HomerandClaude Opus 5.5
a18950367f
ci / check (push) Failing after 24s
Tauri 2, no Node. A first-run page chooses the server; then the window is the server's web UI, whose pages get no IPC. The bundled LLeMbas CLI (fetched and signature-checked by scripts/fetch-cli.sh) links the computer with 'lembas login --json' and runs as 'lembas service' while the app runs. A tray menu starts and stops it. Linux packages from GitHub Actions on a tag. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
45 lines
2.1 KiB
Bash
Executable File
45 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Put the LLeMbas CLI that LLeMbas Desktop carries where Tauri's bundler wants it:
|
|
# src-tauri/binaries/lembas-<target triple>
|
|
#
|
|
# scripts/fetch-cli.sh [target-triple] (default: this machine's, from rustc)
|
|
#
|
|
# The version is the one in lembas-cli.version. The files are checked exactly as the CLI's own
|
|
# get.sh checks them: SHA256SUMS signed by the release key in the namespace lembas-release, naming
|
|
# this version, and the binary matching it. Nothing unverified is bundled.
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
|
|
VERSION="$(tr -d '[:space:]' < lembas-cli.version)"
|
|
TRIPLE="${1:-$(rustc -vV | sed -n 's/^host: //p')}"
|
|
BASE="${LEMBAS_CLI_RELEASES:-https://github.com/LLeMbas/LLeMbas-CLI/releases/download}/v${VERSION}"
|
|
PUBKEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDSZO3Byow7R3ZpOH3MCvpPIga2pZBzhfX5wXfNP1cLa"
|
|
|
|
case "$TRIPLE" in
|
|
# The baseline build runs on any x86-64 CPU, not only those with AVX2: a desktop app meets
|
|
# older machines than a server does.
|
|
x86_64-unknown-linux-gnu) ASSET=lembas-linux-x64-baseline ;;
|
|
aarch64-unknown-linux-gnu) ASSET=lembas-linux-arm64 ;;
|
|
*) echo "fetch-cli: no LLeMbas CLI build for $TRIPLE yet" >&2; exit 1 ;;
|
|
esac
|
|
|
|
work="$(mktemp -d)"
|
|
trap 'rm -rf "$work"' EXIT
|
|
for f in SHA256SUMS SHA256SUMS.sig "$ASSET.gz"; do
|
|
curl -fsSL --retry 3 -o "$work/$f" "$BASE/$f"
|
|
done
|
|
|
|
printf 'lembas-release %s\n' "$PUBKEY" > "$work/allowed"
|
|
ssh-keygen -Y verify -f "$work/allowed" -I lembas-release -n lembas-release \
|
|
-s "$work/SHA256SUMS.sig" < "$work/SHA256SUMS" >/dev/null \
|
|
|| { echo "fetch-cli: SHA256SUMS is not signed by the release key" >&2; exit 1; }
|
|
[ "$(sed -n -E 's/^# lembas //p' "$work/SHA256SUMS" | head -n1)" = "$VERSION" ] \
|
|
|| { echo "fetch-cli: SHA256SUMS is not for $VERSION" >&2; exit 1; }
|
|
(cd "$work" && grep -E " $ASSET\.gz\$" SHA256SUMS | sha256sum -c --strict --quiet -) \
|
|
|| { echo "fetch-cli: $ASSET.gz does not match SHA256SUMS" >&2; exit 1; }
|
|
|
|
mkdir -p src-tauri/binaries
|
|
gunzip -c "$work/$ASSET.gz" > "src-tauri/binaries/lembas-$TRIPLE"
|
|
chmod 755 "src-tauri/binaries/lembas-$TRIPLE"
|
|
echo "fetch-cli: LLeMbas CLI $VERSION ($ASSET) -> src-tauri/binaries/lembas-$TRIPLE"
|