83 lines
2.8 KiB
Bash
83 lines
2.8 KiB
Bash
#!/usr/bin/env bash
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
set -euo pipefail
|
|
|
|
if [ "$#" -ne 1 ]; then
|
|
echo "Usage: $0 OUTPUT_DIRECTORY" >&2
|
|
exit 2
|
|
fi
|
|
|
|
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
OUTPUT_DIR="$1"
|
|
|
|
if [ -e "$OUTPUT_DIR" ]; then
|
|
echo "Output path already exists: $OUTPUT_DIR" >&2
|
|
exit 1
|
|
fi
|
|
if ! git -C "$ROOT_DIR" -c core.fileMode=false diff --ignore-space-at-eol --quiet \
|
|
|| ! git -C "$ROOT_DIR" -c core.fileMode=false diff --cached --quiet; then
|
|
echo "Commit or stash repository changes before creating a public export." >&2
|
|
exit 1
|
|
fi
|
|
|
|
mkdir -p "$OUTPUT_DIR"
|
|
git -C "$ROOT_DIR" archive --format=tar HEAD | tar -xf - -C "$OUTPUT_DIR"
|
|
|
|
# Agent instructions contain private research-session context and are not part
|
|
# of the distributable library or its safety evidence.
|
|
find "$OUTPUT_DIR" -type f -name AGENTS.md -delete
|
|
|
|
for forbidden in \
|
|
'.env' '*.pem' '*.key' '*.p12' '*.pfx' '*.db' '*.sqlite' '*.sqlite3' \
|
|
'*.elf' '*.self' '*.bin' '*.dmp' '*.core' '*.zip' \
|
|
'secret.key' 'id_rsa' 'id_ed25519'; do
|
|
if find "$OUTPUT_DIR" -type f -name "$forbidden" -print -quit | grep -q .; then
|
|
echo "Forbidden file found in public export: $forbidden" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
if grep -RIlE --exclude='export-public-source.sh' \
|
|
'192\.168\.10\.150|NuklearRabbit|C:\\Users\\Jens' "$OUTPUT_DIR" >/dev/null; then
|
|
echo "Private operator marker found in public export." >&2
|
|
exit 1
|
|
fi
|
|
if find "$OUTPUT_DIR" -type f -size +10M -print -quit | grep -q .; then
|
|
echo "Unexpected file larger than 10 MiB found in public export." >&2
|
|
exit 1
|
|
fi
|
|
|
|
git -C "$OUTPUT_DIR" init -q
|
|
# The export is created in a fresh repository, so source paths that happen to
|
|
# match a diagnostic ignore rule (for example src/core/) must still be added.
|
|
git -C "$OUTPUT_DIR" add --force .
|
|
git -C "$OUTPUT_DIR" -c user.name='Chimera GFX release export' \
|
|
-c user.email='release-export@invalid.example' \
|
|
commit -q -m "Publish Chimera GFX source"
|
|
|
|
EXPECTED_FILES="$(mktemp)"
|
|
ACTUAL_FILES="$(mktemp)"
|
|
trap 'rm -f "$EXPECTED_FILES" "$ACTUAL_FILES"' EXIT
|
|
git -C "$ROOT_DIR" ls-tree -r --name-only HEAD \
|
|
| grep -Ev '(^|/)AGENTS\.md$' \
|
|
| LC_ALL=C sort > "$EXPECTED_FILES"
|
|
git -C "$OUTPUT_DIR" ls-files | LC_ALL=C sort > "$ACTUAL_FILES"
|
|
if ! diff -u "$EXPECTED_FILES" "$ACTUAL_FILES"; then
|
|
echo "Public export does not contain the complete tracked source tree." >&2
|
|
exit 1
|
|
fi
|
|
|
|
(
|
|
cd "$OUTPUT_DIR"
|
|
git ls-files -z | sort -z | xargs -0 sha256sum > PUBLIC-SOURCE-MANIFEST.sha256
|
|
)
|
|
git -C "$OUTPUT_DIR" add PUBLIC-SOURCE-MANIFEST.sha256
|
|
git -C "$OUTPUT_DIR" -c user.name='Chimera GFX release export' \
|
|
-c user.email='release-export@invalid.example' \
|
|
commit -q --amend --no-edit
|
|
git -C "$OUTPUT_DIR" tag public-release-baseline
|
|
|
|
echo "Public source export created at $OUTPUT_DIR"
|
|
echo "Commit: $(git -C "$OUTPUT_DIR" rev-parse HEAD)"
|