Prepare v0.6.7-alpha dedicated packaging

README.md

@@ -4,6 +4,12 @@ This repository packages the headless NETfishing server produced by the main
 game project. Gameplay and networking code remain in the `netfishing`
 repository so clients and servers use the same protocol implementation.
 
+Production tags follow the coordinated NETfishing release train. Package a
+game release with the same `vX.Y.Z-alpha` tag checked out in this repository.
+The package manifest records both the exact game commit and the exact dedicated
+packaging commit; packaging refuses to run when its matching release tag does
+not point to the current commit.
+
 ## Stage a build
 
 Export the `Linux Dedicated Server` preset from the game project, then stage
@@ -18,9 +24,9 @@ game_commit="$(git -C ../netfishing rev-parse HEAD)"
 ```
 
 The staged binaries under `dist/` are release inputs and are intentionally not
-tracked by Git. `dist/BUILD_INFO` records the version, full game commit, export
-preset, platform, and binary hashes. Packaging refuses a version mismatch or
-failed internal checksum.
+tracked by Git. `dist/BUILD_INFO` records the version, full game and packaging
+commits, export preset, platform, and binary hashes. Packaging refuses a
+version mismatch, packaging-tag mismatch, or failed internal checksum.
 
 Create a deterministic native archive after staging:
 

scripts/install-native-release.sh

@@ -101,8 +101,9 @@ manifest_value() {
 manifest_version="$(manifest_value manifest_version)"
 game_version="$(manifest_value game_version)"
 game_commit="$(manifest_value game_commit)"
+packaging_commit="$(manifest_value packaging_commit)"
 platform="$(manifest_value platform)"
-if [[ "${manifest_version}" != "1" ]]; then
+if [[ "${manifest_version}" != "1" && "${manifest_version}" != "2" ]]; then
 	echo "Unsupported BUILD_INFO format." >&2
 	exit 1
 fi
@@ -114,6 +115,11 @@ if [[ ! "${game_commit}" =~ ^[0-9a-f]{40}$ ]]; then
 	echo "Invalid game commit in BUILD_INFO." >&2
 	exit 1
 fi
+if [[ "${manifest_version}" == "2" \
+	&& ! "${packaging_commit}" =~ ^[0-9a-f]{40}$ ]]; then
+	echo "Invalid packaging commit in BUILD_INFO." >&2
+	exit 1
+fi
 if [[ "${platform}" != "linux-x86_64" ]]; then
 	echo "This installer only accepts linux-x86_64 packages." >&2
 	exit 1
@@ -201,6 +207,9 @@ if [[ -n "${old_current}" && "${old_current}" != "${release_dir}" ]]; then
 fi
 
 echo "Installed NETfishing dedicated server ${game_version} (${game_commit})."
+if [[ -n "${packaging_commit}" ]]; then
+	echo "Dedicated packaging commit: ${packaging_commit}."
+fi
 if ${service_exists} && ! ${service_active}; then
 	echo "${service_name} was inactive and was not started."
 fi

scripts/package-native.sh

@@ -18,6 +18,12 @@ package_name="netfishing-dedicated-server-${version}-linux-x86_64"
 staging_dir="$(mktemp -d)"
 trap 'rm -rf -- "${staging_dir}"' EXIT
 
+if ! git -C "${repository_dir}" diff --quiet \
+	|| ! git -C "${repository_dir}" diff --cached --quiet; then
+	echo "Commit dedicated packaging changes before creating a release." >&2
+	exit 1
+fi
+
 for filename in NETfishingServer.x86_64 NETfishingServer.pck BUILD_INFO SHA256SUMS; do
 	if [[ ! -f "${dist_dir}/${filename}" ]]; then
 		echo "Run scripts/stage-build.sh before packaging." >&2
@@ -28,6 +34,26 @@ if ! grep -Fxq "game_version=${version}" "${dist_dir}/BUILD_INFO"; then
 	echo "Staged BUILD_INFO does not match package version ${version}." >&2
 	exit 1
 fi
+packaging_commit="$(
+	awk -F= '$1 == "packaging_commit" {print tolower($2); exit}' \
+		"${dist_dir}/BUILD_INFO"
+)"
+current_packaging_commit="$(git -C "${repository_dir}" rev-parse HEAD)"
+if [[ "${packaging_commit}" != "${current_packaging_commit}" ]]; then
+	echo "Staged BUILD_INFO does not match the current packaging commit." >&2
+	exit 1
+fi
+release_tag="v${version}"
+if ! release_commit="$(
+	git -C "${repository_dir}" rev-parse --verify "refs/tags/${release_tag}^{commit}"
+)"; then
+	echo "Dedicated packaging tag ${release_tag} does not exist." >&2
+	exit 1
+fi
+if [[ "${release_commit}" != "${current_packaging_commit}" ]]; then
+	echo "Dedicated packaging tag ${release_tag} does not point to HEAD." >&2
+	exit 1
+fi
 (cd -- "${dist_dir}" && sha256sum -c SHA256SUMS)
 
 install -d "${staging_dir}/${package_name}"

scripts/stage-build.sh

@@ -11,6 +11,13 @@ game_version="$2"
 game_commit="${3,,}"
 repository_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
 destination_dir="${repository_dir}/dist"
+packaging_commit="$(git -C "${repository_dir}" rev-parse HEAD)"
+
+if ! git -C "${repository_dir}" diff --quiet \
+	|| ! git -C "${repository_dir}" diff --cached --quiet; then
+	echo "Commit dedicated packaging changes before staging a release." >&2
+	exit 1
+fi
 
 if [[ ! "${game_version}" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]]; then
 	echo "GAME_VERSION must contain only letters, numbers, dots, underscores, or hyphens." >&2
@@ -20,6 +27,10 @@ if [[ ! "${game_commit}" =~ ^[0-9a-f]{40}$ ]]; then
 	echo "GAME_COMMIT must be the full 40-character Git commit." >&2
 	exit 2
 fi
+if [[ ! "${packaging_commit}" =~ ^[0-9a-f]{40}$ ]]; then
+	echo "Could not resolve the dedicated packaging Git commit." >&2
+	exit 2
+fi
 
 for filename in NETfishingServer.x86_64 NETfishingServer.pck; do
 	if [[ ! -f "${source_dir}/${filename}" ]]; then
@@ -40,9 +51,10 @@ pck_sha256="$(sha256sum NETfishingServer.pck | awk '{print $1}')"
 apply_umask="$(umask)"
 umask 022
 printf '%s\n' \
-	"manifest_version=1" \
+	"manifest_version=2" \
 	"game_version=${game_version}" \
 	"game_commit=${game_commit}" \
+	"packaging_commit=${packaging_commit}" \
 	"export_preset=Linux Dedicated Server" \
 	"platform=linux-x86_64" \
 	"executable_sha256=${executable_sha256}" \