v4.4.0: stable installers that follow the newest published buildHEADmaster

Adds web/latest.php: a plain-text feed of the newest version with each artifact's filename and SHA-256. The per-release generated installers are replaced by stable web/install.sh and web/install.ps1; both read the feed, pick the newest build, verify it, install per-user and add a launcher. Publishing a new app version no longer regenerates or versions the installers.

publish.sh drops the installer renderer and Python dependency. deploy.sh now also verifies latest.php against the local artifacts and that the served installer scripts match the repository.

1 files changed, 30 insertions, 278 deletions

diff --git a/web/index.php b/web/index.php
index 77edf95..3f0ab92 100644
--- a/web/index.php
+++ b/web/index.php
@@ -1,63 +1,34 @@
 <?php
 declare(strict_types=1);
 
+require __DIR__ . '/releases.php';
+
 /**
  * zagan.bet download page.
  *
- * Scans ./bin/{gui,client,server} and renders every build it finds, with its
- * version, size and SHA-256. The GPL source link points at the public git
- * repository. No database, no JavaScript, no dependencies.
- *
- * Expected file names (anything else is ignored):
- *
- *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>[.exe]
- *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.sh
- *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.ps1
- *   bin/client/zagan-bet-client-<version>-<platform>-<arch>[.exe]
- *   bin/server/zagan-bet-server-<version>-<platform>-<arch>[.exe]
- *
- * <version> is MAJOR.MINOR.PATCH, <platform> is linux|windows|macos and
- * <arch> is x86_64|i686|aarch64. Example:
- *
- *   bin/gui/zagan-bet-gui-4.3.0-linux-x86_64
- *   bin/client/zagan-bet-client-4.3.0-linux-x86_64
- *
- * SHA-256 values are cached in a JSON file keyed on size and mtime, so a file
- * is only re-read when it changes. The cache lives in the system temp
- * directory by default (the web root is often not writable by the PHP user);
- * set ZAGAN_HASH_CACHE to put it somewhere else.
+ * Lists every published app, terminal client and server, with version, size
+ * and SHA-256. The installers are stable links that ask latest.php for the
+ * newest build. The GPL source link points at the public git repository. No
+ * database, no JavaScript, no dependencies.
  */
 
-const KINDS = [
-    'gui' => [
-        'title' => 'Desktop app',
-        'hint' => 'Windows 10 or newer, or a Linux desktop. No terminal needed.',
-    ],
-    'client' => [
-        'title' => 'Client',
-        'hint' => 'Needs a terminal of at least 80×24 cells.',
-    ],
-    'server' => [
-        'title' => 'Server',
-        'hint' => 'Generates its own TLS identity on first run.',
-    ],
-];
+$scan = scan_releases();
+$releases = $scan['releases'];
+$newest = $scan['newest_mtime'];
 
-const PLATFORMS = [
-    'linux' => 'Linux',
-    'windows' => 'Windows',
-    'macos' => 'macOS',
-];
+$base = rtrim(str_replace('\\', '/', dirname($_SERVER['SCRIPT_NAME'] ?? '/')), '/');
+if ($base === '.' || $base === '/') {
+    $base = '';
+}
 
-const ARCHES = [
-    'x86_64' => '64-bit',
-    'i686' => '32-bit',
-    'aarch64' => 'ARM64',
-];
+foreach ($releases as $kind => &$found) {
+    foreach ($found as &$release) {
+        $release['href'] = $base . '/bin/' . $kind . '/' . rawurlencode($release['file']);
+    }
+}
+unset($found, $release);
 
-// Newest version first, then 64-bit builds before 32-bit.
-const PLATFORM_ORDER = ['linux' => 0, 'windows' => 1, 'macos' => 2];
-const ARCH_ORDER = ['x86_64' => 0, 'aarch64' => 1, 'i686' => 2];
+$all = array_merge($releases['gui'], $releases['client'], $releases['server']);
 
