diff options
Diffstat (limited to 'packaging/build/build-common.sh')
| -rwxr-xr-x | packaging/build/build-common.sh | 26 |
1 files changed, 23 insertions, 3 deletions
diff --git a/packaging/build/build-common.sh b/packaging/build/build-common.sh index 5f119c6..ca5bd1b 100755 --- a/packaging/build/build-common.sh +++ b/packaging/build/build-common.sh @@ -29,9 +29,9 @@ echo " creating venv at $VENV_BUILD" python3 -m venv "$VENV_BUILD" "$VENV_BUILD/bin/pip" install --upgrade pip wheel 2>&1 | tail -1 -# --- Build wheels for all three packages ----------------------------------- +# --- Build wheels for every package ---------------------------------------- echo " building wheels" -for pkg in meshbay-common meshbay-hub meshbay-node; do +for pkg in meshbay-common meshbay-hub meshbay-node meshbay-cli; do "$VENV_BUILD/bin/pip" wheel \ --no-deps \ --wheel-dir "$WHEEL_DIR" \ @@ -44,11 +44,29 @@ echo " installing all packages + dependencies" --find-links "$WHEEL_DIR" \ meshbay-common meshbay-hub meshbay-node 2>&1 | tail -3 +# The command-line client goes in last, after a list of what the servers need: +# whatever its install adds is the CLI's alone, and build-cli.sh moves it into +# the meshbay-cli package, so a server carries no Textual. +SITE_BUILD=$(echo "$VENV_BUILD"/lib/python3.*/site-packages) +LC_ALL=C ls -1A "$SITE_BUILD" > "$STAGING/servers-site.txt" +LC_ALL=C ls -1A "$VENV_BUILD/bin" > "$STAGING/servers-bin.txt" +echo " installing meshbay-cli + its own dependencies" +"$VENV_BUILD/bin/pip" install \ + --find-links "$WHEEL_DIR" \ + meshbay-cli 2>&1 | tail -1 + # --- Third-party notices: every package the venv ships, with its licence ------- echo " writing THIRD-PARTY-NOTICES.txt" "$VENV_BUILD/bin/python" "$REPO/packaging/third_party_notices.py" \ -o "$ROOT/opt/meshbay-common/THIRD-PARTY-NOTICES.txt" meshbay-hub meshbay-node +# --- Known vulnerabilities in what ships ----------------------------------- +# One stops the build unless packaging/pip-audit-ignore.txt says why it does not +# apply; no network only skips the audit, with a warning. pip-audit runs from a +# venv of its own under the staging dir, never from the one shipped. +echo " auditing dependencies (pip-audit)" +"$VENV_BUILD/bin/python" "$REPO/packaging/audit_deps.py" --tool-dir "$STAGING/pip-audit" + # --- Strip build tools from the venv (not needed at runtime) --------------- echo " stripping build tools" "$VENV_BUILD/bin/pip" uninstall -y pip setuptools wheel 2>&1 | tail -1 @@ -64,7 +82,9 @@ for f in "$VENV_BUILD/bin"/*; do [ -f "$f" ] || continue [ -L "$f" ] && continue head -1 "$f" | grep -q "^#!" || continue - sed -i "1s|$ROOT||" "$f" + # Line 2 too: past 127 characters, pip writes a `#!/bin/sh` trampoline that + # names the interpreter on the next line. + sed -i "1,2s|$ROOT||" "$f" done sed -i "s|$ROOT||g" "$VENV_BUILD/pyvenv.cfg" |