Repository navigation
build: Homebrew/Scoop/winget manifests and cargo-auditable release builds (WI-1724) - #258
Merged
Merged
Conversation
…itable Build every standalone release binary and the container image through cargo-auditable, so the resolved crate list is embedded in the shipped executable rather than inferred by syft from the build tree. - ci/tasks/auditable pins v0.7.7 and its tarball SHA-256, installs it once per task, and provides the wrapper environment the cross builders (cargo zigbuild / cargo xwin) need. - the Linux, arm64 and Windows build tasks build through it and fail if the resulting binary has no .dep-v0 section. - the Dockerfile installs the same pinned tool and asserts the section. - release.yml and promote-release.yml re-check both shipped Linux binaries before SBOM generation, so a regression cannot quietly produce a non-dependency-accurate SBOM.
Add the remaining distribution channels beyond Unraid and AUR, with every value derived from the release workflow's own assets and checksums. Nothing is published: CI renders the Windows manifests and uploads them as a workflow artefact for the operator to review and submit. - packaging/homebrew/Formula/rustnzb.rb installs the prebuilt Linux tarballs (x86_64 default, aarch64 under on_arm); update-formula.sh downloads both assets and SHA256SUMS, verifies them, and rewrites version/URL/hashes. - packaging/scoop/bucket/rustnzb.json extracts the NSIS installer with Expand-7zipArchive instead of running it, so no registry entries, service or uninstaller are created. - packaging/winget/.../1.5.0 declares InstallerType nullsoft, machine scope, elevatesSelf, the rustnzb command and the .nzb file extension. - packaging/distribution/render-windows-manifests.sh renders both Windows channels from one SHA256SUMS file and writes nothing on a bad or missing hash; release.yml runs it as a dry run against the assets it just built. - cargo-auditable builds are documented in RELEASING.md, with the cosign mirror question recorded as an open operator decision. The Windows installer is not Authenticode-signed, so SmartScreen warns on first run; winget accepts that, and the docs say so. A macOS formula needs a macOS artefact, which the release does not produce yet.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Rebase of #253 onto current
main, superseding it. #253 conflicts withmainafter #252 (**config:**changelog entry) and #254 (CodeQL made release-only, push-to-main CI runs removed) landed.Adds Homebrew, Scoop and winget distribution manifests, and builds release binaries with
cargo-auditableso dependency data is embedded forcargo audit bin.The rebase keeps both sides:
main's workflow changes from ci: CodeQL only on release builds; no duplicate full CI on push to main #254 — CodeQL stays release-only (codeql.ymlremainsworkflow_call/workflow_dispatch, thecodeql:job stays inrelease.yml) and the push-to-main CI trigger stays removed.CHANGELOG.mdkeeps feat(ui): i18n groundwork — English catalog, locale switch, missing-key test (WI-1721) #252's**config:**entry followed by this branch's**packaging:**andcargo-auditableentries.User-visible behaviour
Users can install from Homebrew, Scoop and winget. Release binaries carry embedded dependency data, so
cargo audit binworks against a published artifact.Compatibility
None. No native
/api/..., SABnzbd-compatible response, config key or on-disk state changes.Tests
cargo fmt --all --checkcargo clippy --workspace --all-targets -- -D warningscargo test --workspacecargo check --workspace --all-targetscargo test --manifest-path benchnzb/Cargo.toml --all-targets --lockednpm test -- --watch=falseand production build, ifapps/rustnzb/frontendchanged — not applicable, frontend untouchedAdditional verification on the packaging scripts:
shellcheckclean andsh -nclean onci/tasks/auditable,packaging/distribution/render-windows-manifests.sh,packaging/homebrew/update-formula.sh.render-windows-manifests.shexercised end to end: valid release writes the Scoop JSON and winget YAML with the right version and hash (uppercase hex for winget), a checksum mismatch exits 1, a bad tag exits 2.ruby -c— Ruby is not installed in this environment.Note on test runs: two earlier
cargo test --workspaceattempts hit load-sensitive failures innzb-web/tests/harness_speed_limit.rsandnzb-dispatch/tests/slice_map.rswhile the host load average was 18–27 on 24 cores. Both pass in isolation and serially, and the final full run was green. Neither file is touched by this branch.Checklist
docs/RELEASING.md,packaging/README.md).