 function e(?string $value): string
 {
@@ -74,220 +45,6 @@ function human_size(int $bytes): string
     }
     return $bytes . ' B';
 }
-
-/**
- * Hash to use for a published file, reusing the cached value when the file has
- * not changed since it was hashed.
- *
- * A cached hash is valid only when the size and mtime still match and the hash
- * was taken at or after the file's mtime, so a restored or touched file is
- * re-read.
- *
- * @param array{files:array<string,array{size:int,mtime:int,sha256:string,hashed_at:int}>} $cache
- */
-function cached_hash(
-    string $key,
-    string $path,
-    int $size,
-    int $mtime,
-    array &$cache,
-    bool &$dirty
-): ?string {
-    $entry = $cache['files'][$key] ?? null;
-    if (
-        is_array($entry)
-        && ($entry['size'] ?? null) === $size
-        && ($entry['mtime'] ?? null) === $mtime
-        && (int) ($entry['hashed_at'] ?? 0) >= $mtime
-        && isset($entry['sha256'])
-        && is_string($entry['sha256'])
-        && preg_match('/\A[0-9a-f]{64}\z/', $entry['sha256']) === 1
-    ) {
-        return $entry['sha256'];
-    }
-
-    $hash = hash_file('sha256', $path);
-    if ($hash === false) {
-        return null;
-    }
-
-    $cache['files'][$key] = [
-        'size' => $size,
-        'mtime' => $mtime,
-        'sha256' => $hash,
-        'hashed_at' => time(),
-    ];
-    $dirty = true;
-
-    return $hash;
-}
-
-/** @return array{files:array<string,array{size:int,mtime:int,sha256:string,hashed_at:int}>} */
-function load_hash_cache(string $path): array
-{
-    $raw = @file_get_contents($path);
-    if ($raw === false || $raw === '') {
-        return ['files' => []];
-    }
-    $decoded = json_decode($raw, true);
-    if (!is_array($decoded) || !isset($decoded['files']) || !is_array($decoded['files'])) {
-        return ['files' => []];
-    }
-
-    return ['files' => $decoded['files']];
-}
-
-/**
- * Best effort: a read-only web root, a full disk or a racing writer must never
- * break the page, so failures are ignored and the next request recomputes.
- *
- * @param array{files:array<string,array{size:int,mtime:int,sha256:string,hashed_at:int}>} $cache
- */
-function save_hash_cache(string $path, array $cache): void
-{
-    $json = json_encode($cache, JSON_UNESCAPED_SLASHES);
-    if ($json === false) {
-        return;
-    }
-    $directory = dirname($path);
-    $temporary = @tempnam($directory, '.zagan-hashes-');
-    if ($temporary === false) {
-        return;
-    }
-    if (@file_put_contents($temporary, $json, LOCK_EX) === false || !@rename($temporary, $path)) {
-        @unlink($temporary);
-    }
-}
-
-/**
- * @return array{version:string,platform:string,arch:string,file:string,size:int,mtime:int,sha256:string}|null
- */
-function read_release(
-    string $kind,
-    string $directory,
-    string $entry,
-    array &$cache,
-    bool &$dirty
-): ?array {
-    $pattern = '/^zagan-bet-' . preg_quote($kind, '/')
-        . '-v?(\d+\.\d+\.\d+)-([a-z]+)-([a-z0-9_]+)(-install\.sh|-install\.ps1|\.exe)?$/i';
-    if (preg_match($pattern, $entry, $matches) !== 1) {
-        return null;
-    }
-
-    $realDirectory = realpath($directory);
-    $real = realpath($directory . '/' . $entry);
-    if ($realDirectory === false || $real === false) {
-        return null;
-    }
-    // Never serve anything that resolves outside the published directory.
-    if (!str_starts_with($real, $realDirectory . DIRECTORY_SEPARATOR)) {
-        return null;
-    }
-    if (!is_file($real)) {
-        return null;
-    }
-
-    $size = filesize($real);
-    $mtime = filemtime($real);
-    if ($size === false || $mtime === false) {
-        return null;
-    }
-
-    $hash = cached_hash($kind . '/' . $entry, $real, $size, $mtime, $cache, $dirty);
-    if ($hash === null) {
-        return null;
-    }
-
-    $suffix = strtolower($matches[4] ?? '');
-    $variant = str_starts_with($suffix, '-install.') ? 'installer' : 'binary';
-
-    return [
-        'version' => $matches[1],
-        'platform' => strtolower($matches[2]),
-        'arch' => strtolower($matches[3]),
-        'variant' => $variant,
-        'file' => $entry,
-        'size' => $size,
-        'mtime' => $mtime,
-        'sha256' => $hash,
-    ];
-}
-
-$base = rtrim(str_replace('\\', '/', dirname($_SERVER['SCRIPT_NAME'] ?? '/')), '/');
-if ($base === '.' || $base === '/') {
-    $base = '';
-}
-
-$cachePath = getenv('ZAGAN_HASH_CACHE');
-if (!is_string($cachePath) || $cachePath === '') {
-    $cachePath = rtrim(sys_get_temp_dir(), DIRECTORY_SEPARATOR)
-        . DIRECTORY_SEPARATOR . 'zagan-bet-hashes-'
-        . substr(hash('sha256', __DIR__), 0, 16) . '.json';
-}
-$cache = load_hash_cache($cachePath);
-$cacheDirty = false;
-$seen = [];
-
-$releases = [];
-$newest = 0;
-
-foreach (KINDS as $kind => $meta) {
-    $found = [];
-    $directory = __DIR__ . '/bin/' . $kind;
-
-    if (is_dir($directory)) {
-        $entries = scandir($directory);
-        if ($entries !== false) {
-            foreach ($entries as $entry) {
-                if ($entry === '.' || $entry === '..') {
-                    continue;
-                }
-                $release = read_release($kind, $directory, $entry, $cache, $cacheDirty);
-                if ($release === null) {
-                    continue;
-                }
-                $seen[$kind . '/' . $entry] = true;
-                $release['href'] = $base . '/bin/' . $kind . '/' . rawurlencode($release['file']);
-                $found[] = $release;
-                $newest = max($newest, $release['mtime']);
-            }
-        }
-    }
-
-    usort($found, static function (array $a, array $b): int {
-        $byVersion = version_compare($b['version'], $a['version']);
-        if ($byVersion !== 0) {
-            return $byVersion;
-        }
-        $byPlatform = (PLATFORM_ORDER[$a['platform']] ?? 9) <=> (PLATFORM_ORDER[$b['platform']] ?? 9);
-        if ($byPlatform !== 0) {
-            return $byPlatform;
-        }
-        $byArch = (ARCH_ORDER[$a['arch']] ?? 9) <=> (ARCH_ORDER[$b['arch']] ?? 9);
-        if ($byArch !== 0) {
-            return $byArch;
-        }
-        $byVariant = ($a['variant'] === 'installer' ? 1 : 0) <=> ($b['variant'] === 'installer' ? 1 : 0);
-        if ($byVariant !== 0) {
-            return $byVariant;
-        }
-        return strcmp($a['file'], $b['file']);
-    });
-
-    $releases[$kind] = $found;
-}
-
-// Drop cache entries for files that are no longer published.
-foreach (array_keys($cache['files']) as $key) {
-    if (!isset($seen[$key])) {
-        unset($cache['files'][$key]);
-        $cacheDirty = true;
-    }
-}
-if ($cacheDirty) {
-    save_hash_cache($cachePath, $cache);
-}
 ?>
 <!doctype html>
 <html lang="en">
@@ -308,24 +65,20 @@ if ($cacheDirty) {
 
