Skip to content

dist: add CI job to detect files missing from distro#14463

Closed
vszakats wants to merge 15 commits intocurl:masterfrom
vszakats:distfilescheck
Closed

dist: add CI job to detect files missing from distro#14463
vszakats wants to merge 15 commits intocurl:masterfrom
vszakats:distfilescheck

Conversation

@vszakats
Copy link
Member

@vszakats vszakats commented Aug 8, 2024

Also:

  • delete previous, cmake-specific solution.
  • move a CI script under .github.

Follow-up to a118a6e #14323
Closes #14463


@vszakats vszakats added dist CI Continuous Integration labels Aug 8, 2024
@vszakats vszakats force-pushed the distfilescheck branch 2 times, most recently from d2293ea to 9a0e5ce Compare August 8, 2024 20:09
@vszakats vszakats changed the title dist: add CI job to check files missing from distro dist: add CI job to detect files missing from distro Aug 8, 2024
@vszakats
Copy link
Member Author

vszakats commented Aug 8, 2024

It detects the problem fixed in #14459:

--- /tmp/tmp.G7I2Upv0ud	2024-08-08 20:13:08.385252775 +0000
+++ /tmp/tmp.EdTxmiptJ0	2024-08-08 20:13:08.389252796 +0000
@@ -1418,6 +1418,7 @@
 m4/xc-am-iface.m4
 m4/xc-cc-check.m4
 m4/xc-lt-iface.m4
+m4/xc-translit.m4
 m4/xc-val-flgs.m4
 m4/zz40-xc-ovr.m4
 m4/zz50-xc-ovr.m4
Error: Process completed with exit code 1.

Ref: https://github.com/curl/curl/actions/runs/10308837478/job/28537182373?pr=14463#step:3:1595

- let dots be literal dots
- use `*` as a wildcard

Makes it easier to find these exceptions with grep,
also easier to edit and read.
now a grep would hit the referenced files trivially.
Makes editing a reading them easier too.
@vszakats
Copy link
Member Author

vszakats commented Aug 9, 2024

Made the exception lists less regexpy, with the intent of making
them easier to edit, read and grep.

@vszakats
Copy link
Member Author

vszakats commented Aug 9, 2024

Actually, if we don't care about files present in tar and not in git, we might drop the taronly exception list, by filtering for the '+' differences. I'd say there is some value (from a security angle) in checking what extra files make into the tarball, but not mandatory to achieve the goal of this PR.

--- a/.github/scripts/distfiles.sh
+++ b/.github/scripts/distfiles.sh
@@ -13,23 +13,7 @@ gitfiles="$(mktemp)"
 
 taronly="/
 ^
-Makefile.in
-^aclocal.m4
-^compile
-^configure
-^config.*
-^depcomp
-^install-sh
-^ltmain.sh
-^missing
-^docs/libcurl/libcurl-symbols.md
-^docs/RELEASE-TOOLS.md
-^docs/tarball-commit.txt
-^lib/curl_config.h.in
-^m4/libtool.m4
-^m4/lt*.m4
-^src/tool_ca_embed.c
-^src/tool_hugehelp.c"
+Makefile.in"
 
 gitonly=".git*
 ^.*
@@ -64,7 +48,14 @@ git ls-files \
   | grep -v -E "($(printf '%s' "${gitonly}" | tr $'\n' '|' | sed -e 's|\.|\\.|g' -e 's|\*|.+|g'))$" \
   | sort > "${gitfiles}"
 
-diff -u "${tarfiles}" "${gitfiles}"
+dif="$(diff -u "${tarfiles}" "${gitfiles}" | tail -n +3 || true)"
+
+echo 'Only in tarball:'
+echo "${dif}" | grep '^-'
+echo
+
+echo 'Missing from tarball:'
+echo "${dif}" | grep '^+'
 res=$?
 
 rm -rf "${tarfiles:?}" "${gitfiles:?}"

@bagder
Copy link
Member

bagder commented Aug 9, 2024

I'd say there is some value (from a security angle) in checking what extra files make into the tarball, but not mandatory to achieve the goal of this PR.

Right. And the reproducible-releases CI job already verifies that a release from tarball contents becomes identical as a release from git, which is a teller that what is listed as going into the tarball is what goes in and nothing else.

@vszakats vszakats closed this in 2edbc22 Aug 10, 2024
@vszakats vszakats deleted the distfilescheck branch August 10, 2024 08:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CI Continuous Integration dist

Development

Successfully merging this pull request may close these issues.

2 participants