serve the generic install.sh per repo, tested end to end against a stand-in s3, and add robots.txt, the public-repos sitemap and kepr 2's favicon (v3.0.24)

@@ -0,0 +1,5 @@1+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32">2+  <title>kepr</title>3+  <polygon points="16,3 27,23 5,23" fill="none" stroke="#c89a5a" stroke-width="2" stroke-linejoin="round"/>4+  <polygon points="16,10 22,21 10,21" fill="none" stroke="#c89a5a" stroke-width="1.5" stroke-linejoin="round"/>5+</svg>\ No newline at end of file

@@ -0,0 +1,40 @@1+import { readFileSync } from "node:fs";2+import { join } from "node:path";3+import type { Hono } from "hono";4+import { publicRepoNames } from "../server/db.ts";5+import type { PageContext } from "./layout.ts";6+7+// Kepr 2's mark, in Kepr's gold.8+const FAVICON = readFileSync(join(import.meta.dir, "../../public/favicon.svg"));9+10+/** §22.6: robots.txt, the sitemap (public repos only, as everywhere, §20) and the favicon. */11+export function registerHousekeeping(app: Hono, ctx: PageContext): void {12+	const origin = `https://${ctx.domain}`;13+	app.get("/robots.txt", (c) =>14+		c.body(`User-agent: *\nAllow: /\n\nSitemap: ${origin}/sitemap.xml\n`, 200, {15+			"Content-Type": "text/plain; charset=UTF-8",16+		}),17+	);18+	app.get("/sitemap.xml", (c) => {19+		const url = (path: string, changefreq: string, priority: string) =>20+			`  <url><loc>${origin}${path}</loc><changefreq>${changefreq}</changefreq><priority>${priority}</priority></url>\n`;21+		const urls = [22+			url("/", "daily", "1.0"),23+			url("/browse", "daily", "0.9"),24+			url("/docs", "weekly", "0.8"),25+			// Repo names are [A-Za-z0-9._-] (§9.2's check at sync), so they need no XML escaping.26+			...publicRepoNames(ctx.kepr).map((name) => url(`/${name}`, "daily", "0.7")),27+		];28+		return c.body(29+			`<?xml version="1.0" encoding="UTF-8"?>\n<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">\n${urls.join("")}</urlset>\n`,30+			200,31+			{ "Content-Type": "application/xml; charset=UTF-8", "Cache-Control": "public, max-age=3600" },32+		);33+	});34+	app.get("/favicon.svg", (c) =>35+		c.body(FAVICON, 200, {36+			"Content-Type": "image/svg+xml",37+			"Cache-Control": "public, max-age=86400",38+		}),39+	);40+}

@@ -0,0 +1,49 @@1+#!/bin/sh2+# Installs the newest release of @REPO@ for this machine, checked against its SHA-256 (§22.5).3+#   curl -fsSL @BASE@/install.sh | sh4+# INSTALL_DIR picks the folder (default ~/.local/bin).5+set -eu6+7+repo=@REPO@8+base=@BASE@/releases9+10+fail() {11+	echo "$repo: $*" >&212+	exit 113+}14+15+case "$(uname -s)" in16+Linux) os=linux ;;17+Darwin) os=macos ;;18+*) fail "no builds for $(uname -s)" ;;19+esac20+case "$(uname -m)" in21+x86_64 | amd64) arch=x86_64 ;;22+arm64 | aarch64) arch=aarch64 ;;23+*) fail "no builds for $(uname -m)" ;;24+esac25+platform=$os-$arch26+27+command -v curl >/dev/null 2>&1 || fail "installing needs curl"28+if command -v sha256sum >/dev/null 2>&1; then29+	sha256() { sha256sum "$1" | cut -d ' ' -f 1; }30+elif command -v shasum >/dev/null 2>&1; then31+	sha256() { shasum -a 256 "$1" | cut -d ' ' -f 1; }32+else33+	fail "installing needs sha256sum or shasum"34+fi35+36+version=$(curl -fsSL "$base/latest/version.txt") || fail "no release found"37+expected=$(curl -fsSL "$base/$version/checksums.txt" |38+	awk -v name="$repo-$platform" '$2 == name && sub(/^sha256:/, "", $1) { print $1 }')39+[ -n "$expected" ] || fail "$version has no build for $platform"40+41+dir=${INSTALL_DIR:-$HOME/.local/bin}42+mkdir -p "$dir"43+tmp=$(mktemp "$dir/.$repo.XXXXXX")44+trap 'rm -f "$tmp"' EXIT45+curl -fsSL -o "$tmp" "$base/latest/$platform" || fail "download failed"46+[ "$(sha256 "$tmp")" = "$expected" ] || fail "checksum mismatch; nothing installed"47+chmod 755 "$tmp"48+mv "$tmp" "$dir/$repo"49+echo "$repo $version installed to $dir/$repo"