 <h2>Desktop app</h2>
 <p>Windows 10 or newer, or a Linux desktop. No terminal needed.</p>
-<?php $guiBinaries = array_values(array_filter($releases['gui'], static fn (array $r): bool => $r['variant'] === 'binary')); ?>
-<?php $guiInstallers = array_values(array_filter($releases['gui'], static fn (array $r): bool => $r['variant'] === 'installer')); ?>
-<?php if ($guiBinaries === []): ?>
+<?php if ($releases['gui'] === []): ?>
 <p>Nothing published yet.</p>
 <?php else: ?>
 <ul>
-<?php foreach ($guiBinaries as $release): ?>
+<?php foreach ($releases['gui'] as $release): ?>
 <li><a href="<?= e($release['href']) ?>" download><?= e(PLATFORMS[$release['platform']] ?? ucfirst($release['platform'])) ?> <?= e($release['arch']) ?><?php if (isset(ARCHES[$release['arch']])): ?> (<?= e(ARCHES[$release['arch']]) ?>)<?php endif; ?> v<?= e($release['version']) ?> — <?= e(human_size($release['size'])) ?></a></li>
 <?php endforeach; ?>
 </ul>
-<?php endif; ?>
-<?php if ($guiInstallers !== []): ?>
+
 <h3>Installers</h3>
-<p>The installer checks the download, installs Zagan-Bet for your user and adds it to your programs. Run it next to a downloaded app, or on its own to fetch one.</p>
+<p>Downloads the newest build, checks its SHA-256 and installs it for your user.</p>
 <ul>
-<?php foreach ($guiInstallers as $release): ?>
-<li><a href="<?= e($release['href']) ?>" download><?= e(PLATFORMS[$release['platform']] ?? ucfirst($release['platform'])) ?> <?= e($release['arch']) ?> installer (<?= str_ends_with($release['file'], '.ps1') ? 'PowerShell' : 'bash' ?>) v<?= e($release['version']) ?> — <?= e(human_size($release['size'])) ?></a></li>
-<?php endforeach; ?>
+<li><a href="<?= e($base) ?>/install.sh" download>Linux installer (bash)</a></li>
+<li><a href="<?= e($base) ?>/install.ps1" download>Windows installer (PowerShell)</a></li>
 </ul>
 <?php endif; ?>
 
@@ -353,7 +106,6 @@ if ($cacheDirty) {
 </ul>
 <?php endif; ?>
 
-<?php $all = array_merge($releases['gui'], $releases['client'], $releases['server']); ?>
 <?php if ($all !== []): ?>
 <h2>SHA-256</h2>
 <p>On Linux use <code>sha256sum &lt;file&gt;</code>. On Windows use <code>Get-FileHash &lt;file&gt;</code>.</p>
@@ -372,11 +124,11 @@ echo e($sums);
 
 <h2>Running it</h2>
 <p>Desktop app on Linux:</p>
-<pre><code>chmod +x zagan-bet-gui-*-linux-x86_64-install.sh
-./zagan-bet-gui-*-linux-x86_64-install.sh</code></pre>
+<pre><code>chmod +x install.sh
+./install.sh</code></pre>
 <p>Desktop app on Windows (PowerShell):</p>
-<pre><code>powershell -ExecutionPolicy Bypass -File .\zagan-bet-gui-*-windows-x86_64-install.ps1</code></pre>
-<p>The installers verify the SHA-256 before installing. You can also run the downloaded app directly.</p>
+<pre><code>powershell -ExecutionPolicy Bypass -File .\install.ps1</code></pre>
+<p>The installers fetch the newest build, verify its SHA-256, install it for your user and add a launcher.</p>
 <p>Terminal client:</p>
 <pre><code>chmod +x &lt;downloaded-client&gt;
 ./&lt;downloaded-client&gt;</code></pre>