dl/go${GO_REQUIRED}.linux-amd64.tar.gz" "$archive"
|
|
verify_archive_sha256 "$archive" "$GO_ARCHIVE_SHA256" "GO_ARCHIVE"
|
|
rm -rf "$TOOLCHAIN_DIR/go"
|
|
tar -C "$TOOLCHAIN_DIR" -xzf "$archive"
|
|
GO_BIN="$managed"
|
|
go_mode="managed"
|
|
fi
|
|
|
|
export GO_BIN
|
|
if [ "$go_mode" = "managed" ]; then
|
|
export GOROOT="$TOOLCHAIN_DIR/go"
|
|
else
|
|
unset GOROOT || true
|
|
fi
|
|
export PATH="$(dirname "$GO_BIN"):$PATH"
|
|
export GOTOOLCHAIN=local
|
|
[ "$(go_version "$GO_BIN")" = "$GO_REQUIRED" ] || fail "Go version mismatch: required $GO_REQUIRED, got $($GO_BIN version)"
|
|
}
|
|
|
|
ensure_bun() {
|
|
local managed="$TOOLCHAIN_DIR/bun/bin/bun"
|
|
if [ -x "$managed" ] && [ "$($managed --version)" = "$BUN_REQUIRED" ]; then
|
|
BUN_BIN="$managed"
|
|
elif command -v bun >/dev/null 2>&1 && [ "$(bun --version)" = "$BUN_REQUIRED" ]; then
|
|
BUN_BIN="$(command -v bun)"
|
|
else
|
|
log_info "Installing Bun $BUN_REQUIRED into $TOOLCHAIN_DIR/bun"
|
|
mkdir -p "$TOOLCHAIN_DIR/downloads" "$TOOLCHAIN_DIR/bun"
|
|
local archive="$TOOLCHAIN_DIR/downloads/bun-linux-x64-${BUN_REQUIRED}.zip"
|
|
download_file "https://github.com/oven-sh/bun/releases/download/bun-v${BUN_REQUIRED}/bun-linux-x64.zip" "$archive"
|
|
verify_archive_sha256 "$archive" "$BUN_ARCHIVE_SHA256" "BUN_ARCHIVE"
|
|
rm -rf "$TOOLCHAIN_DIR/bun-tmp" "$TOOLCHAIN_DIR/bun"
|
|
mkdir -p "$TOOLCHAIN_DIR/bun-tmp"
|
|
unzip -q "$archive" -d "$TOOLCHAIN_DIR/bun-tmp"
|
|
mkdir -p "$TOOLCHAIN_DIR/bun/bin"
|
|
install -m 0755 "$TOOLCHAIN_DIR/bun-tmp/bun-linux-x64/bun" "$managed"
|
|
rm -rf "$TOOLCHAIN_DIR/bun-tmp"
|
|
BUN_BIN="$managed"
|
|
fi
|
|
|
|
export BUN_BIN
|
|
export PATH="$(dirname "$BUN_BIN"):$PATH"
|
|
[ "$($BUN_BIN --version)" = "$BUN_REQUIRED" ] || fail "Bun version mismatch: required $BUN_REQUIRED, got $($BUN_BIN --version)"
|
|
}
|
|
|
|
node_version() {
|
|
"$1" --version | sed 's/^v//'
|
|
}
|
|
|
|
ensure_node() {
|
|
local managed="$TOOLCHAIN_DIR/node/bin/node"
|
|
if [ -x "$managed" ] && [ "$(node_version "$managed")" = "$NODE_REQUIRED" ]; then
|
|
NODE_BIN="$managed"
|
|
elif command -v node >/dev/null 2>&1 && [ "$(node_version "$(command -v node)")" = "$NODE_REQUIRED" ]; then
|
|
NODE_BIN="$(command -v node)"
|
|
else
|
|
log_info "Installing Node.js $NODE_REQUIRED into $TOOLCHAIN_DIR/node"
|
|
mkdir -p "$TOOLCHAIN_DIR/downloads"
|
|
local archive="$TOOLCHAIN_DIR/downloads/node-v${NODE_REQUIRED}-linux-x64.tar.xz"
|
|
download_file "https://nodejs.org/dist/v${NODE_REQUIRED}/node-v${NODE_REQUIRED}-linux-x64.tar.xz" "$archive"
|
|
verify_archive_sha256 "$archive" "$NODE_ARCHIVE_SHA256" "NODE_ARCHIVE"
|
|
rm -rf "$TOOLCHAIN_DIR/node" "$TOOLCHAIN_DIR/node-v${NODE_REQUIRED}-linux-x64"
|
|
tar -C "$TOOLCHAIN_DIR" -xJf "$archive"
|
|
mv "$TOOLCHAIN_DIR/node-v${NODE_REQUIRED}-linux-x64" "$TOOLCHAIN_DIR/node"
|
|
NODE_BIN="$managed"
|
|
fi
|
|
|
|
export NODE_BIN
|
|
export PATH="$(dirname "$NODE_BIN"):$PATH"
|
|
[ "$(node_version "$NODE_BIN")" = "$NODE_REQUIRED" ] || fail "Node.js version mismatch: required $NODE_REQUIRED, got $($NODE_BIN --version)"
|
|
}
|
|
|
|
ensure_pnpm() {
|
|
local managed="$TOOLCHAIN_DIR/pnpm/bin/pnpm"
|
|
export PATH="$TOOLCHAIN_DIR/pnpm/bin:$PATH"
|
|
if [ -x "$managed" ] && [ "$($managed --version)" = "$PNPM_REQUIRED" ]; then
|
|
PNPM_BIN="$managed"
|
|
else
|
|
log_info "Installing pnpm $PNPM_REQUIRED into $TOOLCHAIN_DIR/pnpm"
|
|
mkdir -p "$TOOLCHAIN_DIR/pnpm/bin"
|
|
corepack enable --install-directory "$TOOLCHAIN_DIR/pnpm/bin"
|
|
corepack prepare "pnpm@$PNPM_REQUIRED" --activate
|
|
[ -x "$managed" ] || fail "pnpm binary was not installed into $managed"
|
|
PNPM_BIN="$managed"
|
|
fi
|
|
|
|
export PNPM_BIN
|
|
[ "$($PNPM_BIN --version)" = "$PNPM_REQUIRED" ] || fail "pnpm version mismatch: required $PNPM_REQUIRED, got $($PNPM_BIN --version)"
|
|
}
|
|
|
|
ensure_toolchain() {
|
|
ensure_go
|
|
ensure_bun
|
|
ensure_node
|
|
ensure_pnpm
|
|
|
|
log_info "Go: $($GO_BIN version)"
|
|
log_info "Bun: $($BUN_BIN --version)"
|
|
log_info "Node.js: $($NODE_BIN --version)"
|
|
log_info "pnpm: $($PNPM_BIN --version)"
|
|
}
|