@@ -0,0 +1,122 @@1+import { afterAll, beforeAll, expect, test } from "bun:test";2+import { existsSync, readdirSync } from "node:fs";3+import { mkdtemp, readFile, stat, writeFile } from "node:fs/promises";4+import { tmpdir } from "node:os";5+import { join } from "node:path";6+import { openBucket } from "../src/bucket/reader.ts";7+import { syncAll } from "../src/bucket/sync.ts";8+import { createApp } from "../src/server/app.ts";9+import { openKeprDb } from "../src/server/db.ts";10+import { makeRepos, writeRelease } from "./fixture.ts";11+12+// install.sh runs for real: Kepr serves on localhost, and its downloads redirect to a stand-in S313+// server that serves the bucket folder (a folder source's file:// URLs are not followed by curl).14+// The script's https:// addresses are switched to http:// for the run; nothing else changes.15+16+const PLATFORM = `${process.platform === "darwin" ? "macos" : "linux"}-${process.arch === "arm64" ? "aarch64" : "x86_64"}`;17+const PLATFORMS = ["linux-x86_64", "linux-aarch64", "macos-aarch64", "macos-x86_64"];18+const binary = (version: string, platform: string) =>19+	new TextEncoder().encode(`#!/bin/sh\necho tool ${version} ${platform}\n`);20+21+let kepr: ReturnType<typeof Bun.serve>;22+let s3: ReturnType<typeof Bun.serve>;23+let bucketDir: string;24+let script: string;25+26+beforeAll(async () => {27+	const repos = await makeRepos(["tool"]);28+	bucketDir = repos.bucketDir;29+	for (const version of ["1.0.0", "1.1.0"]) {30+		const files = PLATFORMS.map((platform) => ({31+			platform,32+			name: "tool",33+			bytes: binary(version, platform),34+		}));35+		await writeRelease(bucketDir, "tool", { version, save: repos.saves.tool as string, files });36+	}37+	s3 = Bun.serve({38+		port: 0,39+		fetch: (req) =>40+			new Response(Bun.file(join(bucketDir, new URL(req.url).pathname.slice("/b/".length)))),41+	});42+	const dataDir = await mkdtemp(join(tmpdir(), "kepr-install-"));43+	const db = openKeprDb(dataDir);44+	await syncAll({45+		bucket: openBucket({ kind: "folder", path: bucketDir }),46+		kepr: db,47+		mirrorDir: join(dataDir, "mirror"),48+		tarballDir: join(dataDir, "tarballs"),49+	});50+	db.run("UPDATE repos SET public = 1");51+	kepr = Bun.serve({ port: 0, fetch: () => new Response("starting") });52+	const app = createApp(53+		{54+			domain: `127.0.0.1:${kepr.port}`,55+			dataDir,56+			adminPasswordHash: "$argon2id$x",57+			bucket: {58+				kind: "s3",59+				endpoint: `http://127.0.0.1:${s3.port}`,60+				name: "b",61+				region: "fr-par",62+				accessKeyId: "read",63+				secretAccessKey: "only",64+			},65+		},66+		db,67+	);68+	kepr.reload({ fetch: app.fetch });69+	const res = await fetch(`http://127.0.0.1:${kepr.port}/tool/install.sh`);70+	expect([res.status, res.headers.get("Content-Type")]).toEqual([200, "text/plain; charset=UTF-8"]);71+	script = await res.text();72+});73+74+afterAll(() => {75+	kepr.stop();76+	s3.stop();77+});78+79+async function install(): Promise<{ code: number; stderr: string; dir: string }> {80+	const home = await mkdtemp(join(tmpdir(), "kepr-install-home-"));81+	const path = join(home, "install.sh");82+	await writeFile(path, script.replaceAll("https://", "http://"));83+	const dir = join(home, "bin");84+	const run = Bun.spawn(["sh", path], {85+		cwd: home,86+		env: { PATH: process.env.PATH, HOME: home, INSTALL_DIR: dir },87+		stderr: "pipe",88+		stdout: "pipe",89+	});90+	return { code: await run.exited, stderr: await new Response(run.stderr).text(), dir };91+}92+93+test("install.sh is POSIX sh naming this repo and domain", async () => {94+	const dir = await mkdtemp(join(tmpdir(), "kepr-install-check-"));95+	await writeFile(join(dir, "install.sh"), script);96+	expect(Bun.spawnSync(["sh", "-n", join(dir, "install.sh")]).exitCode).toBe(0);97+	expect(script).toContain("repo=tool\n");98+	expect(script).toContain(`base=https://127.0.0.1:${kepr.port}/tool/releases\n`);99+});100+101+test("installs the newest build for this machine into INSTALL_DIR, executable", async () => {102+	const { code, stderr, dir } = await install();103+	expect([code, stderr]).toEqual([0, ""]);104+	const installed = join(dir, "tool");105+	expect(await readFile(installed)).toEqual(Buffer.from(binary("1.1.0", PLATFORM)));106+	expect((await stat(installed)).mode & 0o111).toBe(0o111);107+	expect(readdirSync(dir)).toEqual(["tool"]);108+});109+110+test("refuses a file that doesn't match checksums.txt, installing nothing", async () => {111+	await writeFile(join(bucketDir, "tool/releases/1.1.0", PLATFORM, "tool"), "tampered");112+	const { code, stderr, dir } = await install();113+	expect(code).not.toBe(0);114+	expect(stderr).toContain("checksum mismatch; nothing installed");115+	expect(existsSync(join(dir, "tool"))).toBe(false);116+	expect(readdirSync(dir)).toEqual([]);117+});118+119+test("a repo without releases has no installer", async () => {120+	const res = await fetch(`http://127.0.0.1:${kepr.port}/nowhere/install.sh`);121+	expect(res.status).toBe(404);122+});