v4.3.0: package the desktop app with verifiable installers

publish.sh builds the GUI with the gui-release profile, names it zagan-bet-gui-<version>-<platform>-<arch>, and renders a bash and a PowerShell installer next to each app. Both embed the app's SHA-256, verify the file (or fetch it), install per-user and add a launcher: a desktop entry plus an SVG icon on Linux, a Start-menu shortcut on Windows.

The download page gains a Desktop app section with the apps and installers, keeps the terminal client and server, links the public git repository for the GPL source, and lists every file in the sha256sum block. deploy.sh verifies all four artifact kinds. Publishing refuses a dirty tree so the linked history matches the binaries.

1 files changed, 62 insertions, 4 deletions

diff --git a/scripts/publish.sh b/scripts/publish.sh
index 8240859..3a04631 100755
--- a/scripts/publish.sh
+++ b/scripts/publish.sh
@@ -3,14 +3,22 @@
 # download page expects:
 #
 #   zagan-bet-client-<version>-<platform>-<arch>[.exe]
-#   zagan-bet-server-<version>-<platform>-<arch>
+#   zagan-bet-server-<version>-<platform>-<arch>[.exe]
+#   zagan-bet-gui-<version>-<platform>-<arch>[.exe]
+#   zagan-bet-gui-<version>-<platform>-<arch>-install.sh
+#   zagan-bet-gui-<version>-<platform>-<arch>-install.ps1
 #
-# Cargo always writes target/<triple>/release/<bin>, so the rename happens here
-# after each build. The version comes from Cargo.toml.
+# Cargo always writes target/<triple>/<profile>/<bin>, so the rename happens
+# here after each build. The version comes from Cargo.toml.
+#
+# The GUI uses the workspace's `gui-release` profile (small, stripped, LTO).
+# The public git repository is the GPL source for these binaries, so publish
+# from a clean tree (or set ALLOW_DIRTY=1 for a preview).
 #
 # Usage:
 #   ./scripts/publish.sh
 #   DEST=/srv/www/bin ./scripts/publish.sh
+#   URL_BASE=https://staging.example/ ./scripts/publish.sh
 set -euo pipefail
 
 ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
@@ -23,6 +31,21 @@ if [ -z "${VERSION:-}" ]; then
 fi
 
 DEST=${DEST:-web/bin}
+URL_BASE=${URL_BASE:-https://zagan.2137697.xyz}
+
+if [ "${ALLOW_DIRTY:-0}" != "1" ] && [ -n "$(git status --porcelain)" ]; then
+  echo "the working tree is dirty; commit the release first (or ALLOW_DIRTY=1)" >&2
+  exit 1
+fi
+
+command -v python3 >/dev/null || {
+  echo "python3 is required to render the installers" >&2
+  exit 1
+}
+
+hash_of() {
+  sha256sum "$1" | awk '{print $1}'
+}
 
 publish() {
   local triple=$1 kind=$2 platform=$3 arch=$4
@@ -47,11 +70,46 @@ publish() {
   echo "    $DEST/$kind/$artifact ($(du -h "$DEST/$kind/$artifact" | cut -f1))"
 }
 
+publish_gui() {
+  local triple=$1 platform=$2 arch=$3
+  local ext=""
+  if [ "$platform" = windows ]; then
+    ext=".exe"
+  fi
+
+  local artifact="zagan-bet-gui-$VERSION-$platform-$arch$ext"
+  local source="target/$triple/gui-release/zagan-bet-gui$ext"
+
+  echo "==> $artifact"
+  cargo build -p zagan-bet-gui --profile gui-release --quiet --target "$triple"
+
+  mkdir -p "$DEST/gui"
+  install -m 0755 "$source" "$DEST/gui/$artifact"
+  local sha
+  sha=$(hash_of "$DEST/gui/$artifact")
+  echo "    $DEST/gui/$artifact ($(du -h "$DEST/gui/$artifact" | cut -f1))"
+
+  if [ "$platform" = linux ]; then
+    python3 scripts/render-installer.py \
+      scripts/installers/linux.sh.in \
+      "$DEST/gui/zagan-bet-gui-$VERSION-linux-$arch-install.sh" \
+      "$VERSION" "$artifact" "$sha" "$URL_BASE/bin/gui/$artifact"
+  elif [ "$platform" = windows ]; then
+    python3 scripts/render-installer.py \
+      scripts/installers/windows.ps1.in \
+      "$DEST/gui/zagan-bet-gui-$VERSION-windows-$arch-install.ps1" \
+      "$VERSION" "$artifact" "$sha" "$URL_BASE/bin/gui/$artifact"
+  fi
+}
+
+publish_gui x86_64-unknown-linux-gnu linux x86_64
+publish_gui x86_64-pc-windows-gnu windows x86_64
+
 publish x86_64-unknown-linux-gnu client linux x86_64
 publish i686-unknown-linux-gnu   client linux i686
 publish x86_64-pc-windows-gnu    client windows x86_64
 publish x86_64-unknown-linux-gnu server linux x86_64
-publish x86_64-pc-windows-gnu    server windows x86_64
+publish x86_64-pc-windows-gnu    server windows x86_64
 
 echo
 echo "published $VERSION to $DEST"