eleven / messenger Public

deploy: ship needs no signing key — gate the key/toolchain checks to publish/promote (#508)

The top-of-script guards ran before subcommand dispatch, so `ship` — which
only drives the box updater over ssh — refused to run without
LCHAT_RELEASE_KEY_FILE. Move the key/jq/gh checks and the tool build into a
publish|promote gate. Caught on ship's first real run.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Paul Campbell 4 months ago 6585bd9ab719fb2762085889f4cacac0df1aaa03 parent 5cae2ff

1 file changed, +13 −6

deploy/release-server.sh +13 −6

diff --git a/deploy/release-server.sh b/deploy/release-server.sh

index 69f3000..6129d44 100755

--- a/deploy/release-server.sh

+++ b/deploy/release-server.sh

@@ -29,18 +29,25 @@ KEY="${LCHAT_RELEASE_KEY_FILE:-}"

BIN=lchat-linux-amd64

BIN_ARM=lchat-linux-arm64

-[ -n "$KEY" ] && [ -f "$KEY" ] || {

- echo "release-server: set LCHAT_RELEASE_KEY_FILE to the signing key file" >&2; exit 1; }

-command -v jq >/dev/null || { echo "release-server: jq is required" >&2; exit 1; }

-command -v gh >/dev/null || { echo "release-server: gh is required" >&2; exit 1; }

+# ship only drives the box over ssh — no signing, no feed writes — so the key

+# and the gh/jq toolchain are required only where the feed is touched

+# (publish/promote, checked below).

+case "${1:-}" in publish|promote)

+ [ -n "$KEY" ] && [ -f "$KEY" ] || {

+ echo "release-server: set LCHAT_RELEASE_KEY_FILE to the signing key file" >&2; exit 1; }

+ command -v jq >/dev/null || { echo "release-server: jq is required" >&2; exit 1; }

+ command -v gh >/dev/null || { echo "release-server: gh is required" >&2; exit 1; }

+ ;;

+esac

TMP="$(mktemp -d)"

trap 'rm -rf "$TMP"' EXIT

# The signing/manifest code lives in the binary itself, so builder and box

-# can't drift on the format. Build a local tool from this checkout.

+# can't drift on the format. Build a local tool from this checkout (only the

+# feed-touching commands need it).

TOOL="$TMP/lchat-tool"

-go build -o "$TOOL" .

+case "${1:-}" in publish|promote) go build -o "$TOOL" . ;; esac

# fetch_payload: current feed payload JSON (verified), or a fresh skeleton.

fetch_payload() {