21 lines
1.5 KiB
Bash
Executable File
21 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
if [ "$#" -ne 4 ]; then echo "Usage: $0 BASE_ISO OFFLINE_PAYLOAD RELEASE_PRIVATE_KEY OUTPUT_ISO" >&2; exit 2; fi
|
|
base=$(cd "$(dirname "$1")" && pwd)/$(basename "$1")
|
|
payload=$(cd "$(dirname "$2")" && pwd)/$(basename "$2")
|
|
key=$(cd "$(dirname "$3")" && pwd)/$(basename "$3")
|
|
out=$4
|
|
for f in "$base" "$payload" "$key"; do test -s "$f" || { echo "Missing/empty required input: $f" >&2; exit 1; }; done
|
|
case "$(basename "$payload")" in *model*|*gguf*|*safetensors*) echo "Model payloads are forbidden in RC1" >&2; exit 1;; esac
|
|
command -v xorriso >/dev/null; command -v openssl >/dev/null
|
|
work=$(mktemp -d); trap 'rm -rf "$work"' EXIT
|
|
xorriso -osirrox on -indev "$base" -extract / "$work/iso" >/dev/null 2>&1
|
|
mkdir -p "$work/iso/nexus/rc1"
|
|
cp "$payload" "$work/iso/nexus/rc1/offline-payload.tar.zst"
|
|
cp "$(dirname "$0")/release.json" "$(dirname "$0")/feature-profiles.json" "$(dirname "$0")/agent-registry.schema.json" "$work/iso/nexus/rc1/"
|
|
(cd "$work/iso/nexus/rc1" && find . -type f -print0 | sort -z | xargs -0 shasum -a 256 > SHA256SUMS)
|
|
openssl dgst -sha256 -sign "$key" -out "$work/iso/nexus/rc1/SHA256SUMS.sig" "$work/iso/nexus/rc1/SHA256SUMS"
|
|
echo "RC1 content staged and signed. Use the Ubuntu-preserving hybrid repack in phase2/appliance-iso/build-iso.sh on the approved amd64 build host." >&2
|
|
echo "$work/iso"
|
|
test "${NEXUS_ALLOW_UNQUALIFIED_REPACK:-0}" = 1 || { echo "Refusing unqualified local repack; stage path retained only during this process." >&2; exit 1; }
|